Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Packing list.exe

Overview

General Information

Sample Name:Packing list.exe
Analysis ID:680524
MD5:c7a4e2993e53b71353110debf193f711
SHA1:c5cc5b995685cf3474d0998dc8f8be0080635f2c
SHA256:2698f26bc94c6ee64dd216f13c805f6a2ee512c47f1a23f026dd606adc42fcb9
Tags:exeFormbook
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
Queues an APC in another process (thread injection)
.NET source code contains very large strings
Deletes itself after installation
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • Packing list.exe (PID: 6064 cmdline: "C:\Users\user\Desktop\Packing list.exe" MD5: C7A4E2993E53B71353110DEBF193F711)
    • schtasks.exe (PID: 6020 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcWxLdFqdoHatB" /XML "C:\Users\user\AppData\Local\Temp\tmp7D6D.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Packing list.exe (PID: 1320 cmdline: {path} MD5: C7A4E2993E53B71353110DEBF193F711)
      • explorer.exe (PID: 684 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • raserver.exe (PID: 3856 cmdline: C:\Windows\SysWOW64\raserver.exe MD5: 2AADF65E395BFBD0D9B71D7279C8B5EC)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.pahunt.org/umhl/"], "decoy": ["mB8gvYWKNnd+6kcRK8M=", "7zn0DtefQVZc3UcRK8M=", "qj9AgFfem/K5", "7W+k2buMQnZxzkqW8v2wDA==", "BXmNsJSLLt9UZYuO3C2l", "PHnylup3Ec5YTj8qPV+8", "5wuv0g7RYfoLhg==", "qy3Wf2Qv9yamjg==", "EWjULZ91La2UEjQ=", "aN2KCV/tiOP2gyVROJbK2Fg=", "a9tVEduGJF1q4GcHnr2dBg==", "111flmRlGlRY0vPmzRR63KW1wyqR6Q==", "f7+r8NeWp+WZYf6D8v2wDA==", "LGG2X0VJ1rSPHL0Yd/60", "A21qVr1P5aZSS/pCOZbK2Fg=", "W7uNpIBT4NZ+WoHtRGa+", "YpWyeGx/Qx22izPhZenb5O65", "xPm54b/IeWRI4IYqPV+8", "gtxoMfmYZ0HgmQ==", "LMlLAuXndyCmnEXPMpdwBwxB0g==", "siWU81PxsC+0oEWT8v2wDA==", "ks2JuqR+Kkb324cqPV+8", "7CHy2pNs9fzthn43", "uTnZelYp9yamjg==", "FYR8ZtIuEACu", "QV+IJwsM0kTK+2oVgQ==", "I60qeTRmGDxa4UcRK8M=", "bI7FSA8i5lsh0IMkgw==", "fPDj0E0bvTlUwOLGFVq2", "oOS6vYWSNl3Gn4c1", "MMijCmIt6ShS2/7z4Dvb5O65", "hMS597ZZ/MZLKR7nZ54/kNuz", "K2nSnIFmKWqgHFcyv/imbncPSqo=", "4Xb7v/PEdz7Y+2oVgQ==", "Vt2QCbF0aJ4=", "m9VmkEwbxnIa/p3YBFc98Gux", "Q7lAGwwBhTLthn43", "DlGQCZkaysdZJh8yWdKN6m+x", "CF0uM/wT2M7JHzQqPV+8", "1wevt3hI3tPaR2ozyQe1it7fHPg/eczb", "qxcRVQuWHw1MKdA4", "dMADqcZ+K4I=", "H3ZFO+VrJQ6lnpmPa5bK2Fg=", "I2NcqXM1zEPK+2oVgQ==", "XoQXQA0PxDRI+2oVgQ==", "9VDJi2RwODvp3Hz5d+nb5O65", "H4PEOo8dwjlj9KRE8v2wDA==", "fq1yc81rHThNtiRPOJbK2Fg=", "90u1gKqiSJc=", "HnInjdeMNq2UEjQ=", "3O7PDrhF5tWQl8Iwiw==", "AXuXhUUotKqgEHuvpP/GHaUbXbTp8o5Lpg==", "edtWHfXmei7thn43", "1vdgIc5iAGSI60cRK8M=", "sj5/NqAuEACu", "dpQOonl8Rr7LGTZGYZX9RTsVSrM=", "rt0X7dDlpHsQFcJC8v2wDA==", "+nf/2b/GeGL/AHBFB0erBoHNITKM4Q==", "MLMz38fRYBvGpEWX8v2wDA==", "I186c0wbqBqOlnEPXsSi6j64nGru", "CipT7MK3Xrk2U7YQJHvxBA==", "2k/ZrIpV38eJR3Au", "83OJo30uEACu", "yva3tQ7Zsm36/6Qbgtk8EOkFF2SA6Q=="]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x65f1:$a1: 3C 30 50 4F 53 54 74 09 40
    • 0x1e1b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xa90f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x17307:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x17105:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x16bb1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x17207:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1737f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa4da:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x15dcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xb222:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x1ce07:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1df1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x19829:$sqlite3step: 68 34 1C 7B E1
    • 0x1995c:$sqlite3step: 68 34 1C 7B E1
    • 0x1986b:$sqlite3text: 68 38 2A 90 C5
    • 0x199b3:$sqlite3text: 68 38 2A 90 C5
    • 0x19882:$sqlite3blob: 68 53 D8 7F 8C
    • 0x199d5:$sqlite3blob: 68 53 D8 7F 8C
    00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      Click to see the 27 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      8.0.Packing list.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        8.0.Packing list.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x57f1:$a1: 3C 30 50 4F 53 54 74 09 40
        • 0x1d3b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x9b0f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        • 0x16507:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        8.0.Packing list.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x16305:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x15db1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x16407:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x1657f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x96da:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x14fcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa422:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x1c007:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1d11a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        8.0.Packing list.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x18a29:$sqlite3step: 68 34 1C 7B E1
        • 0x18b5c:$sqlite3step: 68 34 1C 7B E1
        • 0x18a6b:$sqlite3text: 68 38 2A 90 C5
        • 0x18bb3:$sqlite3text: 68 38 2A 90 C5
        • 0x18a82:$sqlite3blob: 68 53 D8 7F 8C
        • 0x18bd5:$sqlite3blob: 68 53 D8 7F 8C
        0.2.Packing list.exe.33f638c.1.raw.unpackINDICATOR_SUSPICIOUS_DisableWinDefenderDetects executables containing artifcats associated with disabling Widnows DefenderditekSHen
        • 0xcdec:$reg1: SOFTWARE\Microsoft\Windows Defender\Features
        • 0xce30:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender
        • 0xce78:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender
        • 0xd104:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
        • 0xd168:$s2: Set-MpPreference -DisableArchiveScanning $true
        • 0xd1c0:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true
        • 0xd218:$s4: Set-MpPreference -DisableScriptScanning $true
        • 0xd264:$s5: Set-MpPreference -SubmitSamplesConsent 2
        • 0xd2a4:$s6: Set-MpPreference -MAPSReporting 0
        • 0xd2f0:$s7: Set-MpPreference -HighThreatDefaultAction 6
        • 0xd348:$s8: Set-MpPreference -ModerateThreatDefaultAction 6
        • 0xd398:$s9: Set-MpPreference -LowThreatDefaultAction 6
        • 0xd3e8:$s10: Set-MpPreference -SevereThreatDefaultAction 6

        Sigma Signatures

        ⊘No Sigma rule has matched

        Snort Signatures

        ⊘No Snort rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: Packing list.exeVirustotal: Detection: 43%Perma Link
        Yara detected FormBook
        Source: Yara matchFile source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
        Antivirus detection for URL or domain
        Source: www.pahunt.org/umhl/Avira URL Cloud: Label: malware
        Machine Learning detection for sample
        Source: Packing list.exeJoe Sandbox ML: detected
        Machine Learning detection for dropped file
        Source: C:\Users\user\AppData\Roaming\jcWxLdFqdoHatB.exeJoe Sandbox ML: detected
        Source: 8.0.Packing list.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
        Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.pahunt.org/umhl/"], "decoy": ["mB8gvYWKNnd+6kcRK8M=", "7zn0DtefQVZc3UcRK8M=", "qj9AgFfem/K5", "7W+k2buMQnZxzkqW8v2wDA==", "BXmNsJSLLt9UZYuO3C2l", "PHnylup3Ec5YTj8qPV+8", "5wuv0g7RYfoLhg==", "qy3Wf2Qv9yamjg==", "EWjULZ91La2UEjQ=", "aN2KCV/tiOP2gyVROJbK2Fg=", "a9tVEduGJF1q4GcHnr2dBg==", "111flmRlGlRY0vPmzRR63KW1wyqR6Q==", "f7+r8NeWp+WZYf6D8v2wDA==", "LGG2X0VJ1rSPHL0Yd/60", "A21qVr1P5aZSS/pCOZbK2Fg=", "W7uNpIBT4NZ+WoHtRGa+", "YpWyeGx/Qx22izPhZenb5O65", "xPm54b/IeWRI4IYqPV+8", "gtxoMfmYZ0HgmQ==", "LMlLAuXndyCmnEXPMpdwBwxB0g==", "siWU81PxsC+0oEWT8v2wDA==", "ks2JuqR+Kkb324cqPV+8", "7CHy2pNs9fzthn43", "uTnZelYp9yamjg==", "FYR8ZtIuEACu", "QV+IJwsM0kTK+2oVgQ==", "I60qeTRmGDxa4UcRK8M=", "bI7FSA8i5lsh0IMkgw==", "fPDj0E0bvTlUwOLGFVq2", "oOS6vYWSNl3Gn4c1", "MMijCmIt6ShS2/7z4Dvb5O65", "hMS597ZZ/MZLKR7nZ54/kNuz", "K2nSnIFmKWqgHFcyv/imbncPSqo=", "4Xb7v/PEdz7Y+2oVgQ==", "Vt2QCbF0aJ4=", "m9VmkEwbxnIa/p3YBFc98Gux", "Q7lAGwwBhTLthn43", "DlGQCZkaysdZJh8yWdKN6m+x", "CF0uM/wT2M7JHzQqPV+8", "1wevt3hI3tPaR2ozyQe1it7fHPg/eczb", "qxcRVQuWHw1MKdA4", "dMADqcZ+K4I=", "H3ZFO+VrJQ6lnpmPa5bK2Fg=", "I2NcqXM1zEPK+2oVgQ==", "XoQXQA0PxDRI+2oVgQ==", "9VDJi2RwODvp3Hz5d+nb5O65", "H4PEOo8dwjlj9KRE8v2wDA==", "fq1yc81rHThNtiRPOJbK2Fg=", "90u1gKqiSJc=", "HnInjdeMNq2UEjQ=", "3O7PDrhF5tWQl8Iwiw==", "AXuXhUUotKqgEHuvpP/GHaUbXbTp8o5Lpg==", "edtWHfXmei7thn43", "1vdgIc5iAGSI60cRK8M=", "sj5/NqAuEACu", "dpQOonl8Rr7LGTZGYZX9RTsVSrM=", "rt0X7dDlpHsQFcJC8v2wDA==", "+nf/2b/GeGL/AHBFB0erBoHNITKM4Q==", "MLMz38fRYBvGpEWX8v2wDA==", "I186c0wbqBqOlnEPXsSi6j64nGru", "CipT7MK3Xrk2U7YQJHvxBA==", "2k/ZrIpV38eJR3Au", "83OJo30uEACu", "yva3tQ7Zsm36/6Qbgtk8EOkFF2SA6Q=="]}
        Source: Packing list.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: Packing list.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: wntdll.pdbUGP source: Packing list.exe, 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Packing list.exe, 00000008.00000003.458129700.00000000018F1000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.560808608.0000000000A04000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.566392906.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: Packing list.exe, Packing list.exe, 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Packing list.exe, 00000008.00000003.458129700.00000000018F1000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.560808608.0000000000A04000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.566392906.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h0_2_086745A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h0_2_086745B0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 4x nop then pop edi19_2_032D8920
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 4x nop then pop edi19_2_032D439F
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 4x nop then pop edi19_2_032D891F
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 4x nop then pop edi19_2_032D8911

        Networking

        barindex
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\explorer.exeDomain query: www.chillsafe.online
        Source: C:\Windows\explorer.exeDomain query: www.alshared.info
        C2 URLs / IPs found in malware configuration
        Source: Malware configuration extractorURLs: www.pahunt.org/umhl/
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
        Source: Packing list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com
        Source: Packing list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comRes
        Source: Packing list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coma-dY
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.456872900.0000000006100000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
        Source: Packing list.exe, 00000000.00000003.456872900.0000000006100000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comC
        Source: Packing list.exe, 00000000.00000003.456872900.0000000006100000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.como
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.417011575.000000000610B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
        Source: Packing list.exe, 00000000.00000003.417047585.0000000006105000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
        Source: Packing list.exe, 00000000.00000003.424293456.0000000006102000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.424293456.0000000006102000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.417883204.0000000006103000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
        Source: Packing list.exe, 00000000.00000003.417883204.0000000006103000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.comlic
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
        Source: Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
        Source: Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
        Source: Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn$
        Source: Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.
        Source: Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cnx
        Source: unknownDNS traffic detected: queries for: www.chillsafe.online
        Source: Packing list.exe, 00000000.00000002.457845803.0000000001589000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

        E-Banking Fraud

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0.2.Packing list.exe.33f638c.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
        Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
        Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
        Source: Process Memory Space: Packing list.exe PID: 1320, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: Process Memory Space: raserver.exe PID: 3856, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        .NET source code contains very large strings
        Source: Packing list.exe, AddCompanyForm.csLong String: Length: 20037
        Source: jcWxLdFqdoHatB.exe.0.dr, AddCompanyForm.csLong String: Length: 20037
        Source: 0.0.Packing list.exe.e70000.0.unpack, AddCompanyForm.csLong String: Length: 20037
        Source: Packing list.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0.2.Packing list.exe.33f638c.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
        Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
        Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
        Source: Process Memory Space: Packing list.exe PID: 6064, type: MEMORYSTRMatched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
        Source: Process Memory Space: Packing list.exe PID: 1320, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: Process Memory Space: raserver.exe PID: 3856, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_0339E8200_2_0339E820
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_0339E8100_2_0339E810
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_0339BF540_2_0339BF54
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE63F80_2_07DE63F8
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE2D000_2_07DE2D00
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE4B000_2_07DE4B00
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE96080_2_07DE9608
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE55500_2_07DE5550
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DED3200_2_07DED320
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE3EE00_2_07DE3EE0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE86400_2_07DE8640
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE86320_2_07DE8632
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE84100_2_07DE8410
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE84200_2_07DE8420
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE63D50_2_07DE63D5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DEC3E80_2_07DEC3E8
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE63080_2_07DE6308
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DEE3380_2_07DEE338
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE4FB00_2_07DE4FB0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE4FA00_2_07DE4FA0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE4AF10_2_07DE4AF1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE8A580_2_07DE8A58
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DECA400_2_07DECA40
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE8A680_2_07DE8A68
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE885B0_2_07DE885B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE88680_2_07DE8868
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE95D10_2_07DE95D1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE55430_2_07DE5543
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE32D80_2_07DE32D8
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE32E80_2_07DE32E8
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE70900_2_07DE7090
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DE3E080_2_07DE3E08
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DEDD300_2_07DEDD30
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_07DED8280_2_07DED828
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_086700400_2_08670040
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_086700110_2_08670011
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_086700400_2_08670040
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD41208_2_01AD4120
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABF9008_2_01ABF900
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE20A08_2_01AE20A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B820A88_2_01B820A8
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACB0908_2_01ACB090
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B828EC8_2_01B828EC
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B710028_2_01B71002
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEEBB08_2_01AEEBB0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7DBD28_2_01B7DBD2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B82B288_2_01B82B28
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B822AE8_2_01B822AE
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE25818_2_01AE2581
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACD5E08_2_01ACD5E0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B825DD8_2_01B825DD
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB0D208_2_01AB0D20
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B82D078_2_01B82D07
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B81D558_2_01B81D55
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC841F8_2_01AC841F
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7D4668_2_01B7D466
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B81FF18_2_01B81FF1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B82EF78_2_01B82EF7
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD6E308_2_01AD6E30
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7D6168_2_01B7D616
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_004202EF8_2_004202EF
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484841F19_2_0484841F
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FD46619_2_048FD466
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486258119_2_04862581
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_049025DD19_2_049025DD
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484D5E019_2_0484D5E0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04902D0719_2_04902D07
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04830D2019_2_04830D20
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04901D5519_2_04901D55
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04902EF719_2_04902EF7
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FD61619_2_048FD616
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04856E3019_2_04856E30
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0490DFCE19_2_0490DFCE
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04901FF119_2_04901FF1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484B09019_2_0484B090
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048620A019_2_048620A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_049020A819_2_049020A8
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_049028EC19_2_049028EC
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F100219_2_048F1002
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0490E82419_2_0490E824
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483F90019_2_0483F900
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485412019_2_04854120
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_049022AE19_2_049022AE
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048EFA2B19_2_048EFA2B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486EBB019_2_0486EBB0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F03DA19_2_048F03DA
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FDBD219_2_048FDBD2
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04902B2819_2_04902B28
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D892019_2_032D8920
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EEB9319_2_032EEB93
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EFAA019_2_032EFAA0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032F02EF19_2_032F02EF
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032DE9E019_2_032DE9E0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EEF7619_2_032EEF76
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D2FB019_2_032D2FB0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EFD3A19_2_032EFD3A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D9DA019_2_032D9DA0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D2D8F19_2_032D2D8F
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D9D9D19_2_032D9D9D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D2D9019_2_032D2D90
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EF4D319_2_032EF4D3
        Source: C:\Windows\SysWOW64\raserver.exeCode function: String function: 0483B150 appears 45 times
        Source: C:\Users\user\Desktop\Packing list.exeCode function: String function: 01ABB150 appears 35 times
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF99A0 NtCreateSection,LdrInitializeThunk,8_2_01AF99A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9910 NtAdjustPrivilegesToken,LdrInitializeThunk,8_2_01AF9910
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF98F0 NtReadVirtualMemory,LdrInitializeThunk,8_2_01AF98F0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9860 NtQuerySystemInformation,LdrInitializeThunk,8_2_01AF9860
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9840 NtDelayExecution,LdrInitializeThunk,8_2_01AF9840
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9A20 NtResumeThread,LdrInitializeThunk,8_2_01AF9A20
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9A00 NtProtectVirtualMemory,LdrInitializeThunk,8_2_01AF9A00
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9A50 NtCreateFile,LdrInitializeThunk,8_2_01AF9A50
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF95D0 NtClose,LdrInitializeThunk,8_2_01AF95D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9540 NtReadFile,LdrInitializeThunk,8_2_01AF9540
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF97A0 NtUnmapViewOfSection,LdrInitializeThunk,8_2_01AF97A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9780 NtMapViewOfSection,LdrInitializeThunk,8_2_01AF9780
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9FE0 NtCreateMutant,LdrInitializeThunk,8_2_01AF9FE0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9710 NtQueryInformationToken,LdrInitializeThunk,8_2_01AF9710
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF96E0 NtFreeVirtualMemory,LdrInitializeThunk,8_2_01AF96E0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9660 NtAllocateVirtualMemory,LdrInitializeThunk,8_2_01AF9660
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF99D0 NtCreateProcessEx,8_2_01AF99D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9950 NtQueueApcThread,8_2_01AF9950
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF98A0 NtWriteVirtualMemory,8_2_01AF98A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9820 NtEnumerateKey,8_2_01AF9820
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AFB040 NtSuspendThread,8_2_01AFB040
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AFA3B0 NtGetContextThread,8_2_01AFA3B0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9B00 NtSetValueKey,8_2_01AF9B00
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9A80 NtOpenDirectoryObject,8_2_01AF9A80
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9A10 NtQuerySection,8_2_01AF9A10
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF95F0 NtQueryInformationFile,8_2_01AF95F0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9520 NtWaitForSingleObject,8_2_01AF9520
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AFAD30 NtSetContextThread,8_2_01AFAD30
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9560 NtWriteFile,8_2_01AF9560
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9730 NtQueryVirtualMemory,8_2_01AF9730
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AFA710 NtOpenProcessToken,8_2_01AFA710
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9760 NtOpenProcess,8_2_01AF9760
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AFA770 NtOpenThread,8_2_01AFA770
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9770 NtSetInformationFile,8_2_01AF9770
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF96D0 NtCreateKey,8_2_01AF96D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9610 NtEnumerateValueKey,8_2_01AF9610
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9670 NtQueryInformationProcess,8_2_01AF9670
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF9650 NtQueryValueKey,8_2_01AF9650
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048795D0 NtClose,LdrInitializeThunk,19_2_048795D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879540 NtReadFile,LdrInitializeThunk,19_2_04879540
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048796D0 NtCreateKey,LdrInitializeThunk,19_2_048796D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048796E0 NtFreeVirtualMemory,LdrInitializeThunk,19_2_048796E0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879650 NtQueryValueKey,LdrInitializeThunk,19_2_04879650
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879660 NtAllocateVirtualMemory,LdrInitializeThunk,19_2_04879660
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879780 NtMapViewOfSection,LdrInitializeThunk,19_2_04879780
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879FE0 NtCreateMutant,LdrInitializeThunk,19_2_04879FE0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879710 NtQueryInformationToken,LdrInitializeThunk,19_2_04879710
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879840 NtDelayExecution,LdrInitializeThunk,19_2_04879840
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879860 NtQuerySystemInformation,LdrInitializeThunk,19_2_04879860
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048799A0 NtCreateSection,LdrInitializeThunk,19_2_048799A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879910 NtAdjustPrivilegesToken,LdrInitializeThunk,19_2_04879910
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879A50 NtCreateFile,LdrInitializeThunk,19_2_04879A50
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048795F0 NtQueryInformationFile,19_2_048795F0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879520 NtWaitForSingleObject,19_2_04879520
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0487AD30 NtSetContextThread,19_2_0487AD30
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879560 NtWriteFile,19_2_04879560
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879610 NtEnumerateValueKey,19_2_04879610
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879670 NtQueryInformationProcess,19_2_04879670
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048797A0 NtUnmapViewOfSection,19_2_048797A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0487A710 NtOpenProcessToken,19_2_0487A710
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879730 NtQueryVirtualMemory,19_2_04879730
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879760 NtOpenProcess,19_2_04879760
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0487A770 NtOpenThread,19_2_0487A770
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879770 NtSetInformationFile,19_2_04879770
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048798A0 NtWriteVirtualMemory,19_2_048798A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048798F0 NtReadVirtualMemory,19_2_048798F0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879820 NtEnumerateKey,19_2_04879820
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0487B040 NtSuspendThread,19_2_0487B040
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048799D0 NtCreateProcessEx,19_2_048799D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879950 NtQueueApcThread,19_2_04879950
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879A80 NtOpenDirectoryObject,19_2_04879A80
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879A00 NtProtectVirtualMemory,19_2_04879A00
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879A10 NtQuerySection,19_2_04879A10
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879A20 NtResumeThread,19_2_04879A20
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0487A3B0 NtGetContextThread,19_2_0487A3B0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04879B00 NtSetValueKey,19_2_04879B00
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB950 NtAllocateVirtualMemory,19_2_032EB950
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB820 NtReadFile,19_2_032EB820
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB870 NtDeleteFile,19_2_032EB870
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB8A0 NtClose,19_2_032EB8A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB770 NtCreateFile,19_2_032EB770
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB86A NtDeleteFile,19_2_032EB86A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB89A NtClose,19_2_032EB89A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EB76A NtCreateFile,19_2_032EB76A
        Source: Packing list.exe, 00000000.00000002.457845803.0000000001589000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Packing list.exe
        Source: Packing list.exe, 00000000.00000002.466545787.0000000004551000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs Packing list.exe
        Source: Packing list.exe, 00000000.00000002.466545787.0000000004551000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameG702.exe6 vs Packing list.exe
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBunifu.UI.dll4 vs Packing list.exe
        Source: Packing list.exe, 00000000.00000002.472987115.0000000007CD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs Packing list.exe
        Source: Packing list.exe, 00000000.00000000.410358073.0000000000F46000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameG702.exe6 vs Packing list.exe
        Source: Packing list.exe, 00000000.00000003.446205184.0000000003A08000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs Packing list.exe
        Source: Packing list.exe, 00000008.00000003.458924092.0000000001A10000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Packing list.exe
        Source: Packing list.exe, 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Packing list.exe
        Source: Packing list.exe, 00000008.00000003.456310804.000000000186E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Packing list.exe
        Source: Packing list.exe, 00000008.00000002.562266975.00000000015B3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameraserver.exej% vs Packing list.exe
        Source: Packing list.exeBinary or memory string: OriginalFilenameG702.exe6 vs Packing list.exe
        Source: Packing list.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: jcWxLdFqdoHatB.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: Packing list.exeVirustotal: Detection: 43%
        Source: C:\Users\user\Desktop\Packing list.exeFile read: C:\Users\user\Desktop\Packing list.exeJump to behavior
        Source: Packing list.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\Packing list.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\Packing list.exe "C:\Users\user\Desktop\Packing list.exe"
        Source: C:\Users\user\Desktop\Packing list.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcWxLdFqdoHatB" /XML "C:\Users\user\AppData\Local\Temp\tmp7D6D.tmp
        Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\Packing list.exeProcess created: C:\Users\user\Desktop\Packing list.exe {path}
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
        Source: C:\Users\user\Desktop\Packing list.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcWxLdFqdoHatB" /XML "C:\Users\user\AppData\Local\Temp\tmp7D6D.tmpJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess created: C:\Users\user\Desktop\Packing list.exe {path}Jump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeFile created: C:\Users\user\AppData\Roaming\jcWxLdFqdoHatB.exeJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeFile created: C:\Users\user\AppData\Local\Temp\tmp7D6D.tmpJump to behavior
        Source: classification engineClassification label: mal100.troj.evad.winEXE@7/3@3/0
        Source: C:\Users\user\Desktop\Packing list.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
        Source: Packing list.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
        Source: C:\Users\user\Desktop\Packing list.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeMutant created: \Sessions\1\BaseNamedObjects\JcKpFLwEHGkRAE
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_01
        Source: Packing list.exeString found in binary or memory: Address:/AddressToolStripTextBox-AddressToolStripButton'ToolStripSeparator3'PhoneToolStripLabel
        Source: Packing list.exeString found in binary or memory: Address:/AddressToolStripTextBox-AddressToolStripButton'ToolStripSeparator3'PhoneToolStripLabel
        Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
        Source: Packing list.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
        Source: Packing list.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: wntdll.pdbUGP source: Packing list.exe, 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Packing list.exe, 00000008.00000003.458129700.00000000018F1000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.560808608.0000000000A04000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.566392906.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: Packing list.exe, Packing list.exe, 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Packing list.exe, 00000008.00000003.458129700.00000000018F1000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.560808608.0000000000A04000.00000004.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmp, raserver.exe, 00000013.00000003.566392906.0000000000BAF000.00000004.00000800.00020000.00000000.sdmp

        Data Obfuscation

        barindex
        .NET source code contains method to dynamically call methods (often used by packers)
        Source: Packing list.exe, AddCompanyForm.cs.Net Code: NewLateBinding.LateCall(dax, null, "Invoke", stackVariable4, null, null, stackVariable13, true)
        Source: jcWxLdFqdoHatB.exe.0.dr, AddCompanyForm.cs.Net Code: NewLateBinding.LateCall(dax, null, "Invoke", stackVariable4, null, null, stackVariable13, true)
        Source: 0.0.Packing list.exe.e70000.0.unpack, AddCompanyForm.cs.Net Code: NewLateBinding.LateCall(dax, null, "Invoke", stackVariable4, null, null, stackVariable13, true)
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 0_2_0867513D push FFFFFF8Bh; iretd 0_2_0867513F
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B0D0D1 push ecx; ret 8_2_01B0D0E4
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0488D0D1 push ecx; ret 19_2_0488D0E4
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EEB5C push eax; ret 19_2_032EEB62
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EEAA5 push eax; ret 19_2_032EEAF8
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EEAFB push eax; ret 19_2_032EEB62
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032EEAF2 push eax; ret 19_2_032EEAF8
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032E4126 push FFFFFF98h; ret 19_2_032E412A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032E919F push ss; retf 19_2_032E91AD
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032E7F12 push ebx; iretd 19_2_032E7F19
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032ECD73 pushad ; iretd 19_2_032ECD74
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D3DD7 pushad ; ret 19_2_032D3DAD
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_032D3C87 push cs; iretd 19_2_032D3C96
        Source: initial sampleStatic PE information: section name: .text entropy: 7.781035493181961
        Source: initial sampleStatic PE information: section name: .text entropy: 7.781035493181961
        Source: C:\Users\user\Desktop\Packing list.exeFile created: C:\Users\user\AppData\Roaming\jcWxLdFqdoHatB.exeJump to dropped file

        Boot Survival

        barindex
        Uses schtasks.exe or at.exe to add and modify task schedules
        Source: C:\Users\user\Desktop\Packing list.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcWxLdFqdoHatB" /XML "C:\Users\user\AppData\Local\Temp\tmp7D6D.tmp

        Hooking and other Techniques for Hiding and Protection

        barindex
        Deletes itself after installation
        Source: C:\Windows\SysWOW64\raserver.exeFile deleted: c:\users\user\desktop\packing list.exeJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\raserver.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Yara detected AntiVM3
        Source: Yara matchFile source: Process Memory Space: Packing list.exe PID: 6064, type: MEMORYSTR
        Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
        Source: Packing list.exe, 00000000.00000002.463942931.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
        Source: Packing list.exe, 00000000.00000002.463942931.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
        Source: C:\Users\user\Desktop\Packing list.exe TID: 6048Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\explorer.exeLast function: Thread delayed
        Source: C:\Windows\SysWOW64\raserver.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B85BA5 rdtsc 8_2_01B85BA5
        Source: C:\Users\user\Desktop\Packing list.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeAPI coverage: 5.4 %
        Source: C:\Windows\SysWOW64\raserver.exeAPI coverage: 9.3 %
        Source: C:\Users\user\Desktop\Packing list.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: explorer.exe, 0000000A.00000000.518640024.000000000807B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: explorer.exe, 0000000A.00000000.539248413.0000000007EF6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
        Source: explorer.exe, 0000000A.00000000.518640024.000000000807B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}8Ll/
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
        Source: explorer.exe, 0000000A.00000000.518640024.000000000807B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
        Source: explorer.exe, 0000000A.00000000.539248413.0000000007EF6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
        Source: explorer.exe, 0000000A.00000000.475254478.0000000006915000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: explorer.exe, 0000000A.00000000.475637080.00000000069D0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE
        Source: explorer.exe, 0000000A.00000000.518640024.000000000807B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
        Source: Packing list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
        Source: explorer.exe, 0000000A.00000000.539248413.0000000007EF6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B85BA5 rdtsc 8_2_01B85BA5
        Source: C:\Users\user\Desktop\Packing list.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\raserver.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B351BE mov eax, dword ptr fs:[00000030h]8_2_01B351BE
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B351BE mov eax, dword ptr fs:[00000030h]8_2_01B351BE
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B351BE mov eax, dword ptr fs:[00000030h]8_2_01B351BE
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B351BE mov eax, dword ptr fs:[00000030h]8_2_01B351BE
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE61A0 mov eax, dword ptr fs:[00000030h]8_2_01AE61A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE61A0 mov eax, dword ptr fs:[00000030h]8_2_01AE61A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B369A6 mov eax, dword ptr fs:[00000030h]8_2_01B369A6
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEA185 mov eax, dword ptr fs:[00000030h]8_2_01AEA185
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADC182 mov eax, dword ptr fs:[00000030h]8_2_01ADC182
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2990 mov eax, dword ptr fs:[00000030h]8_2_01AE2990
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABB1E1 mov eax, dword ptr fs:[00000030h]8_2_01ABB1E1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABB1E1 mov eax, dword ptr fs:[00000030h]8_2_01ABB1E1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABB1E1 mov eax, dword ptr fs:[00000030h]8_2_01ABB1E1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B441E8 mov eax, dword ptr fs:[00000030h]8_2_01B441E8
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD4120 mov eax, dword ptr fs:[00000030h]8_2_01AD4120
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD4120 mov eax, dword ptr fs:[00000030h]8_2_01AD4120
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD4120 mov eax, dword ptr fs:[00000030h]8_2_01AD4120
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD4120 mov eax, dword ptr fs:[00000030h]8_2_01AD4120
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD4120 mov ecx, dword ptr fs:[00000030h]8_2_01AD4120
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE513A mov eax, dword ptr fs:[00000030h]8_2_01AE513A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE513A mov eax, dword ptr fs:[00000030h]8_2_01AE513A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9100 mov eax, dword ptr fs:[00000030h]8_2_01AB9100
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9100 mov eax, dword ptr fs:[00000030h]8_2_01AB9100
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9100 mov eax, dword ptr fs:[00000030h]8_2_01AB9100
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABC962 mov eax, dword ptr fs:[00000030h]8_2_01ABC962
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABB171 mov eax, dword ptr fs:[00000030h]8_2_01ABB171
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABB171 mov eax, dword ptr fs:[00000030h]8_2_01ABB171
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADB944 mov eax, dword ptr fs:[00000030h]8_2_01ADB944
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADB944 mov eax, dword ptr fs:[00000030h]8_2_01ADB944
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF90AF mov eax, dword ptr fs:[00000030h]8_2_01AF90AF
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE20A0 mov eax, dword ptr fs:[00000030h]8_2_01AE20A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE20A0 mov eax, dword ptr fs:[00000030h]8_2_01AE20A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE20A0 mov eax, dword ptr fs:[00000030h]8_2_01AE20A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE20A0 mov eax, dword ptr fs:[00000030h]8_2_01AE20A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE20A0 mov eax, dword ptr fs:[00000030h]8_2_01AE20A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE20A0 mov eax, dword ptr fs:[00000030h]8_2_01AE20A0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEF0BF mov ecx, dword ptr fs:[00000030h]8_2_01AEF0BF
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEF0BF mov eax, dword ptr fs:[00000030h]8_2_01AEF0BF
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEF0BF mov eax, dword ptr fs:[00000030h]8_2_01AEF0BF
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9080 mov eax, dword ptr fs:[00000030h]8_2_01AB9080
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B33884 mov eax, dword ptr fs:[00000030h]8_2_01B33884
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B33884 mov eax, dword ptr fs:[00000030h]8_2_01B33884
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB58EC mov eax, dword ptr fs:[00000030h]8_2_01AB58EC
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4B8D0 mov eax, dword ptr fs:[00000030h]8_2_01B4B8D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4B8D0 mov ecx, dword ptr fs:[00000030h]8_2_01B4B8D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4B8D0 mov eax, dword ptr fs:[00000030h]8_2_01B4B8D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4B8D0 mov eax, dword ptr fs:[00000030h]8_2_01B4B8D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4B8D0 mov eax, dword ptr fs:[00000030h]8_2_01B4B8D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4B8D0 mov eax, dword ptr fs:[00000030h]8_2_01B4B8D0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE002D mov eax, dword ptr fs:[00000030h]8_2_01AE002D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE002D mov eax, dword ptr fs:[00000030h]8_2_01AE002D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE002D mov eax, dword ptr fs:[00000030h]8_2_01AE002D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE002D mov eax, dword ptr fs:[00000030h]8_2_01AE002D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE002D mov eax, dword ptr fs:[00000030h]8_2_01AE002D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACB02A mov eax, dword ptr fs:[00000030h]8_2_01ACB02A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACB02A mov eax, dword ptr fs:[00000030h]8_2_01ACB02A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACB02A mov eax, dword ptr fs:[00000030h]8_2_01ACB02A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACB02A mov eax, dword ptr fs:[00000030h]8_2_01ACB02A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B37016 mov eax, dword ptr fs:[00000030h]8_2_01B37016
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B37016 mov eax, dword ptr fs:[00000030h]8_2_01B37016
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B37016 mov eax, dword ptr fs:[00000030h]8_2_01B37016
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B84015 mov eax, dword ptr fs:[00000030h]8_2_01B84015
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B84015 mov eax, dword ptr fs:[00000030h]8_2_01B84015
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B72073 mov eax, dword ptr fs:[00000030h]8_2_01B72073
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B81074 mov eax, dword ptr fs:[00000030h]8_2_01B81074
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD0050 mov eax, dword ptr fs:[00000030h]8_2_01AD0050
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD0050 mov eax, dword ptr fs:[00000030h]8_2_01AD0050
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE4BAD mov eax, dword ptr fs:[00000030h]8_2_01AE4BAD
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE4BAD mov eax, dword ptr fs:[00000030h]8_2_01AE4BAD
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE4BAD mov eax, dword ptr fs:[00000030h]8_2_01AE4BAD
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B85BA5 mov eax, dword ptr fs:[00000030h]8_2_01B85BA5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC1B8F mov eax, dword ptr fs:[00000030h]8_2_01AC1B8F
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC1B8F mov eax, dword ptr fs:[00000030h]8_2_01AC1B8F
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B6D380 mov ecx, dword ptr fs:[00000030h]8_2_01B6D380
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2397 mov eax, dword ptr fs:[00000030h]8_2_01AE2397
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7138A mov eax, dword ptr fs:[00000030h]8_2_01B7138A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEB390 mov eax, dword ptr fs:[00000030h]8_2_01AEB390
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADDBE9 mov eax, dword ptr fs:[00000030h]8_2_01ADDBE9
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE03E2 mov eax, dword ptr fs:[00000030h]8_2_01AE03E2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE03E2 mov eax, dword ptr fs:[00000030h]8_2_01AE03E2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE03E2 mov eax, dword ptr fs:[00000030h]8_2_01AE03E2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE03E2 mov eax, dword ptr fs:[00000030h]8_2_01AE03E2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE03E2 mov eax, dword ptr fs:[00000030h]8_2_01AE03E2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE03E2 mov eax, dword ptr fs:[00000030h]8_2_01AE03E2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B353CA mov eax, dword ptr fs:[00000030h]8_2_01B353CA
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B353CA mov eax, dword ptr fs:[00000030h]8_2_01B353CA
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7131B mov eax, dword ptr fs:[00000030h]8_2_01B7131B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABDB60 mov ecx, dword ptr fs:[00000030h]8_2_01ABDB60
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE3B7A mov eax, dword ptr fs:[00000030h]8_2_01AE3B7A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE3B7A mov eax, dword ptr fs:[00000030h]8_2_01AE3B7A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B88B58 mov eax, dword ptr fs:[00000030h]8_2_01B88B58
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABDB40 mov eax, dword ptr fs:[00000030h]8_2_01ABDB40
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABF358 mov eax, dword ptr fs:[00000030h]8_2_01ABF358
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB52A5 mov eax, dword ptr fs:[00000030h]8_2_01AB52A5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB52A5 mov eax, dword ptr fs:[00000030h]8_2_01AB52A5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB52A5 mov eax, dword ptr fs:[00000030h]8_2_01AB52A5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB52A5 mov eax, dword ptr fs:[00000030h]8_2_01AB52A5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB52A5 mov eax, dword ptr fs:[00000030h]8_2_01AB52A5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACAAB0 mov eax, dword ptr fs:[00000030h]8_2_01ACAAB0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACAAB0 mov eax, dword ptr fs:[00000030h]8_2_01ACAAB0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEFAB0 mov eax, dword ptr fs:[00000030h]8_2_01AEFAB0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AED294 mov eax, dword ptr fs:[00000030h]8_2_01AED294
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AED294 mov eax, dword ptr fs:[00000030h]8_2_01AED294
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2AE4 mov eax, dword ptr fs:[00000030h]8_2_01AE2AE4
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2ACB mov eax, dword ptr fs:[00000030h]8_2_01AE2ACB
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF4A2C mov eax, dword ptr fs:[00000030h]8_2_01AF4A2C
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF4A2C mov eax, dword ptr fs:[00000030h]8_2_01AF4A2C
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7AA16 mov eax, dword ptr fs:[00000030h]8_2_01B7AA16
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7AA16 mov eax, dword ptr fs:[00000030h]8_2_01B7AA16
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC8A0A mov eax, dword ptr fs:[00000030h]8_2_01AC8A0A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD3A1C mov eax, dword ptr fs:[00000030h]8_2_01AD3A1C
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB5210 mov eax, dword ptr fs:[00000030h]8_2_01AB5210
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB5210 mov ecx, dword ptr fs:[00000030h]8_2_01AB5210
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB5210 mov eax, dword ptr fs:[00000030h]8_2_01AB5210
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB5210 mov eax, dword ptr fs:[00000030h]8_2_01AB5210
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABAA16 mov eax, dword ptr fs:[00000030h]8_2_01ABAA16
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABAA16 mov eax, dword ptr fs:[00000030h]8_2_01ABAA16
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF927A mov eax, dword ptr fs:[00000030h]8_2_01AF927A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B6B260 mov eax, dword ptr fs:[00000030h]8_2_01B6B260
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B6B260 mov eax, dword ptr fs:[00000030h]8_2_01B6B260
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B88A62 mov eax, dword ptr fs:[00000030h]8_2_01B88A62
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7EA55 mov eax, dword ptr fs:[00000030h]8_2_01B7EA55
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B44257 mov eax, dword ptr fs:[00000030h]8_2_01B44257
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9240 mov eax, dword ptr fs:[00000030h]8_2_01AB9240
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9240 mov eax, dword ptr fs:[00000030h]8_2_01AB9240
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9240 mov eax, dword ptr fs:[00000030h]8_2_01AB9240
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB9240 mov eax, dword ptr fs:[00000030h]8_2_01AB9240
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE35A1 mov eax, dword ptr fs:[00000030h]8_2_01AE35A1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B805AC mov eax, dword ptr fs:[00000030h]8_2_01B805AC
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B805AC mov eax, dword ptr fs:[00000030h]8_2_01B805AC
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE1DB5 mov eax, dword ptr fs:[00000030h]8_2_01AE1DB5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE1DB5 mov eax, dword ptr fs:[00000030h]8_2_01AE1DB5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE1DB5 mov eax, dword ptr fs:[00000030h]8_2_01AE1DB5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB2D8A mov eax, dword ptr fs:[00000030h]8_2_01AB2D8A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB2D8A mov eax, dword ptr fs:[00000030h]8_2_01AB2D8A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB2D8A mov eax, dword ptr fs:[00000030h]8_2_01AB2D8A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB2D8A mov eax, dword ptr fs:[00000030h]8_2_01AB2D8A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB2D8A mov eax, dword ptr fs:[00000030h]8_2_01AB2D8A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2581 mov eax, dword ptr fs:[00000030h]8_2_01AE2581
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2581 mov eax, dword ptr fs:[00000030h]8_2_01AE2581
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2581 mov eax, dword ptr fs:[00000030h]8_2_01AE2581
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE2581 mov eax, dword ptr fs:[00000030h]8_2_01AE2581
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEFD9B mov eax, dword ptr fs:[00000030h]8_2_01AEFD9B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEFD9B mov eax, dword ptr fs:[00000030h]8_2_01AEFD9B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B68DF1 mov eax, dword ptr fs:[00000030h]8_2_01B68DF1
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACD5E0 mov eax, dword ptr fs:[00000030h]8_2_01ACD5E0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACD5E0 mov eax, dword ptr fs:[00000030h]8_2_01ACD5E0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7FDE2 mov eax, dword ptr fs:[00000030h]8_2_01B7FDE2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7FDE2 mov eax, dword ptr fs:[00000030h]8_2_01B7FDE2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7FDE2 mov eax, dword ptr fs:[00000030h]8_2_01B7FDE2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7FDE2 mov eax, dword ptr fs:[00000030h]8_2_01B7FDE2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36DC9 mov eax, dword ptr fs:[00000030h]8_2_01B36DC9
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36DC9 mov eax, dword ptr fs:[00000030h]8_2_01B36DC9
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36DC9 mov eax, dword ptr fs:[00000030h]8_2_01B36DC9
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36DC9 mov ecx, dword ptr fs:[00000030h]8_2_01B36DC9
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36DC9 mov eax, dword ptr fs:[00000030h]8_2_01B36DC9
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36DC9 mov eax, dword ptr fs:[00000030h]8_2_01B36DC9
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B3A537 mov eax, dword ptr fs:[00000030h]8_2_01B3A537
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B88D34 mov eax, dword ptr fs:[00000030h]8_2_01B88D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7E539 mov eax, dword ptr fs:[00000030h]8_2_01B7E539
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE4D3B mov eax, dword ptr fs:[00000030h]8_2_01AE4D3B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE4D3B mov eax, dword ptr fs:[00000030h]8_2_01AE4D3B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE4D3B mov eax, dword ptr fs:[00000030h]8_2_01AE4D3B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC3D34 mov eax, dword ptr fs:[00000030h]8_2_01AC3D34
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABAD30 mov eax, dword ptr fs:[00000030h]8_2_01ABAD30
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADC577 mov eax, dword ptr fs:[00000030h]8_2_01ADC577
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADC577 mov eax, dword ptr fs:[00000030h]8_2_01ADC577
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF3D43 mov eax, dword ptr fs:[00000030h]8_2_01AF3D43
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B33540 mov eax, dword ptr fs:[00000030h]8_2_01B33540
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD7D50 mov eax, dword ptr fs:[00000030h]8_2_01AD7D50
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC849B mov eax, dword ptr fs:[00000030h]8_2_01AC849B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36CF0 mov eax, dword ptr fs:[00000030h]8_2_01B36CF0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36CF0 mov eax, dword ptr fs:[00000030h]8_2_01B36CF0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36CF0 mov eax, dword ptr fs:[00000030h]8_2_01B36CF0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B714FB mov eax, dword ptr fs:[00000030h]8_2_01B714FB
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B88CD6 mov eax, dword ptr fs:[00000030h]8_2_01B88CD6
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEBC2C mov eax, dword ptr fs:[00000030h]8_2_01AEBC2C
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71C06 mov eax, dword ptr fs:[00000030h]8_2_01B71C06
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B8740D mov eax, dword ptr fs:[00000030h]8_2_01B8740D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B8740D mov eax, dword ptr fs:[00000030h]8_2_01B8740D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B8740D mov eax, dword ptr fs:[00000030h]8_2_01B8740D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36C0A mov eax, dword ptr fs:[00000030h]8_2_01B36C0A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36C0A mov eax, dword ptr fs:[00000030h]8_2_01B36C0A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36C0A mov eax, dword ptr fs:[00000030h]8_2_01B36C0A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B36C0A mov eax, dword ptr fs:[00000030h]8_2_01B36C0A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AD746D mov eax, dword ptr fs:[00000030h]8_2_01AD746D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4C450 mov eax, dword ptr fs:[00000030h]8_2_01B4C450
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4C450 mov eax, dword ptr fs:[00000030h]8_2_01B4C450
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEA44B mov eax, dword ptr fs:[00000030h]8_2_01AEA44B
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B37794 mov eax, dword ptr fs:[00000030h]8_2_01B37794
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B37794 mov eax, dword ptr fs:[00000030h]8_2_01B37794
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B37794 mov eax, dword ptr fs:[00000030h]8_2_01B37794
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC8794 mov eax, dword ptr fs:[00000030h]8_2_01AC8794
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF37F5 mov eax, dword ptr fs:[00000030h]8_2_01AF37F5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB4F2E mov eax, dword ptr fs:[00000030h]8_2_01AB4F2E
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AB4F2E mov eax, dword ptr fs:[00000030h]8_2_01AB4F2E
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEE730 mov eax, dword ptr fs:[00000030h]8_2_01AEE730
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEA70E mov eax, dword ptr fs:[00000030h]8_2_01AEA70E
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEA70E mov eax, dword ptr fs:[00000030h]8_2_01AEA70E
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4FF10 mov eax, dword ptr fs:[00000030h]8_2_01B4FF10
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4FF10 mov eax, dword ptr fs:[00000030h]8_2_01B4FF10
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B8070D mov eax, dword ptr fs:[00000030h]8_2_01B8070D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B8070D mov eax, dword ptr fs:[00000030h]8_2_01B8070D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADF716 mov eax, dword ptr fs:[00000030h]8_2_01ADF716
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACFF60 mov eax, dword ptr fs:[00000030h]8_2_01ACFF60
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B88F6A mov eax, dword ptr fs:[00000030h]8_2_01B88F6A
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ACEF40 mov eax, dword ptr fs:[00000030h]8_2_01ACEF40
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B346A7 mov eax, dword ptr fs:[00000030h]8_2_01B346A7
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B80EA5 mov eax, dword ptr fs:[00000030h]8_2_01B80EA5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B80EA5 mov eax, dword ptr fs:[00000030h]8_2_01B80EA5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B80EA5 mov eax, dword ptr fs:[00000030h]8_2_01B80EA5
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B4FE87 mov eax, dword ptr fs:[00000030h]8_2_01B4FE87
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE16E0 mov ecx, dword ptr fs:[00000030h]8_2_01AE16E0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC76E2 mov eax, dword ptr fs:[00000030h]8_2_01AC76E2
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE36CC mov eax, dword ptr fs:[00000030h]8_2_01AE36CC
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF8EC7 mov eax, dword ptr fs:[00000030h]8_2_01AF8EC7
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B88ED6 mov eax, dword ptr fs:[00000030h]8_2_01B88ED6
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B6FEC0 mov eax, dword ptr fs:[00000030h]8_2_01B6FEC0
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B6FE3F mov eax, dword ptr fs:[00000030h]8_2_01B6FE3F
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABE620 mov eax, dword ptr fs:[00000030h]8_2_01ABE620
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABC600 mov eax, dword ptr fs:[00000030h]8_2_01ABC600
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABC600 mov eax, dword ptr fs:[00000030h]8_2_01ABC600
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ABC600 mov eax, dword ptr fs:[00000030h]8_2_01ABC600
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AE8E00 mov eax, dword ptr fs:[00000030h]8_2_01AE8E00
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEA61C mov eax, dword ptr fs:[00000030h]8_2_01AEA61C
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AEA61C mov eax, dword ptr fs:[00000030h]8_2_01AEA61C
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B71608 mov eax, dword ptr fs:[00000030h]8_2_01B71608
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC766D mov eax, dword ptr fs:[00000030h]8_2_01AC766D
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADAE73 mov eax, dword ptr fs:[00000030h]8_2_01ADAE73
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADAE73 mov eax, dword ptr fs:[00000030h]8_2_01ADAE73
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADAE73 mov eax, dword ptr fs:[00000030h]8_2_01ADAE73
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADAE73 mov eax, dword ptr fs:[00000030h]8_2_01ADAE73
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01ADAE73 mov eax, dword ptr fs:[00000030h]8_2_01ADAE73
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC7E41 mov eax, dword ptr fs:[00000030h]8_2_01AC7E41
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC7E41 mov eax, dword ptr fs:[00000030h]8_2_01AC7E41
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC7E41 mov eax, dword ptr fs:[00000030h]8_2_01AC7E41
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC7E41 mov eax, dword ptr fs:[00000030h]8_2_01AC7E41
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC7E41 mov eax, dword ptr fs:[00000030h]8_2_01AC7E41
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AC7E41 mov eax, dword ptr fs:[00000030h]8_2_01AC7E41
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7AE44 mov eax, dword ptr fs:[00000030h]8_2_01B7AE44
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01B7AE44 mov eax, dword ptr fs:[00000030h]8_2_01B7AE44
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484849B mov eax, dword ptr fs:[00000030h]19_2_0484849B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04908CD6 mov eax, dword ptr fs:[00000030h]19_2_04908CD6
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F14FB mov eax, dword ptr fs:[00000030h]19_2_048F14FB
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6CF0 mov eax, dword ptr fs:[00000030h]19_2_048B6CF0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6CF0 mov eax, dword ptr fs:[00000030h]19_2_048B6CF0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6CF0 mov eax, dword ptr fs:[00000030h]19_2_048B6CF0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6C0A mov eax, dword ptr fs:[00000030h]19_2_048B6C0A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6C0A mov eax, dword ptr fs:[00000030h]19_2_048B6C0A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6C0A mov eax, dword ptr fs:[00000030h]19_2_048B6C0A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6C0A mov eax, dword ptr fs:[00000030h]19_2_048B6C0A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1C06 mov eax, dword ptr fs:[00000030h]19_2_048F1C06
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0490740D mov eax, dword ptr fs:[00000030h]19_2_0490740D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0490740D mov eax, dword ptr fs:[00000030h]19_2_0490740D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0490740D mov eax, dword ptr fs:[00000030h]19_2_0490740D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486BC2C mov eax, dword ptr fs:[00000030h]19_2_0486BC2C
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486A44B mov eax, dword ptr fs:[00000030h]19_2_0486A44B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CC450 mov eax, dword ptr fs:[00000030h]19_2_048CC450
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CC450 mov eax, dword ptr fs:[00000030h]19_2_048CC450
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485746D mov eax, dword ptr fs:[00000030h]19_2_0485746D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04862581 mov eax, dword ptr fs:[00000030h]19_2_04862581
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04862581 mov eax, dword ptr fs:[00000030h]19_2_04862581
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04862581 mov eax, dword ptr fs:[00000030h]19_2_04862581
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04862581 mov eax, dword ptr fs:[00000030h]19_2_04862581
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04832D8A mov eax, dword ptr fs:[00000030h]19_2_04832D8A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04832D8A mov eax, dword ptr fs:[00000030h]19_2_04832D8A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04832D8A mov eax, dword ptr fs:[00000030h]19_2_04832D8A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04832D8A mov eax, dword ptr fs:[00000030h]19_2_04832D8A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04832D8A mov eax, dword ptr fs:[00000030h]19_2_04832D8A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486FD9B mov eax, dword ptr fs:[00000030h]19_2_0486FD9B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486FD9B mov eax, dword ptr fs:[00000030h]19_2_0486FD9B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048635A1 mov eax, dword ptr fs:[00000030h]19_2_048635A1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04861DB5 mov eax, dword ptr fs:[00000030h]19_2_04861DB5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04861DB5 mov eax, dword ptr fs:[00000030h]19_2_04861DB5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04861DB5 mov eax, dword ptr fs:[00000030h]19_2_04861DB5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_049005AC mov eax, dword ptr fs:[00000030h]19_2_049005AC
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_049005AC mov eax, dword ptr fs:[00000030h]19_2_049005AC
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6DC9 mov eax, dword ptr fs:[00000030h]19_2_048B6DC9
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6DC9 mov eax, dword ptr fs:[00000030h]19_2_048B6DC9
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6DC9 mov eax, dword ptr fs:[00000030h]19_2_048B6DC9
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6DC9 mov ecx, dword ptr fs:[00000030h]19_2_048B6DC9
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6DC9 mov eax, dword ptr fs:[00000030h]19_2_048B6DC9
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B6DC9 mov eax, dword ptr fs:[00000030h]19_2_048B6DC9
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484D5E0 mov eax, dword ptr fs:[00000030h]19_2_0484D5E0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484D5E0 mov eax, dword ptr fs:[00000030h]19_2_0484D5E0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FFDE2 mov eax, dword ptr fs:[00000030h]19_2_048FFDE2
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FFDE2 mov eax, dword ptr fs:[00000030h]19_2_048FFDE2
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FFDE2 mov eax, dword ptr fs:[00000030h]19_2_048FFDE2
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FFDE2 mov eax, dword ptr fs:[00000030h]19_2_048FFDE2
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048E8DF1 mov eax, dword ptr fs:[00000030h]19_2_048E8DF1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04908D34 mov eax, dword ptr fs:[00000030h]19_2_04908D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04843D34 mov eax, dword ptr fs:[00000030h]19_2_04843D34
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483AD30 mov eax, dword ptr fs:[00000030h]19_2_0483AD30
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FE539 mov eax, dword ptr fs:[00000030h]19_2_048FE539
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048BA537 mov eax, dword ptr fs:[00000030h]19_2_048BA537
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04864D3B mov eax, dword ptr fs:[00000030h]19_2_04864D3B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04864D3B mov eax, dword ptr fs:[00000030h]19_2_04864D3B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04864D3B mov eax, dword ptr fs:[00000030h]19_2_04864D3B
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04873D43 mov eax, dword ptr fs:[00000030h]19_2_04873D43
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B3540 mov eax, dword ptr fs:[00000030h]19_2_048B3540
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048E3D40 mov eax, dword ptr fs:[00000030h]19_2_048E3D40
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04857D50 mov eax, dword ptr fs:[00000030h]19_2_04857D50
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485C577 mov eax, dword ptr fs:[00000030h]19_2_0485C577
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485C577 mov eax, dword ptr fs:[00000030h]19_2_0485C577
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CFE87 mov eax, dword ptr fs:[00000030h]19_2_048CFE87
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B46A7 mov eax, dword ptr fs:[00000030h]19_2_048B46A7
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04900EA5 mov eax, dword ptr fs:[00000030h]19_2_04900EA5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04900EA5 mov eax, dword ptr fs:[00000030h]19_2_04900EA5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04900EA5 mov eax, dword ptr fs:[00000030h]19_2_04900EA5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04878EC7 mov eax, dword ptr fs:[00000030h]19_2_04878EC7
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04908ED6 mov eax, dword ptr fs:[00000030h]19_2_04908ED6
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048636CC mov eax, dword ptr fs:[00000030h]19_2_048636CC
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048EFEC0 mov eax, dword ptr fs:[00000030h]19_2_048EFEC0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048616E0 mov ecx, dword ptr fs:[00000030h]19_2_048616E0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048476E2 mov eax, dword ptr fs:[00000030h]19_2_048476E2
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483C600 mov eax, dword ptr fs:[00000030h]19_2_0483C600
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483C600 mov eax, dword ptr fs:[00000030h]19_2_0483C600
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483C600 mov eax, dword ptr fs:[00000030h]19_2_0483C600
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04868E00 mov eax, dword ptr fs:[00000030h]19_2_04868E00
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F1608 mov eax, dword ptr fs:[00000030h]19_2_048F1608
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486A61C mov eax, dword ptr fs:[00000030h]19_2_0486A61C
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486A61C mov eax, dword ptr fs:[00000030h]19_2_0486A61C
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483E620 mov eax, dword ptr fs:[00000030h]19_2_0483E620
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048EFE3F mov eax, dword ptr fs:[00000030h]19_2_048EFE3F
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04847E41 mov eax, dword ptr fs:[00000030h]19_2_04847E41
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04847E41 mov eax, dword ptr fs:[00000030h]19_2_04847E41
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04847E41 mov eax, dword ptr fs:[00000030h]19_2_04847E41
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04847E41 mov eax, dword ptr fs:[00000030h]19_2_04847E41
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04847E41 mov eax, dword ptr fs:[00000030h]19_2_04847E41
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04847E41 mov eax, dword ptr fs:[00000030h]19_2_04847E41
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FAE44 mov eax, dword ptr fs:[00000030h]19_2_048FAE44
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048FAE44 mov eax, dword ptr fs:[00000030h]19_2_048FAE44
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484766D mov eax, dword ptr fs:[00000030h]19_2_0484766D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485AE73 mov eax, dword ptr fs:[00000030h]19_2_0485AE73
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485AE73 mov eax, dword ptr fs:[00000030h]19_2_0485AE73
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485AE73 mov eax, dword ptr fs:[00000030h]19_2_0485AE73
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485AE73 mov eax, dword ptr fs:[00000030h]19_2_0485AE73
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485AE73 mov eax, dword ptr fs:[00000030h]19_2_0485AE73
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04848794 mov eax, dword ptr fs:[00000030h]19_2_04848794
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B7794 mov eax, dword ptr fs:[00000030h]19_2_048B7794
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B7794 mov eax, dword ptr fs:[00000030h]19_2_048B7794
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B7794 mov eax, dword ptr fs:[00000030h]19_2_048B7794
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048737F5 mov eax, dword ptr fs:[00000030h]19_2_048737F5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486A70E mov eax, dword ptr fs:[00000030h]19_2_0486A70E
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486A70E mov eax, dword ptr fs:[00000030h]19_2_0486A70E
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485F716 mov eax, dword ptr fs:[00000030h]19_2_0485F716
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CFF10 mov eax, dword ptr fs:[00000030h]19_2_048CFF10
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CFF10 mov eax, dword ptr fs:[00000030h]19_2_048CFF10
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0490070D mov eax, dword ptr fs:[00000030h]19_2_0490070D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0490070D mov eax, dword ptr fs:[00000030h]19_2_0490070D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04834F2E mov eax, dword ptr fs:[00000030h]19_2_04834F2E
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04834F2E mov eax, dword ptr fs:[00000030h]19_2_04834F2E
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486E730 mov eax, dword ptr fs:[00000030h]19_2_0486E730
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484EF40 mov eax, dword ptr fs:[00000030h]19_2_0484EF40
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484FF60 mov eax, dword ptr fs:[00000030h]19_2_0484FF60
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04908F6A mov eax, dword ptr fs:[00000030h]19_2_04908F6A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04839080 mov eax, dword ptr fs:[00000030h]19_2_04839080
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B3884 mov eax, dword ptr fs:[00000030h]19_2_048B3884
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B3884 mov eax, dword ptr fs:[00000030h]19_2_048B3884
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048620A0 mov eax, dword ptr fs:[00000030h]19_2_048620A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048620A0 mov eax, dword ptr fs:[00000030h]19_2_048620A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048620A0 mov eax, dword ptr fs:[00000030h]19_2_048620A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048620A0 mov eax, dword ptr fs:[00000030h]19_2_048620A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048620A0 mov eax, dword ptr fs:[00000030h]19_2_048620A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048620A0 mov eax, dword ptr fs:[00000030h]19_2_048620A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048790AF mov eax, dword ptr fs:[00000030h]19_2_048790AF
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486F0BF mov ecx, dword ptr fs:[00000030h]19_2_0486F0BF
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486F0BF mov eax, dword ptr fs:[00000030h]19_2_0486F0BF
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486F0BF mov eax, dword ptr fs:[00000030h]19_2_0486F0BF
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CB8D0 mov eax, dword ptr fs:[00000030h]19_2_048CB8D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CB8D0 mov ecx, dword ptr fs:[00000030h]19_2_048CB8D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CB8D0 mov eax, dword ptr fs:[00000030h]19_2_048CB8D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CB8D0 mov eax, dword ptr fs:[00000030h]19_2_048CB8D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CB8D0 mov eax, dword ptr fs:[00000030h]19_2_048CB8D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048CB8D0 mov eax, dword ptr fs:[00000030h]19_2_048CB8D0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048340E1 mov eax, dword ptr fs:[00000030h]19_2_048340E1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048340E1 mov eax, dword ptr fs:[00000030h]19_2_048340E1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048340E1 mov eax, dword ptr fs:[00000030h]19_2_048340E1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048358EC mov eax, dword ptr fs:[00000030h]19_2_048358EC
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04904015 mov eax, dword ptr fs:[00000030h]19_2_04904015
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04904015 mov eax, dword ptr fs:[00000030h]19_2_04904015
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B7016 mov eax, dword ptr fs:[00000030h]19_2_048B7016
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B7016 mov eax, dword ptr fs:[00000030h]19_2_048B7016
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B7016 mov eax, dword ptr fs:[00000030h]19_2_048B7016
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486002D mov eax, dword ptr fs:[00000030h]19_2_0486002D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486002D mov eax, dword ptr fs:[00000030h]19_2_0486002D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486002D mov eax, dword ptr fs:[00000030h]19_2_0486002D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486002D mov eax, dword ptr fs:[00000030h]19_2_0486002D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486002D mov eax, dword ptr fs:[00000030h]19_2_0486002D
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484B02A mov eax, dword ptr fs:[00000030h]19_2_0484B02A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484B02A mov eax, dword ptr fs:[00000030h]19_2_0484B02A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484B02A mov eax, dword ptr fs:[00000030h]19_2_0484B02A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484B02A mov eax, dword ptr fs:[00000030h]19_2_0484B02A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04850050 mov eax, dword ptr fs:[00000030h]19_2_04850050
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04850050 mov eax, dword ptr fs:[00000030h]19_2_04850050
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04901074 mov eax, dword ptr fs:[00000030h]19_2_04901074
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F2073 mov eax, dword ptr fs:[00000030h]19_2_048F2073
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486A185 mov eax, dword ptr fs:[00000030h]19_2_0486A185
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485C182 mov eax, dword ptr fs:[00000030h]19_2_0485C182
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04862990 mov eax, dword ptr fs:[00000030h]19_2_04862990
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048661A0 mov eax, dword ptr fs:[00000030h]19_2_048661A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048661A0 mov eax, dword ptr fs:[00000030h]19_2_048661A0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F49A4 mov eax, dword ptr fs:[00000030h]19_2_048F49A4
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F49A4 mov eax, dword ptr fs:[00000030h]19_2_048F49A4
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F49A4 mov eax, dword ptr fs:[00000030h]19_2_048F49A4
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048F49A4 mov eax, dword ptr fs:[00000030h]19_2_048F49A4
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B69A6 mov eax, dword ptr fs:[00000030h]19_2_048B69A6
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B51BE mov eax, dword ptr fs:[00000030h]19_2_048B51BE
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B51BE mov eax, dword ptr fs:[00000030h]19_2_048B51BE
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B51BE mov eax, dword ptr fs:[00000030h]19_2_048B51BE
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048B51BE mov eax, dword ptr fs:[00000030h]19_2_048B51BE
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483B1E1 mov eax, dword ptr fs:[00000030h]19_2_0483B1E1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483B1E1 mov eax, dword ptr fs:[00000030h]19_2_0483B1E1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483B1E1 mov eax, dword ptr fs:[00000030h]19_2_0483B1E1
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048C41E8 mov eax, dword ptr fs:[00000030h]19_2_048C41E8
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04839100 mov eax, dword ptr fs:[00000030h]19_2_04839100
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04839100 mov eax, dword ptr fs:[00000030h]19_2_04839100
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04839100 mov eax, dword ptr fs:[00000030h]19_2_04839100
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04854120 mov eax, dword ptr fs:[00000030h]19_2_04854120
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04854120 mov eax, dword ptr fs:[00000030h]19_2_04854120
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04854120 mov eax, dword ptr fs:[00000030h]19_2_04854120
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04854120 mov eax, dword ptr fs:[00000030h]19_2_04854120
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04854120 mov ecx, dword ptr fs:[00000030h]19_2_04854120
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486513A mov eax, dword ptr fs:[00000030h]19_2_0486513A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486513A mov eax, dword ptr fs:[00000030h]19_2_0486513A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485B944 mov eax, dword ptr fs:[00000030h]19_2_0485B944
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0485B944 mov eax, dword ptr fs:[00000030h]19_2_0485B944
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483C962 mov eax, dword ptr fs:[00000030h]19_2_0483C962
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483B171 mov eax, dword ptr fs:[00000030h]19_2_0483B171
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483B171 mov eax, dword ptr fs:[00000030h]19_2_0483B171
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486D294 mov eax, dword ptr fs:[00000030h]19_2_0486D294
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486D294 mov eax, dword ptr fs:[00000030h]19_2_0486D294
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048352A5 mov eax, dword ptr fs:[00000030h]19_2_048352A5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048352A5 mov eax, dword ptr fs:[00000030h]19_2_048352A5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048352A5 mov eax, dword ptr fs:[00000030h]19_2_048352A5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048352A5 mov eax, dword ptr fs:[00000030h]19_2_048352A5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_048352A5 mov eax, dword ptr fs:[00000030h]19_2_048352A5
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484AAB0 mov eax, dword ptr fs:[00000030h]19_2_0484AAB0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0484AAB0 mov eax, dword ptr fs:[00000030h]19_2_0484AAB0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0486FAB0 mov eax, dword ptr fs:[00000030h]19_2_0486FAB0
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04862ACB mov eax, dword ptr fs:[00000030h]19_2_04862ACB
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04862AE4 mov eax, dword ptr fs:[00000030h]19_2_04862AE4
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04848A0A mov eax, dword ptr fs:[00000030h]19_2_04848A0A
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04835210 mov eax, dword ptr fs:[00000030h]19_2_04835210
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04835210 mov ecx, dword ptr fs:[00000030h]19_2_04835210
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04835210 mov eax, dword ptr fs:[00000030h]19_2_04835210
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04835210 mov eax, dword ptr fs:[00000030h]19_2_04835210
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483AA16 mov eax, dword ptr fs:[00000030h]19_2_0483AA16
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_0483AA16 mov eax, dword ptr fs:[00000030h]19_2_0483AA16
        Source: C:\Windows\SysWOW64\raserver.exeCode function: 19_2_04853A1C mov eax, dword ptr fs:[00000030h]19_2_04853A1C
        Source: C:\Users\user\Desktop\Packing list.exeProcess queried: DebugPortJump to behavior
        Source: C:\Windows\SysWOW64\raserver.exeProcess queried: DebugPortJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeCode function: 8_2_01AF99A0 NtCreateSection,LdrInitializeThunk,8_2_01AF99A0
        Source: C:\Users\user\Desktop\Packing list.exeMemory allocated: page read and write | page guardJump to behavior

        HIPS / PFW / Operating System Protection Evasion

        barindex
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\explorer.exeDomain query: www.chillsafe.online
        Source: C:\Windows\explorer.exeDomain query: www.alshared.info
        Sample uses process hollowing technique
        Source: C:\Users\user\Desktop\Packing list.exeSection unmapped: C:\Windows\SysWOW64\raserver.exe base address: 350000Jump to behavior
        Maps a DLL or memory area into another process
        Source: C:\Users\user\Desktop\Packing list.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeSection loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and writeJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeSection loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and writeJump to behavior
        Source: C:\Windows\SysWOW64\raserver.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
        Source: C:\Windows\SysWOW64\raserver.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
        Injects a PE file into a foreign processes
        Source: C:\Users\user\Desktop\Packing list.exeMemory written: C:\Users\user\Desktop\Packing list.exe base: 400000 value starts with: 4D5AJump to behavior
        Queues an APC in another process (thread injection)
        Source: C:\Users\user\Desktop\Packing list.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
        Modifies the context of a thread in another process (thread injection)
        Source: C:\Users\user\Desktop\Packing list.exeThread register set: target process: 684Jump to behavior
        Source: C:\Windows\SysWOW64\raserver.exeThread register set: target process: 684Jump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcWxLdFqdoHatB" /XML "C:\Users\user\AppData\Local\Temp\tmp7D6D.tmpJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeProcess created: C:\Users\user\Desktop\Packing list.exe {path}Jump to behavior
        Source: explorer.exe, 0000000A.00000000.529517602.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.475161545.0000000006100000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.486817000.0000000007EF6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
        Source: explorer.exe, 0000000A.00000000.529517602.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.528908599.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.463219469.0000000001430000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
        Source: explorer.exe, 0000000A.00000000.529517602.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.463219469.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.505932724.0000000001430000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: YProgram Managerf
        Source: explorer.exe, 0000000A.00000000.529517602.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.463219469.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.505932724.0000000001430000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Users\user\Desktop\Packing list.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\Packing list.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

        Stealing of Sensitive Information

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 8.0.Packing list.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid Accounts2
        Command and Scripting Interpreter        		1
        Scheduled Task/Job        		612
        Process Injection        		1
        Masquerading        		1
        Input Capture        		121
        Security Software Discovery        		Remote Services1
        Input Capture        		Exfiltration Over Other Network Medium1
        Encrypted Channel        		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
        Default Accounts1
        Scheduled Task/Job        		Boot or Logon Initialization Scripts1
        Scheduled Task/Job        		1
        Disable or Modify Tools        		LSASS Memory2
        Process Discovery        		Remote Desktop Protocol1
        Archive Collected Data        		Exfiltration Over Bluetooth1
        Non-Application Layer Protocol        		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
        Domain Accounts1
        Shared Modules        		Logon Script (Windows)Logon Script (Windows)31
        Virtualization/Sandbox Evasion        		Security Account Manager31
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration11
        Application Layer Protocol        		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
        Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)612
        Process Injection        		NTDS1
        Remote System Discovery        		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
        Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
        Deobfuscate/Decode Files or Information        		LSA Secrets1
        File and Directory Discovery        		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
        Replication Through Removable MediaLaunchdRc.commonRc.common4
        Obfuscated Files or Information        		Cached Domain Credentials12
        System Information Discovery        		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
        External Remote ServicesScheduled TaskStartup ItemsStartup Items13
        Software Packing        		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
        Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
        File Deletion        		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 680524 Sample: Packing list.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 33 www.rewaard.club 2->33 35 rewaard.club 2->35 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 9 other signatures 2->47 9 Packing list.exe 6 2->9         started        signatures3 process4 file5 27 C:\Users\user\AppData\...\jcWxLdFqdoHatB.exe, PE32 9->27 dropped 29 C:\Users\user\AppData\Local\...\tmp7D6D.tmp, XML 9->29 dropped 31 C:\Users\user\...\Packing list.exe.log, ASCII 9->31 dropped 57 Injects a PE file into a foreign processes 9->57 13 Packing list.exe 9->13         started        16 schtasks.exe 1 9->16         started        signatures6 process7 signatures8 59 Modifies the context of a thread in another process (thread injection) 13->59 61 Maps a DLL or memory area into another process 13->61 63 Sample uses process hollowing technique 13->63 65 Queues an APC in another process (thread injection) 13->65 18 explorer.exe 13->18 injected 22 conhost.exe 16->22         started        process9 dnsIp10 37 www.chillsafe.online 18->37 39 www.alshared.info 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 24 raserver.exe 18->24         started        signatures11 process12 signatures13 51 Deletes itself after installation 24->51 53 Modifies the context of a thread in another process (thread injection) 24->53 55 Maps a DLL or memory area into another process 24->55

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        Packing list.exe44%VirustotalBrowse
        Packing list.exe100%Joe Sandbox ML

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Roaming\jcWxLdFqdoHatB.exe100%Joe Sandbox ML

        Unpacked PE Files

        SourceDetectionScannerLabelLinkDownload
        8.0.Packing list.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://www.galapagosdesign.com/0%URL Reputationsafe
        http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
        http://www.zhongyicts.com.cnx0%Avira URL Cloudsafe
        http://www.carterandcone.comRes0%Avira URL Cloudsafe
        http://www.tiro.com0%URL Reputationsafe
        http://www.tiro.comlic0%URL Reputationsafe
        http://www.goodfont.co.kr0%URL Reputationsafe
        http://www.carterandcone.com0%URL Reputationsafe
        http://www.carterandcone.coml0%URL Reputationsafe
        http://www.sajatypeworks.com0%URL Reputationsafe
        http://www.carterandcone.coma-dY0%Avira URL Cloudsafe
        http://www.founder.com.cn/cn/0%URL Reputationsafe
        http://www.typography.netD0%URL Reputationsafe
        http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
        http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
        http://fontfabrik.com0%URL Reputationsafe
        http://www.founder.com.cn/cn0%URL Reputationsafe
        http://www.zhongyicts.com.cn$0%Avira URL Cloudsafe
        http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
        http://www.fontbureau.como0%URL Reputationsafe
        http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
        http://www.zhongyicts.com.cno.0%URL Reputationsafe
        http://www.sandoll.co.kr0%URL Reputationsafe
        http://www.urwpp.deDPlease0%URL Reputationsafe
        http://www.zhongyicts.com.cn0%URL Reputationsafe
        http://www.sakkal.com0%URL Reputationsafe
        http://www.fontbureau.comC0%Avira URL Cloudsafe
        www.pahunt.org/umhl/100%Avira URL Cloudmalware

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        rewaard.club
        		185.192.114.83
        		truefalse
          		unknown
          www.chillsafe.online
          		unknown
          		unknowntrue
            		unknown
            www.rewaard.club
            		unknown
            		unknowntrue
              		unknown
              www.alshared.info
              		unknown
              		unknowntrue
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                www.pahunt.org/umhl/true
                • Avira URL Cloud: malware
                		low

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://www.apache.org/licenses/LICENSE-2.0Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://www.fontbureau.comPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.456872900.0000000006100000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://www.fontbureau.com/designersGPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.galapagosdesign.com/Packing list.exe, 00000000.00000003.424293456.0000000006102000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com/designers/?Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.founder.com.cn/cn/bThePacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers?Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.zhongyicts.com.cnxPacking list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.carterandcone.comResPacking list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.tiro.comPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.417883204.0000000006103000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.tiro.comlicPacking list.exe, 00000000.00000003.417883204.0000000006103000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designersPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.goodfont.co.krPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.carterandcone.comPacking list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.carterandcone.comlPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.carterandcone.coma-dYPacking list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.founder.com.cn/cn/Packing list.exe, 00000000.00000003.417047585.0000000006105000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.typography.netDPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/cabarga.htmlNPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/cThePacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.galapagosdesign.com/staff/dennis.htmPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.424293456.0000000006102000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://fontfabrik.comPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.founder.com.cn/cnPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.417011575.000000000610B000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers/frere-jones.htmlPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.zhongyicts.com.cn$Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                http://www.jiyu-kobo.co.jp/Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.comoPacking list.exe, 00000000.00000003.456872900.0000000006100000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.galapagosdesign.com/DPleasePacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.zhongyicts.com.cno.Packing list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers8Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.fonts.comPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.sandoll.co.krPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.urwpp.deDPleasePacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.zhongyicts.com.cnPacking list.exe, 00000000.00000003.417439081.0000000006106000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmp, Packing list.exe, 00000000.00000003.417613150.0000000006106000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namePacking list.exe, 00000000.00000002.459045143.00000000033B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.sakkal.comPacking list.exe, 00000000.00000002.471132417.00000000073F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.comCPacking list.exe, 00000000.00000003.456872900.0000000006100000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown

                                      World Map of Contacted IPs

                                      ⊘No contacted IP infos

                                      General Information

                                      Joe Sandbox Version:35.0.0 Citrine
                                      Analysis ID:680524
                                      Start date and time: 08/08/202218:32:062022-08-08 18:32:06 +02:00
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:0h 9m 22s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Sample file name:Packing list.exe
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                      Number of analysed new started processes analysed:24
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:1
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • HDC enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Detection:MAL
                                      Classification:mal100.troj.evad.winEXE@7/3@3/0
                                      EGA Information:
                                      • Successful, ratio: 100%
                                      HDC Information:
                                      • Successful, ratio: 59.4% (good quality ratio 51.7%)
                                      • Quality average: 71.6%
                                      • Quality standard deviation: 33.4%
                                      HCA Information:
                                      • Successful, ratio: 94%
                                      • Number of executed functions: 89
                                      • Number of non-executed functions: 173
                                      Cookbook Comments:
                                      • Found application associated with file extension: .exe
                                      • Adjust boot time
                                      • Enable AMSI

                                      Warnings

                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                      • Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, licensing.mp.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      18:33:20API Interceptor1x Sleep call for process: Packing list.exe modified

                                      Joe Sandbox View / Context

                                      IPs

                                      ⊘No context

                                      Domains

                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext

                                      ASNs

                                      ⊘No context

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Packing list.exe.log

                                      Download File
                                      Process:C:\Users\user\Desktop\Packing list.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1216
                                      Entropy (8bit):5.355304211458859
                                      Encrypted:false
                                      SSDEEP:24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
                                      MD5:69206D3AF7D6EFD08F4B4726998856D3
                                      SHA1:E778D4BF781F7712163CF5E2F5E7C15953E484CF
                                      SHA-256:A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
                                      SHA-512:CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
                                      Malicious:true
                                      Reputation:high, very likely benign file
                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                      C:\Users\user\AppData\Local\Temp\tmp7D6D.tmp

                                      Download File
                                      Process:C:\Users\user\Desktop\Packing list.exe
                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1651
                                      Entropy (8bit):5.17949713007774
                                      Encrypted:false
                                      SSDEEP:24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKButn:cbhC7ZlNQF/rydbz9I3YODOLNdq3W
                                      MD5:6527089BACCDC5417F25E75F643B1384
                                      SHA1:5DC2EEC38E431AAD51106626913E4AD0D74D241F
                                      SHA-256:661A8DEBE0FB8BCB91202D6806C30BE748E69709EC0C57FDC4D992CB855687D4
                                      SHA-512:4D238245D556825E9CAE02EE2712C82CEB9819EC4F062C437CB1BB8349AF1AF895D921E73D91CBDDEC66047852DA4C87B83F06C0418EFA77FC28D6354758C879
                                      Malicious:true
                                      Reputation:low
                                      Preview:<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

                                      C:\Users\user\AppData\Roaming\jcWxLdFqdoHatB.exe

                                      Download File
                                      Process:C:\Users\user\Desktop\Packing list.exe
                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Category:dropped
                                      Size (bytes):866816
                                      Entropy (8bit):7.774266041426872
                                      Encrypted:false
                                      SSDEEP:12288:Py5/O6uz02iN2SeIo4D6KftU7+ZbWLlbjskXIdpcum3FO9m/8UgxBzifEBJw87o:PIWE18SeWOKft2lJbPQcnM68UmXo
                                      MD5:C7A4E2993E53B71353110DEBF193F711
                                      SHA1:C5CC5B995685CF3474D0998DC8F8BE0080635F2C
                                      SHA-256:2698F26BC94C6EE64DD216F13C805F6A2EE512C47F1A23F026DD606ADC42FCB9
                                      SHA-512:B657DCF76D2BBEFB933738E61948886DBA367AAF8DF226175114C8261580C2AA6D821E93F1F9FF56740825B683403A5726681202B535E7D010A240972A361819
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                      Reputation:low
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............P..0...........N... ...`....@.. ....................................@.................................hN..O....`............................................................................... ............... ..H............text........ ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................N......H.......8~..XH...........................................................( ...*&..(!....*.s"........s#........s$........s%........s&........*...0...........~....o'....+..*.0...........~....o(....+..*.0...........~....o)....+..*.0...........~....o*....+..*.0...........~....o+....+..*.0..<........~.....(,.....,!r...p.....(-...o....s/............~.....+..*.0...........~.....+..*".......*.0..&........(....r5..p~....o0...(1.....t$....+..*...0..&........(....rC..p~....o0...(1.....

                                      Static File Info

                                      General

                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Entropy (8bit):7.774266041426872
                                      TrID:
                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                      • Win32 Executable (generic) a (10002005/4) 49.75%
                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                      • Windows Screen Saver (13104/52) 0.07%
                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                      File name:Packing list.exe
                                      File size:866816
                                      MD5:c7a4e2993e53b71353110debf193f711
                                      SHA1:c5cc5b995685cf3474d0998dc8f8be0080635f2c
                                      SHA256:2698f26bc94c6ee64dd216f13c805f6a2ee512c47f1a23f026dd606adc42fcb9
                                      SHA512:b657dcf76d2bbefb933738e61948886dba367aaf8df226175114c8261580c2aa6d821e93f1f9ff56740825b683403a5726681202b535e7d010a240972a361819
                                      SSDEEP:12288:Py5/O6uz02iN2SeIo4D6KftU7+ZbWLlbjskXIdpcum3FO9m/8UgxBzifEBJw87o:PIWE18SeWOKft2lJbPQcnM68UmXo
                                      TLSH:0C05F1F09AF9B658F035637636D0A03C6BF3EA1BC908E1399D67934D9316EC145E1A23
                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............P..0...........N... ...`....@.. ....................................@................................

                                      File Icon

                                      Icon Hash:00828e8e8686b000

                                      Static PE Info

                                      General

                                      Entrypoint:0x4d4eba
                                      Entrypoint Section:.text
                                      Digitally signed:false
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                      Time Stamp:0x62F118C3 [Mon Aug 8 14:08:03 2022 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:
                                      OS Version Major:4
                                      OS Version Minor:0
                                      File Version Major:4
                                      File Version Minor:0
                                      Subsystem Version Major:4
                                      Subsystem Version Minor:0
                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                      Entrypoint Preview

                                      Instruction
                                      jmp dword ptr [00402000h]
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al

                                      Data Directories

                                      NameVirtual AddressVirtual Size Is in Section
                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xd4e680x4f.text
                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xd60000x5b4.rsrc
                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xd80000xc.reloc
                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                      Sections

                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                      .text0x20000xd2ec00xd3000False0.8657967083827014data7.781035493181961IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                      .rsrc0xd60000x5b40x600False0.427734375data4.099660684112187IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                      .reloc0xd80000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                      Resources

                                      NameRVASizeTypeLanguageCountry
                                      RT_VERSION0xd60900x324data
                                      RT_MANIFEST0xd63c40x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                      Imports

                                      DLLImport
                                      mscoree.dll_CorExeMain

                                      Network Behavior

                                      Network Port Distribution

                                      UDP Packets

                                      TimestampSource PortDest PortSource IPDest IP
                                      Aug 8, 2022 18:34:59.524580002 CEST5874853192.168.2.58.8.8.8
                                      Aug 8, 2022 18:34:59.548988104 CEST53587488.8.8.8192.168.2.5
                                      Aug 8, 2022 18:35:09.584357977 CEST6297253192.168.2.58.8.8.8
                                      Aug 8, 2022 18:35:09.629686117 CEST53629728.8.8.8192.168.2.5
                                      Aug 8, 2022 18:35:19.659698009 CEST6455953192.168.2.58.8.8.8
                                      Aug 8, 2022 18:35:19.717200041 CEST53645598.8.8.8192.168.2.5

                                      DNS Queries

                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                      Aug 8, 2022 18:34:59.524580002 CEST192.168.2.58.8.8.80x5c60Standard query (0)www.chillsafe.onlineA (IP address)IN (0x0001)
                                      Aug 8, 2022 18:35:09.584357977 CEST192.168.2.58.8.8.80xb990Standard query (0)www.alshared.infoA (IP address)IN (0x0001)
                                      Aug 8, 2022 18:35:19.659698009 CEST192.168.2.58.8.8.80x88e0Standard query (0)www.rewaard.clubA (IP address)IN (0x0001)

                                      DNS Answers

                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                      Aug 8, 2022 18:34:59.548988104 CEST8.8.8.8192.168.2.50x5c60No error (0)www.chillsafe.onlinetropical-basin-s8sbx7dp132gwikfbpmorir6.herokudns.comCNAME (Canonical name)IN (0x0001)
                                      Aug 8, 2022 18:35:09.629686117 CEST8.8.8.8192.168.2.50xb990Name error (3)www.alshared.infononenoneA (IP address)IN (0x0001)
                                      Aug 8, 2022 18:35:19.717200041 CEST8.8.8.8192.168.2.50x88e0No error (0)www.rewaard.clubrewaard.clubCNAME (Canonical name)IN (0x0001)
                                      Aug 8, 2022 18:35:19.717200041 CEST8.8.8.8192.168.2.50x88e0No error (0)rewaard.club185.192.114.83A (IP address)IN (0x0001)

                                      Statistics

                                      CPU Usage

                                      Click to jump to process

                                      Memory Usage

                                      Click to jump to process

                                      High Level Behavior Distribution

                                      Click to dive into process behavior distribution

                                      Behavior

                                      Click to jump to process

                                      System Behavior

                                      General

                                      Target ID:0
                                      Start time:18:33:09
                                      Start date:08/08/2022
                                      Path:C:\Users\user\Desktop\Packing list.exe
                                      Wow64 process (32bit):true
                                      Commandline:"C:\Users\user\Desktop\Packing list.exe"
                                      Imagebase:0xe70000
                                      File size:866816 bytes
                                      MD5 hash:C7A4E2993E53B71353110DEBF193F711
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:.Net C# or VB.NET
                                      Yara matches:
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.464998989.00000000043B9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                      Reputation:low

                                      General

                                      Target ID:6
                                      Start time:18:33:28
                                      Start date:08/08/2022
                                      Path:C:\Windows\SysWOW64\schtasks.exe
                                      Wow64 process (32bit):true
                                      Commandline:C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcWxLdFqdoHatB" /XML "C:\Users\user\AppData\Local\Temp\tmp7D6D.tmp
                                      Imagebase:0x1250000
                                      File size:185856 bytes
                                      MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high

                                      General

                                      Target ID:7
                                      Start time:18:33:28
                                      Start date:08/08/2022
                                      Path:C:\Windows\System32\conhost.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      Imagebase:0x7ff77f440000
                                      File size:625664 bytes
                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Reputation:high

                                      General

                                      Target ID:8
                                      Start time:18:33:29
                                      Start date:08/08/2022
                                      Path:C:\Users\user\Desktop\Packing list.exe
                                      Wow64 process (32bit):true
                                      Commandline:{path}
                                      Imagebase:0xff0000
                                      File size:866816 bytes
                                      MD5 hash:C7A4E2993E53B71353110DEBF193F711
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.455277708.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                      Reputation:low

                                      General

                                      Target ID:10
                                      Start time:18:33:33
                                      Start date:08/08/2022
                                      Path:C:\Windows\explorer.exe
                                      Wow64 process (32bit):false
                                      Commandline:C:\Windows\Explorer.EXE
                                      Imagebase:0x7ff74fc70000
                                      File size:3933184 bytes
                                      MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000000.542334317.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000000.521600311.000000000ACD4000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                      Reputation:high

                                      General

                                      Target ID:19
                                      Start time:18:34:15
                                      Start date:08/08/2022
                                      Path:C:\Windows\SysWOW64\raserver.exe
                                      Wow64 process (32bit):true
                                      Commandline:C:\Windows\SysWOW64\raserver.exe
                                      Imagebase:0x350000
                                      File size:108544 bytes
                                      MD5 hash:2AADF65E395BFBD0D9B71D7279C8B5EC
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.682502518.0000000002FD0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.679680318.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                      Reputation:moderate

                                      Disassembly

                                      Reset < >

                                        Execution Graph

                                        Execution Coverage:11.2%
                                        Dynamic/Decrypted Code Coverage:100%
                                        Signature Coverage:0%
                                        Total number of Nodes:198
                                        Total number of Limit Nodes:5
                                        execution_graph 21446 3396b58 21447 3396b59 21446->21447 21450 33966bc 21447->21450 21449 3396b75 21451 33966c7 21450->21451 21454 33966dc 21451->21454 21453 3396c25 21453->21449 21455 33966e7 21454->21455 21458 339670c 21455->21458 21457 3396d02 21457->21453 21459 3396717 21458->21459 21462 339673c 21459->21462 21461 3396e02 21461->21457 21464 3396747 21462->21464 21463 339755c 21463->21461 21464->21463 21467 339b7a8 21464->21467 21473 339b798 21464->21473 21469 339b7a9 21467->21469 21468 339b7ed 21468->21463 21469->21468 21479 339b915 21469->21479 21483 339b958 21469->21483 21487 339b949 21469->21487 21474 339b79c 21473->21474 21475 339b7ed 21474->21475 21476 339b949 3 API calls 21474->21476 21477 339b958 3 API calls 21474->21477 21478 339b915 3 API calls 21474->21478 21475->21463 21476->21475 21477->21475 21478->21475 21480 339b924 21479->21480 21481 339b92b 21480->21481 21491 339a47c 21480->21491 21481->21468 21484 339b959 21483->21484 21485 339b99f 21484->21485 21486 339a47c 3 API calls 21484->21486 21485->21468 21486->21485 21488 339b952 21487->21488 21489 339b99f 21488->21489 21490 339a47c 3 API calls 21488->21490 21489->21468 21490->21489 21492 339a487 21491->21492 21494 339c698 21492->21494 21495 339bc94 21492->21495 21494->21494 21496 339bc9f 21495->21496 21497 339673c 3 API calls 21496->21497 21498 339c707 21497->21498 21502 339e490 21498->21502 21510 339e478 21498->21510 21499 339c740 21499->21494 21503 339e491 21502->21503 21504 339e4cd 21503->21504 21518 339e7d8 21503->21518 21522 339e7c8 21503->21522 21504->21499 21505 339e50e 21526 339f1a0 21505->21526 21535 339f190 21505->21535 21511 339e48c 21510->21511 21513 339e4cd 21511->21513 21514 339e7d8 3 API calls 21511->21514 21515 339e7c8 3 API calls 21511->21515 21512 339e50e 21516 339f1a0 GetModuleHandleW 21512->21516 21517 339f190 GetModuleHandleW 21512->21517 21513->21499 21514->21512 21515->21512 21516->21513 21517->21513 21519 339e7d9 21518->21519 21520 3399788 GetModuleHandleW LoadLibraryExW GetModuleHandleW 21519->21520 21521 339e7e1 21520->21521 21521->21505 21523 339e7cc 21522->21523 21524 3399788 GetModuleHandleW LoadLibraryExW GetModuleHandleW 21523->21524 21525 339e7dd 21523->21525 21524->21525 21525->21505 21527 339f1a1 21526->21527 21528 339dcd4 GetModuleHandleW 21527->21528 21529 339f22c 21528->21529 21533 339f5f8 GetModuleHandleW 21529->21533 21534 339dcd4 GetModuleHandleW 21529->21534 21530 339f248 21531 3398a94 GetModuleHandleW 21530->21531 21532 339f271 21530->21532 21531->21532 21533->21530 21534->21530 21536 339f194 21535->21536 21536->21504 21537 339dcd4 GetModuleHandleW 21536->21537 21538 339f22c 21537->21538 21542 339f5f8 GetModuleHandleW 21538->21542 21543 339dcd4 GetModuleHandleW 21538->21543 21539 339f248 21540 3398a94 GetModuleHandleW 21539->21540 21541 339f271 21539->21541 21540->21541 21542->21539 21543->21539 21377 86712a4 21378 86712ad 21377->21378 21382 8671ca0 21378->21382 21386 8671c99 21378->21386 21379 86712d9 21383 8671ceb WriteProcessMemory 21382->21383 21385 8671d3c 21383->21385 21385->21379 21387 8671ceb WriteProcessMemory 21386->21387 21389 8671d3c 21387->21389 21389->21379 21544 8670341 21548 8671b20 21544->21548 21551 8671b28 21544->21551 21545 8670359 21549 8671b73 ReadProcessMemory 21548->21549 21550 8671bb6 21549->21550 21550->21545 21552 8671b73 ReadProcessMemory 21551->21552 21553 8671bb6 21552->21553 21553->21545 21554 8670281 21556 8671ca0 WriteProcessMemory 21554->21556 21557 8671c99 WriteProcessMemory 21554->21557 21555 86701f7 21556->21555 21557->21555 21390 86705e0 21394 8671a60 21390->21394 21398 8671a68 21390->21398 21391 86705f1 21395 8671ab0 SetThreadContext 21394->21395 21397 8671aee 21395->21397 21397->21391 21399 8671ab0 SetThreadContext 21398->21399 21401 8671aee 21399->21401 21401->21391 21402 339ba70 21403 339ba71 21402->21403 21407 339c038 21403->21407 21411 339c028 21403->21411 21404 339bb85 21408 339c039 21407->21408 21415 339a4dc 21408->21415 21412 339c034 21411->21412 21413 339a4dc DuplicateHandle 21412->21413 21414 339c066 21413->21414 21414->21404 21416 339c0a0 DuplicateHandle 21415->21416 21417 339c066 21416->21417 21417->21404 21558 3399690 21562 3399778 21558->21562 21572 3399788 21558->21572 21559 339969f 21563 339977c 21562->21563 21582 3398a94 21563->21582 21566 33997b3 21566->21559 21567 33997ab 21567->21566 21568 33999b0 GetModuleHandleW 21567->21568 21569 33999dd 21568->21569 21569->21559 21573 3399789 21572->21573 21574 3398a94 GetModuleHandleW 21573->21574 21575 339979b 21574->21575 21576 33997b3 21575->21576 21580 3399a10 2 API calls 21575->21580 21581 3399a03 2 API calls 21575->21581 21576->21559 21577 33997ab 21577->21576 21578 33999b0 GetModuleHandleW 21577->21578 21579 33999dd 21578->21579 21579->21559 21580->21577 21581->21577 21583 3399968 GetModuleHandleW 21582->21583 21585 339979b 21583->21585 21585->21566 21586 3399a10 21585->21586 21592 3399a03 21585->21592 21587 3399a15 21586->21587 21588 3398a94 GetModuleHandleW 21587->21588 21590 3399a24 21588->21590 21589 3399a49 21589->21567 21590->21589 21599 3398af8 21590->21599 21593 3399a0e 21592->21593 21595 3399a6c 21592->21595 21594 3398a94 GetModuleHandleW 21593->21594 21596 3399a24 21594->21596 21597 3398af8 LoadLibraryExW 21596->21597 21598 3399a49 21596->21598 21597->21598 21598->21567 21600 3399bf0 LoadLibraryExW 21599->21600 21602 3399c69 21600->21602 21602->21589 21603 86709cb 21607 8671bf0 21603->21607 21610 8671bf8 21603->21610 21604 86709e5 21608 8671c3b VirtualAllocEx 21607->21608 21609 8671c72 21608->21609 21609->21604 21611 8671c3b VirtualAllocEx 21610->21611 21612 8671c72 21611->21612 21612->21604 21418 8670429 21419 867042f 21418->21419 21423 86716ec 21419->21423 21428 86716f8 21419->21428 21424 867047a 21423->21424 21425 86716f7 CreateProcessW 21423->21425 21427 8671860 21425->21427 21429 8671777 CreateProcessW 21428->21429 21431 8671860 21429->21431 21432 7debd88 21433 7debdd0 VirtualProtect 21432->21433 21434 7debe0a 21433->21434 21613 8670fdf 21615 8671a60 SetThreadContext 21613->21615 21616 8671a68 SetThreadContext 21613->21616 21614 8670ff0 21615->21614 21616->21614 21435 86710ba 21436 86710c0 21435->21436 21440 8671e51 21436->21440 21443 8671e58 21436->21443 21437 86710dc 21441 8671e99 ResumeThread 21440->21441 21442 8671ec6 21441->21442 21442->21437 21444 8671e99 ResumeThread 21443->21444 21445 8671ec6 21444->21445 21445->21437 21621 8672558 21622 86726e3 21621->21622 21623 867257e 21621->21623 21623->21622 21626 86727d1 PostMessageW 21623->21626 21628 86727d8 PostMessageW 21623->21628 21627 8672844 21626->21627 21627->21623 21629 8672844 21628->21629 21629->21623

                                        Executed Functions

                                        Function 07DE2D00 Relevance: 4.2, Strings: 3, Instructions: 478COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 0 7de2d00-7de2d27 2 7de2d89-7de2da9 0->2 3 7de2d29-7de2d36 0->3 6 7de2e7e-7de2e81 2->6 7 7de2daf-7de2dc1 2->7 3->2 4 7de2d38-7de2d88 3->4 11 7de2dd6-7de2dd9 7->11 12 7de2dc3-7de2dc6 7->12 16 7de2ddb-7de2dde 11->16 17 7de2de9-7de2def 11->17 13 7de2dcc-7de2dcf 12->13 14 7de2e4b-7de2e51 12->14 22 7de2e1a-7de2e20 13->22 23 7de2dd1 13->23 18 7de2e57-7de2e63 14->18 19 7de2e53-7de2e55 14->19 24 7de2e7a-7de2e7c 16->24 25 7de2de4 16->25 20 7de2df5-7de2e01 17->20 21 7de2df1-7de2df3 17->21 26 7de2e65-7de2e78 18->26 19->26 27 7de2e03-7de2e18 20->27 21->27 28 7de2e26-7de2e32 22->28 29 7de2e22-7de2e24 22->29 23->24 24->6 30 7de2e82-7de2f04 24->30 25->24 26->24 27->24 34 7de2e34-7de2e49 28->34 29->34 49 7de2f1c-7de2f24 30->49 50 7de2f06-7de2f0c 30->50 34->24 53 7de2f2a-7de2f2c 49->53 54 7de30d0-7de30d2 49->54 51 7de2f0e 50->51 52 7de2f10-7de2f1a 50->52 51->49 52->49 53->54 57 7de2f32-7de2f36 53->57 55 7de30dc-7de30e3 54->55 56 7de30d4-7de30d9 54->56 56->55 58 7de2f3c-7de2f44 57->58 59 7de3020-7de3028 57->59 58->54 61 7de2f4a-7de2f4e 58->61 59->54 62 7de302e-7de3032 59->62 63 7de2f8b-7de2f9e 61->63 64 7de2f50-7de2f5f 61->64 65 7de306c-7de307b 62->65 66 7de3034-7de3043 62->66 63->54 73 7de2fa4 63->73 64->54 74 7de2f65-7de2f68 64->74 65->54 72 7de307d-7de3080 65->72 66->54 71 7de3049-7de304c 66->71 76 7de304f-7de3052 71->76 77 7de3083-7de308c 72->77 78 7de2fa7-7de2fad 73->78 75 7de2f6b-7de2f6e 74->75 79 7de30eb-7de311a 75->79 81 7de2f74-7de2f7c 75->81 76->79 82 7de3058-7de3060 76->82 77->79 83 7de308e-7de3093 77->83 78->79 80 7de2fb3-7de2fb9 78->80 99 7de311c-7de311e 79->99 100 7de3123-7de312f 79->100 84 7de300d-7de3010 80->84 85 7de2fbb-7de2fcb 80->85 86 7de30e6 81->86 87 7de2f82-7de2f84 81->87 82->86 88 7de3066-7de3068 82->88 89 7de30c7-7de30ca 83->89 90 7de3095-7de309b 83->90 84->86 94 7de3016-7de3019 84->94 85->84 102 7de2fcd-7de2fd9 85->102 86->79 87->75 91 7de2f86 87->91 88->76 93 7de306a 88->93 89->86 92 7de30cc-7de30ce 89->92 90->79 96 7de309d-7de30a5 90->96 91->54 92->54 92->77 93->54 94->78 98 7de301b 94->98 96->79 101 7de30a7-7de30ad 96->101 98->54 103 7de31f6-7de31fb 99->103 108 7de3138-7de314d 100->108 109 7de3131-7de3133 100->109 101->89 104 7de30af-7de30ba 101->104 102->79 106 7de2fdf-7de2fe7 102->106 104->79 105 7de30bc-7de30c0 104->105 105->89 106->79 110 7de2fed-7de2ffc 106->110 114 7de314f-7de315a 108->114 115 7de3161-7de316d 108->115 109->103 110->79 111 7de3002-7de3006 110->111 111->84 114->115 118 7de316f-7de3178 115->118 119 7de317a-7de317c 115->119 118->119 120 7de317e-7de318a 119->120 121 7de318c-7de3190 119->121 120->121 126 7de31a2-7de31ac 120->126 122 7de319e-7de31a0 121->122 123 7de3192-7de319c 121->123 122->103 128 7de3208-7de3214 123->128 131 7de31ae-7de31ba 126->131 132 7de31fc-7de3206 126->132 133 7de3216-7de321f 128->133 134 7de3221-7de3223 128->134 138 7de31cc-7de31ce 131->138 139 7de31bc-7de31ca 131->139 132->128 133->103 134->103 138->103 139->138 141 7de31d0-7de31d6 139->141 142 7de31da 141->142 143 7de31d8 141->143 144 7de31dc-7de31de 142->144 143->144 145 7de3225-7de32b8 144->145 146 7de31e0-7de31ec 144->146 159 7de32bf-7de32cb call 7de38f4 call 7de8c05 145->159 160 7de32ba 145->160 146->145 149 7de31ee 146->149 149->103 166 7de32cb call 7de979b 159->166 167 7de32cb call 7de9608 159->167 168 7de32cb call 7de9919 159->168 169 7de32cb call 7de95d1 159->169 160->159 163 7de32d1-7de32d5 166->163 167->163 168->163 169->163
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: D0Ul$XcUl$XcUl
                                        • API String ID: 0-1558410462
                                        • Opcode ID: 418b09a39274ae4e319309b2ebb47450fae3beb017ec5029d388f09cb71015e0
                                        • Instruction ID: ca34f971f5b0e25751b7ac12b8cbe3be0f11e07f3f6fa8f0df327c5c499bccff
                                        • Opcode Fuzzy Hash: 418b09a39274ae4e319309b2ebb47450fae3beb017ec5029d388f09cb71015e0
                                        • Instruction Fuzzy Hash: 57F1E4B17041158FCB1AEF69C484A3EBBEABF85304F1A8469D406DB761DB31EC41C7A2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE6308 Relevance: 1.7, Strings: 1, Instructions: 419COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 231 7de6308-7de6338 232 7de633a-7de6354 231->232 233 7de639b-7de63b6 231->233 234 7de63b8-7de63c0 232->234 235 7de6356-7de6370 232->235 233->234 238 7de641f 234->238 239 7de63c2-7de63cc 234->239 236 7de63cd-7de63d2 235->236 237 7de6372-7de6394 235->237 240 7de63ee-7de641d 236->240 237->240 241 7de6396-7de639a 237->241 242 7de6424-7de6460 238->242 239->236 240->238 240->242 241->233 313 7de6462 call 7de6a48 242->313 314 7de6462 call 7de6a38 242->314 244 7de6468 245 7de646f-7de648b 244->245 246 7de648d 245->246 247 7de6494-7de6495 245->247 246->244 248 7de649a-7de64af 246->248 249 7de6619-7de6625 246->249 250 7de66d7-7de66e3 246->250 251 7de6794-7de67a0 246->251 252 7de6512-7de6529 246->252 253 7de654a-7de654e 246->253 254 7de670b-7de671f 246->254 255 7de67c8-7de67d4 246->255 256 7de6646-7de6652 246->256 257 7de6847-7de684e 246->257 258 7de65c1-7de65e1 246->258 259 7de67fc-7de6808 246->259 260 7de65fd-7de6614 246->260 261 7de667a-7de667e 246->261 262 7de657a-7de6583 246->262 263 7de677a-7de678f 246->263 264 7de6830-7de6842 246->264 265 7de64b1-7de64bd 246->265 266 7de652e-7de6545 246->266 267 7de65af-7de65bc 246->267 268 7de66aa-7de66b6 246->268 269 7de65e6-7de65f8 246->269 270 7de6724-7de675e 246->270 271 7de64e2-7de64e6 246->271 272 7de6763-7de6775 246->272 247->248 247->257 248->245 277 7de662c 249->277 278 7de6627 249->278 285 7de66ea-7de6706 250->285 286 7de66e5 250->286 287 7de67a7-7de67c3 251->287 288 7de67a2 251->288 252->245 273 7de6550-7de655f 253->273 274 7de6561-7de6568 253->274 254->245 291 7de67db-7de67f7 255->291 292 7de67d6 255->292 279 7de6659-7de6675 256->279 280 7de6654 256->280 258->245 295 7de680f-7de682b 259->295 296 7de680a 259->296 260->245 281 7de6680-7de668f 261->281 282 7de6691-7de6698 261->282 275 7de6596-7de659d 262->275 276 7de6585-7de6594 262->276 263->245 264->245 289 7de64bf 265->289 290 7de64c4-7de64e0 265->290 266->245 267->245 283 7de66bd-7de66d2 268->283 284 7de66b8 268->284 269->245 270->245 293 7de64e8-7de64f7 271->293 294 7de64f9-7de6500 271->294 272->245 297 7de656f-7de6575 273->297 274->297 298 7de65a4-7de65aa 275->298 276->298 304 7de6636-7de6641 277->304 278->277 279->245 280->279 301 7de669f-7de66a5 281->301 282->301 283->245 284->283 285->245 286->285 287->245 288->287 289->290 290->245 291->245 292->291 300 7de6507-7de650d 293->300 294->300 295->245 296->295 297->245 298->245 300->245 301->245 304->245 313->244 314->244
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: kuo
                                        • API String ID: 0-3768112333
                                        • Opcode ID: 7c5979df25ea0e1fc96316e09f2ef9969e4e8333c2414290d0aa07e5fef884e6
                                        • Instruction ID: 4103daab860a25971874befc7a04c8e8516ee70d5640d8117e0d0be0a29f2bf7
                                        • Opcode Fuzzy Hash: 7c5979df25ea0e1fc96316e09f2ef9969e4e8333c2414290d0aa07e5fef884e6
                                        • Instruction Fuzzy Hash: 13F18DB191420ACFCB05DF9AC4818EEFBB6FF99314B24D56AD941A7204E734DA42CF94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE63D5 Relevance: 1.6, Strings: 1, Instructions: 312COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 394 7de63d5-7de641d 395 7de641f 394->395 396 7de6424-7de6460 394->396 395->396 467 7de6462 call 7de6a48 396->467 468 7de6462 call 7de6a38 396->468 398 7de6468 399 7de646f-7de648b 398->399 400 7de648d 399->400 401 7de6494-7de6495 399->401 400->398 402 7de649a-7de64af 400->402 403 7de6619-7de6625 400->403 404 7de66d7-7de66e3 400->404 405 7de6794-7de67a0 400->405 406 7de6512-7de6529 400->406 407 7de654a-7de654e 400->407 408 7de670b-7de671f 400->408 409 7de67c8-7de67d4 400->409 410 7de6646-7de6652 400->410 411 7de6847-7de684e 400->411 412 7de65c1-7de65e1 400->412 413 7de67fc-7de6808 400->413 414 7de65fd-7de6614 400->414 415 7de667a-7de667e 400->415 416 7de657a-7de6583 400->416 417 7de677a-7de678f 400->417 418 7de6830-7de6842 400->418 419 7de64b1-7de64bd 400->419 420 7de652e-7de6545 400->420 421 7de65af-7de65bc 400->421 422 7de66aa-7de66b6 400->422 423 7de65e6-7de65f8 400->423 424 7de6724-7de675e 400->424 425 7de64e2-7de64e6 400->425 426 7de6763-7de6775 400->426 401->402 401->411 402->399 431 7de662c 403->431 432 7de6627 403->432 439 7de66ea-7de6706 404->439 440 7de66e5 404->440 441 7de67a7-7de67c3 405->441 442 7de67a2 405->442 406->399 427 7de6550-7de655f 407->427 428 7de6561-7de6568 407->428 408->399 445 7de67db-7de67f7 409->445 446 7de67d6 409->446 433 7de6659-7de6675 410->433 434 7de6654 410->434 412->399 449 7de680f-7de682b 413->449 450 7de680a 413->450 414->399 435 7de6680-7de668f 415->435 436 7de6691-7de6698 415->436 429 7de6596-7de659d 416->429 430 7de6585-7de6594 416->430 417->399 418->399 443 7de64bf 419->443 444 7de64c4-7de64e0 419->444 420->399 421->399 437 7de66bd-7de66d2 422->437 438 7de66b8 422->438 423->399 424->399 447 7de64e8-7de64f7 425->447 448 7de64f9-7de6500 425->448 426->399 451 7de656f-7de6575 427->451 428->451 452 7de65a4-7de65aa 429->452 430->452 458 7de6636-7de6641 431->458 432->431 433->399 434->433 455 7de669f-7de66a5 435->455 436->455 437->399 438->437 439->399 440->439 441->399 442->441 443->444 444->399 445->399 446->445 454 7de6507-7de650d 447->454 448->454 449->399 450->449 451->399 452->399 454->399 455->399 458->399 467->398 468->398
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: kuo
                                        • API String ID: 0-3768112333
                                        • Opcode ID: b9cd3b9305cdb0cb6489b7326f12a104605cce1a65e379a8fba9dae1c8c58378
                                        • Instruction ID: 5b1115eec30a3db9d7471123bb1cb095afa6b6cad25c355da97825eea8db4302
                                        • Opcode Fuzzy Hash: b9cd3b9305cdb0cb6489b7326f12a104605cce1a65e379a8fba9dae1c8c58378
                                        • Instruction Fuzzy Hash: A2D126B0E1420ACFCB05DFA9C4858AEFBB6BF99300F14E465D545AB214D734EA42CF94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE63F8 Relevance: 1.6, Strings: 1, Instructions: 308COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 486 7de63f8-7de641d 487 7de641f 486->487 488 7de6424-7de6460 486->488 487->488 559 7de6462 call 7de6a48 488->559 560 7de6462 call 7de6a38 488->560 490 7de6468 491 7de646f-7de648b 490->491 492 7de648d 491->492 493 7de6494-7de6495 491->493 492->490 494 7de649a-7de64af 492->494 495 7de6619-7de6625 492->495 496 7de66d7-7de66e3 492->496 497 7de6794-7de67a0 492->497 498 7de6512-7de6529 492->498 499 7de654a-7de654e 492->499 500 7de670b-7de671f 492->500 501 7de67c8-7de67d4 492->501 502 7de6646-7de6652 492->502 503 7de6847-7de684e 492->503 504 7de65c1-7de65e1 492->504 505 7de67fc-7de6808 492->505 506 7de65fd-7de6614 492->506 507 7de667a-7de667e 492->507 508 7de657a-7de6583 492->508 509 7de677a-7de678f 492->509 510 7de6830-7de6842 492->510 511 7de64b1-7de64bd 492->511 512 7de652e-7de6545 492->512 513 7de65af-7de65bc 492->513 514 7de66aa-7de66b6 492->514 515 7de65e6-7de65f8 492->515 516 7de6724-7de675e 492->516 517 7de64e2-7de64e6 492->517 518 7de6763-7de6775 492->518 493->494 493->503 494->491 523 7de662c 495->523 524 7de6627 495->524 531 7de66ea-7de6706 496->531 532 7de66e5 496->532 533 7de67a7-7de67c3 497->533 534 7de67a2 497->534 498->491 519 7de6550-7de655f 499->519 520 7de6561-7de6568 499->520 500->491 537 7de67db-7de67f7 501->537 538 7de67d6 501->538 525 7de6659-7de6675 502->525 526 7de6654 502->526 504->491 541 7de680f-7de682b 505->541 542 7de680a 505->542 506->491 527 7de6680-7de668f 507->527 528 7de6691-7de6698 507->528 521 7de6596-7de659d 508->521 522 7de6585-7de6594 508->522 509->491 510->491 535 7de64bf 511->535 536 7de64c4-7de64e0 511->536 512->491 513->491 529 7de66bd-7de66d2 514->529 530 7de66b8 514->530 515->491 516->491 539 7de64e8-7de64f7 517->539 540 7de64f9-7de6500 517->540 518->491 543 7de656f-7de6575 519->543 520->543 544 7de65a4-7de65aa 521->544 522->544 550 7de6636-7de6641 523->550 524->523 525->491 526->525 547 7de669f-7de66a5 527->547 528->547 529->491 530->529 531->491 532->531 533->491 534->533 535->536 536->491 537->491 538->537 546 7de6507-7de650d 539->546 540->546 541->491 542->541 543->491 544->491 546->491 547->491 550->491 559->490 560->490
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: kuo
                                        • API String ID: 0-3768112333
                                        • Opcode ID: 18e09575369e3b1da85630c1fc8a89ea1ea055d94e67e0f4e0728913063635a4
                                        • Instruction ID: 4c04158a5f14bbde6070af540fe54409b1af6487641ccfd475ec48a0fe4d7539
                                        • Opcode Fuzzy Hash: 18e09575369e3b1da85630c1fc8a89ea1ea055d94e67e0f4e0728913063635a4
                                        • Instruction Fuzzy Hash: 90D126B0E1420ADFCB48DFA5C4858AEFBB6FF99300F14A559D505AB214D734EA42CF94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DED320 Relevance: .3, Instructions: 264COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 638184437bfab659e12be2c9b1202afff8109d8aeb4312d476de2a1b0f794ddd
                                        • Instruction ID: 2834a45935ba6f6bb88792f33eefc86cb9f6def76bedd65af9c8b2646256b6b7
                                        • Opcode Fuzzy Hash: 638184437bfab659e12be2c9b1202afff8109d8aeb4312d476de2a1b0f794ddd
                                        • Instruction Fuzzy Hash: 29B124B4E042198BCB05DFE9C98159EFBF6BF89300F24D56AD405EB358DB349942CBA4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE3E08 Relevance: .3, Instructions: 252COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 400829a41c14026a70e32a67a8e816b26a59c53efb147d9c4e2f517597dd235e
                                        • Instruction ID: d6865255d152926e1b4eabfde7987953e02ca6bc2a73044656ba869743808394
                                        • Opcode Fuzzy Hash: 400829a41c14026a70e32a67a8e816b26a59c53efb147d9c4e2f517597dd235e
                                        • Instruction Fuzzy Hash: C6A114B5E00209CFCB05DFAAC985AEDFBB2FF89314F20812AD955AB254DB345946CF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE3EE0 Relevance: .2, Instructions: 183COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: cc5331960a2de1fb45e5989eaf6751994539d15d7f7987080aff79f26c32321e
                                        • Instruction ID: c7e46168b386c1ac2d3d7e76672598f66a31c2ed09e58d795e17e37efe4e36bb
                                        • Opcode Fuzzy Hash: cc5331960a2de1fb45e5989eaf6751994539d15d7f7987080aff79f26c32321e
                                        • Instruction Fuzzy Hash: 8981D4B4E102198FDB08CFE9C884AAEFBB2FF89300F10912AD519AB354D7349945CF54
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE4B00 Relevance: .2, Instructions: 155COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 32f5b5f2d30e3a2c63b2684dd7296a7b884a521d9dfa038ca6b4dd68a91d0c99
                                        • Instruction ID: a87059018a336ece71e93890544b2f415b8f17077e26b3c3282adc6eafe2429f
                                        • Opcode Fuzzy Hash: 32f5b5f2d30e3a2c63b2684dd7296a7b884a521d9dfa038ca6b4dd68a91d0c99
                                        • Instruction Fuzzy Hash: B1513AB0E1464ACFCB08DFEAC4456AEFBF6EB89300F24D46AE455A7254D7349A01CF58
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE4AF1 Relevance: .2, Instructions: 155COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: e277ce7103e49af6158ec5a8115e7aa9185a40686a47655da41f0169cb1021d1
                                        • Instruction ID: 5a21c939f02596c6dd001cfd98fb3905d608dcb34618d54d951dc2672bd474eb
                                        • Opcode Fuzzy Hash: e277ce7103e49af6158ec5a8115e7aa9185a40686a47655da41f0169cb1021d1
                                        • Instruction Fuzzy Hash: 3E514AB0E1424A9FCB08DFEAC4416AEFBF6EBC9300F14D46AE455A7254D7349A01CF98
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE95D1 Relevance: .1, Instructions: 116COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 13e5fce8b2c36fcfb4168cc99f7915416afe78c1e48bbb6cb75797064f0b7ee9
                                        • Instruction ID: d6a8f25e118e4f4b86b587ed8605b2ebb039fee2cbd3b7542584ace9860427da
                                        • Opcode Fuzzy Hash: 13e5fce8b2c36fcfb4168cc99f7915416afe78c1e48bbb6cb75797064f0b7ee9
                                        • Instruction Fuzzy Hash: A0519C71E016188BDB19CF6B8D4568AFBF3AFC9300F14C1BA994CAB265EB341A458F41
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE9608 Relevance: .1, Instructions: 106COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8a352d187bf09d2c2266004b5a048511bcd82ea02823d2017d551595b943c4af
                                        • Instruction ID: 8bfe792c75178f4cc821af9e23fb86631221eed0dbc20faca708f8e56b4a11a8
                                        • Opcode Fuzzy Hash: 8a352d187bf09d2c2266004b5a048511bcd82ea02823d2017d551595b943c4af
                                        • Instruction Fuzzy Hash: EE416CB1E116188BDB58DF6B8D4479EFBF7BFC8300F14C1BA950CA6224DB341A858E11
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 086745A0 Relevance: .1, Instructions: 91COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 86948714c7fa2005dd4467bd7033b3ec931476af987853d590931b3f5c59a27c
                                        • Instruction ID: c7bb2cffd2e1433f397d82231e6f6458f17ddbb7b398f62c30e3e20f2db61c35
                                        • Opcode Fuzzy Hash: 86948714c7fa2005dd4467bd7033b3ec931476af987853d590931b3f5c59a27c
                                        • Instruction Fuzzy Hash: 3D319A71A00218CFDB15CFA8D448BEDBBF1EF49306F1A846AD115BB361CB309944CBA8
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE5550 Relevance: .1, Instructions: 67COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 832203916992bc2fc89dd5d5076465f6556675acf36df9827a7b6d20b463c691
                                        • Instruction ID: ce6181846edb04a25cab2926643da4c60cc0dd2451c7b0d2d4cd8a3ae7f2a750
                                        • Opcode Fuzzy Hash: 832203916992bc2fc89dd5d5076465f6556675acf36df9827a7b6d20b463c691
                                        • Instruction Fuzzy Hash: 6921E3B1E006188BDB18CFABD8443DEFBB7AFC8310F14C06AD509A6258DB745A55CF54
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE5543 Relevance: .1, Instructions: 59COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5c7f3f0f8ab9f3aa58c6eb2f25483f4a3b16534f2ea92c828997e569461fc113
                                        • Instruction ID: dbe43ae13f97590cee5e64becdab9624beaf1c3828bac06b3c2865d84e6d7c49
                                        • Opcode Fuzzy Hash: 5c7f3f0f8ab9f3aa58c6eb2f25483f4a3b16534f2ea92c828997e569461fc113
                                        • Instruction Fuzzy Hash: BE21A5B1E006188BEB18CFABD94539EFBF3AFC8300F14C16AD909A6258DB745946CF54
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 03399788 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 170 3399788-339979d call 3398a94 174 339979f 170->174 175 33997b3-33997b7 170->175 227 33997a5 call 3399a10 174->227 228 33997a5 call 3399a03 174->228 176 33997b9-33997c3 175->176 177 33997cb-339980c 175->177 176->177 182 3399819-3399827 177->182 183 339980e-3399816 177->183 178 33997ab-33997ad 178->175 179 33998e8-3399962 178->179 219 3399969-33999a8 179->219 220 3399964-3399968 179->220 185 3399829-339982e 182->185 186 339984b-339984d 182->186 183->182 187 3399839 185->187 188 3399830-3399837 call 3398aa0 185->188 189 3399850-3399857 186->189 193 339983b-3399849 187->193 188->193 190 3399859-3399861 189->190 191 3399864-339986b 189->191 190->191 195 3399878-3399881 call 3398ab0 191->195 196 339986d-3399875 191->196 193->189 201 339988e-3399893 195->201 202 3399883-339988b 195->202 196->195 204 33998b1-33998b5 201->204 205 3399895-339989c 201->205 202->201 229 33998b8 call 3399d08 204->229 230 33998b8 call 3399ce0 204->230 205->204 206 339989e-33998ae call 3398ac0 call 3398ad0 205->206 206->204 208 33998bb-33998be 210 33998e1-33998e7 208->210 211 33998c0-33998de 208->211 211->210 222 33999aa-33999ad 219->222 223 33999b0-33999db GetModuleHandleW 219->223 220->219 222->223 224 33999dd-33999e3 223->224 225 33999e4-33999f8 223->225 224->225 227->178 228->178 229->208 230->208
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID: HandleModule
                                        • String ID:
                                        • API String ID: 4139908857-0
                                        • Opcode ID: 88577e94a62d17b9e38693b848fe69826c921aa83b4a1d40d8612305049da727
                                        • Instruction ID: bedc9b6be6c3b158e2b497a0ae2377b3d588a2c93470c1b38ca329e99f9d9992
                                        • Opcode Fuzzy Hash: 88577e94a62d17b9e38693b848fe69826c921aa83b4a1d40d8612305049da727
                                        • Instruction Fuzzy Hash: 3B711470A04B058FEB24DF2AC48475AB7F5BF88204F048A6EE54ADBA50DB75E805CF91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 086716EC Relevance: 1.7, APIs: 1, Instructions: 160processCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 315 86716ec-86716f5 316 86716f7-8671783 315->316 317 86716b3-86716c8 315->317 321 8671785-867178b 316->321 322 867178e-8671795 316->322 318 86716cf-86716e0 317->318 319 86716ca 317->319 319->318 321->322 324 8671797-867179d 322->324 325 86717a0-86717b6 322->325 324->325 326 86717c1-867185e CreateProcessW 325->326 327 86717b8-86717be 325->327 329 8671867-86718db 326->329 330 8671860-8671866 326->330 327->326 338 86718ed-86718f4 329->338 339 86718dd-86718e3 329->339 330->329 340 86718f6-8671905 338->340 341 867190b 338->341 339->338 340->341 343 867190c 341->343 343->343
                                        APIs
                                        • CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0867184B
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: CreateProcess
                                        • String ID:
                                        • API String ID: 963392458-0
                                        • Opcode ID: 57a5542d445c6acef23d78d4213b63134340b3a1f4cd954ad8356842eb815a9e
                                        • Instruction ID: 343d77fe86e108ef41a6bb13e4d72e413b991b3585ee21fc9216db71ec196757
                                        • Opcode Fuzzy Hash: 57a5542d445c6acef23d78d4213b63134340b3a1f4cd954ad8356842eb815a9e
                                        • Instruction Fuzzy Hash: ED611671D00318DFDB60CF99C884BDDBBB1BF89304F15819AE908A7250DB349A89CF91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 086716F8 Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 344 86716f8-8671783 346 8671785-867178b 344->346 347 867178e-8671795 344->347 346->347 348 8671797-867179d 347->348 349 86717a0-86717b6 347->349 348->349 350 86717c1-867185e CreateProcessW 349->350 351 86717b8-86717be 349->351 353 8671867-86718db 350->353 354 8671860-8671866 350->354 351->350 362 86718ed-86718f4 353->362 363 86718dd-86718e3 353->363 354->353 364 86718f6-8671905 362->364 365 867190b 362->365 363->362 364->365 367 867190c 365->367 367->367
                                        APIs
                                        • CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0867184B
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: CreateProcess
                                        • String ID:
                                        • API String ID: 963392458-0
                                        • Opcode ID: a3956e388301b3eff601d166f9d2f190ff38b11918ac6486fc04db8c1cfb601c
                                        • Instruction ID: f1c0417662daf5af80294212c54e411a93762592dde5cb4e05ecc9c57825ab47
                                        • Opcode Fuzzy Hash: a3956e388301b3eff601d166f9d2f190ff38b11918ac6486fc04db8c1cfb601c
                                        • Instruction Fuzzy Hash: 2B510771900329DFDB10CF99C880BDDBBB5BF89314F15819AE908B7250DB319A89CF91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0339A4DC Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 368 339a4dc-339c134 DuplicateHandle 370 339c13d-339c15a 368->370 371 339c136-339c13c 368->371 371->370
                                        APIs
                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0339C066,?,?,?,?,?), ref: 0339C127
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID: DuplicateHandle
                                        • String ID:
                                        • API String ID: 3793708945-0
                                        • Opcode ID: d972de7facb5a0a3e6350e7c7a1968bb06bf77b5cc17965cfddb01e458327fd4
                                        • Instruction ID: 7693db3332e54226a6ec520b9b60986a97edd4693cca98a086041619ff5d7b72
                                        • Opcode Fuzzy Hash: d972de7facb5a0a3e6350e7c7a1968bb06bf77b5cc17965cfddb01e458327fd4
                                        • Instruction Fuzzy Hash: 7521D2B5900208EFDF10CF99D884AEEBBF8EB48324F14801AE915A3310D374A954CFA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671CA0 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 381 8671ca0-8671cf1 383 8671cf3-8671cff 381->383 384 8671d01-8671d3a WriteProcessMemory 381->384 383->384 385 8671d43-8671d64 384->385 386 8671d3c-8671d42 384->386 386->385
                                        APIs
                                        • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08671D2D
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: MemoryProcessWrite
                                        • String ID:
                                        • API String ID: 3559483778-0
                                        • Opcode ID: 2a5a86de1052b8e9ddde6cb5d304774d0c360d7d0d3a0324c55603510e749ebc
                                        • Instruction ID: 767feca56e051484cdb37ba14acebe11347dd6788b8fd17379c2d872475028a9
                                        • Opcode Fuzzy Hash: 2a5a86de1052b8e9ddde6cb5d304774d0c360d7d0d3a0324c55603510e749ebc
                                        • Instruction Fuzzy Hash: 1B2112B19002199FCB10CF9AD885BDEBBF4FB49324F00842AE919A3350D778A944CFA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671C99 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 374 8671c99-8671cf1 376 8671cf3-8671cff 374->376 377 8671d01-8671d3a WriteProcessMemory 374->377 376->377 378 8671d43-8671d64 377->378 379 8671d3c-8671d42 377->379 379->378
                                        APIs
                                        • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08671D2D
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: MemoryProcessWrite
                                        • String ID:
                                        • API String ID: 3559483778-0
                                        • Opcode ID: 9d3b29a4b72fe95229b668870a79bceaf8abc6153f802b83041dfc6d2f6e28cb
                                        • Instruction ID: a0012195ebc478987c96d9e0f28fe9a34e830ed5e004cad23becb75f2abf673d
                                        • Opcode Fuzzy Hash: 9d3b29a4b72fe95229b668870a79bceaf8abc6153f802b83041dfc6d2f6e28cb
                                        • Instruction Fuzzy Hash: 632103B19002199FCB10CF99D885BEEBBF4FB88314F00852AE819A3350D774A954CFA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0339C099 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 388 339c099-339c09b 389 339c0a0-339c134 DuplicateHandle 388->389 390 339c13d-339c15a 389->390 391 339c136-339c13c 389->391 391->390
                                        APIs
                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0339C066,?,?,?,?,?), ref: 0339C127
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID: DuplicateHandle
                                        • String ID:
                                        • API String ID: 3793708945-0
                                        • Opcode ID: 239615ffbad3f8bb93e4768e0b1de2b123ebcf9bb766d8b41355a32d4dd48959
                                        • Instruction ID: 3c644f0e9573708255aa1430b21dc8cebffa75d1c8d9cb2219ea67c06c53a199
                                        • Opcode Fuzzy Hash: 239615ffbad3f8bb93e4768e0b1de2b123ebcf9bb766d8b41355a32d4dd48959
                                        • Instruction Fuzzy Hash: 5B21E3B6900208AFDF10CFA9D884ADEFBF4EB48324F14801AE915A3310D374A944CFA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671A60 Relevance: 1.6, APIs: 1, Instructions: 59threadinjectionCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 469 8671a60-8671ab4 471 8671ab6-8671abe 469->471 472 8671ac0-8671aec SetThreadContext 469->472 471->472 473 8671af5-8671b16 472->473 474 8671aee-8671af4 472->474 474->473
                                        APIs
                                        • SetThreadContext.KERNELBASE(?,00000000), ref: 08671ADF
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: ContextThread
                                        • String ID:
                                        • API String ID: 1591575202-0
                                        • Opcode ID: d0143e405eb4499bfa9d1e3fb3319cccc1f9db01e1d2df76da34f1141690bf95
                                        • Instruction ID: 0452d8e4243941b9577f5eef959cb01786b986870eada1748224735e17c58a5e
                                        • Opcode Fuzzy Hash: d0143e405eb4499bfa9d1e3fb3319cccc1f9db01e1d2df76da34f1141690bf95
                                        • Instruction Fuzzy Hash: C5212771D0061A8FCB10CF99C4857EEFBF4BB49214F05812AE819B3740D774A944CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671B20 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 476 8671b20-8671bb4 ReadProcessMemory 478 8671bb6-8671bbc 476->478 479 8671bbd-8671bde 476->479 478->479
                                        APIs
                                        • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08671BA7
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: MemoryProcessRead
                                        • String ID:
                                        • API String ID: 1726664587-0
                                        • Opcode ID: 932f5392ae3ebaad1065fbfe85b4ae410d27c7520bb24069ed279b556afae08d
                                        • Instruction ID: 434f38bba3624b01d9cfb4a96c6c55148a10739ecd06ae98930d62c4bad94f8f
                                        • Opcode Fuzzy Hash: 932f5392ae3ebaad1065fbfe85b4ae410d27c7520bb24069ed279b556afae08d
                                        • Instruction Fuzzy Hash: E421E2B6900219DFCB10CF99D984BDEBBF4BF48324F04842AE919A3650D338A554CFA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671B28 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 481 8671b28-8671bb4 ReadProcessMemory 483 8671bb6-8671bbc 481->483 484 8671bbd-8671bde 481->484 483->484
                                        APIs
                                        • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08671BA7
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: MemoryProcessRead
                                        • String ID:
                                        • API String ID: 1726664587-0
                                        • Opcode ID: 7838f7cd39bf84a7bf47b38daaeea230846fd98116565f3391966a2ae0bdef84
                                        • Instruction ID: 1dac5047fc76fbe4219b07fc19240854587ab14fdf3f3f568120c2da73926141
                                        • Opcode Fuzzy Hash: 7838f7cd39bf84a7bf47b38daaeea230846fd98116565f3391966a2ae0bdef84
                                        • Instruction Fuzzy Hash: 4E21E4B5900259DFCB10CF9AD884BDEBBF4FB49324F10842AE918A3350D374A954CFA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671A68 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 561 8671a68-8671ab4 563 8671ab6-8671abe 561->563 564 8671ac0-8671aec SetThreadContext 561->564 563->564 565 8671af5-8671b16 564->565 566 8671aee-8671af4 564->566 566->565
                                        APIs
                                        • SetThreadContext.KERNELBASE(?,00000000), ref: 08671ADF
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: ContextThread
                                        • String ID:
                                        • API String ID: 1591575202-0
                                        • Opcode ID: 10552da6ddf0ae737b8d22c0213fe4455a638cc0f2be85eb2cbe43328e408c8d
                                        • Instruction ID: c8ee2b39eed1da9297e5a71c4af2a24c14fe8b610b82f3db8649be537f8b2664
                                        • Opcode Fuzzy Hash: 10552da6ddf0ae737b8d22c0213fe4455a638cc0f2be85eb2cbe43328e408c8d
                                        • Instruction Fuzzy Hash: 1C2106B1D006199FDB00CF9AC4857EEFBF4BB49224F05812AD819B3740D778A944CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DEBD88 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • VirtualProtect.KERNELBASE(?,?,?,?), ref: 07DEBDFB
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID: ProtectVirtual
                                        • String ID:
                                        • API String ID: 544645111-0
                                        • Opcode ID: 41007a19babbd4dc0fa83b303f7ab16bbc05dde8e32b9632b200887f5b657257
                                        • Instruction ID: 19cb3e2d173d97ef96d07bc8e47d2bcb1994ff113cb9d54333c74d688ff769d0
                                        • Opcode Fuzzy Hash: 41007a19babbd4dc0fa83b303f7ab16bbc05dde8e32b9632b200887f5b657257
                                        • Instruction Fuzzy Hash: DE2117B19002099FCB10CF9AC484BDEFBF4FB48320F14842AE959A3350D374A944CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 03398AF8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,03399A49,00000800,00000000,00000000), ref: 03399C5A
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID: LibraryLoad
                                        • String ID:
                                        • API String ID: 1029625771-0
                                        • Opcode ID: 731af14e3f789c6cc46c8b8748d889f70acd6052db11850a5a5e41acc4cf0502
                                        • Instruction ID: 8e279b54cde3d591b8b7670937c627b258d9ad7f92a34536aa85d90cd9b3ee0f
                                        • Opcode Fuzzy Hash: 731af14e3f789c6cc46c8b8748d889f70acd6052db11850a5a5e41acc4cf0502
                                        • Instruction Fuzzy Hash: BA11C2B69042099BDB10CF9AC884B9EFBF4AB89324F14842EE915A7610C375A945CFA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 03399BE8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,03399A49,00000800,00000000,00000000), ref: 03399C5A
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID: LibraryLoad
                                        • String ID:
                                        • API String ID: 1029625771-0
                                        • Opcode ID: 3c7595cfb89760d294e734b6a54f250b126ce316c02e4ac61e0ac68ad5c8869e
                                        • Instruction ID: 2d8be03d9455955450f25c4f59d222cf4e5ef3ac050710e673716c4418e23dcc
                                        • Opcode Fuzzy Hash: 3c7595cfb89760d294e734b6a54f250b126ce316c02e4ac61e0ac68ad5c8869e
                                        • Instruction Fuzzy Hash: D621E3B6C042499FDB10CF99C984B9EBBF4AB89214F08841ED815A7600C375A545CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 03398A94 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0339979B), ref: 033999CE
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID: HandleModule
                                        • String ID:
                                        • API String ID: 4139908857-0
                                        • Opcode ID: 5f8527d849f27543a593ac3931325a01857820ec7049ead4b1537ab8e497ba54
                                        • Instruction ID: 4a4c288a50568639f385041e4871ca2c4e82847b0690e5c0b936d251dad80854
                                        • Opcode Fuzzy Hash: 5f8527d849f27543a593ac3931325a01857820ec7049ead4b1537ab8e497ba54
                                        • Instruction Fuzzy Hash: E411F0B6C006498FDB10CF9AC484BDEFBF8EB88224F14842ED859B7610C375A945CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671BF0 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08671C63
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: AllocVirtual
                                        • String ID:
                                        • API String ID: 4275171209-0
                                        • Opcode ID: bc59efeb6069a3eb3d458ff3ef8d9719ed4e033d43bb75d57e70bac3c23f3dd5
                                        • Instruction ID: d2bb32ece7ba5d036d9481710b799b883e13c07a2459c2a186324cb520a1e4a3
                                        • Opcode Fuzzy Hash: bc59efeb6069a3eb3d458ff3ef8d9719ed4e033d43bb75d57e70bac3c23f3dd5
                                        • Instruction Fuzzy Hash: F61113B5800249DFCB10CF99C988BDEBBF4FB88324F14841AE929A7710D375A954CFA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671BF8 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08671C63
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: AllocVirtual
                                        • String ID:
                                        • API String ID: 4275171209-0
                                        • Opcode ID: 13aef1b02984dff0b4f7480f2e0af23a2e7f77eda3be7db81d6a9fc06144935d
                                        • Instruction ID: cf2d930e405aa050f23ee0db067533cf0464c31ea4b434a4e0e2dc2ddfd0c8ab
                                        • Opcode Fuzzy Hash: 13aef1b02984dff0b4f7480f2e0af23a2e7f77eda3be7db81d6a9fc06144935d
                                        • Instruction Fuzzy Hash: FF11F5B5900249DFCB10CF9AC884BDEBBF4FB89324F14841AE529A7350C375A954CFA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 086727D1 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • PostMessageW.USER32(?,?,?,?), ref: 08672835
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: MessagePost
                                        • String ID:
                                        • API String ID: 410705778-0
                                        • Opcode ID: 186cd33388623d88b60ea5215d4c3392dda630538c79d41b84b125f9393734d4
                                        • Instruction ID: 1f692b63d4d4bc3769b4e7004ee2f5887625e542c20627edad8c5cdb4a2f257a
                                        • Opcode Fuzzy Hash: 186cd33388623d88b60ea5215d4c3392dda630538c79d41b84b125f9393734d4
                                        • Instruction Fuzzy Hash: 5711E0B58002499FDB20CF99C489BDEBFF8EB88324F14845EE855A7710C375A958CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 086727D8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
                                        Download Yara Rule
                                        APIs
                                        • PostMessageW.USER32(?,?,?,?), ref: 08672835
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: MessagePost
                                        • String ID:
                                        • API String ID: 410705778-0
                                        • Opcode ID: 6d42e531f4c45e7df7d19dee2a12e997512d24073fe034113343bea9df29c976
                                        • Instruction ID: 9b14c036124d7c6f0aa36489018be20c989762d4554a67faf5ee1e0c1981f13a
                                        • Opcode Fuzzy Hash: 6d42e531f4c45e7df7d19dee2a12e997512d24073fe034113343bea9df29c976
                                        • Instruction Fuzzy Hash: 9511D0B58002499FDB10CF99C889BDEBBF8FB89324F14841AE915A7710C375A948CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671E51 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • ResumeThread.KERNELBASE(?), ref: 08671EB7
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: ResumeThread
                                        • String ID:
                                        • API String ID: 947044025-0
                                        • Opcode ID: 0722a5aec19ddab4ecec3e6daa7829a4511f1805a84f2a43d3dc9b62fef7add3
                                        • Instruction ID: 4abe41aba017a3aa8c582d4c184393dd223a7bd329b22c630928f75c480d4922
                                        • Opcode Fuzzy Hash: 0722a5aec19ddab4ecec3e6daa7829a4511f1805a84f2a43d3dc9b62fef7add3
                                        • Instruction Fuzzy Hash: F3112EB58002088FCB10CF99D488BDEBBF4EB88224F10845AD819A3310D374A944CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08671E58 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON
                                        Download Yara Rule
                                        APIs
                                        • ResumeThread.KERNELBASE(?), ref: 08671EB7
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID: ResumeThread
                                        • String ID:
                                        • API String ID: 947044025-0
                                        • Opcode ID: dcc13e7f150bfd6e9565e724aa5197ed15512ad96ef45c49f8027c8c68a27aa7
                                        • Instruction ID: ff08789fa87eb910be8f6ea082c25ccdaca683101ac8c7255fa4ecc804e5e0a4
                                        • Opcode Fuzzy Hash: dcc13e7f150bfd6e9565e724aa5197ed15512ad96ef45c49f8027c8c68a27aa7
                                        • Instruction Fuzzy Hash: 211112B18002088FCB10CF9AD484BDEBBF8EB89324F10841AD519A3340C375A944CFA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Non-executed Functions

                                        Function 07DED828 Relevance: 2.8, Strings: 2, Instructions: 346COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: AqH$D0Ul
                                        • API String ID: 0-2929027544
                                        • Opcode ID: ab5c942ae4626881ab3a1a1e2e9d3a619dd86a314f8fec427a16285e0c545f63
                                        • Instruction ID: 9d4bc4feaba04f70a43cb57f16829402807a3b1f904785a800d82f9fe40badc4
                                        • Opcode Fuzzy Hash: ab5c942ae4626881ab3a1a1e2e9d3a619dd86a314f8fec427a16285e0c545f63
                                        • Instruction Fuzzy Hash: E4D1BFB0F0420A8FCB05EFA9C9415AEFBF7EF89244F10852AD555A7354EF34DA018BA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE4FB0 Relevance: 2.7, Strings: 2, Instructions: 177COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: q`x$q`x
                                        • API String ID: 0-2690937077
                                        • Opcode ID: 4b692c7c250f053d19f19145c8d80329d8b312a993e539c5229081a08e848b75
                                        • Instruction ID: 793f952122092a6b715d9b803b5a19cd3186cea66f60ec24486e55120302b32d
                                        • Opcode Fuzzy Hash: 4b692c7c250f053d19f19145c8d80329d8b312a993e539c5229081a08e848b75
                                        • Instruction Fuzzy Hash: 397138B4E1520ADFCB04DF99D4809EEFBB6FF89350F10942AE516A7214D7349A41CFA4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DEDD30 Relevance: 2.6, Strings: 2, Instructions: 142COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: _5CP$_5CP
                                        • API String ID: 0-3390200954
                                        • Opcode ID: b8dd495b7b2646962a561e90842ced6a079c73bd31d1c51e16c3057010fa02bc
                                        • Instruction ID: 42cab634a55d2444e8b8af5f20ce29592ba6f8db54f73fdd8172b697247f4e91
                                        • Opcode Fuzzy Hash: b8dd495b7b2646962a561e90842ced6a079c73bd31d1c51e16c3057010fa02bc
                                        • Instruction Fuzzy Hash: C25108B4E10219CFDB58DF69D980B9EF7B6FB89200F1490A9D509A7314DB709E41CF51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE8868 Relevance: 2.6, Strings: 2, Instructions: 114COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: {JU${JU
                                        • API String ID: 0-2782968353
                                        • Opcode ID: d635b9434cf8e4120283014d3a5a57269f31e5b35b090b072b462c6cd552c179
                                        • Instruction ID: b8ac30326a765771007b5add3435fd63006ed4924d91a5065d00d341cc4cad88
                                        • Opcode Fuzzy Hash: d635b9434cf8e4120283014d3a5a57269f31e5b35b090b072b462c6cd552c179
                                        • Instruction Fuzzy Hash: 144139B4E1460ACBCB09DFA9D5815AEFFF6FB88300F24E56AC905B7214D3349A41CB95
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DEE338 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: `H!]
                                        • API String ID: 0-4256091341
                                        • Opcode ID: fd46203eb8ce65318715f2c14c48675090c7d73b9b0ee856279cc6557cd50562
                                        • Instruction ID: 568c5a9960e749278d75ab650ddb6b15b84599628a7581cb12a1230ae9c4e8df
                                        • Opcode Fuzzy Hash: fd46203eb8ce65318715f2c14c48675090c7d73b9b0ee856279cc6557cd50562
                                        • Instruction Fuzzy Hash: 5C515DB0E141298BDB14DFAAD9806AEFBF6FF89304F14C16AD419A7345D7309941CFA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE7090 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: 80A3
                                        • API String ID: 0-1711469968
                                        • Opcode ID: dc128e2109c85fa2c15e00490769790050d6acd612fc51bb47917f1c2ccbe533
                                        • Instruction ID: 03791007664712ebac5468ae8a18a8aec4bac1352d55d967dca739e48a03fb32
                                        • Opcode Fuzzy Hash: dc128e2109c85fa2c15e00490769790050d6acd612fc51bb47917f1c2ccbe533
                                        • Instruction Fuzzy Hash: CD41A1B0D1020ADBCB49DF95C9804AEFBB6FF85310F24E6A9C515A7359D730DA41CB51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0339E820 Relevance: .3, Instructions: 315COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0b6dcd217879da0a61cddb722d08c76b8fafbcdc1936c41ade9892c8c57f8a25
                                        • Instruction ID: 78b35a66eb292678d17cdd4663aae99b3cf33820ef3190b7862830db3176af98
                                        • Opcode Fuzzy Hash: 0b6dcd217879da0a61cddb722d08c76b8fafbcdc1936c41ade9892c8c57f8a25
                                        • Instruction Fuzzy Hash: C312A5B14A17468AD330CF69E49858D3B61B7453A9B924308D2B21FAF9E7F4114EEFC4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0339BF54 Relevance: .3, Instructions: 265COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 175ac82df26d0a3439c181fcadd99d6406a70a939eaf1f7945651a1616d87d64
                                        • Instruction ID: 80b0243d9bb0d4bb502fd277010e6d57f0b4f5a2a07cd9a710f30211c6d77c47
                                        • Opcode Fuzzy Hash: 175ac82df26d0a3439c181fcadd99d6406a70a939eaf1f7945651a1616d87d64
                                        • Instruction Fuzzy Hash: 10A17D36E00619CFDF15DFA5C8845DEBBB6FF84300B16816AE915AF220EB35E945CB80
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0339E810 Relevance: .2, Instructions: 227COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.458980684.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_3390000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: d9fa7d6bff8c39202636fe02b38b6a993f46b8567818bc4f8ee0ac1ce833e519
                                        • Instruction ID: 841047796e7605b5b1b106016bb0a09800db1c791a64b374b7f8ce151d236ef0
                                        • Opcode Fuzzy Hash: d9fa7d6bff8c39202636fe02b38b6a993f46b8567818bc4f8ee0ac1ce833e519
                                        • Instruction Fuzzy Hash: 00C12AB14A17458BD720CF68E88858D7B61BB853A9F524308D2716FAF8E7B4144EEFC4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE4FA0 Relevance: .2, Instructions: 171COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2b55a4e62ece994b62f6a4ae14393d4c78afdfb57ad53a706aa2f4793d1bd401
                                        • Instruction ID: 4bc2a97f0423add720fbfea2925125c420fa5f8bfbd6dd0b150d48c9a3cb6eb4
                                        • Opcode Fuzzy Hash: 2b55a4e62ece994b62f6a4ae14393d4c78afdfb57ad53a706aa2f4793d1bd401
                                        • Instruction Fuzzy Hash: EC7139B4E1020ADFCB04DF99D4809AEFBB6FF89350F14942AE515A7354D7349A41CFA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08670040 Relevance: .2, Instructions: 163COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: bc7e4480c824c71a1cfc9ddb241ebc368adbe21ad8f9b05cf8528e72ea2cb648
                                        • Instruction ID: 9b3356390df29400754475c3a0454cc6b964c51ef11f8f28527f6f3021d7d2c6
                                        • Opcode Fuzzy Hash: bc7e4480c824c71a1cfc9ddb241ebc368adbe21ad8f9b05cf8528e72ea2cb648
                                        • Instruction Fuzzy Hash: 9E714C71E1461ACBDB68CF66C9447A9FBB2FFC9301F1186FAD509A7614EB305A818F40
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE8640 Relevance: .1, Instructions: 149COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 80ffc3aa548cc3668613049e949d4b17466f5aad40b855d1d41eb84926c90647
                                        • Instruction ID: c3255f50416ace0baf4d3b6b868411dc8305bb8b432026d10f158202bf676cf9
                                        • Opcode Fuzzy Hash: 80ffc3aa548cc3668613049e949d4b17466f5aad40b855d1d41eb84926c90647
                                        • Instruction Fuzzy Hash: C351D2B0E14209CFCB09DFAAD5849DEFBF6EB89310F14A42AD519B7364D7309A41CB64
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 08670011 Relevance: .1, Instructions: 147COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 61a6f94f6d74138abaf49c19ba39fef59e9ab84142e38dd1c4a008add2132678
                                        • Instruction ID: 8f9e88bac73b65ee7be0ab2fb4219d963af3e03160d501c4d7c85a50b7555424
                                        • Opcode Fuzzy Hash: 61a6f94f6d74138abaf49c19ba39fef59e9ab84142e38dd1c4a008add2132678
                                        • Instruction Fuzzy Hash: 51616C71E1561A8FCB68CF6ACD44799FBB2BFC9300F1582EAD408A7614EB305A818F41
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE8632 Relevance: .1, Instructions: 144COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5b3ed0d39673d8e4168ae671b99a2adf779483888c07a96e10f7bd56690b3802
                                        • Instruction ID: 36b70ac7bd83dd656802871b2a3b9edcc0c7b6c6d12c775556692e9ecc0d843a
                                        • Opcode Fuzzy Hash: 5b3ed0d39673d8e4168ae671b99a2adf779483888c07a96e10f7bd56690b3802
                                        • Instruction Fuzzy Hash: 6151E2B0E14609CFCB08DFAAC98459EFBF2EF89310F14A42AD519B7364D7309A418B64
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DECA40 Relevance: .1, Instructions: 131COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 19bb3a6e1011f1767b9ab25ec1fde2713bd2923111a9ca57dccd14621db03f87
                                        • Instruction ID: f94b271761db2acd7703b9f5055ab8a4a9cab3189233067dfe5271d2de5168b8
                                        • Opcode Fuzzy Hash: 19bb3a6e1011f1767b9ab25ec1fde2713bd2923111a9ca57dccd14621db03f87
                                        • Instruction Fuzzy Hash: 34510A70E152198FCB59DF69D980B9EFBB6FF89304F1480A9D509A7351DB309A40DF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE885B Relevance: .1, Instructions: 111COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6d1aa5094eeff41c0a37531a11ac35b1e5930b120b649737f9059226feaf7226
                                        • Instruction ID: ae23eea6efa953f0b5db73d6cea09b89b2aecf7fcc314e94f83b86d44a65069d
                                        • Opcode Fuzzy Hash: 6d1aa5094eeff41c0a37531a11ac35b1e5930b120b649737f9059226feaf7226
                                        • Instruction Fuzzy Hash: 404138B4E1460ACBCB09DFA9D5815AEFFF2FB88300F24E56AC905B7314D3309A418B95
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE8410 Relevance: .1, Instructions: 107COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6962dbefcb6193a0630caaa59cc1a5ea472a7cf1da04873805d8ce000bd18853
                                        • Instruction ID: 8b84aa5f5f71e91dd078e74b14d2a566545d46efa3bbd1535bfea38065cff55c
                                        • Opcode Fuzzy Hash: 6962dbefcb6193a0630caaa59cc1a5ea472a7cf1da04873805d8ce000bd18853
                                        • Instruction Fuzzy Hash: B34157B5E0420A8FCB09DFAAC4815AEFBF2FF89310F14E46AC515A7254D7349A428F94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE8420 Relevance: .1, Instructions: 107COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8b46c6b65ec8fc4046408e17e3f040d190489b7472aa691e4bf0e417f64e4cee
                                        • Instruction ID: 84883dc14fedeed63f7303325ecc5e5ba0c406e198d4e14646c22aad894f833a
                                        • Opcode Fuzzy Hash: 8b46c6b65ec8fc4046408e17e3f040d190489b7472aa691e4bf0e417f64e4cee
                                        • Instruction Fuzzy Hash: E34102B1E0420ACFCB48DFAAC4815AEFBF6FF89310F14E46AD515A7214D7349A419FA4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE8A68 Relevance: .1, Instructions: 72COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: b1a9d0b556347b8e45f1e6617be3ea6b94768beec8f95a7771bf7884af3cdd86
                                        • Instruction ID: f037e3de1e0c634885bf2a1d03523e3a8801c8704d8d16faff5064f9aae93403
                                        • Opcode Fuzzy Hash: b1a9d0b556347b8e45f1e6617be3ea6b94768beec8f95a7771bf7884af3cdd86
                                        • Instruction Fuzzy Hash: 3D212AB1E046189BEB48CFABD8406DEFAF7BFC9300F04D17AC408A6224EB3455468F15
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE8A58 Relevance: .1, Instructions: 71COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 95d9a18c5a0c736d4b42b2df3fd230be910a9052dab0ce6ff39d6c35bfe80622
                                        • Instruction ID: 67c3cf8b3580de3a8517f66a4164a4719c58a0d487dcc15e5fcd8643cbe16bfa
                                        • Opcode Fuzzy Hash: 95d9a18c5a0c736d4b42b2df3fd230be910a9052dab0ce6ff39d6c35bfe80622
                                        • Instruction Fuzzy Hash: 4E210AB1E046188BDB18CFABD94069EFBF3BFC9300F08D57AC808A6224EB3455468F55
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DEC3E8 Relevance: .1, Instructions: 60COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: fbd4863d7559b4e1c4e60e5841e8d8cbd62037933c3e6393bdfe95fa311acfe0
                                        • Instruction ID: b111644f4c6d37e5e42cc6a4bd6b64bf5007855d1edb948502b7f6b2f095cefc
                                        • Opcode Fuzzy Hash: fbd4863d7559b4e1c4e60e5841e8d8cbd62037933c3e6393bdfe95fa311acfe0
                                        • Instruction Fuzzy Hash: 02111A71E116199BDB18CFAAD9416AEFBF7AFC8200F14C03AD508A7254EB305A058F51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE32E8 Relevance: .1, Instructions: 59COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: a5e2b5925dd77121eeab67cd06930fedeb5fa6af1ba04b3cc367d55361c227dc
                                        • Instruction ID: 89923bd0db1475c2435007c7a7a25fcce42e4e70ae0f8dcc5b231a501ddeb26f
                                        • Opcode Fuzzy Hash: a5e2b5925dd77121eeab67cd06930fedeb5fa6af1ba04b3cc367d55361c227dc
                                        • Instruction Fuzzy Hash: 1011DDB1E146189BEB18CFABD84469EFAF7AFC8200F04C176D918A7218EB3416418F51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 07DE32D8 Relevance: .1, Instructions: 54COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.473855413.0000000007DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DE0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_7de0000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0eb1992223a501f862e5e12d7b995a890e22cb4b97da384dfa24fdfe64cc1b24
                                        • Instruction ID: d839fa0d45da2b98479a65ebcd732e3ca1d4eab4220ca79f0422ce82120ba732
                                        • Opcode Fuzzy Hash: 0eb1992223a501f862e5e12d7b995a890e22cb4b97da384dfa24fdfe64cc1b24
                                        • Instruction Fuzzy Hash: 8A11D0B1E046088BEB19CF6BD80469EFAF3AFC8200F08C07AC818B7258EB3405418F15
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 086745B0 Relevance: .0, Instructions: 43COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.474231596.0000000008670000.00000040.00000800.00020000.00000000.sdmp, Offset: 08670000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_0_2_8670000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2d18b19223b2642e905ac721ea7c53311a8a40a6f97ebd951a875fdd6cb49802
                                        • Instruction ID: 478385032b5cce8478492d36026f69ed73193c4a7a6e367c4fd1c2988ba42d34
                                        • Opcode Fuzzy Hash: 2d18b19223b2642e905ac721ea7c53311a8a40a6f97ebd951a875fdd6cb49802
                                        • Instruction Fuzzy Hash: F1014B70D052588FDB15CFA9C448BEDBBF1AF4D312F19906AD415B7290DB788988CFA8
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Execution Graph

                                        Execution Coverage:0.6%
                                        Dynamic/Decrypted Code Coverage:100%
                                        Signature Coverage:58.8%
                                        Total number of Nodes:716
                                        Total number of Limit Nodes:48
                                        execution_graph 16637 1ab0b60 16638 1ab0b72 16637->16638 16640 1ab0baf 16637->16640 16638->16640 16641 1ab0bd0 16638->16641 16642 1ab0c66 16641->16642 16643 1ab0c05 16641->16643 16644 1b0e940 16642->16644 16645 1b0e915 16642->16645 16648 1ab0c8d _vswprintf_s 16642->16648 16643->16642 16643->16648 16649 1b01700 12 API calls 16643->16649 16647 1b01700 12 API calls 16644->16647 16644->16648 16645->16648 16650 1b01700 16645->16650 16647->16648 16648->16640 16649->16643 16653 1b014e9 16650->16653 16652 1b0171c 16652->16648 16655 1b014fb 16653->16655 16654 1afb58e _vswprintf_s 12 API calls 16656 1b0150e __cftof 16654->16656 16655->16654 16655->16656 16656->16652 16480 1b8e5b6 16481 1b8e608 RtlDebugPrintTimes 16480->16481 16482 1b8e5e1 16480->16482 16483 1b8e619 16481->16483 16482->16481 16487 1b8ed52 16482->16487 16485 1afb640 _vswprintf_s 12 API calls 16483->16485 16486 1b8e626 16485->16486 16491 1b8ed73 16487->16491 16488 1b8ee58 16489 1afb640 _vswprintf_s 12 API calls 16488->16489 16490 1b8ee6d 16489->16490 16490->16482 16491->16488 16492 1b8ee47 RtlDebugPrintTimes 16491->16492 16492->16488 16493 1ae35a1 16494 1ae35a7 16493->16494 16495 1ae35b8 GetPEB 16494->16495 16496 1ae35b7 16494->16496 16497 1aceb70 34 API calls 16495->16497 16497->16496 15845 1b85ba5 15846 1b85bb4 _vswprintf_s 15845->15846 15852 1b85c2a _vswprintf_s 15846->15852 15853 1b85c10 15846->15853 15856 1b84c56 15846->15856 15852->15853 15854 1b860cf GetPEB 15852->15854 15855 1af9710 LdrInitializeThunk 15852->15855 15860 1af6de6 15852->15860 15866 1b0d130 15853->15866 15854->15852 15855->15852 15857 1b84c62 _vswprintf_s 15856->15857 15858 1b0d130 _vswprintf_s 12 API calls 15857->15858 15859 1b84caa 15858->15859 15859->15852 15861 1af6e03 15860->15861 15865 1af6e73 15860->15865 15863 1af6e53 15861->15863 15861->15865 15869 1af6ebe 15861->15869 15863->15865 15877 1ae6a60 15863->15877 15865->15852 15867 1afb640 _vswprintf_s 12 API calls 15866->15867 15868 1b0d13a 15867->15868 15868->15868 15882 1aceef0 15869->15882 15872 1af6f0d 15887 1aceb70 15872->15887 15875 1af6f48 15875->15861 15876 1af6eeb 15876->15872 15893 1af7742 15876->15893 15899 1b684e0 15876->15899 15878 1b28025 15877->15878 15879 1ae6a8d _vswprintf_s 15877->15879 15879->15878 15880 1afb640 _vswprintf_s 12 API calls 15879->15880 15881 1ae6b66 15880->15881 15881->15865 15883 1acef0c 15882->15883 15884 1acef21 15882->15884 15883->15876 15885 1acef29 15884->15885 15905 1acef40 15884->15905 15885->15876 15888 1aceb81 15887->15888 15892 1aceb9e 15887->15892 15890 1acebac 15888->15890 15888->15892 16169 1b4ff10 15888->16169 15890->15892 16163 1ab4dc0 15890->16163 15892->15875 15894 1af7827 15893->15894 15896 1af7768 _vswprintf_s 15893->15896 15894->15876 15896->15894 15897 1aceef0 27 API calls 15896->15897 15898 1aceb70 34 API calls 15896->15898 16239 1af9660 LdrInitializeThunk 15896->16239 15897->15896 15898->15896 15900 1b68511 15899->15900 15901 1aceb70 34 API calls 15900->15901 15903 1b68556 15901->15903 15902 1aceef0 27 API calls 15904 1b685f1 15902->15904 15903->15902 15904->15876 15906 1acf0bd 15905->15906 15909 1acef5d 15905->15909 15906->15909 15943 1ab9080 15906->15943 15910 1acf071 15909->15910 15912 1acf042 15909->15912 15913 1ab2d8a 15909->15913 15910->15883 15911 1acf053 GetPEB 15911->15910 15912->15910 15912->15911 15914 1ab2db8 15913->15914 15932 1ab2df1 _vswprintf_s 15913->15932 15915 1ab2de7 15914->15915 15914->15932 15949 1ab2e9f 15914->15949 15915->15932 15953 1ae1624 15915->15953 15917 1b0f9d0 GetPEB 15919 1b0f9e3 GetPEB 15917->15919 15919->15932 15923 1ab2e5a 15924 1ab2e61 15923->15924 15929 1ab2e99 _vswprintf_s 15923->15929 15925 1ab2e69 15924->15925 15926 1ad7d50 GetPEB 15924->15926 15925->15909 15927 1b0fa76 15926->15927 15930 1b0fa8a 15927->15930 15931 1b0fa7a GetPEB 15927->15931 15933 1ab2ece 15929->15933 15996 1af95d0 LdrInitializeThunk 15929->15996 15930->15925 15935 1b0fa97 GetPEB 15930->15935 15931->15930 15932->15917 15932->15919 15932->15923 15947 1ad7d50 GetPEB 15932->15947 15960 1b4fe87 15932->15960 15967 1b4fdda 15932->15967 15973 1b4ffb9 15932->15973 15981 1b45720 15932->15981 15933->15909 15935->15925 15937 1b0faaa 15935->15937 15938 1ad7d50 GetPEB 15937->15938 15939 1b0faaf 15938->15939 15940 1b0fac3 15939->15940 15941 1b0fab3 GetPEB 15939->15941 15940->15925 15984 1b37016 15940->15984 15941->15940 15944 1ab9098 15943->15944 15945 1ab909e GetPEB 15943->15945 15944->15945 15946 1ab90aa 15945->15946 15946->15909 15948 1ad7d5d 15947->15948 15948->15932 15950 1ab2ebb _vswprintf_s 15949->15950 15952 1ab2ece 15950->15952 15997 1af95d0 LdrInitializeThunk 15950->15997 15952->15915 15998 1ae16e0 15953->15998 15955 1ae1630 15959 1ae1691 15955->15959 16002 1ae16c7 15955->16002 15958 1ae165a 15958->15959 16009 1aea185 15958->16009 15959->15932 15961 1ad7d50 GetPEB 15960->15961 15962 1b4fec1 15961->15962 15963 1b4fec5 GetPEB 15962->15963 15964 1b4fed5 _vswprintf_s 15962->15964 15963->15964 16035 1afb640 15964->16035 15966 1b4fef8 15966->15932 15968 1b4fdff __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 15967->15968 15969 1b45720 _vswprintf_s 12 API calls 15968->15969 15970 1b4fe0f 15969->15970 15971 1b45720 _vswprintf_s 12 API calls 15970->15971 15972 1b4fe39 15971->15972 15972->15932 15974 1b4ffc8 _vswprintf_s 15973->15974 16112 1aee730 15974->16112 16123 1abb171 15981->16123 15985 1b37052 15984->15985 15986 1b37073 GetPEB 15985->15986 15992 1b37084 15985->15992 15986->15992 15987 1b37101 _vswprintf_s 15988 1b37136 15987->15988 15989 1b37125 GetPEB 15987->15989 15990 1afb640 _vswprintf_s 12 API calls 15988->15990 15989->15988 15991 1b37147 15990->15991 15991->15925 15992->15987 15992->15988 15993 1ad7d50 GetPEB 15992->15993 15994 1b370ec 15993->15994 15994->15987 15995 1b370f0 GetPEB 15994->15995 15995->15987 15996->15933 15997->15952 15999 1ae16ed 15998->15999 16000 1ae16f3 GetPEB 15999->16000 16001 1ae16f1 15999->16001 16000->16001 16001->15955 16003 1ae16da 16002->16003 16004 1b255f4 16002->16004 16003->15958 16014 1b6bbf0 16004->16014 16008 1b2560a 16010 1aea192 16009->16010 16011 1aea1a0 16009->16011 16010->15959 16011->16010 16012 1aea1b0 GetPEB 16011->16012 16013 1aea1c1 16012->16013 16013->15959 16015 1b6bc12 16014->16015 16016 1b255fb 16015->16016 16022 1b6c08a 16015->16022 16016->16008 16018 1b6bf33 16016->16018 16019 1b6bf4c 16018->16019 16021 1b6bf97 16019->16021 16030 1b6be9b 16019->16030 16021->16008 16023 1b6c0c6 16022->16023 16025 1b6c104 _vswprintf_s 16023->16025 16026 1b6bfdb 16023->16026 16025->16016 16027 1b6bfef 16026->16027 16029 1b6bfeb 16026->16029 16028 1b6bdfa LdrInitializeThunk 16027->16028 16027->16029 16028->16029 16029->16025 16032 1b6beb3 16030->16032 16031 1b6bf08 16031->16021 16032->16031 16034 1af9660 LdrInitializeThunk 16032->16034 16034->16031 16036 1afb64b 16035->16036 16037 1afb648 16035->16037 16040 1b6b590 16036->16040 16037->15966 16039 1afb74a _vswprintf_s 16039->15966 16043 1b6b260 16040->16043 16042 1b6b5a3 16042->16039 16101 1b0d08c 16043->16101 16045 1b6b26c GetPEB 16046 1b6b279 GetPEB 16045->16046 16048 1b6b293 16046->16048 16049 1b6b54b 16048->16049 16050 1b6b2ba 16048->16050 16051 1b6b48b 16048->16051 16057 1b6b56b _vswprintf_s 16049->16057 16102 1b40c30 16049->16102 16053 1b6b2c6 16050->16053 16054 1b6b414 16050->16054 16052 1b45720 _vswprintf_s 10 API calls 16051->16052 16055 1b6b49e 16052->16055 16058 1b6b2ce 16053->16058 16059 1b6b32d 16053->16059 16056 1b45720 _vswprintf_s 10 API calls 16054->16056 16066 1b45720 _vswprintf_s 10 API calls 16055->16066 16060 1b6b427 16056->16060 16057->16042 16062 1b6b2f3 16058->16062 16063 1b6b2da 16058->16063 16068 1b6b396 16059->16068 16074 1b6b34d 16059->16074 16097 1b6b2eb 16059->16097 16067 1b45720 _vswprintf_s 10 API calls 16060->16067 16065 1b45720 _vswprintf_s 10 API calls 16062->16065 16064 1b45720 _vswprintf_s 10 API calls 16063->16064 16064->16097 16070 1b6b302 16065->16070 16071 1b6b4c2 16066->16071 16073 1b6b43e 16067->16073 16072 1b45720 _vswprintf_s 10 API calls 16068->16072 16069 1b45720 _vswprintf_s 10 API calls 16075 1b6b4fd 16069->16075 16076 1b45720 _vswprintf_s 10 API calls 16070->16076 16077 1b6b4cc 16071->16077 16086 1b6b320 16071->16086 16078 1b6b3aa 16072->16078 16079 1b45720 _vswprintf_s 10 API calls 16073->16079 16080 1b45720 _vswprintf_s 10 API calls 16074->16080 16081 1b6b519 16075->16081 16088 1b45720 _vswprintf_s 10 API calls 16075->16088 16082 1b6b311 16076->16082 16083 1b45720 _vswprintf_s 10 API calls 16077->16083 16084 1b6b38f 16078->16084 16085 1b6b3b6 16078->16085 16079->16086 16087 1b6b361 16080->16087 16089 1b45720 _vswprintf_s 10 API calls 16081->16089 16090 1b45720 _vswprintf_s 10 API calls 16082->16090 16083->16097 16094 1b45720 _vswprintf_s 10 API calls 16084->16094 16091 1b45720 _vswprintf_s 10 API calls 16085->16091 16092 1b45720 _vswprintf_s 10 API calls 16086->16092 16086->16097 16087->16084 16093 1b6b371 16087->16093 16088->16081 16095 1b6b528 16089->16095 16090->16086 16096 1b6b3c5 16091->16096 16092->16097 16098 1b45720 _vswprintf_s 10 API calls 16093->16098 16094->16097 16095->16049 16100 1b45720 _vswprintf_s 10 API calls 16095->16100 16099 1b45720 _vswprintf_s 10 API calls 16096->16099 16097->16069 16098->16097 16099->16097 16100->16049 16101->16045 16103 1b40c50 16102->16103 16105 1b40c49 16102->16105 16104 1b4193b _vswprintf_s LdrInitializeThunk 16103->16104 16106 1b40c5e 16104->16106 16105->16057 16106->16105 16107 1b41c76 _vswprintf_s LdrInitializeThunk 16106->16107 16108 1b40c70 16107->16108 16109 1b40fec _vswprintf_s 12 API calls 16108->16109 16110 1b40c91 16109->16110 16111 1b4193b _vswprintf_s LdrInitializeThunk 16110->16111 16111->16105 16118 1af9670 16112->16118 16120 1af967a 16118->16120 16121 1af968f LdrInitializeThunk 16120->16121 16122 1af9681 16120->16122 16124 1abb180 _vswprintf_s 16123->16124 16125 1abb1b0 GetPEB 16124->16125 16132 1abb1c0 _vswprintf_s 16124->16132 16125->16132 16126 1b0d130 _vswprintf_s 10 API calls 16127 1abb1de 16126->16127 16127->15932 16129 1b14904 GetPEB 16130 1abb1d1 _vswprintf_s 16129->16130 16130->16126 16132->16129 16132->16130 16133 1afe2d0 16132->16133 16136 1afe2ed 16133->16136 16135 1afe2e8 16135->16132 16137 1afe30f 16136->16137 16138 1afe2fb 16136->16138 16140 1afe332 16137->16140 16141 1afe31e 16137->16141 16145 1afb58e 16138->16145 16150 1b02440 16140->16150 16142 1afb58e _vswprintf_s 12 API calls 16141->16142 16144 1afe307 _vswprintf_s 16142->16144 16144->16135 16146 1abb150 _vswprintf_s 12 API calls 16145->16146 16147 1afb627 16146->16147 16148 1afb640 _vswprintf_s 12 API calls 16147->16148 16149 1afb632 16148->16149 16149->16144 16151 1b0249a 16150->16151 16152 1b024af 16150->16152 16153 1afb58e _vswprintf_s 12 API calls 16151->16153 16154 1b024b7 16152->16154 16162 1b024cc __aulldvrm _vswprintf_s 16152->16162 16156 1b024a4 16153->16156 16155 1afb58e _vswprintf_s 12 API calls 16154->16155 16155->16156 16157 1afb640 _vswprintf_s 12 API calls 16156->16157 16158 1b02d6e 16157->16158 16158->16144 16159 1b02d4f 16161 1afb58e _vswprintf_s 12 API calls 16159->16161 16160 1b058ee 12 API calls __cftof 16160->16162 16161->16156 16162->16156 16162->16159 16162->16160 16164 1ab4dfa 16163->16164 16166 1ab4dd1 _vswprintf_s 16163->16166 16165 1ab2e9f LdrInitializeThunk 16164->16165 16165->16166 16168 1ab4df3 16166->16168 16185 1ab4f2e 16166->16185 16168->15892 16238 1b0d0e8 16169->16238 16171 1b4ff1c GetPEB 16172 1b4ff43 GetPEB 16171->16172 16173 1b4ff2b 16171->16173 16175 1b4ff6e 16172->16175 16176 1b4ff4f 16172->16176 16173->16172 16174 1b4ffb1 16173->16174 16178 1b0d130 _vswprintf_s 12 API calls 16174->16178 16177 1aee730 2 API calls 16175->16177 16179 1b45720 _vswprintf_s 12 API calls 16176->16179 16180 1b4ff7d _vswprintf_s 16177->16180 16181 1b4ffb6 16178->16181 16179->16175 16182 1b4ffa4 16180->16182 16183 1b4ff94 RtlDebugPrintTimes 16180->16183 16181->15890 16182->15890 16184 1b4ffa3 16183->16184 16184->15890 16186 1b10b85 16185->16186 16189 1ab4f3e 16185->16189 16187 1b10b8b GetPEB 16186->16187 16188 1b10b9a 16186->16188 16187->16188 16190 1b10b9f 16187->16190 16194 1b888f5 16188->16194 16189->16186 16192 1ab4f5b GetPEB 16189->16192 16192->16186 16193 1ab4f6e 16192->16193 16193->16168 16195 1b88901 _vswprintf_s 16194->16195 16200 1abcc50 16195->16200 16197 1b8891f _vswprintf_s 16198 1b0d130 _vswprintf_s 12 API calls 16197->16198 16199 1b88946 16198->16199 16199->16190 16201 1abcc79 16200->16201 16205 1abcc7e 16201->16205 16206 1aeb230 16201->16206 16202 1afb640 _vswprintf_s 12 API calls 16203 1abcc89 16202->16203 16203->16197 16205->16202 16207 1aeb26a 16206->16207 16208 1b2a2f6 16206->16208 16207->16208 16209 1b2a2fd 16207->16209 16214 1aeb2ab _vswprintf_s 16207->16214 16210 1aeb2b5 16209->16210 16224 1b85ba5 16209->16224 16210->16208 16211 1afb640 _vswprintf_s 12 API calls 16210->16211 16213 1aeb2d0 16211->16213 16213->16205 16214->16210 16216 1abccc0 16214->16216 16217 1abcd04 16216->16217 16218 1abcd95 16217->16218 16234 1abb150 16217->16234 16218->16210 16221 1abb150 _vswprintf_s 12 API calls 16222 1b14e14 16221->16222 16223 1abb150 _vswprintf_s 12 API calls 16222->16223 16223->16218 16225 1b85bb4 _vswprintf_s 16224->16225 16227 1b84c56 12 API calls 16225->16227 16231 1b85c2a _vswprintf_s 16225->16231 16232 1b85c10 16225->16232 16226 1b0d130 _vswprintf_s 12 API calls 16228 1b863e5 16226->16228 16227->16231 16228->16210 16230 1af6de6 33 API calls 16230->16231 16231->16230 16231->16232 16233 1b860cf GetPEB 16231->16233 16237 1af9710 LdrInitializeThunk 16231->16237 16232->16226 16233->16231 16235 1abb171 _vswprintf_s 12 API calls 16234->16235 16236 1abb16e 16235->16236 16236->16221 16237->16231 16238->16171 16239->15896 16240 1aefab0 16241 1aefb14 16240->16241 16242 1aefac2 16240->16242 16243 1aceef0 27 API calls 16242->16243 16244 1aefacd 16243->16244 16245 1aefadf 16244->16245 16249 1aefb18 16244->16249 16246 1aceb70 34 API calls 16245->16246 16247 1aefaf1 16246->16247 16247->16241 16248 1aefafa GetPEB 16247->16248 16248->16241 16250 1aefb09 16248->16250 16254 1b2bdcb 16249->16254 16276 1ac6d90 16249->16276 16286 1acff60 16250->16286 16258 1abb150 _vswprintf_s 12 API calls 16254->16258 16259 1b2be19 16254->16259 16271 1b2bea7 16254->16271 16255 1ac76e2 GetPEB 16256 1aefc4b 16255->16256 16257 1aefba7 16257->16256 16261 1aefbe4 16257->16261 16294 1aefd22 16257->16294 16258->16259 16259->16271 16306 1ac75ce 16259->16306 16261->16256 16263 1b2bf17 16261->16263 16264 1aefc47 16261->16264 16263->16256 16265 1aefd22 GetPEB 16263->16265 16264->16256 16266 1aefd22 GetPEB 16264->16266 16267 1b2bf22 16265->16267 16268 1aefcb2 16266->16268 16267->16256 16272 1aefd9b 3 API calls 16267->16272 16268->16256 16298 1aefd9b 16268->16298 16269 1b2be92 16269->16271 16275 1ac76e2 GetPEB 16269->16275 16270 1b2be54 16270->16256 16270->16269 16310 1ac76e2 16270->16310 16271->16255 16271->16256 16272->16256 16275->16271 16277 1ac6dba 16276->16277 16280 1ac6da4 16276->16280 16314 1af2e1c 16277->16314 16279 1ac6dbf 16281 1aceef0 27 API calls 16279->16281 16280->16254 16280->16256 16280->16257 16282 1ac6dca 16281->16282 16283 1ac6dde 16282->16283 16319 1abdb60 16282->16319 16285 1aceb70 34 API calls 16283->16285 16285->16280 16287 1acff6d 16286->16287 16288 1acff99 16286->16288 16287->16288 16291 1acff80 GetPEB 16287->16291 16289 1b888f5 34 API calls 16288->16289 16290 1acff94 16289->16290 16290->16241 16291->16288 16292 1acff8f 16291->16292 16431 1ad0050 16292->16431 16295 1aefd31 _vswprintf_s 16294->16295 16296 1aefd3a 16294->16296 16295->16261 16296->16295 16467 1ac7608 16296->16467 16299 1aefdba GetPEB 16298->16299 16300 1aefdcc 16298->16300 16299->16300 16301 1aefdf2 16300->16301 16302 1b2c0bd 16300->16302 16305 1aefdfc 16300->16305 16303 1ac76e2 GetPEB 16301->16303 16301->16305 16304 1b2c0d3 GetPEB 16302->16304 16302->16305 16303->16305 16304->16305 16305->16256 16307 1ac75db 16306->16307 16308 1ac75eb 16306->16308 16307->16308 16309 1ac7608 GetPEB 16307->16309 16308->16270 16309->16308 16311 1ac76fd 16310->16311 16312 1ac76e6 16310->16312 16311->16269 16312->16311 16313 1ac76ec GetPEB 16312->16313 16313->16311 16315 1af2e32 16314->16315 16316 1af2e57 16315->16316 16327 1af9840 LdrInitializeThunk 16315->16327 16316->16279 16318 1b2df2e 16320 1abdb91 16319->16320 16321 1abdb6d 16319->16321 16320->16283 16321->16320 16328 1abdb40 GetPEB 16321->16328 16323 1abdb76 16323->16320 16330 1abe7b0 16323->16330 16325 1abdb87 16325->16320 16326 1b14fa6 GetPEB 16325->16326 16326->16320 16327->16318 16329 1abdb52 16328->16329 16329->16323 16331 1abe7e0 16330->16331 16332 1abe7ce 16330->16332 16333 1abe7e8 16331->16333 16336 1abb150 _vswprintf_s 12 API calls 16331->16336 16332->16333 16338 1ac3d34 16332->16338 16337 1abe7f6 16333->16337 16377 1abdca4 16333->16377 16336->16333 16337->16325 16339 1ac3d6c 16338->16339 16340 1b18213 16338->16340 16393 1ac1b8f 16339->16393 16344 1b1822b GetPEB 16340->16344 16364 1ac4068 16340->16364 16342 1ac3d81 16342->16340 16343 1ac3d89 16342->16343 16345 1ac1b8f 2 API calls 16343->16345 16344->16364 16346 1ac3d9e 16345->16346 16347 1ac3dba 16346->16347 16348 1ac3da2 GetPEB 16346->16348 16349 1ac1b8f 2 API calls 16347->16349 16348->16347 16350 1ac3dd2 16349->16350 16352 1ac3e91 16350->16352 16356 1ac3deb GetPEB 16350->16356 16350->16364 16351 1b18344 GetPEB 16353 1ac407a 16351->16353 16355 1ac1b8f 2 API calls 16352->16355 16354 1ac4085 16353->16354 16358 1b18363 GetPEB 16353->16358 16354->16331 16357 1ac3ea9 16355->16357 16370 1ac3dfc _vswprintf_s 16356->16370 16359 1ac3f6a 16357->16359 16361 1ac3ec2 GetPEB 16357->16361 16357->16364 16358->16354 16360 1ac1b8f 2 API calls 16359->16360 16362 1ac3f82 16360->16362 16374 1ac3ed3 _vswprintf_s 16361->16374 16363 1ac3f9b GetPEB 16362->16363 16362->16364 16376 1ac3fac _vswprintf_s 16363->16376 16364->16351 16364->16353 16365 1ac3e74 16365->16352 16367 1ac3e81 GetPEB 16365->16367 16366 1ac3e62 GetPEB 16366->16365 16367->16352 16368 1ac3f3b GetPEB 16369 1ac3f4d 16368->16369 16369->16359 16371 1ac3f5a GetPEB 16369->16371 16370->16364 16370->16365 16370->16366 16371->16359 16372 1ac404f 16372->16364 16375 1ac4058 GetPEB 16372->16375 16373 1b18324 GetPEB 16373->16364 16374->16364 16374->16368 16374->16369 16375->16364 16376->16364 16376->16372 16376->16373 16379 1abdcfd 16377->16379 16391 1abdd6f _vswprintf_s 16377->16391 16378 1abdd47 16408 1abdbb1 16378->16408 16379->16378 16387 1abdfc2 16379->16387 16399 1abe620 16379->16399 16381 1b14ff2 16381->16381 16383 1abdfae 16383->16387 16421 1af95d0 LdrInitializeThunk 16383->16421 16388 1afb640 _vswprintf_s 12 API calls 16387->16388 16390 1abdfe4 16388->16390 16390->16337 16391->16381 16391->16383 16391->16387 16415 1abe375 16391->16415 16420 1af95d0 LdrInitializeThunk 16391->16420 16397 1ac1ba9 _vswprintf_s 16393->16397 16398 1ac1c05 16393->16398 16394 1b1701a GetPEB 16395 1ac1c21 16394->16395 16395->16342 16396 1ac1bf4 GetPEB 16396->16398 16397->16395 16397->16396 16397->16398 16398->16394 16398->16395 16400 1b15503 16399->16400 16401 1abe644 16399->16401 16401->16400 16422 1abf358 16401->16422 16403 1abe661 _vswprintf_s 16404 1abe725 16403->16404 16426 1af95d0 LdrInitializeThunk 16403->16426 16406 1abe73b 16404->16406 16407 1abe729 GetPEB 16404->16407 16406->16378 16407->16406 16427 1ac766d 16408->16427 16410 1abdbcf 16410->16391 16411 1abdbf1 16410->16411 16412 1abdc05 16411->16412 16413 1ac766d GetPEB 16412->16413 16414 1abdc22 16413->16414 16414->16391 16416 1abe3a3 16415->16416 16417 1b15306 16416->16417 16418 1afb640 _vswprintf_s 12 API calls 16416->16418 16419 1abe400 16418->16419 16419->16391 16420->16391 16421->16387 16423 1abf370 16422->16423 16424 1abf379 GetPEB 16423->16424 16425 1abf38c 16423->16425 16424->16425 16425->16403 16426->16404 16429 1ac7687 16427->16429 16428 1ac76d3 16428->16410 16429->16428 16430 1ac76c2 GetPEB 16429->16430 16430->16428 16432 1ad0074 16431->16432 16433 1ad009d GetPEB 16432->16433 16446 1ad00f8 16432->16446 16434 1b1c01b 16433->16434 16435 1ad00d0 16433->16435 16434->16435 16438 1b1c024 GetPEB 16434->16438 16439 1ad00df 16435->16439 16440 1b1c037 16435->16440 16436 1afb640 _vswprintf_s 12 API calls 16437 1ad0105 16436->16437 16437->16290 16438->16435 16447 1ae9702 16439->16447 16451 1b88a62 16440->16451 16443 1b1c04b 16443->16443 16444 1ad00ef 16445 1ad0109 RtlDebugPrintTimes 16444->16445 16444->16446 16445->16446 16446->16436 16448 1ae9720 16447->16448 16450 1ae9784 16448->16450 16458 1b88214 16448->16458 16450->16444 16452 1ad7d50 GetPEB 16451->16452 16453 1b88a9d 16452->16453 16454 1b88aa1 GetPEB 16453->16454 16455 1b88ab1 _vswprintf_s 16453->16455 16454->16455 16456 1afb640 _vswprintf_s 12 API calls 16455->16456 16457 1b88ad7 16456->16457 16457->16443 16460 1b8823b 16458->16460 16459 1b882c0 16459->16450 16460->16459 16462 1ae3b7a GetPEB 16460->16462 16466 1ae3bb5 _vswprintf_s 16462->16466 16463 1b26298 16464 1ae3c1b GetPEB 16465 1ae3c35 16464->16465 16465->16459 16466->16463 16466->16464 16466->16466 16468 1ac7620 16467->16468 16469 1ac766d GetPEB 16468->16469 16470 1ac7632 16469->16470 16470->16295 16498 1af35b1 16499 1af35f2 16498->16499 16500 1af35ca 16498->16500 16500->16499 16501 1ac7608 GetPEB 16500->16501 16501->16499 16472 1af9670 16473 1af967a _vswprintf_s LdrInitializeThunk 16472->16473 16502 1b70a28 16503 1b70a57 16502->16503 16504 1b70a4d 16502->16504 16506 1ae4e70 16503->16506 16507 1ae4ec0 16506->16507 16509 1ae4e94 16506->16509 16508 1ae4ed6 RtlDebugPrintTimes 16507->16508 16513 1ae4eeb 16507->16513 16508->16513 16510 1afb640 _vswprintf_s 12 API calls 16509->16510 16511 1ae4eac 16510->16511 16511->16504 16513->16509 16514 1b68df1 16513->16514 16522 1b0d0e8 16514->16522 16516 1b68dfd GetPEB 16517 1b68e10 16516->16517 16518 1b45720 _vswprintf_s 12 API calls 16517->16518 16519 1b68e2f _vswprintf_s 16517->16519 16518->16519 16520 1b0d130 _vswprintf_s 12 API calls 16519->16520 16521 1b68ebd 16520->16521 16521->16509 16522->16516 16523 1b3b111 16524 1b3b131 16523->16524 16525 1b3b143 16523->16525 16527 1b421b7 16524->16527 16530 1afe3a0 16527->16530 16533 1afe3bd 16530->16533 16532 1afe3b8 16532->16525 16534 1afe3cc 16533->16534 16535 1afe3e3 16533->16535 16536 1afb58e _vswprintf_s 12 API calls 16534->16536 16537 1afb58e _vswprintf_s 12 API calls 16535->16537 16538 1afe3d8 _vswprintf_s 16535->16538 16536->16538 16537->16538 16538->16532 16657 1ae36cc 16658 1ae36e6 16657->16658 16659 1ae36d4 GetPEB 16657->16659 16660 1ae36e5 16659->16660 16661 1ab9240 16662 1ab924c _vswprintf_s 16661->16662 16663 1ab925f 16662->16663 16679 1af95d0 LdrInitializeThunk 16662->16679 16680 1ab9335 16663->16680 16667 1ab9335 LdrInitializeThunk 16668 1ab9276 16667->16668 16685 1af95d0 LdrInitializeThunk 16668->16685 16670 1ab927e GetPEB 16671 1ad77f0 16670->16671 16672 1ab929a GetPEB 16671->16672 16673 1ad77f0 16672->16673 16674 1ab92b6 GetPEB 16673->16674 16676 1ab92d2 16674->16676 16675 1ab9330 16676->16675 16677 1ab9305 GetPEB 16676->16677 16678 1ab931f _vswprintf_s 16677->16678 16679->16663 16686 1af95d0 LdrInitializeThunk 16680->16686 16682 1ab9342 16687 1af95d0 LdrInitializeThunk 16682->16687 16684 1ab926b 16684->16667 16685->16670 16686->16682 16687->16684 16539 1b6239a 16540 1b623d5 _vswprintf_s 16539->16540 16541 1afb640 _vswprintf_s 12 API calls 16540->16541 16542 1b623df 16541->16542 16476 1af9540 LdrInitializeThunk 16543 1ab1e04 16544 1ab1e10 _vswprintf_s 16543->16544 16546 1ab1e37 _vswprintf_s 16544->16546 16548 1b7a80d 16544->16548 16549 1b0f18b 16548->16549 16550 1b7a81c 16548->16550 16552 1b6ff41 16550->16552 16553 1b6ff4d _vswprintf_s 16552->16553 16554 1b6ffaf _vswprintf_s 16553->16554 16556 1b72073 16553->16556 16554->16549 16566 1b6fd22 16556->16566 16558 1b7207d 16559 1b72085 16558->16559 16560 1b720a4 16558->16560 16561 1b68df1 13 API calls 16559->16561 16565 1b720be 16560->16565 16569 1b71c06 GetPEB 16560->16569 16562 1b720a2 16561->16562 16562->16554 16565->16554 16567 1af9670 _vswprintf_s LdrInitializeThunk 16566->16567 16568 1b6fd3d 16567->16568 16568->16558 16570 1b71c20 GetPEB 16569->16570 16571 1b71c3d 16569->16571 16572 1abb150 _vswprintf_s 12 API calls 16570->16572 16573 1abb150 _vswprintf_s 12 API calls 16571->16573 16574 1b71c3a 16572->16574 16573->16574 16575 1abb150 _vswprintf_s 12 API calls 16574->16575 16576 1b71c5a GetPEB 16575->16576 16578 1b71ce7 GetPEB 16576->16578 16579 1b71d04 16576->16579 16580 1abb150 _vswprintf_s 12 API calls 16578->16580 16581 1abb150 _vswprintf_s 12 API calls 16579->16581 16582 1b71d01 16580->16582 16581->16582 16583 1abb150 _vswprintf_s 12 API calls 16582->16583 16584 1b71d1c 16583->16584 16585 1b71d27 GetPEB 16584->16585 16586 1b71d66 16584->16586 16587 1b71d32 GetPEB 16585->16587 16588 1b71d4f 16585->16588 16589 1b71daf 16586->16589 16590 1b71d70 GetPEB 16586->16590 16592 1abb150 _vswprintf_s 12 API calls 16587->16592 16593 1abb150 _vswprintf_s 12 API calls 16588->16593 16591 1b71db9 GetPEB 16589->16591 16621 1b71df8 16589->16621 16594 1b71d7b GetPEB 16590->16594 16595 1b71d98 16590->16595 16599 1b71dc4 GetPEB 16591->16599 16600 1b71de1 16591->16600 16598 1b71d4c 16592->16598 16593->16598 16601 1abb150 _vswprintf_s 12 API calls 16594->16601 16597 1abb150 _vswprintf_s 12 API calls 16595->16597 16596 1b71e0a GetPEB 16606 1b71e15 GetPEB 16596->16606 16607 1b71e32 16596->16607 16602 1b71d95 16597->16602 16608 1abb150 _vswprintf_s 12 API calls 16598->16608 16603 1abb150 _vswprintf_s 12 API calls 16599->16603 16604 1abb150 _vswprintf_s 12 API calls 16600->16604 16601->16602 16609 1abb150 _vswprintf_s 12 API calls 16602->16609 16612 1b71dde 16603->16612 16604->16612 16605 1b71e52 GetPEB 16613 1b71e5d GetPEB 16605->16613 16614 1b71e7a 16605->16614 16610 1abb150 _vswprintf_s 12 API calls 16606->16610 16611 1abb150 _vswprintf_s 12 API calls 16607->16611 16608->16586 16609->16589 16617 1b71e2f 16610->16617 16611->16617 16616 1abb150 _vswprintf_s 12 API calls 16612->16616 16618 1abb150 _vswprintf_s 12 API calls 16613->16618 16615 1abb150 _vswprintf_s 12 API calls 16614->16615 16620 1b71e77 16615->16620 16616->16621 16619 1abb150 _vswprintf_s 12 API calls 16617->16619 16618->16620 16623 1b71e4f 16619->16623 16622 1abb150 _vswprintf_s 12 API calls 16620->16622 16621->16596 16621->16605 16624 1b71e90 GetPEB 16622->16624 16623->16605 16624->16565 16625 1b6d380 16626 1b6d393 16625->16626 16627 1b6d38c 16625->16627 16628 1b6d3a0 GetPEB 16626->16628 16628->16627 16629 1ab1190 16630 1ab11a0 16629->16630 16632 1ab11be 16629->16632 16630->16632 16633 1ab11e0 16630->16633 16636 1ab1204 16633->16636 16634 1afb640 _vswprintf_s 12 API calls 16635 1ab1296 16634->16635 16635->16632 16636->16634 16688 1b037cc 16689 1b037db 16688->16689 16691 1b037ea 16689->16691 16692 1b0590b 16689->16692 16693 1b05917 16692->16693 16696 1b0592d 16692->16696 16694 1afb58e _vswprintf_s 12 API calls 16693->16694 16695 1b05923 16694->16695 16695->16691 16696->16691

                                        Executed Functions

                                        Function 01AF99A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 15 1af99a0-1af99ac LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: ff34910e71399b6bf793d421fcd22b1eb626f124d03adfcc354275408e499e7a
                                        • Instruction ID: a05dca2d18a0e4c348b119bd1cefed6220597157ec9cbaebaf80be52068b7716
                                        • Opcode Fuzzy Hash: ff34910e71399b6bf793d421fcd22b1eb626f124d03adfcc354275408e499e7a
                                        • Instruction Fuzzy Hash: 829002A234100442D11561D94414B060405E7E1341F51C059E106455CDC799CC627166
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 14 1af9910-1af991c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 7dc65a0b8da0d20cdeddebf3047d31040e488a9c6043a84cc0e394d90421bde7
                                        • Instruction ID: fe6ce725115bd297479695f41078486963d96e397aa41f4273500d8bcd991d2a
                                        • Opcode Fuzzy Hash: 7dc65a0b8da0d20cdeddebf3047d31040e488a9c6043a84cc0e394d90421bde7
                                        • Instruction Fuzzy Hash: AE9002B220100402D15571D944047460405A7D0341F51C055A506455CEC7D98DE576A5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF98F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 13 1af98f0-1af98fc LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: b0bc641663b6352b794c5b25737207452565cdae2bda9e7e2d42873e5437b588
                                        • Instruction ID: f691699e33de6f1f9b393a8ed87488b11ef445474cb02a4d016a3071198a2507
                                        • Opcode Fuzzy Hash: b0bc641663b6352b794c5b25737207452565cdae2bda9e7e2d42873e5437b588
                                        • Instruction Fuzzy Hash: 6E90026260100502D11671D94404616040AA7D0281F91C066A102455DECBA589A2B171
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 12 1af9860-1af986c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 763d0f77e6090dbf3773608593865e4ab018f04bf59906922fb56fcf99bd386d
                                        • Instruction ID: 662f2c732ab4f4647162cd11f40601b4d106b4c6bc5d6cde4f541fcc0e977e9c
                                        • Opcode Fuzzy Hash: 763d0f77e6090dbf3773608593865e4ab018f04bf59906922fb56fcf99bd386d
                                        • Instruction Fuzzy Hash: E690027220100413D12661D945047070409A7D0281F91C456A042455CDD7D68962B161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 11 1af9840-1af984c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 8c89c0700114aee78bc5b2d4b026accad9f4d920eeda558dd585acade57c6169
                                        • Instruction ID: e816a6e6c2188c3a2b5df05a2f43e9b652e55c582c0a10ed2bd52873ad1f6457
                                        • Opcode Fuzzy Hash: 8c89c0700114aee78bc5b2d4b026accad9f4d920eeda558dd585acade57c6169
                                        • Instruction Fuzzy Hash: 5990026224204152555AB1D944045074406B7E0281791C056A1414958CC6A69866E661
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9A20 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 17 1af9a20-1af9a2c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 6c008c28ec6ad46bb3f35858876f21c6dedeed6fe7922672bdafc9b602e5bcc8
                                        • Instruction ID: d6784142976a9127db5920d80932fad6e3970c71d7fc0f2db9f1adb66d440499
                                        • Opcode Fuzzy Hash: 6c008c28ec6ad46bb3f35858876f21c6dedeed6fe7922672bdafc9b602e5bcc8
                                        • Instruction Fuzzy Hash: 9790026260100042415571E988449064405BBE1251751C165A0998558DC6D9887566A5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9A00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 16 1af9a00-1af9a0c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: b36723f41e72ec3cd2ee09bfa73f74f9e335a7f36ad6c3a0d8235c20f70d30f7
                                        • Instruction ID: 98a8fd2545824c3f9fcb02b79d8d7a61a9f99a3bca6bf14da30a3d4e45d397e3
                                        • Opcode Fuzzy Hash: b36723f41e72ec3cd2ee09bfa73f74f9e335a7f36ad6c3a0d8235c20f70d30f7
                                        • Instruction Fuzzy Hash: 9E90027220140402D11561D9481470B0405A7D0342F51C055A116455DDC7A5886175B1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: dc73fe174b91d0730ef2274061aabb3ba56ea490e4f225480d0948c08feb220b
                                        • Instruction ID: 7b7b104d834589a2ee486ce543b3bdc7e02966bdd0692bee94f9b2db6b1c6ad0
                                        • Opcode Fuzzy Hash: dc73fe174b91d0730ef2274061aabb3ba56ea490e4f225480d0948c08feb220b
                                        • Instruction Fuzzy Hash: 1A90026221180042D21565E94C14B070405A7D0343F51C159A015455CCCA9588716561
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF95D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 5 1af95d0-1af95dc LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 42b6c84b468c51ddc454ecb6652126b54618ed29b37edde1d0e6ac6301d79750
                                        • Instruction ID: 10b34423553418fe4d8f54392f24b078750063370d0ad69f233b484184505384
                                        • Opcode Fuzzy Hash: 42b6c84b468c51ddc454ecb6652126b54618ed29b37edde1d0e6ac6301d79750
                                        • Instruction Fuzzy Hash: AD9002A220200003411A71D94414616440AA7E0241B51C065E1014598DC6A588A17165
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 4 1af9540-1af954c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 58cbec1f21506c373e0b9f70005fab8b2a8ecc3fd7932026756d39c4eb0c8e4a
                                        • Instruction ID: 0aba461734ec994a6cd8c17132fd854436223a6d6f49fe3bef15f3e8f61faeae
                                        • Opcode Fuzzy Hash: 58cbec1f21506c373e0b9f70005fab8b2a8ecc3fd7932026756d39c4eb0c8e4a
                                        • Instruction Fuzzy Hash: 1C90026621100003011AA5D907045070446A7D5391351C065F1015558CD7A188716161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF97A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 10 1af97a0-1af97ac LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 8937b9682d4680c416601369a2a4edc7a8c3d685f6ea1e0efe5b1d5b8d70cd1c
                                        • Instruction ID: 3b7abb7630fd957e1242a6d2312f5060e960089e4ebc2a358e8a1e87038ded3b
                                        • Opcode Fuzzy Hash: 8937b9682d4680c416601369a2a4edc7a8c3d685f6ea1e0efe5b1d5b8d70cd1c
                                        • Instruction Fuzzy Hash: 0C90026230100003D15571D954186064405F7E1341F51D055E041455CCDA9588666262
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 9 1af9780-1af978c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 26e11c05f380e65b21dd352fd7089515b5c432a0e4af0f9c35dbdce7a292e9d5
                                        • Instruction ID: b5cc76aedd17d89a984ee751d6a96ee25fb9a78ee08f14230e17155fec4bd0e1
                                        • Opcode Fuzzy Hash: 26e11c05f380e65b21dd352fd7089515b5c432a0e4af0f9c35dbdce7a292e9d5
                                        • Instruction Fuzzy Hash: 7990026A21300002D19571D9540860A0405A7D1242F91D459A001555CCCA9588796361
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 5e7a188c0eaee9d826e7812f7250036203942d207b41453f87cfc1f9184c6e75
                                        • Instruction ID: a7ac63c1a44673d48ff6c20717f34f99497bdf4eb87af25b5c8c9d38163de233
                                        • Opcode Fuzzy Hash: 5e7a188c0eaee9d826e7812f7250036203942d207b41453f87cfc1f9184c6e75
                                        • Instruction Fuzzy Hash: 1090027231114402D12561D984047060405A7D1241F51C455A082455CDC7D588A17162
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 8 1af9710-1af971c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: a33bdee19fd0b7254b2c34f8bcac17224b40b9233a48c743ef87b8597cde5fa2
                                        • Instruction ID: c293e3c4fa20ee97f70e85f478db121d40fc42d0710e0b34059b77a0a9db53b4
                                        • Opcode Fuzzy Hash: a33bdee19fd0b7254b2c34f8bcac17224b40b9233a48c743ef87b8597cde5fa2
                                        • Instruction Fuzzy Hash: B990027220100402D11565D954086460405A7E0341F51D055A502455DEC7E588A17171
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF96E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 7 1af96e0-1af96ec LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 953723aac0640c0a59961a12b132d60bc2014c790f869e77a7fd51b4d16170bd
                                        • Instruction ID: 3cfbbc4022cc41fa9735f1c9c418b4b25fe974bd2781e5774756dc2da5c56848
                                        • Opcode Fuzzy Hash: 953723aac0640c0a59961a12b132d60bc2014c790f869e77a7fd51b4d16170bd
                                        • Instruction Fuzzy Hash: E890027220108802D12561D9840474A0405A7D0341F55C455A442465CDC7D588A17161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 6 1af9660-1af966c LdrInitializeThunk
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: f2163cf389b570312d20a82b05526d71566038476cba7631db86a012b33349f1
                                        • Instruction ID: 2673acd77baeaad1bf8ac15b9750673ba4c3d973122b5db9131affb249a1513c
                                        • Opcode Fuzzy Hash: f2163cf389b570312d20a82b05526d71566038476cba7631db86a012b33349f1
                                        • Instruction Fuzzy Hash: 2B90027220100802D19571D9440464A0405A7D1341F91C059A002565CDCB958A6977E1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 0 1af967a-1af967f 1 1af968f-1af9696 LdrInitializeThunk 0->1 2 1af9681-1af9688 0->2
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 1c48e1f064b761fae4289bef0d2e864d7cc54cdfc45b463ab4950ae11febefb1
                                        • Instruction ID: 7026d7097bf5fdd5caaaae8531f8f31da3054cf029c980a6f470b6ec9f93006c
                                        • Opcode Fuzzy Hash: 1c48e1f064b761fae4289bef0d2e864d7cc54cdfc45b463ab4950ae11febefb1
                                        • Instruction Fuzzy Hash: 9EB09B729014C5C5D656D7E546087177E007BD0745F16C055F2030645B8778C091F5B6
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004207E1 Relevance: .0, Instructions: 12COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.560832932.0000000000420000.00000040.00000400.00020000.00000000.sdmp, Offset: 00420000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_420000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 929beaed355f7942d3d2bbdce9769aef50be6738abdff7cb82ff7c69f8d3518c
                                        • Instruction ID: 53c7bef5a76be7e34b3e3c1bb344494d07a7689ecd5f9096a30e08090c4e3d3d
                                        • Opcode Fuzzy Hash: 929beaed355f7942d3d2bbdce9769aef50be6738abdff7cb82ff7c69f8d3518c
                                        • Instruction Fuzzy Hash: 43C08C2145EB8B168A26F2BE1D66193BF4D0992028B8C83E9AF98460D3E746C83101E7
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004207F0 Relevance: .0, Instructions: 7COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.560832932.0000000000420000.00000040.00000400.00020000.00000000.sdmp, Offset: 00420000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_420000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6273e0d6cc52ef251a37ce67887362a7d1e6b1bb604896cf83aa7f776474ed6b
                                        • Instruction ID: 5fce7ad16b1a93d6844339fe2a13d0436d9d47e0b73b554ad55db6175adc7614
                                        • Opcode Fuzzy Hash: 6273e0d6cc52ef251a37ce67887362a7d1e6b1bb604896cf83aa7f776474ed6b
                                        • Instruction Fuzzy Hash: C7A02238C8830C03002030FA2E03023BB0C8000808F0003EABC0C02202BC02A83000EB
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Non-executed Functions

                                        Function 01B6B260 Relevance: 37.8, Strings: 30, Instructions: 262COMMONLIBRARYCODE
                                        Download Yara Rule
                                        Strings
                                        • *** A stack buffer overrun occurred in %ws:%s, xrefs: 01B6B2F3
                                        • *** An Access Violation occurred in %ws:%s, xrefs: 01B6B48F
                                        • This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 01B6B47D
                                        • If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 01B6B314
                                        • *** Inpage error in %ws:%s, xrefs: 01B6B418
                                        • *** Critical Section Timeout (%p) in %ws:%s, xrefs: 01B6B39B
                                        • an invalid address, %p, xrefs: 01B6B4CF
                                        • *** enter .exr %p for the exception record, xrefs: 01B6B4F1
                                        • read from, xrefs: 01B6B4AD, 01B6B4B2
                                        • The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 01B6B3D6
                                        • This means that the I/O device reported an I/O error. Check your hardware., xrefs: 01B6B476
                                        • *** enter .cxr %p for the context, xrefs: 01B6B50D
                                        • *** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 01B6B53F
                                        • The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 01B6B323
                                        • The instruction at %p referenced memory at %p., xrefs: 01B6B432
                                        • *** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 01B6B2DC
                                        • Go determine why that thread has not released the critical section., xrefs: 01B6B3C5
                                        • *** then kb to get the faulting stack, xrefs: 01B6B51C
                                        • The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 01B6B38F
                                        • a NULL pointer, xrefs: 01B6B4E0
                                        • This failed because of error %Ix., xrefs: 01B6B446
                                        • This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 01B6B305
                                        • The resource is owned exclusively by thread %p, xrefs: 01B6B374
                                        • This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 01B6B484
                                        • The resource is owned shared by %d threads, xrefs: 01B6B37E
                                        • The instruction at %p tried to %s , xrefs: 01B6B4B6
                                        • The critical section is owned by thread %p., xrefs: 01B6B3B9
                                        • *** Resource timeout (%p) in %ws:%s, xrefs: 01B6B352
                                        • <unknown>, xrefs: 01B6B27E, 01B6B2D1, 01B6B350, 01B6B399, 01B6B417, 01B6B48E
                                        • write to, xrefs: 01B6B4A6
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
                                        • API String ID: 0-108210295
                                        • Opcode ID: 940114e4cb73cce7c74d94c489923b230d9569c0d7845e848dc9a2fab2749f10
                                        • Instruction ID: 0c64ca6ae685265ce5545db72a14325c6ff597639bf3248107e45a754387875b
                                        • Opcode Fuzzy Hash: 940114e4cb73cce7c74d94c489923b230d9569c0d7845e848dc9a2fab2749f10
                                        • Instruction Fuzzy Hash: 2881F571B40210FFDB29AA4ACD85D7B3F39EF66B51F8040D8F604AB112D3698512D6B2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B71C06 Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 44%
                                        			E01B71C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x1a948a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E01ABB150();
				} else {
					E01ABB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x1ba589c);
				E01ABB150("Heap error detected at %p (heap handle %p)\n",  *0x1ba58a0);
				_t27 =  *0x1ba5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M01B71E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E01ABB150();
				} else {
					E01ABB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E01ABB150("Error code: %d - %s\n",  *0x1ba5898);
				_t113 =  *0x1ba58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E01ABB150();
					} else {
						E01ABB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E01ABB150("Parameter1: %p\n",  *0x1ba58a4);
				}
				_t115 =  *0x1ba58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E01ABB150();
					} else {
						E01ABB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E01ABB150("Parameter2: %p\n",  *0x1ba58a8);
				}
				_t117 =  *0x1ba58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E01ABB150();
					} else {
						E01ABB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E01ABB150("Parameter3: %p\n",  *0x1ba58ac);
				}
				_t119 =  *0x1ba58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E01ABB150();
					} else {
						E01ABB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x1ba58b4);
					E01ABB150("Last known valid blocks: before - %p, after - %p\n",  *0x1ba58b0);
				} else {
					_t120 =  *0x1ba58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E01ABB150();
				} else {
					E01ABB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E01ABB150("Stack trace available at %p\n", 0x1ba58c0);
			}











                                        0x01b71c10
                                        0x01b71c16
                                        0x01b71c1e
                                        0x01b71c3d
                                        0x01b71c3e
                                        0x01b71c20
                                        0x01b71c35
                                        0x01b71c3a
                                        0x01b71c44
                                        0x01b71c55
                                        0x01b71c5a
                                        0x01b71c65
                                        0x01b71c67
                                        0x00000000
                                        0x01b71c6e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b71c67
                                        0x01b71cdc
                                        0x01b71ce5
                                        0x01b71d04
                                        0x01b71d05
                                        0x01b71ce7
                                        0x01b71cfc
                                        0x01b71d01
                                        0x01b71d0b
                                        0x01b71d17
                                        0x01b71d1f
                                        0x01b71d25
                                        0x01b71d30
                                        0x01b71d4f
                                        0x01b71d50
                                        0x01b71d32
                                        0x01b71d47
                                        0x01b71d4c
                                        0x01b71d61
                                        0x01b71d67
                                        0x01b71d68
                                        0x01b71d6e
                                        0x01b71d79
                                        0x01b71d98
                                        0x01b71d99
                                        0x01b71d7b
                                        0x01b71d90
                                        0x01b71d95
                                        0x01b71daa
                                        0x01b71db0
                                        0x01b71db1
                                        0x01b71db7
                                        0x01b71dc2
                                        0x01b71de1
                                        0x01b71de2
                                        0x01b71dc4
                                        0x01b71dd9
                                        0x01b71dde
                                        0x01b71df3
                                        0x01b71df9
                                        0x01b71dfa
                                        0x01b71e00
                                        0x01b71e0a
                                        0x01b71e13
                                        0x01b71e32
                                        0x01b71e33
                                        0x01b71e15
                                        0x01b71e2a
                                        0x01b71e2f
                                        0x01b71e39
                                        0x01b71e4a
                                        0x01b71e02
                                        0x01b71e02
                                        0x01b71e08
                                        0x00000000
                                        0x00000000
                                        0x01b71e08
                                        0x01b71e5b
                                        0x01b71e7a
                                        0x01b71e7b
                                        0x01b71e5d
                                        0x01b71e72
                                        0x01b71e77
                                        0x01b71e95

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                        • API String ID: 0-2897834094
                                        • Opcode ID: 3889b41f2f4482e93fd89dfb4dba3223a855ca813bb39d6045354573a136fac7
                                        • Instruction ID: 6315b91de4c9d7e0219eef16c1ce1d5f260c32ae3f6073b9b254de66ca3a1e43
                                        • Opcode Fuzzy Hash: 3889b41f2f4482e93fd89dfb4dba3223a855ca813bb39d6045354573a136fac7
                                        • Instruction Fuzzy Hash: 8261A232525285EFD729EB9DE585E2473ECEB04930B4981AEF51E5F302D7249C808F7A
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE8E00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 126timeCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 44%
                                        			E01AE8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x1bad360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1ba8464; // 0x76d90110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1ba5780 & 0x00000003) != 0) {
							E01B35510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1ba5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E01AFB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1ba7984; // 0x1572b10
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1ba8464; // 0x76d90110
					 *0x1bab1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E01AE9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1ba5780 & 0x00000005) != 0) {
						_push(_t49);
						E01B35510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}




















                                        0x01ae8e0f
                                        0x01ae8e16
                                        0x01ae8e19
                                        0x01ae8e1b
                                        0x01ae8e21
                                        0x01ae8e7f
                                        0x01ae8e85
                                        0x01b29354
                                        0x01b2936c
                                        0x01b29371
                                        0x01b2937b
                                        0x01b29381
                                        0x01b29381
                                        0x01b2937b
                                        0x01ae8e9d
                                        0x01ae8e9d
                                        0x01ae8e29
                                        0x01ae8e2c
                                        0x01ae8e38
                                        0x01ae8e3e
                                        0x01ae8e43
                                        0x01ae8eb5
                                        0x01ae8eb9
                                        0x01b292aa
                                        0x01b292af
                                        0x01b292e8
                                        0x01b292e8
                                        0x01b292af
                                        0x01ae8eb9
                                        0x01ae8e45
                                        0x01ae8e53
                                        0x01ae8e5b
                                        0x01ae8e5f
                                        0x01ae8e78
                                        0x01ae8e78
                                        0x01ae8e7d
                                        0x01ae8ec3
                                        0x01ae8ecd
                                        0x01ae8ed2
                                        0x01ae8ed2
                                        0x01ae8ec5
                                        0x01ae8ec5
                                        0x00000000
                                        0x01ae8e7d
                                        0x01ae8e67
                                        0x01ae8ea4
                                        0x01b2931a
                                        0x00000000
                                        0x00000000
                                        0x01b29320
                                        0x01ae8ea4
                                        0x01ae8e70
                                        0x01b29325
                                        0x01b29340
                                        0x01b29345
                                        0x01b29345
                                        0x01ae8e76
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        APIs
                                        Strings
                                        • Querying the active activation context failed with status 0x%08lx, xrefs: 01B29357
                                        • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 01B2932A
                                        • minkernel\ntdll\ldrsnap.c, xrefs: 01B2933B, 01B29367
                                        • LdrpFindDllActivationContext, xrefs: 01B29331, 01B2935D
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: DebugPrintTimes
                                        • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                        • API String ID: 3446177414-3779518884
                                        • Opcode ID: bdb434d1c8bc59ad7d1ee6b0a460e04f13e0bb3b6ecf6804d3bd33739ab451a7
                                        • Instruction ID: 9b9d86a3b8f07468143e07d20113a3e07f46f1b48647328e3307a12cde2113fe
                                        • Opcode Fuzzy Hash: bdb434d1c8bc59ad7d1ee6b0a460e04f13e0bb3b6ecf6804d3bd33739ab451a7
                                        • Instruction Fuzzy Hash: D4413CB2A00325AFEF36AB5DC88DB76B7F4BB00654F4A4169E90857152E778EDC083C1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC3D34 Relevance: 6.7, Strings: 5, Instructions: 435COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 96%
                                        			E01AC3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E01AC1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E01AC1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E01AC1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E01AC1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E01AC1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L01AD4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E01AFF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E01B01370(_t276, 0x1a94e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E01AFBB40(0,  &_v68, _t170);
									if(L01AC43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E01AFBB40(_t257,  &_v68, _t243);
								if(L01AC43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E01B01370(_t278, 0x1a94e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L01AD4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E01AFF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E01B01370(_v16, 0x1a94e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E01AFBB40(_t262,  &_v68, _t244);
								if(L01AC43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E01B01370(_t282, 0x1a94e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E01AFBB40(_t262,  &_v68, _t201);
							if(L01AC43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L01AD4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E01AFF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E01B01370(_t280, 0x1a94e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E01AFBB40(_t267,  &_v68, _t245);
							if(L01AC43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E01B01370(_t284, 0x1a94e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E01AFBB40(_t267,  &_v68, _t224);
						if(L01AC43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}










































                                        0x01ac3d3c
                                        0x01ac3d42
                                        0x01ac3d44
                                        0x01ac3d46
                                        0x01ac3d49
                                        0x01ac3d4c
                                        0x01ac3d4f
                                        0x01ac3d52
                                        0x01ac3d55
                                        0x01ac3d58
                                        0x01ac3d5b
                                        0x01ac3d5f
                                        0x01ac3d61
                                        0x01ac3d66
                                        0x01b18213
                                        0x01b18218
                                        0x01ac4085
                                        0x01ac4088
                                        0x01ac408e
                                        0x01ac4094
                                        0x01ac409a
                                        0x01ac40a0
                                        0x01ac40a6
                                        0x01ac40a9
                                        0x01ac40af
                                        0x01ac40b6
                                        0x01ac40bd
                                        0x01ac40bd
                                        0x01ac3d83
                                        0x01b1821f
                                        0x01b18229
                                        0x01b18238
                                        0x01b18238
                                        0x01b1823d
                                        0x01b1823d
                                        0x01ac3da0
                                        0x01ac3daf
                                        0x01ac3db5
                                        0x01ac3dba
                                        0x01ac3dba
                                        0x01ac3dd4
                                        0x01ac3e94
                                        0x01ac3eab
                                        0x01ac3f6d
                                        0x01ac3f84
                                        0x01ac406b
                                        0x01ac406b
                                        0x01ac406e
                                        0x01ac406e
                                        0x01ac4070
                                        0x01ac4074
                                        0x01b18351
                                        0x01b18351
                                        0x01ac407a
                                        0x01ac407f
                                        0x01b1835d
                                        0x01b18370
                                        0x01b18377
                                        0x01b18379
                                        0x01b1837c
                                        0x01b1837c
                                        0x01b1835d
                                        0x00000000
                                        0x01ac407f
                                        0x01ac3f8a
                                        0x01ac3f8d
                                        0x01ac3f90
                                        0x01ac3f95
                                        0x01b1830d
                                        0x01b1830f
                                        0x01ac3f9b
                                        0x01ac3fac
                                        0x01ac3fae
                                        0x01ac3fb1
                                        0x01ac3fb1
                                        0x01ac3fb6
                                        0x01b18317
                                        0x01b1831a
                                        0x00000000
                                        0x01ac3fbc
                                        0x01ac3fc1
                                        0x01ac3fc9
                                        0x01ac3fd7
                                        0x01ac3fda
                                        0x01ac3fdd
                                        0x01ac4021
                                        0x01ac4021
                                        0x01ac4029
                                        0x01ac4030
                                        0x01ac4044
                                        0x01ac4046
                                        0x01ac4046
                                        0x01ac4044
                                        0x01ac4049
                                        0x01b18327
                                        0x01b18334
                                        0x01b18339
                                        0x01b1833c
                                        0x01ac404f
                                        0x01ac404f
                                        0x01ac404f
                                        0x01ac4051
                                        0x01ac4056
                                        0x01ac4063
                                        0x01ac4063
                                        0x01ac4068
                                        0x00000000
                                        0x01ac4068
                                        0x01ac3fdf
                                        0x01ac3fe2
                                        0x01ac3fe4
                                        0x01ac3fe7
                                        0x01ac3fef
                                        0x01ac4003
                                        0x01ac4005
                                        0x01ac4005
                                        0x01ac400c
                                        0x01ac4013
                                        0x01ac4016
                                        0x01ac4017
                                        0x01ac401b
                                        0x01ac401e
                                        0x00000000
                                        0x01ac401e
                                        0x01ac3fb6
                                        0x01ac3eb1
                                        0x01ac3eb4
                                        0x01ac3eb7
                                        0x01ac3ebc
                                        0x01b182a9
                                        0x01b182ab
                                        0x01ac3ec2
                                        0x01ac3ed3
                                        0x01ac3ed5
                                        0x01ac3ed8
                                        0x01ac3ed8
                                        0x01ac3edd
                                        0x01b182b3
                                        0x01b182b6
                                        0x00000000
                                        0x01ac3ee3
                                        0x01ac3ee8
                                        0x01ac3eed
                                        0x01ac3ef0
                                        0x01ac3ef3
                                        0x01ac3f02
                                        0x01ac3f05
                                        0x01ac3f08
                                        0x01b182c0
                                        0x01b182c3
                                        0x01b182c5
                                        0x01b182c8
                                        0x01b182d0
                                        0x01b182e4
                                        0x01b182e6
                                        0x01b182e6
                                        0x01b182ed
                                        0x01b182f4
                                        0x01b182f7
                                        0x01b182f8
                                        0x01b182fc
                                        0x01b182ff
                                        0x01b182ff
                                        0x01ac3f0e
                                        0x01ac3f11
                                        0x01ac3f16
                                        0x01ac3f1d
                                        0x01ac3f31
                                        0x01b18307
                                        0x01b18307
                                        0x01ac3f31
                                        0x01ac3f39
                                        0x01ac3f48
                                        0x01ac3f4d
                                        0x01ac3f50
                                        0x01ac3f50
                                        0x01ac3f53
                                        0x01ac3f58
                                        0x01ac3f65
                                        0x01ac3f65
                                        0x01ac3f6a
                                        0x00000000
                                        0x01ac3f6a
                                        0x01ac3edd
                                        0x01ac3dda
                                        0x01ac3ddd
                                        0x01ac3de0
                                        0x01ac3de5
                                        0x01b18245
                                        0x01ac3deb
                                        0x01ac3df7
                                        0x01ac3dfc
                                        0x01ac3dfe
                                        0x01ac3e01
                                        0x01ac3e01
                                        0x01ac3e06
                                        0x01b1824d
                                        0x01b1824f
                                        0x01b18254
                                        0x00000000
                                        0x01ac3e0c
                                        0x01ac3e11
                                        0x01ac3e16
                                        0x01ac3e19
                                        0x01ac3e29
                                        0x01ac3e2c
                                        0x01ac3e2f
                                        0x01b1825c
                                        0x01b1825f
                                        0x01b18261
                                        0x01b18264
                                        0x01b1826c
                                        0x01b18280
                                        0x01b18282
                                        0x01b18282
                                        0x01b18289
                                        0x01b18290
                                        0x01b18293
                                        0x01b18294
                                        0x01b18298
                                        0x01b1829b
                                        0x01b1829b
                                        0x01ac3e35
                                        0x01ac3e38
                                        0x01ac3e3d
                                        0x01ac3e44
                                        0x01ac3e58
                                        0x01b182a3
                                        0x01b182a3
                                        0x01ac3e58
                                        0x01ac3e60
                                        0x01ac3e6f
                                        0x01ac3e74
                                        0x01ac3e77
                                        0x01ac3e77
                                        0x01ac3e7a
                                        0x01ac3e7f
                                        0x01ac3e8c
                                        0x01ac3e8c
                                        0x01ac3e91
                                        0x00000000
                                        0x01ac3e91

                                        Strings
                                        • Kernel-MUI-Number-Allowed, xrefs: 01AC3D8C
                                        • Kernel-MUI-Language-SKU, xrefs: 01AC3F70
                                        • Kernel-MUI-Language-Disallowed, xrefs: 01AC3E97
                                        • WindowsExcludedProcs, xrefs: 01AC3D6F
                                        • Kernel-MUI-Language-Allowed, xrefs: 01AC3DC0
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                        • API String ID: 0-258546922
                                        • Opcode ID: 75d2baef2be0fbd7a75cd9fcc9c94a56583dbb21fd401babab8da364fbd8b673
                                        • Instruction ID: 5e93797341280df38fdb9d07f37060a8339ea55aa919362a0e12c21a73ec3cc9
                                        • Opcode Fuzzy Hash: 75d2baef2be0fbd7a75cd9fcc9c94a56583dbb21fd401babab8da364fbd8b673
                                        • Instruction Fuzzy Hash: 9AF14E72D00619EFCF16DF98CA80AEEBBF9FF48A50F15416AE505A7250D7349E01CBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC8794 Relevance: 4.0, Strings: 3, Instructions: 255COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 83%
                                        			E01AC8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E01AC934A() != 0) {
								_t159 = E01B3A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x1ba5780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E01B35510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x1ba5780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E01AC849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E01AC8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E01AC8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x1ba5c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x1ba5c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E01AD2280(_t92, 0x1ba86cc);
															_t94 = E01B89DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E01AE61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x1ba5c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E01AC8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x1ba5c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x1ba5c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E01AFF380(_t136, 0x1a91184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E01AD2280(_t108, 0x1ba86cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E01AE61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E01B89D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E01ACFFB0(_t118, _t156, 0x1ba86cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E01AF9A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}












































                                        0x01ac8799
                                        0x01ac879d
                                        0x01ac87a1
                                        0x01ac87a3
                                        0x01ac87a8
                                        0x01ac87c3
                                        0x01ac87c3
                                        0x01ac87c8
                                        0x01ac87d1
                                        0x01ac87d4
                                        0x01ac87d8
                                        0x01ac87e5
                                        0x01ac87ec
                                        0x01b19bfe
                                        0x01b19c00
                                        0x01b19c02
                                        0x01b19c08
                                        0x01b19c0d
                                        0x01b19c0f
                                        0x01b19c14
                                        0x01b19c2d
                                        0x01b19c32
                                        0x01b19c37
                                        0x01b19c3a
                                        0x01b19c3c
                                        0x01b19c42
                                        0x01b19c42
                                        0x01b19c3c
                                        0x01b19c02
                                        0x01ac87da
                                        0x01ac87df
                                        0x01ac87e3
                                        0x00000000
                                        0x00000000
                                        0x01ac87e3
                                        0x01ac87f2
                                        0x00000000
                                        0x01ac87fb
                                        0x01ac87fd
                                        0x01ac87fe
                                        0x01ac880e
                                        0x01ac880f
                                        0x01ac8810
                                        0x01ac8814
                                        0x01ac881a
                                        0x01ac881c
                                        0x01ac881f
                                        0x01ac8821
                                        0x01ac8822
                                        0x01ac8824
                                        0x01ac8826
                                        0x01ac882c
                                        0x01ac882e
                                        0x01b19c48
                                        0x01b19c48
                                        0x01ac8834
                                        0x01ac8834
                                        0x01ac8837
                                        0x00000000
                                        0x00000000
                                        0x01ac8837
                                        0x01ac882e
                                        0x01ac883d
                                        0x01ac8840
                                        0x01ac8843
                                        0x01ac8846
                                        0x01ac8849
                                        0x01ac884c
                                        0x01ac884e
                                        0x01ac8850
                                        0x01ac8852
                                        0x01ac8854
                                        0x01ac8857
                                        0x01ac88b4
                                        0x01ac88b6
                                        0x01ac88b6
                                        0x01ac8859
                                        0x01ac8859
                                        0x01ac8859
                                        0x01ac8861
                                        0x01ac8866
                                        0x01ac886a
                                        0x01ac893d
                                        0x01ac8941
                                        0x00000000
                                        0x01ac8947
                                        0x01ac8947
                                        0x01ac894a
                                        0x01ac894c
                                        0x00000000
                                        0x01ac8952
                                        0x01ac8955
                                        0x01ac895a
                                        0x01ac895d
                                        0x01ac895d
                                        0x01ac895f
                                        0x01ac8961
                                        0x01ac8961
                                        0x01ac8968
                                        0x00000000
                                        0x00000000
                                        0x01ac896a
                                        0x01ac896b
                                        0x01ac896e
                                        0x00000000
                                        0x01ac8970
                                        0x01ac8970
                                        0x01ac8970
                                        0x01ac8970
                                        0x01ac8972
                                        0x01ac8972
                                        0x01ac8974
                                        0x00000000
                                        0x01ac897a
                                        0x01ac897a
                                        0x01ac897d
                                        0x00000000
                                        0x01ac8983
                                        0x01b19c65
                                        0x01b19c6d
                                        0x01b19c72
                                        0x01b19c75
                                        0x01b19c75
                                        0x01b19c82
                                        0x01b19c86
                                        0x01b19c87
                                        0x01b19c88
                                        0x01b19c89
                                        0x01b19c8c
                                        0x01b19c90
                                        0x01b19c95
                                        0x01b19c97
                                        0x01b19ca0
                                        0x01b19ca3
                                        0x01b19ca9
                                        0x01b19ca9
                                        0x00000000
                                        0x01b19ca9
                                        0x01b19ca3
                                        0x00000000
                                        0x01b19c97
                                        0x01ac897d
                                        0x00000000
                                        0x01ac8974
                                        0x01ac8988
                                        0x01ac8992
                                        0x01ac8996
                                        0x00000000
                                        0x01ac8996
                                        0x01ac894c
                                        0x00000000
                                        0x01ac8870
                                        0x01ac887b
                                        0x01ac887d
                                        0x01ac887f
                                        0x01ac8881
                                        0x01ac8884
                                        0x01ac8884
                                        0x01ac8886
                                        0x01ac8889
                                        0x01ac888c
                                        0x01ac888e
                                        0x01ac8891
                                        0x01ac8891
                                        0x01ac8898
                                        0x00000000
                                        0x00000000
                                        0x01ac889a
                                        0x01ac889b
                                        0x01ac889e
                                        0x00000000
                                        0x00000000
                                        0x01ac88a0
                                        0x01ac88a8
                                        0x01ac88b0
                                        0x01ac88b2
                                        0x01ac88d3
                                        0x01ac88d5
                                        0x00000000
                                        0x01ac88d7
                                        0x01ac88db
                                        0x01ac88dc
                                        0x01ac88e0
                                        0x01ac88e8
                                        0x01ac88ee
                                        0x01ac88f0
                                        0x01ac88f3
                                        0x01ac88fc
                                        0x01ac8901
                                        0x01ac8906
                                        0x01ac890c
                                        0x01ac890c
                                        0x01ac890f
                                        0x01ac8916
                                        0x01ac8917
                                        0x01ac8918
                                        0x01ac8919
                                        0x01ac891a
                                        0x01ac891f
                                        0x01ac8921
                                        0x01b19c52
                                        0x01b19c55
                                        0x01b19c5b
                                        0x01b19cac
                                        0x01b19cc0
                                        0x01b19cc0
                                        0x01b19c55
                                        0x01ac8927
                                        0x01ac8927
                                        0x01ac892f
                                        0x01ac8933
                                        0x00000000
                                        0x01ac88f5
                                        0x01ac88f5
                                        0x00000000
                                        0x01ac88f7
                                        0x01ac88f7
                                        0x01ac88fa
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ac88fa
                                        0x01ac88f5
                                        0x01ac88f3
                                        0x00000000
                                        0x01ac88d5
                                        0x00000000
                                        0x01ac88b2
                                        0x01ac88c9
                                        0x00000000
                                        0x01ac88c9
                                        0x01ac887f
                                        0x01ac886a
                                        0x01ac8857
                                        0x01ac8852
                                        0x01ac88bf
                                        0x01ac88bf
                                        0x01ac87aa
                                        0x01ac87ad
                                        0x01ac87ae
                                        0x01ac87b4
                                        0x01ac87b5
                                        0x01ac87b6
                                        0x01ac87b8
                                        0x01ac87bd
                                        0x01ac87c1
                                        0x01ac87f4
                                        0x01ac87fa
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ac87c1
                                        0x00000000

                                        Strings
                                        • LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 01B19C18
                                        • LdrpDoPostSnapWork, xrefs: 01B19C1E
                                        • minkernel\ntdll\ldrsnap.c, xrefs: 01B19C28
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
                                        • API String ID: 2994545307-1948996284
                                        • Opcode ID: 4c54c4203a088ed07f50035c3e29f62c6858d2d2f59c871a59659308b03bd9ba
                                        • Instruction ID: d246e991ee520623f559e5eb3ffa910e0ddbf57090770840e5a94b56c9544355
                                        • Opcode Fuzzy Hash: 4c54c4203a088ed07f50035c3e29f62c6858d2d2f59c871a59659308b03bd9ba
                                        • Instruction Fuzzy Hash: A1912531A00206EFEF29DF59C881ABBBBB5FF40B54B5541ADE905AB641E734ED01CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC7E41 Relevance: 3.9, Strings: 3, Instructions: 174COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 98%
                                        			E01AC7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E01ACCEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E01ABC9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x1ba5780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E01B35510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x1ba5780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E01AD7D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01AD7D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E01B37016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E01AD7D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01AD7D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E01B37016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E01AEA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E01ABB1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}




















                                        0x01ac7e4c
                                        0x01ac7e50
                                        0x01ac7e55
                                        0x01ac7e58
                                        0x01ac7e5d
                                        0x01ac7e71
                                        0x01ac7f33
                                        0x01ac7e77
                                        0x01ac7e77
                                        0x01ac7e79
                                        0x01ac7e79
                                        0x01ac7e7e
                                        0x01ac7f45
                                        0x01b19848
                                        0x00000000
                                        0x01b19848
                                        0x01ac7f4e
                                        0x01ac7f53
                                        0x01ac7f5a
                                        0x00000000
                                        0x00000000
                                        0x01b1985a
                                        0x01b19862
                                        0x01b19866
                                        0x00000000
                                        0x01b1986c
                                        0x00000000
                                        0x01b1986c
                                        0x01ac7e84
                                        0x01ac7e84
                                        0x01ac7e8d
                                        0x01b19871
                                        0x01ac7eb8
                                        0x01ac7ec0
                                        0x01ac7ec0
                                        0x01ac7e9a
                                        0x01b1987e
                                        0x00000000
                                        0x00000000
                                        0x01b19884
                                        0x01b1988b
                                        0x01b198a7
                                        0x01b198ac
                                        0x01b198b1
                                        0x01b198b6
                                        0x01b198b8
                                        0x01b198b8
                                        0x01b198b9
                                        0x00000000
                                        0x01b198b9
                                        0x01ac7ea0
                                        0x01ac7ea7
                                        0x00000000
                                        0x00000000
                                        0x01ac7eac
                                        0x01ac7eb1
                                        0x01ac7ec6
                                        0x01ac7ed0
                                        0x01b198cc
                                        0x01ac7ed6
                                        0x01ac7ed6
                                        0x01ac7ed6
                                        0x01ac7ede
                                        0x01ac7ee3
                                        0x01b198e3
                                        0x01b198f0
                                        0x01b19902
                                        0x01b198f2
                                        0x01b198fb
                                        0x01b198fb
                                        0x01b19907
                                        0x01b1991d
                                        0x01b1991d
                                        0x01b19907
                                        0x01b198e3
                                        0x01ac7ef0
                                        0x01ac7f14
                                        0x01ac7f14
                                        0x01ac7f1e
                                        0x01b19946
                                        0x01ac7f24
                                        0x01ac7f24
                                        0x01ac7f24
                                        0x01ac7f2c
                                        0x01b1996a
                                        0x01b19975
                                        0x01b19975
                                        0x01b1997e
                                        0x01b19993
                                        0x01b19993
                                        0x01b1997e
                                        0x00000000
                                        0x01ac7ef2
                                        0x01ac7efc
                                        0x01ac7f0a
                                        0x01ac7f0e
                                        0x01b19933
                                        0x00000000
                                        0x01b19933
                                        0x00000000
                                        0x01ac7f0e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ac7eb1

                                        Strings
                                        • LdrpCompleteMapModule, xrefs: 01B19898
                                        • minkernel\ntdll\ldrmap.c, xrefs: 01B198A2
                                        • Could not validate the crypto signature for DLL %wZ, xrefs: 01B19891
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                        • API String ID: 0-1676968949
                                        • Opcode ID: 9127e92f8070563d54dd6f858f9c920866709d80f413e03ca57258f14ab0c625
                                        • Instruction ID: f275352308491dbaef6a7c8ff8cca9f96c0f77929b3ec4287838177df9d89525
                                        • Opcode Fuzzy Hash: 9127e92f8070563d54dd6f858f9c920866709d80f413e03ca57258f14ab0c625
                                        • Instruction Fuzzy Hash: 34510372600782DBEB2ACB9DC954B2A7BE4EF01B54F440699E9519B3D1D730ED00CF90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABE620 Relevance: 3.9, Strings: 3, Instructions: 165COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 93%
                                        			E01ABE620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E01ABF358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E01AF95D0();
						}
						if(_t78 != 0) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E01AFFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E01AFBB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E01AF9600();
					if(_t97 < 0) {
						goto L6;
					}
					E01AFBB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L01ABF018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E01AFBB40(_t83, _t102 + 0x24, _t78);
								if(L01AC43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E01AFBB40(_t84, _t102 + 0x24, _t94);
									if(L01AC43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}































                                        0x01abe620
                                        0x01abe628
                                        0x01abe62f
                                        0x01abe631
                                        0x01abe635
                                        0x01abe637
                                        0x01abe63e
                                        0x01b15503
                                        0x01b15503
                                        0x01abe64c
                                        0x01abe64c
                                        0x01abe651
                                        0x00000000
                                        0x00000000
                                        0x01abe661
                                        0x01abe665
                                        0x01b1542a
                                        0x01abe715
                                        0x01abe71a
                                        0x01abe71c
                                        0x01abe720
                                        0x01abe720
                                        0x01abe727
                                        0x01abe736
                                        0x01abe736
                                        0x01abe743
                                        0x01abe743
                                        0x01abe673
                                        0x01abe678
                                        0x01abe67d
                                        0x01abe682
                                        0x01abe685
                                        0x01abe692
                                        0x01abe69b
                                        0x01abe6a3
                                        0x01abe6ad
                                        0x01abe6b1
                                        0x01abe6b2
                                        0x01abe6bb
                                        0x01abe6bf
                                        0x01abe6c0
                                        0x01abe6c8
                                        0x01abe6cc
                                        0x01abe6d5
                                        0x01abe6d9
                                        0x00000000
                                        0x00000000
                                        0x01abe6e5
                                        0x01abe6ea
                                        0x01abe6f9
                                        0x01abe70b
                                        0x01abe70f
                                        0x01b15439
                                        0x01b1545e
                                        0x01b1545e
                                        0x00000000
                                        0x01b1545e
                                        0x01b1543b
                                        0x01b1543e
                                        0x01b15440
                                        0x01b15445
                                        0x01b15472
                                        0x01b15475
                                        0x01b1548d
                                        0x01b15493
                                        0x01b154a9
                                        0x00000000
                                        0x00000000
                                        0x01b154ab
                                        0x01b154b4
                                        0x01b154bc
                                        0x01b154c8
                                        0x01b154de
                                        0x01b154fb
                                        0x01b154e0
                                        0x01b154e6
                                        0x01b154eb
                                        0x01b154eb
                                        0x01b154de
                                        0x00000000
                                        0x01b154bc
                                        0x01b15477
                                        0x01b1547a
                                        0x01b15480
                                        0x01b15483
                                        0x01b15486
                                        0x01b1548b
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b1548b
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b15447
                                        0x01b15447
                                        0x01b15447
                                        0x01b15447
                                        0x01b1544e
                                        0x00000000
                                        0x00000000
                                        0x01b15450
                                        0x01b15452
                                        0x01b15455
                                        0x01b1545a
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b1545c
                                        0x01b1546a
                                        0x01b1546d
                                        0x01b1546f
                                        0x00000000
                                        0x01b1546f
                                        0x01abe70f

                                        Strings
                                        • InstallLanguageFallback, xrefs: 01ABE6DB
                                        • \Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 01ABE68C
                                        • @, xrefs: 01ABE6C0
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
                                        • API String ID: 0-1757540487
                                        • Opcode ID: 3b47e0d4c6d8dd105579c63d7ff5a1cc54f9ea4ca4128bf9bcecb0d64d29df8c
                                        • Instruction ID: 9b19f743c38a40e491d28f12803b0fcb1ade803fa6ae799907c49cf36b569188
                                        • Opcode Fuzzy Hash: 3b47e0d4c6d8dd105579c63d7ff5a1cc54f9ea4ca4128bf9bcecb0d64d29df8c
                                        • Instruction Fuzzy Hash: 8B51E1726083469BD724DF68C480AABB3E8FF89614F45096EFA85D7204F734DA44C7A2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B4FF10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44timeCOMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        • NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 01B4FF60
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: DebugPrintTimes
                                        • String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
                                        • API String ID: 3446177414-1911121157
                                        • Opcode ID: 17944ec133e834baafea54656539281d694f35ac04f6d9a2275f49c8968afcd5
                                        • Instruction ID: 6c8fe1907db440784b18bbf14b8353b7de18cccce85ddc50dcf7c5ede1264b40
                                        • Opcode Fuzzy Hash: 17944ec133e834baafea54656539281d694f35ac04f6d9a2275f49c8968afcd5
                                        • Instruction Fuzzy Hash: 1C11C071951144EFDF2AEB98C949FA8BBB1FF18704F54C098F1096B2A1CB399940EB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B7E539 Relevance: 2.8, Strings: 2, Instructions: 261COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 60%
                                        			E01B7E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E01B7BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E01B7BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E01B7AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E01AF9730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E01B7A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E01B7A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E01AF9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E01B7A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E01B7A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E01AD2280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E01ACB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E01ACFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E01AD7D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E01B6FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}




































                                        0x01b7e547
                                        0x01b7e549
                                        0x01b7e54f
                                        0x01b7e553
                                        0x01b7e557
                                        0x01b7e55a
                                        0x01b7e55c
                                        0x01b7e55f
                                        0x01b7e561
                                        0x01b7e567
                                        0x01b7e56b
                                        0x01b7e7e2
                                        0x00000000
                                        0x01b7e571
                                        0x01b7e575
                                        0x01b7e577
                                        0x01b7e57b
                                        0x01b7e57c
                                        0x01b7e57d
                                        0x01b7e57e
                                        0x01b7e57f
                                        0x01b7e588
                                        0x01b7e58f
                                        0x01b7e591
                                        0x01b7e592
                                        0x01b7e592
                                        0x01b7e596
                                        0x01b7e59e
                                        0x01b7e5a0
                                        0x01b7e5a6
                                        0x01b7e61d
                                        0x01b7e61d
                                        0x01b7e621
                                        0x01b7e623
                                        0x01b7e630
                                        0x01b7e630
                                        0x01b7e7e6
                                        0x01b7e7eb
                                        0x01b7e7ed
                                        0x01b7e7f4
                                        0x01b7e7fa
                                        0x01b7e7ff
                                        0x01b7e7ff
                                        0x01b7e80a
                                        0x01b7e812
                                        0x01b7e812
                                        0x01b7e5ab
                                        0x01b7e5b4
                                        0x01b7e5b9
                                        0x01b7e5be
                                        0x01b7e5c0
                                        0x01b7e5c2
                                        0x01b7e5c8
                                        0x01b7e5c9
                                        0x01b7e5cb
                                        0x01b7e5cc
                                        0x01b7e5d5
                                        0x01b7e5e4
                                        0x01b7e5f1
                                        0x01b7e5f8
                                        0x01b7e5f8
                                        0x01b7e5d5
                                        0x01b7e602
                                        0x01b7e616
                                        0x01b7e63d
                                        0x01b7e644
                                        0x01b7e64d
                                        0x01b7e652
                                        0x01b7e657
                                        0x01b7e659
                                        0x01b7e65b
                                        0x01b7e661
                                        0x01b7e662
                                        0x01b7e664
                                        0x01b7e665
                                        0x01b7e66e
                                        0x01b7e67d
                                        0x01b7e68a
                                        0x01b7e691
                                        0x01b7e691
                                        0x01b7e66e
                                        0x01b7e6b0
                                        0x00000000
                                        0x01b7e6b6
                                        0x01b7e6bd
                                        0x01b7e6c7
                                        0x01b7e6d7
                                        0x01b7e6d9
                                        0x01b7e6db
                                        0x01b7e6de
                                        0x01b7e6e3
                                        0x01b7e6f3
                                        0x01b7e6fc
                                        0x01b7e700
                                        0x01b7e700
                                        0x01b7e704
                                        0x01b7e70a
                                        0x01b7e70a
                                        0x01b7e713
                                        0x01b7e716
                                        0x01b7e719
                                        0x01b7e720
                                        0x01b7e761
                                        0x01b7e76b
                                        0x01b7e774
                                        0x01b7e77a
                                        0x01b7e77a
                                        0x01b7e78a
                                        0x01b7e791
                                        0x01b7e799
                                        0x01b7e79b
                                        0x01b7e79f
                                        0x01b7e7aa
                                        0x01b7e7c0
                                        0x01b7e7ac
                                        0x01b7e7b2
                                        0x01b7e7b9
                                        0x01b7e7b9
                                        0x01b7e7c7
                                        0x01b7e806
                                        0x00000000
                                        0x01b7e7c9
                                        0x01b7e7d1
                                        0x01b7e7d8
                                        0x00000000
                                        0x01b7e7d8
                                        0x00000000
                                        0x00000000
                                        0x01b7e722
                                        0x01b7e72e
                                        0x01b7e748
                                        0x01b7e74c
                                        0x01b7e754
                                        0x01b7e756
                                        0x01b7e75c
                                        0x01b7e75c
                                        0x00000000
                                        0x01b7e75c
                                        0x01b7e758
                                        0x01b7e758
                                        0x00000000
                                        0x01b7e758
                                        0x01b7e750
                                        0x00000000
                                        0x00000000
                                        0x01b7e752
                                        0x00000000
                                        0x01b7e752
                                        0x01b7e730
                                        0x01b7e735
                                        0x01b7e73d
                                        0x01b7e73f
                                        0x00000000
                                        0x00000000
                                        0x01b7e741
                                        0x01b7e741
                                        0x00000000
                                        0x01b7e741
                                        0x01b7e739
                                        0x00000000
                                        0x00000000
                                        0x01b7e73b
                                        0x00000000
                                        0x01b7e73b
                                        0x01b7e722
                                        0x01b7e720
                                        0x01b7e6b0
                                        0x01b7e618
                                        0x00000000
                                        0x01b7e618

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: `$`
                                        • API String ID: 0-197956300
                                        • Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                        • Instruction ID: d2aff1df6db6152faae1e8d08912c995e7d378a785a1e3f48eb643379041f4cd
                                        • Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                        • Instruction Fuzzy Hash: 749182712043429FE728CE29C941B1BBBE5FF84714F1889ADF6A5CB280E775E904CB51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B351BE Relevance: 2.7, Strings: 2, Instructions: 173COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 77%
                                        			E01B351BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x1b905f0);
				E01B0D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E01ACEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E01B353CA(0);
						return E01B0D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E01AFF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E01AD3690(1, _t117, 0x1a91810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E01AFAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L01AD4620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E01AFAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E01B3500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E01AF9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}






















                                        0x01b351be
                                        0x01b351c3
                                        0x01b351c8
                                        0x01b351cd
                                        0x01b351d0
                                        0x01b351d3
                                        0x01b351d8
                                        0x01b351db
                                        0x01b351de
                                        0x01b351e0
                                        0x01b351e3
                                        0x01b351e6
                                        0x01b351e8
                                        0x01b35342
                                        0x01b35351
                                        0x01b35356
                                        0x01b3535a
                                        0x01b35360
                                        0x01b35363
                                        0x01b35366
                                        0x01b35369
                                        0x01b35369
                                        0x01b3536b
                                        0x01b3536b
                                        0x01b35370
                                        0x01b353a3
                                        0x01b353a4
                                        0x01b353a6
                                        0x01b353ab
                                        0x01b353ab
                                        0x01b353ae
                                        0x01b353ae
                                        0x01b353b5
                                        0x01b353bf
                                        0x01b353bf
                                        0x01b35375
                                        0x01b35396
                                        0x01b353a0
                                        0x01b353a0
                                        0x00000000
                                        0x01b35396
                                        0x01b35377
                                        0x01b35379
                                        0x01b3537f
                                        0x01b3538c
                                        0x01b35390
                                        0x00000000
                                        0x01b35390
                                        0x01b351ee
                                        0x01b351f1
                                        0x01b35301
                                        0x01b35310
                                        0x01b35315
                                        0x01b35318
                                        0x01b3531b
                                        0x01b35320
                                        0x01b3532e
                                        0x01b35331
                                        0x00000000
                                        0x01b35331
                                        0x01b35328
                                        0x01b35329
                                        0x00000000
                                        0x01b35329
                                        0x01b351fa
                                        0x01b35235
                                        0x01b35236
                                        0x01b35239
                                        0x01b3523f
                                        0x01b35240
                                        0x01b35241
                                        0x01b35242
                                        0x01b35246
                                        0x01b35247
                                        0x01b3524e
                                        0x01b35251
                                        0x01b35267
                                        0x01b35269
                                        0x01b3526e
                                        0x01b3527d
                                        0x01b3527e
                                        0x01b35281
                                        0x01b35282
                                        0x01b35287
                                        0x01b35288
                                        0x01b3528a
                                        0x01b3528f
                                        0x01b35294
                                        0x00000000
                                        0x00000000
                                        0x01b3529a
                                        0x01b3529c
                                        0x01b3529e
                                        0x01b3529e
                                        0x01b352a4
                                        0x01b352b0
                                        0x00000000
                                        0x00000000
                                        0x01b352ba
                                        0x01b352bc
                                        0x01b352bc
                                        0x01b352d4
                                        0x01b352d9
                                        0x01b352dc
                                        0x01b352e1
                                        0x00000000
                                        0x00000000
                                        0x01b352e7
                                        0x01b352f4
                                        0x00000000
                                        0x01b352f4
                                        0x01b35270
                                        0x00000000
                                        0x01b35270
                                        0x01b351fc
                                        0x01b351fd
                                        0x01b35202
                                        0x01b35203
                                        0x01b35205
                                        0x01b3520a
                                        0x01b3520f
                                        0x00000000
                                        0x00000000
                                        0x01b3521b
                                        0x01b35226
                                        0x01b3522b
                                        0x01b3521d
                                        0x01b3521d
                                        0x01b35222
                                        0x01b35222
                                        0x01b3522d
                                        0x00000000

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID: Legacy$UEFI
                                        • API String ID: 2994545307-634100481
                                        • Opcode ID: 31e531c0719dbf36f56b4a222d11638b2a0a89a98f706acc9681350c11c9f6a1
                                        • Instruction ID: d8e71fbd285ef96ed94d5eea050042f0a86f475085012af0ee55fe1647d46c11
                                        • Opcode Fuzzy Hash: 31e531c0719dbf36f56b4a222d11638b2a0a89a98f706acc9681350c11c9f6a1
                                        • Instruction Fuzzy Hash: B95160B1E006099FDB29DFA8C990BADBBF8FF88700F14416DE64AEB251D7719950CB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ACD5E0 Relevance: 1.9, APIs: 1, Instructions: 353timeCOMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 87%
                                        			E01ACD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x1bad360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E01AC6600(0x1ba52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1ba7b9c; // 0x0
							_t281 = L01AD4620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E01AFF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1ba7b90; // 0x77cf0000
								if(_t384 == 0) {
									_t353 =  *0x1ba7b8c; // 0x1572a28
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E01AD2280(_t200, 0x1ba84d8);
									_t277 =  *0x1ba85f4; // 0x1572f18
									_t351 =  *0x1ba85f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x1572eb0
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E01ACFFB0(_t287, _t353, 0x1ba84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E01B0CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E01AC6600(0x1ba52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E01AC7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x1bab239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E01B3E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1ba8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x1bab218; // 0x0
														asm("ror edi, cl");
														 *0x1bab1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E01AD2280(_t250, 0x1ba84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L01AF3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E01ACFFB0(_t293, _t353, 0x1ba84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E01AF37F5(_t353, 0);
																}
																E01AF0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E01AE9B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E01AE02D6(_t174);
																}
																L01AD77F0( *0x1ba7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E01AEC277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L01ACEC7F(_t353);
										L01AE19B8(_t287, 0, _t353, 0);
										_t200 = E01ABF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E01AFB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x1bab2f8; // 0x0
									if((_t206 |  *0x1bab2fc) == 0 || ( *0x1bab2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x1bab2ec; // 0x0
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E01B66B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E01B66AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E01ACE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L01ACEAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E01AF9730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E01ACE9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L01AC8F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E01AF3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}








































































































                                        0x01acd5f2
                                        0x01acd5f5
                                        0x01acd5f5
                                        0x01acd5fd
                                        0x01acd600
                                        0x01acd60a
                                        0x01acd60d
                                        0x01acd617
                                        0x01acd61d
                                        0x01acd627
                                        0x01acd62e
                                        0x01acd911
                                        0x01acd913
                                        0x00000000
                                        0x01acd919
                                        0x01acd919
                                        0x01acd919
                                        0x01acd634
                                        0x01acd634
                                        0x01acd634
                                        0x01acd634
                                        0x01acd640
                                        0x01acd8bf
                                        0x00000000
                                        0x01acd646
                                        0x01acd646
                                        0x01acd64d
                                        0x01acd652
                                        0x01b1b2fc
                                        0x01b1b2fc
                                        0x01b1b302
                                        0x01b1b33b
                                        0x01b1b341
                                        0x00000000
                                        0x01b1b304
                                        0x01b1b304
                                        0x01b1b319
                                        0x01b1b31e
                                        0x01b1b324
                                        0x01b1b326
                                        0x01b1b332
                                        0x01b1b347
                                        0x01b1b34c
                                        0x01b1b351
                                        0x01b1b35a
                                        0x00000000
                                        0x01b1b328
                                        0x01b1b328
                                        0x00000000
                                        0x01b1b328
                                        0x01b1b326
                                        0x01acd658
                                        0x01acd658
                                        0x01acd65b
                                        0x01acd665
                                        0x00000000
                                        0x01acd66b
                                        0x01acd66b
                                        0x01acd66b
                                        0x01acd66b
                                        0x01acd66d
                                        0x01acd672
                                        0x01acd67a
                                        0x00000000
                                        0x00000000
                                        0x01acd680
                                        0x01acd686
                                        0x01acd8ce
                                        0x01acd8d4
                                        0x01acd8dd
                                        0x01acd8e0
                                        0x01acd68c
                                        0x01acd691
                                        0x01acd69d
                                        0x01acd6a2
                                        0x01acd6a7
                                        0x01acd6b0
                                        0x01acd6b5
                                        0x01acd6e0
                                        0x01acd6b7
                                        0x01acd6b7
                                        0x01acd6b9
                                        0x01acd6b9
                                        0x01acd6bb
                                        0x01acd6bd
                                        0x01acd6ce
                                        0x01acd6d0
                                        0x01acd6d2
                                        0x01b1b363
                                        0x01b1b365
                                        0x00000000
                                        0x01b1b36b
                                        0x00000000
                                        0x01b1b36b
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01acd6bf
                                        0x01acd6bf
                                        0x01acd6e5
                                        0x01acd6e7
                                        0x01acd6e9
                                        0x01acd6ec
                                        0x01acd6ec
                                        0x01acd6ef
                                        0x01acd6f5
                                        0x01acd6f9
                                        0x01acd6fb
                                        0x01acd6fd
                                        0x01acd701
                                        0x01acd703
                                        0x01acd70a
                                        0x01acd70a
                                        0x01acd701
                                        0x01acd710
                                        0x01acd710
                                        0x01acd6c1
                                        0x01acd6c1
                                        0x01acd6c6
                                        0x01b1b36d
                                        0x01b1b36f
                                        0x00000000
                                        0x01b1b375
                                        0x01b1b375
                                        0x01b1b375
                                        0x00000000
                                        0x01b1b375
                                        0x00000000
                                        0x01acd6cc
                                        0x01acd6d8
                                        0x01acd6d8
                                        0x01acd6d8
                                        0x00000000
                                        0x01acd6c6
                                        0x01acd6bf
                                        0x00000000
                                        0x01acd6da
                                        0x01acd6da
                                        0x01acd716
                                        0x01acd71b
                                        0x01acd720
                                        0x01acd726
                                        0x01acd726
                                        0x01acd72d
                                        0x00000000
                                        0x01acd733
                                        0x01acd739
                                        0x01acd742
                                        0x01acd750
                                        0x01acd758
                                        0x01acd764
                                        0x01acd776
                                        0x01acd77a
                                        0x01acd783
                                        0x01acd928
                                        0x01acd92c
                                        0x01acd93d
                                        0x01acd944
                                        0x01acd94f
                                        0x01acd954
                                        0x01acd956
                                        0x01acd95f
                                        0x01acd961
                                        0x01acd973
                                        0x01acd973
                                        0x01acd956
                                        0x01acd944
                                        0x01acd92c
                                        0x01acd78b
                                        0x01b1b394
                                        0x01acd791
                                        0x01acd798
                                        0x01b1b3a3
                                        0x01b1b3bb
                                        0x01b1b3bb
                                        0x01acd7a5
                                        0x01acd866
                                        0x01acd870
                                        0x01acd884
                                        0x01acd892
                                        0x01acd898
                                        0x01acd89e
                                        0x01acd8a0
                                        0x01acd8a6
                                        0x01acd8ac
                                        0x01acd8ae
                                        0x01acd8b4
                                        0x01acd8b4
                                        0x01acd8ae
                                        0x01acd7a5
                                        0x01acd78b
                                        0x01acd7b1
                                        0x01b1b3c5
                                        0x01b1b3c5
                                        0x01acd7c3
                                        0x01acd7ca
                                        0x01acd7e5
                                        0x01acd7eb
                                        0x01acd8eb
                                        0x01acd8ed
                                        0x00000000
                                        0x01acd8f3
                                        0x01acd8f3
                                        0x01acd8f3
                                        0x00000000
                                        0x01acd8ed
                                        0x01acd7cc
                                        0x01acd7cc
                                        0x01acd7d2
                                        0x00000000
                                        0x01acd7d4
                                        0x01acd7d4
                                        0x01acd7d7
                                        0x01acd7df
                                        0x01b1b3d4
                                        0x01b1b3d9
                                        0x01b1b3dc
                                        0x01b1b3dc
                                        0x01b1b3df
                                        0x01b1b3e2
                                        0x01b1b468
                                        0x01b1b46d
                                        0x01b1b46f
                                        0x01b1b46f
                                        0x01b1b475
                                        0x01acd8f8
                                        0x01acd8f9
                                        0x01acd8fd
                                        0x01b1b3e8
                                        0x01b1b3e8
                                        0x01b1b3eb
                                        0x01b1b3ed
                                        0x00000000
                                        0x01b1b3ef
                                        0x01b1b3ef
                                        0x01b1b3f1
                                        0x01b1b3f4
                                        0x01b1b3fe
                                        0x01b1b404
                                        0x01b1b409
                                        0x01b1b40e
                                        0x01b1b410
                                        0x01b1b410
                                        0x01b1b414
                                        0x01b1b414
                                        0x01b1b41b
                                        0x01b1b420
                                        0x01b1b423
                                        0x01b1b425
                                        0x01b1b427
                                        0x01b1b42a
                                        0x01b1b42d
                                        0x01b1b42d
                                        0x01b1b42a
                                        0x01b1b432
                                        0x01b1b436
                                        0x01b1b438
                                        0x01b1b43b
                                        0x01b1b43b
                                        0x01b1b449
                                        0x01b1b44e
                                        0x01b1b454
                                        0x01b1b458
                                        0x01b1b458
                                        0x01b1b45d
                                        0x00000000
                                        0x01b1b45d
                                        0x01b1b3ed
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01acd7df
                                        0x01acd7d2
                                        0x01acd7ca
                                        0x01b1b37c
                                        0x01b1b37e
                                        0x01b1b385
                                        0x01b1b38a
                                        0x00000000
                                        0x01b1b38a
                                        0x01acd742
                                        0x01acd7f1
                                        0x01acd7f8
                                        0x01b1b49b
                                        0x01b1b49b
                                        0x01acd800
                                        0x01acd837
                                        0x01acd843
                                        0x01acd845
                                        0x01acd847
                                        0x01acd84a
                                        0x01acd84b
                                        0x01acd84e
                                        0x01acd857
                                        0x01acd802
                                        0x01acd802
                                        0x01acd80d
                                        0x00000000
                                        0x01acd818
                                        0x01acd818
                                        0x01acd824
                                        0x01acd831
                                        0x01b1b4a5
                                        0x01b1b4ab
                                        0x01b1b4b3
                                        0x01b1b4b8
                                        0x01b1b4bb
                                        0x00000000
                                        0x01b1b4c1
                                        0x01b1b4c1
                                        0x01b1b4c8
                                        0x00000000
                                        0x01b1b4ce
                                        0x01b1b4d4
                                        0x01b1b4e1
                                        0x01b1b4e3
                                        0x01b1b4e5
                                        0x00000000
                                        0x01b1b4eb
                                        0x01b1b4f0
                                        0x01b1b4f2
                                        0x01acdac9
                                        0x01acdacc
                                        0x01acdacf
                                        0x01acdad1
                                        0x01acdd78
                                        0x01acdd78
                                        0x01acdcf2
                                        0x00000000
                                        0x01acdad7
                                        0x01acdad9
                                        0x01acdadb
                                        0x00000000
                                        0x00000000
                                        0x01acdae1
                                        0x01acdae1
                                        0x01acdae4
                                        0x01acdae6
                                        0x01b1b4f9
                                        0x01b1b4f9
                                        0x01b1b500
                                        0x01acdaec
                                        0x01acdaec
                                        0x01acdaf5
                                        0x01acdaf8
                                        0x01acdafb
                                        0x01acdb03
                                        0x01acdb11
                                        0x01acdb16
                                        0x01acdb19
                                        0x01acdb1b
                                        0x01b1b52c
                                        0x01b1b531
                                        0x01b1b534
                                        0x01acdb21
                                        0x01acdb21
                                        0x01acdb24
                                        0x01acdcd9
                                        0x01acdce2
                                        0x01acdce5
                                        0x01acdd6a
                                        0x01acdd6d
                                        0x00000000
                                        0x01acdd73
                                        0x01b1b51a
                                        0x01b1b51c
                                        0x01b1b51f
                                        0x01b1b524
                                        0x00000000
                                        0x01b1b524
                                        0x01acdce7
                                        0x01acdce7
                                        0x01acdce7
                                        0x00000000
                                        0x01acdce7
                                        0x00000000
                                        0x01acdb2a
                                        0x01acdb2c
                                        0x01acdb31
                                        0x01acdb33
                                        0x01acdb36
                                        0x01acdb39
                                        0x01acdb3b
                                        0x01acdb66
                                        0x01acdb66
                                        0x01acdb3d
                                        0x01acdb3d
                                        0x01acdb3e
                                        0x01acdb46
                                        0x01acdb47
                                        0x01acdb49
                                        0x01acdb4c
                                        0x01acdb53
                                        0x01acdb55
                                        0x01acdb58
                                        0x01acdb5a
                                        0x01b1b50a
                                        0x01b1b50f
                                        0x01b1b512
                                        0x01acdb60
                                        0x01acdb60
                                        0x01acdb63
                                        0x01acdb63
                                        0x00000000
                                        0x01acdb63
                                        0x01acdb5a
                                        0x01acdb3b
                                        0x01acdb24
                                        0x01acdb69
                                        0x01acdb69
                                        0x01acdb6c
                                        0x01acdb6f
                                        0x01acdb74
                                        0x01b1b557
                                        0x01b1b557
                                        0x01b1b55e
                                        0x01acdb7a
                                        0x01acdb7c
                                        0x01acdb7f
                                        0x01acdb82
                                        0x01acdb85
                                        0x00000000
                                        0x01acdb8b
                                        0x01acdb8b
                                        0x01acdb8d
                                        0x01acdb9b
                                        0x01acdb9b
                                        0x01acdb9d
                                        0x01acdba0
                                        0x01acdba2
                                        0x01acdba4
                                        0x01acdba7
                                        0x01acdba9
                                        0x01acdbae
                                        0x01acdbae
                                        0x01acdbb1
                                        0x01acdbb4
                                        0x01acdbb4
                                        0x01acdbb7
                                        0x01acdbba
                                        0x01acdcd2
                                        0x01acdcd4
                                        0x00000000
                                        0x01acdbc0
                                        0x01acdbc0
                                        0x01acdbd2
                                        0x01acdbd7
                                        0x01acdbda
                                        0x01acdbdd
                                        0x01acdbdf
                                        0x00000000
                                        0x01acdbe5
                                        0x01acdbe5
                                        0x01acdbee
                                        0x01acdbf1
                                        0x01b1b541
                                        0x01b1b544
                                        0x00000000
                                        0x01b1b546
                                        0x01b1b546
                                        0x00000000
                                        0x01b1b546
                                        0x01acdbf7
                                        0x01acdbf7
                                        0x01acdbfd
                                        0x01acdbfd
                                        0x01acdbff
                                        0x01acdc0b
                                        0x01acdc15
                                        0x01acdc1b
                                        0x01acdc1d
                                        0x01acdc21
                                        0x01acdc21
                                        0x01acdc23
                                        0x01acdc23
                                        0x01acdc26
                                        0x01acdc29
                                        0x01acdc2b
                                        0x00000000
                                        0x00000000
                                        0x01acdc31
                                        0x01acdc34
                                        0x01acdc36
                                        0x01acdcbf
                                        0x01acdcbf
                                        0x01acdcc2
                                        0x00000000
                                        0x01acdc3c
                                        0x01acdc41
                                        0x01acdc43
                                        0x00000000
                                        0x01acdc45
                                        0x01acdc45
                                        0x01acdc47
                                        0x00000000
                                        0x01acdc4d
                                        0x01acdc4d
                                        0x01acdc50
                                        0x01acdc52
                                        0x01acdc55
                                        0x01acdcfa
                                        0x01acdcfe
                                        0x01acdd08
                                        0x01acdd0a
                                        0x01acdd0c
                                        0x00000000
                                        0x01acdd12
                                        0x01acdd15
                                        0x01acdd2d
                                        0x01acdd2f
                                        0x01acdd32
                                        0x01acdd35
                                        0x00000000
                                        0x01acdd35
                                        0x01acdc5b
                                        0x01acdc5b
                                        0x01acdc5e
                                        0x01acdc61
                                        0x01acdc64
                                        0x01acdc67
                                        0x01acdc67
                                        0x01acdc6a
                                        0x01acdc6c
                                        0x01acdc8e
                                        0x01acdc8e
                                        0x01acdc91
                                        0x01acdc93
                                        0x01acdcce
                                        0x01acdcce
                                        0x01acdc95
                                        0x01acdc9c
                                        0x01acdc6e
                                        0x01acdc72
                                        0x01acdc75
                                        0x01acdc77
                                        0x01acdc79
                                        0x01b1b551
                                        0x01b1b551
                                        0x00000000
                                        0x01acdc7f
                                        0x01acdc7f
                                        0x01acdc81
                                        0x00000000
                                        0x01acdc83
                                        0x01acdc86
                                        0x01acdc88
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01acdc88
                                        0x01acdc81
                                        0x01acdc79
                                        0x01acdc6c
                                        0x01acdc55
                                        0x01acdc47
                                        0x01acdc43
                                        0x00000000
                                        0x01acdc36
                                        0x01acdc23
                                        0x00000000
                                        0x01acdbff
                                        0x01acdbf1
                                        0x01acdbdf
                                        0x01acdb8f
                                        0x01acdb92
                                        0x01acdb95
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01acdb95
                                        0x01acdb8d
                                        0x01acdb85
                                        0x01acdb74
                                        0x01acdc9f
                                        0x01acdca2
                                        0x01acdcb0
                                        0x01acdcb0
                                        0x01acdad1
                                        0x01b1b4e5
                                        0x01b1b4c8
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01acd831
                                        0x01acd80d
                                        0x00000000
                                        0x01acd800
                                        0x01b1b47f
                                        0x01b1b485
                                        0x00000000
                                        0x01b1b485
                                        0x01acd665
                                        0x01acd652
                                        0x00000000

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: DebugPrintTimes
                                        • String ID:
                                        • API String ID: 3446177414-0
                                        • Opcode ID: df3cbc523c46adc0756591ff17284ddd7c3329330223b3e8d6b215c8dd6fcd23
                                        • Instruction ID: a14313e494d4ce07658b30fd9534290fcba547f9ce95fde94e9c8085a399f594
                                        • Opcode Fuzzy Hash: df3cbc523c46adc0756591ff17284ddd7c3329330223b3e8d6b215c8dd6fcd23
                                        • Instruction Fuzzy Hash: F4E1F530A00356CFEB39DF68CA80BA9BBB2BF45704F4541EDD90997295D7349D81CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE513A Relevance: 1.8, APIs: 1, Instructions: 258timeCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 67%
                                        			E01AE513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x1bad360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E01AFD0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E01AD2280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L01AD4620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E01AFF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E01ACFFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x1bab1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E01AFB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}































































                                        0x01ae5142
                                        0x01ae514c
                                        0x01ae5150
                                        0x01ae5157
                                        0x01ae5159
                                        0x01ae515e
                                        0x01ae5165
                                        0x01ae5169
                                        0x01ae516c
                                        0x01ae5172
                                        0x01ae5176
                                        0x01ae517a
                                        0x01ae517a
                                        0x01ae517a
                                        0x01ae517f
                                        0x01b26d8b
                                        0x01b26d8e
                                        0x01b26d91
                                        0x01b26d95
                                        0x01b26d98
                                        0x01b26d9c
                                        0x01b26da0
                                        0x01b26da3
                                        0x01b26da7
                                        0x01b26e26
                                        0x01b26e26
                                        0x01b26e2a
                                        0x01ae51f9
                                        0x01ae51f9
                                        0x01ae51fe
                                        0x01b26e33
                                        0x01b26e33
                                        0x01b26e39
                                        0x01b26e3d
                                        0x01b26e46
                                        0x01b26e50
                                        0x00000000
                                        0x00000000
                                        0x01b26e52
                                        0x01b26e53
                                        0x01b26e56
                                        0x01b26e5d
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b26e5f
                                        0x01b26e67
                                        0x01b26e77
                                        0x01b26e7f
                                        0x01b26e80
                                        0x01b26e88
                                        0x01b26e90
                                        0x01b26e9f
                                        0x01b26ea5
                                        0x01b26ea9
                                        0x01b26eb1
                                        0x01b26ebf
                                        0x00000000
                                        0x00000000
                                        0x01b26ecf
                                        0x01b26ed3
                                        0x00000000
                                        0x00000000
                                        0x01b26edb
                                        0x01b26ede
                                        0x01b26ee1
                                        0x01b26ee8
                                        0x01b26eeb
                                        0x01b26eed
                                        0x01b26ef0
                                        0x01b26ef4
                                        0x01b26ef8
                                        0x01b26efc
                                        0x00000000
                                        0x00000000
                                        0x01b26f0d
                                        0x01b26f11
                                        0x01b26f32
                                        0x01b26f37
                                        0x01b26f3b
                                        0x01b26f3e
                                        0x01b26f41
                                        0x01b26f46
                                        0x00000000
                                        0x00000000
                                        0x01b26f4c
                                        0x01b26f50
                                        0x01b26f50
                                        0x01b26f54
                                        0x01b26f62
                                        0x01b26f65
                                        0x01b26f6d
                                        0x01b26f7b
                                        0x01b26f7b
                                        0x01b26f93
                                        0x01b26f98
                                        0x01b26fa0
                                        0x01b26fa6
                                        0x01b26fb3
                                        0x01b26fb6
                                        0x01b26fbf
                                        0x01b26fc1
                                        0x01b26fd5
                                        0x01b26fda
                                        0x01b26fda
                                        0x01b26fdd
                                        0x01b26fe2
                                        0x01b26fe7
                                        0x01b26feb
                                        0x01b26fef
                                        0x01b26ff3
                                        0x01ae520c
                                        0x01ae520c
                                        0x01ae520f
                                        0x01ae5215
                                        0x01ae5234
                                        0x01ae523a
                                        0x01ae523a
                                        0x01ae5244
                                        0x01ae5245
                                        0x01ae5246
                                        0x01ae5251
                                        0x01ae5251
                                        0x01b26f13
                                        0x01b26f17
                                        0x01b26f17
                                        0x01b26f18
                                        0x01b26f1b
                                        0x01b26f1f
                                        0x01b26f23
                                        0x00000000
                                        0x01b26f28
                                        0x01ae5204
                                        0x01ae5204
                                        0x01ae5208
                                        0x00000000
                                        0x01ae5208
                                        0x01ae5185
                                        0x01ae5188
                                        0x01ae518a
                                        0x01ae518e
                                        0x01ae5195
                                        0x01b26db1
                                        0x01b26db5
                                        0x01b26db9
                                        0x01ae519b
                                        0x01ae519b
                                        0x01ae519e
                                        0x01ae51a7
                                        0x01ae51a9
                                        0x01ae51a9
                                        0x01ae51b5
                                        0x01ae51b8
                                        0x01ae51bb
                                        0x01ae51be
                                        0x01ae51c1
                                        0x01ae51c5
                                        0x01ae51c9
                                        0x01ae51cd
                                        0x01ae51cd
                                        0x01ae51d8
                                        0x01ae51dc
                                        0x01ae51e0
                                        0x01b26dcc
                                        0x01b26dd0
                                        0x01b26dd5
                                        0x01b26ddd
                                        0x01b26de1
                                        0x01b26de1
                                        0x01b26de5
                                        0x01b26deb
                                        0x01b26df1
                                        0x01b26df7
                                        0x01b26dfd
                                        0x01b26e01
                                        0x01b26e05
                                        0x01b26e09
                                        0x01b26e0d
                                        0x01b26e11
                                        0x01b26e11
                                        0x01ae51eb
                                        0x01b26e1a
                                        0x01b26e1f
                                        0x01b26e21
                                        0x01b26e23
                                        0x00000000
                                        0x01ae51f1
                                        0x01ae51f1
                                        0x00000000
                                        0x01ae51f1

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: DebugPrintTimes
                                        • String ID:
                                        • API String ID: 3446177414-0
                                        • Opcode ID: 32104dd3fe972dccd5952dd5d5e6e1192e7b599d0b93bd02cfd80204899bcf47
                                        • Instruction ID: 8041fd8e7505612d81a21121a3af5779bb0cdf1b6097a750e2197c484eb46ee5
                                        • Opcode Fuzzy Hash: 32104dd3fe972dccd5952dd5d5e6e1192e7b599d0b93bd02cfd80204899bcf47
                                        • Instruction Fuzzy Hash: 5DC1F1755083818FD359CF28C580A5AFBF1BF88308F184AAEF9998B352D771E945CB52
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE03E2 Relevance: 1.8, APIs: 1, Instructions: 254COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 74%
                                        			E01AE03E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x1bad360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E01AE0548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E01AFB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E01ACB02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x1ba7c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E01AD7D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E01AD7D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E01B37016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E01AF9830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E01B369A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x1ba7c04 != 0) {
						_t118 = _v12;
						_t120 = E01B3A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x1ba7bd8;
						if( *0x1ba7bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E01AF95D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E01AF99A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E01B33540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E01ABB1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E01AFAAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x1ba8474 - 3;
										if( *0x1ba8474 != 3) {
											 *0x1ba79dc =  *0x1ba79dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E01AD7D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E01AD7D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E01B37016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x1ba8708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x1ba7b00; // 0x0
							asm("ror esi, cl");
							 *0x1bab1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E01AF95D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E01AC7F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}








































                                        0x01ae03f1
                                        0x01ae03f7
                                        0x01ae03f9
                                        0x01ae03fb
                                        0x01ae03fd
                                        0x01ae0400
                                        0x01ae040a
                                        0x01b24c7a
                                        0x01ae0537
                                        0x01ae0547
                                        0x01ae0410
                                        0x01ae0410
                                        0x01ae0414
                                        0x01ae0417
                                        0x01ae041a
                                        0x01ae0421
                                        0x01ae0424
                                        0x01ae042b
                                        0x01ae043b
                                        0x01ae043e
                                        0x01ae043f
                                        0x01ae043f
                                        0x01ae0446
                                        0x01ae0449
                                        0x01ae044c
                                        0x01ae044f
                                        0x01ae0459
                                        0x01b24c8d
                                        0x01ae045f
                                        0x01ae045f
                                        0x01ae045f
                                        0x01ae0467
                                        0x01b24c97
                                        0x01b24c9d
                                        0x01b24ca4
                                        0x01b24caa
                                        0x01b24caf
                                        0x01b24cb1
                                        0x01b24cc3
                                        0x01b24cb3
                                        0x01b24cbc
                                        0x01b24cbc
                                        0x01b24cc8
                                        0x01b24ccb
                                        0x01b24cd7
                                        0x01b24cda
                                        0x01b24cdf
                                        0x01b24cdf
                                        0x01b24ccb
                                        0x01b24ca4
                                        0x01ae046d
                                        0x01ae046f
                                        0x01ae046f
                                        0x01ae0471
                                        0x01ae0476
                                        0x01ae047a
                                        0x01ae047b
                                        0x01ae0483
                                        0x01ae0489
                                        0x01ae048d
                                        0x00000000
                                        0x00000000
                                        0x01b24ce9
                                        0x01b24cef
                                        0x01b24d22
                                        0x01b24d22
                                        0x00000000
                                        0x01b24d22
                                        0x01b24cf1
                                        0x01b24cf7
                                        0x00000000
                                        0x00000000
                                        0x01b24cf9
                                        0x01b24cff
                                        0x00000000
                                        0x00000000
                                        0x01b24d05
                                        0x01b24d07
                                        0x00000000
                                        0x00000000
                                        0x01b24d0d
                                        0x01b24d0f
                                        0x01b24d14
                                        0x01b24d16
                                        0x00000000
                                        0x00000000
                                        0x01b24d1c
                                        0x01b24d1c
                                        0x01ae0499
                                        0x01ae0535
                                        0x01ae0535
                                        0x00000000
                                        0x01ae0535
                                        0x01ae04a6
                                        0x01b24d2c
                                        0x01b24d37
                                        0x01b24d39
                                        0x01b24d3b
                                        0x00000000
                                        0x00000000
                                        0x01b24d41
                                        0x01b24d48
                                        0x01ae0527
                                        0x01ae052b
                                        0x01ae052d
                                        0x01ae0530
                                        0x01ae0530
                                        0x00000000
                                        0x01ae052b
                                        0x01b24d4e
                                        0x01ae04ac
                                        0x01ae04ac
                                        0x01ae04af
                                        0x01ae04b2
                                        0x01ae04b7
                                        0x01ae04b9
                                        0x01ae04bb
                                        0x01ae04bd
                                        0x01ae04bf
                                        0x01ae04c5
                                        0x01ae04c9
                                        0x01b24d53
                                        0x01b24d59
                                        0x01b24db9
                                        0x01b24dba
                                        0x01b24dbf
                                        0x01b24dc2
                                        0x01b24dc4
                                        0x01b24dc7
                                        0x01b24dce
                                        0x00000000
                                        0x01b24dce
                                        0x01b24d5b
                                        0x01b24d61
                                        0x00000000
                                        0x00000000
                                        0x01b24d63
                                        0x01b24d69
                                        0x00000000
                                        0x00000000
                                        0x01b24d6b
                                        0x01b24d6e
                                        0x01b24d74
                                        0x01b24d76
                                        0x01b24d7c
                                        0x01b24d7e
                                        0x01b24d84
                                        0x01b24d89
                                        0x01b24d8c
                                        0x01b24d8d
                                        0x01b24d92
                                        0x01b24d95
                                        0x01b24d96
                                        0x01b24d98
                                        0x01b24d9a
                                        0x01b24d9f
                                        0x01b24da4
                                        0x01b24da6
                                        0x01b24da8
                                        0x01b24daf
                                        0x01b24db1
                                        0x01b24db1
                                        0x01b24daf
                                        0x01b24da6
                                        0x01b24d84
                                        0x01b24d7c
                                        0x00000000
                                        0x01b24d74
                                        0x01ae04d6
                                        0x01b24de1
                                        0x01ae04dc
                                        0x01ae04dc
                                        0x01ae04dc
                                        0x01ae04e4
                                        0x01b24deb
                                        0x01b24df1
                                        0x01b24df8
                                        0x01b24dfe
                                        0x01b24e03
                                        0x01b24e05
                                        0x01b24e17
                                        0x01b24e07
                                        0x01b24e10
                                        0x01b24e10
                                        0x01b24e1c
                                        0x01b24e1f
                                        0x01b24e35
                                        0x01b24e35
                                        0x01b24e1f
                                        0x01b24df8
                                        0x01ae04f1
                                        0x01ae04fa
                                        0x01b24e3f
                                        0x01b24e47
                                        0x01b24e5b
                                        0x01b24e61
                                        0x01b24e67
                                        0x01b24e69
                                        0x01b24e71
                                        0x01b24e73
                                        0x01ae0500
                                        0x01ae0500
                                        0x01ae0500
                                        0x01ae04fa
                                        0x01ae0508
                                        0x01ae051d
                                        0x01ae051d
                                        0x01ae051f
                                        0x01ae0524
                                        0x00000000
                                        0x01ae0524
                                        0x01ae0515
                                        0x01ae0517
                                        0x01b24e7a
                                        0x01b24e7c
                                        0x00000000
                                        0x00000000
                                        0x01b24e85
                                        0x00000000
                                        0x01b24e85
                                        0x00000000
                                        0x01ae0517

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8853df8b02ed2492e821a9c62350086194616f0b163f4afea72c570fdc129bb0
                                        • Instruction ID: a036514b1d10a160931b3bd06f44918d8bd6352885b4b4eefad34864c4e5a7d1
                                        • Opcode Fuzzy Hash: 8853df8b02ed2492e821a9c62350086194616f0b163f4afea72c570fdc129bb0
                                        • Instruction Fuzzy Hash: 97915C31F00625AFEB359B6CCA48BAE7BF4EB01714F0502A5FA15AB6D1D7B49C04C791
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABB171 Relevance: 1.7, APIs: 1, Instructions: 166COMMONLIBRARYCODE
                                        Download Yara Rule
                                        C-Code - Quality: 78%
                                        			E01ABB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x1b8f7a8);
				E01B0D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E01B0D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E01AFD000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E01AFF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E01B0DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E01AFB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E01AFB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E01AFE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E01AFA890() != 0) {
					goto L6;
				}
				goto L3;
			}






















                                        0x01abb171
                                        0x01abb171
                                        0x01abb171
                                        0x01abb171
                                        0x01abb171
                                        0x01abb176
                                        0x01abb17b
                                        0x01abb180
                                        0x01abb186
                                        0x01abb18f
                                        0x01abb198
                                        0x01abb1a4
                                        0x01abb1aa
                                        0x01b14802
                                        0x01b14802
                                        0x01b14805
                                        0x01b1480c
                                        0x01b1480e
                                        0x01abb1d1
                                        0x01abb1d3
                                        0x01abb1de
                                        0x01abb1de
                                        0x01b14817
                                        0x01b1481e
                                        0x01b14820
                                        0x01b14822
                                        0x01b14822
                                        0x01b14824
                                        0x01b14824
                                        0x01b1482a
                                        0x00000000
                                        0x00000000
                                        0x01b14835
                                        0x01b1483a
                                        0x01b1483d
                                        0x01b1483f
                                        0x01b14842
                                        0x01b14842
                                        0x01b14842
                                        0x01b14846
                                        0x01b1484c
                                        0x01b1484e
                                        0x01b14851
                                        0x01b14851
                                        0x01b14853
                                        0x01b14854
                                        0x01b14854
                                        0x01b14858
                                        0x01b1485a
                                        0x01b1485a
                                        0x01b1485d
                                        0x01b1485f
                                        0x01b14861
                                        0x01b14861
                                        0x01b14866
                                        0x01b1486b
                                        0x01b1486e
                                        0x01b14871
                                        0x01b14876
                                        0x01b14876
                                        0x01b14878
                                        0x01b1487b
                                        0x01b14884
                                        0x01b14884
                                        0x00000000
                                        0x01b1487d
                                        0x01b1487d
                                        0x01b14882
                                        0x01b14889
                                        0x01b14889
                                        0x01b1488f
                                        0x01b14891
                                        0x01b148e0
                                        0x01b148e2
                                        0x01b148e4
                                        0x01b148e4
                                        0x01b148e7
                                        0x01b148e7
                                        0x01b148ed
                                        0x01b148f4
                                        0x01b148f6
                                        0x01b14951
                                        0x01b14951
                                        0x01b14953
                                        0x01b14953
                                        0x01b14956
                                        0x01b14956
                                        0x01b14958
                                        0x01b14959
                                        0x01b14959
                                        0x01b1495d
                                        0x01b1495d
                                        0x01b1495f
                                        0x01b1495f
                                        0x01b14965
                                        0x01b14969
                                        0x01b149ba
                                        0x01b149ba
                                        0x01b149c1
                                        0x01b149c5
                                        0x01b149cc
                                        0x01b149d4
                                        0x01b149d7
                                        0x01b149da
                                        0x01b149e4
                                        0x01b149e5
                                        0x01b149f3
                                        0x01b14a02
                                        0x00000000
                                        0x01b14a02
                                        0x01b14972
                                        0x01b14974
                                        0x00000000
                                        0x00000000
                                        0x01b14976
                                        0x01b14979
                                        0x01b14982
                                        0x01b14983
                                        0x01b14984
                                        0x01b1498b
                                        0x01b1498d
                                        0x01b14991
                                        0x01b14993
                                        0x01b14999
                                        0x01b1499d
                                        0x01b149a2
                                        0x01b149a2
                                        0x01b149a2
                                        0x01b14999
                                        0x01b149ac
                                        0x00000000
                                        0x01b149b3
                                        0x01b148f8
                                        0x01b148fe
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b148fe
                                        0x01b14895
                                        0x01b1489c
                                        0x01b148ad
                                        0x01b148b2
                                        0x01b148b5
                                        0x01b148b7
                                        0x01b148ba
                                        0x01b148bc
                                        0x01b148c6
                                        0x01b148c6
                                        0x01b148cb
                                        0x01b148d1
                                        0x01b148d4
                                        0x01b148d8
                                        0x01b148d8
                                        0x00000000
                                        0x01b148d8
                                        0x01b148be
                                        0x01b148c0
                                        0x00000000
                                        0x00000000
                                        0x01b148c2
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b148c4
                                        0x00000000
                                        0x01b14882
                                        0x01b1487b
                                        0x01b14904
                                        0x01b14906
                                        0x00000000
                                        0x00000000
                                        0x01b14908
                                        0x01b1490e
                                        0x00000000
                                        0x00000000
                                        0x01b14910
                                        0x01b14917
                                        0x01b14917
                                        0x00000000
                                        0x01b14917
                                        0x01abb1ba
                                        0x01b147f9
                                        0x01b147fc
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b147fc
                                        0x01abb1c0
                                        0x01abb1c0
                                        0x01abb1c3
                                        0x01abb1cb
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: _vswprintf_s
                                        • String ID:
                                        • API String ID: 677850445-0
                                        • Opcode ID: 9be3d8a6fa96e851c2a3e1a4837f680aca0f5f1d86fec94d5a84826f8c938189
                                        • Instruction ID: 08fe8a6d4d5d48d7e49ecd3e8e4392512f1832d0696c1c9dfdbcff31c95a7475
                                        • Opcode Fuzzy Hash: 9be3d8a6fa96e851c2a3e1a4837f680aca0f5f1d86fec94d5a84826f8c938189
                                        • Instruction Fuzzy Hash: 1B51F371D002598EEF39CFA8C944BAEBBB1FF05710F5241EDE859AB286D7704941CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ADB944 Relevance: 1.7, APIs: 1, Instructions: 166COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 76%
                                        			E01ADB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x1bad360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E01AD7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E01B88CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E01AF9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E01AFB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E01AFCE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E01AD7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E01B88F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E01AFAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x1ba8628; // 0x0
								_v68 = _t77;
								_t78 =  *0x1ba862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x1ba8628; // 0x0
							_t116 =  *0x1ba862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}
















































                                        0x01adb94c
                                        0x01adb956
                                        0x01adb95c
                                        0x01adb95e
                                        0x01adb964
                                        0x01adb969
                                        0x01adb96d
                                        0x01adb96d
                                        0x01adb970
                                        0x01adb974
                                        0x01adb97a
                                        0x01adbadf
                                        0x01adbadf
                                        0x01adbae2
                                        0x01adbae4
                                        0x01adbae6
                                        0x01adbaf0
                                        0x01b22cb8
                                        0x01adbaf6
                                        0x01adbaf6
                                        0x01adbaf6
                                        0x01adbafd
                                        0x01adbb1f
                                        0x01adbb1f
                                        0x01adbaff
                                        0x01adbb00
                                        0x01adbb00
                                        0x01adbb03
                                        0x01adbb03
                                        0x01adbacb
                                        0x01adbacf
                                        0x01adbad0
                                        0x01adbad1
                                        0x01adbadc
                                        0x01adbadc
                                        0x01adb980
                                        0x01adb980
                                        0x01adb988
                                        0x01adb98b
                                        0x01adb98d
                                        0x01adb990
                                        0x01adb993
                                        0x01adb999
                                        0x01adb99b
                                        0x01adb9a1
                                        0x01adb9a5
                                        0x01adb9aa
                                        0x01adb9b0
                                        0x01adb9bb
                                        0x01adb9c0
                                        0x01adb9c3
                                        0x01adb9ca
                                        0x01adb9cc
                                        0x01adb9cf
                                        0x01adb9d3
                                        0x01adb9d7
                                        0x01adba94
                                        0x01adba94
                                        0x01adba98
                                        0x01adbaa3
                                        0x01b22ccb
                                        0x01adbaa9
                                        0x01adbaa9
                                        0x01adbaa9
                                        0x01adbab1
                                        0x01b22cd5
                                        0x01b22cdd
                                        0x01b22cdd
                                        0x01adbabb
                                        0x01adbabc
                                        0x01adbac2
                                        0x01adbac3
                                        0x01adbac3
                                        0x01adbac6
                                        0x00000000
                                        0x01adb9dd
                                        0x01adb9dd
                                        0x01adb9e7
                                        0x01adb9e7
                                        0x01adb9ec
                                        0x01adb9ec
                                        0x01adb9f1
                                        0x01adb9f5
                                        0x01adb9fa
                                        0x01adba00
                                        0x01adba0c
                                        0x01adba10
                                        0x01adba10
                                        0x01adba12
                                        0x01adba18
                                        0x00000000
                                        0x00000000
                                        0x01adbb26
                                        0x01adbb26
                                        0x01adba1e
                                        0x01adba1e
                                        0x01adba23
                                        0x01adba25
                                        0x01adba2c
                                        0x01adba30
                                        0x01adba35
                                        0x01adba35
                                        0x01adba41
                                        0x01adba46
                                        0x01adba4c
                                        0x01adba50
                                        0x01adba54
                                        0x01adba6a
                                        0x01adba6e
                                        0x01adba70
                                        0x01adba74
                                        0x01adba78
                                        0x01adba7a
                                        0x01adba7c
                                        0x01adba8e
                                        0x01adba90
                                        0x01adba92
                                        0x01adbb14
                                        0x01adbb14
                                        0x01adbb16
                                        0x01adbb16
                                        0x00000000
                                        0x01adba7c
                                        0x01adbb0a
                                        0x01adbb0d
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01adbb0f

                                        APIs
                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01ADB9A5
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                        • String ID:
                                        • API String ID: 885266447-0
                                        • Opcode ID: 96941338bb9e940f043afd5eefe63f8cf26adf158e0f82a5755e1da49146ae6b
                                        • Instruction ID: 6fbc06eedde0060a449f296d5aa73ebdb3acd13158cab5ebc3918aab96aa3969
                                        • Opcode Fuzzy Hash: 96941338bb9e940f043afd5eefe63f8cf26adf158e0f82a5755e1da49146ae6b
                                        • Instruction Fuzzy Hash: F9515871A08B41CFC724DF69C18092BBBF5FB89600F55896EF68687355D730E844CBA2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF4A2C Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 58%
                                        			E01AF4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x1bad360 ^ _t62;
				_v8 =  *0x1bad360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E01AD2280(_t26, 0x1ba8608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E01ACFFB0(_t41, _t51, 0x1ba8608);
						L2:
						 *0x1bab1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E01AFB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E01AD2280(_t28, 0x1ba8608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E01ACFFB0(_t42, _t53, 0x1ba8608);
							if(_t53 != 0) {
								L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E01ACFFB0(_t41, _t51, 0x1ba8608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}
























                                        0x01af4a2c
                                        0x01af4a34
                                        0x01af4a3c
                                        0x01af4a3e
                                        0x01af4a48
                                        0x01af4a4b
                                        0x01af4a4d
                                        0x01af4a51
                                        0x01af4a9c
                                        0x00000000
                                        0x00000000
                                        0x01af4aa3
                                        0x01af4aa8
                                        0x01af4aad
                                        0x01af4ab1
                                        0x01af4ade
                                        0x01af4ae3
                                        0x01af4a5a
                                        0x01af4a62
                                        0x01af4a6a
                                        0x01af4a6e
                                        0x01b2f203
                                        0x01af4a84
                                        0x01af4a88
                                        0x01af4a89
                                        0x01af4a8a
                                        0x01af4a95
                                        0x01af4a95
                                        0x01af4a79
                                        0x01af4a80
                                        0x01af4af2
                                        0x01af4af4
                                        0x01af4af9
                                        0x01af4aff
                                        0x01af4b01
                                        0x01af4b03
                                        0x01af4b08
                                        0x01b2f20a
                                        0x01b2f212
                                        0x01b2f216
                                        0x01b2f216
                                        0x01af4b08
                                        0x01af4b13
                                        0x01af4b1a
                                        0x01b2f229
                                        0x01b2f229
                                        0x01af4b1a
                                        0x01af4a82
                                        0x00000000
                                        0x01af4a82
                                        0x01af4ab7
                                        0x01af4acd
                                        0x01af4acd
                                        0x01af4ad5
                                        0x01af4ada
                                        0x00000000
                                        0x01af4ada
                                        0x01af4ac2
                                        0x01af4acb
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01af4acb
                                        0x01af4a53
                                        0x01af4a53
                                        0x01af4a58
                                        0x00000000

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: DebugPrintTimes
                                        • String ID:
                                        • API String ID: 3446177414-0
                                        • Opcode ID: cea6258fca58282a4feeb136d397517b29be100135c131f04c2e2b09eea9dbc4
                                        • Instruction ID: 34bd2ce36344ad6f94cfd7eb2871cb57abc3bdf767f136c97c020a9eaa6d591d
                                        • Opcode Fuzzy Hash: cea6258fca58282a4feeb136d397517b29be100135c131f04c2e2b09eea9dbc4
                                        • Instruction Fuzzy Hash: 553124322057119FD721AF98CA40B2BFBB5FF89B10F48456DFA5607A51C770D808CB85
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AD0050 Relevance: 1.6, APIs: 1, Instructions: 81timeCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 53%
                                        			E01AD0050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x1bad360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E01AE9ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E01AFB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E01B88A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E01AE9702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x1bab1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}




















                                        0x01ad0055
                                        0x01ad005d
                                        0x01ad0062
                                        0x01ad006c
                                        0x01ad006f
                                        0x01ad0074
                                        0x01ad007a
                                        0x01ad007a
                                        0x01ad0080
                                        0x01ad0080
                                        0x01ad0087
                                        0x01ad008d
                                        0x01ad008f
                                        0x01ad0093
                                        0x01ad0095
                                        0x01ad009b
                                        0x01ad00f8
                                        0x01ad00fb
                                        0x01ad00fc
                                        0x01ad00ff
                                        0x01ad0108
                                        0x01ad0108
                                        0x01ad00a2
                                        0x01ad00a6
                                        0x01ad00b3
                                        0x01ad00bc
                                        0x01ad00c5
                                        0x01ad00ca
                                        0x01b1c01e
                                        0x00000000
                                        0x00000000
                                        0x01b1c02d
                                        0x01ad00d5
                                        0x01ad00d9
                                        0x01b1c03d
                                        0x01b1c046
                                        0x01b1c046
                                        0x01ad00df
                                        0x01ad00e2
                                        0x01ad00ea
                                        0x01ad00ef
                                        0x01ad00f2
                                        0x01ad00f6
                                        0x01ad0111
                                        0x01ad0117
                                        0x01ad0117
                                        0x00000000
                                        0x01ad00f6
                                        0x01ad00d0
                                        0x01ad00d0
                                        0x00000000

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: DebugPrintTimes
                                        • String ID:
                                        • API String ID: 3446177414-0
                                        • Opcode ID: d4f48c05653dea3ad0e614332d1197daff8091e55aeec0335e5368de578e8623
                                        • Instruction ID: b3506d480c34d8148b315ca4ece97ac2fb312f20572214f45deeabb867398263
                                        • Opcode Fuzzy Hash: d4f48c05653dea3ad0e614332d1197daff8091e55aeec0335e5368de578e8623
                                        • Instruction Fuzzy Hash: 0431AC31241F04DFD726CB28CA44B9AB7E5FF88724F14856DE59A87A90EB71A801CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE2581 Relevance: 1.6, Strings: 1, Instructions: 329COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 82%
                                        			E01AE2581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, intOrPtr _a35) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t242;
				signed int _t246;
				void* _t247;
				signed int _t253;
				signed int _t255;
				intOrPtr _t257;
				signed int _t260;
				signed int _t267;
				signed int _t270;
				signed int _t278;
				intOrPtr _t284;
				signed int _t286;
				signed int _t288;
				void* _t289;
				signed int _t290;
				signed int _t291;
				unsigned int _t294;
				signed int _t298;
				void* _t299;
				signed int _t300;
				signed int _t304;
				intOrPtr _t319;
				signed int _t328;
				signed int _t330;
				signed int _t331;
				signed int _t335;
				signed int _t336;
				intOrPtr* _t338;
				signed int _t339;
				signed int _t341;
				signed int _t343;
				void* _t344;
				void* _t346;
				void* _t347;

				_t341 = _t343;
				_t344 = _t343 - 0x4c;
				_v8 =  *0x1bad360 ^ _t341;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t335 = 0x1bab2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t294 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t347 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t284 = 0x48;
				_t314 = 0 | _t347 == 0x00000000;
				_t328 = 0;
				_v37 = _t347 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t284 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t336 = 0xc0000106;
						goto L32;
					} else {
						_t335 = L01AD4620(_t294,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t284);
						_v52 = _t335;
						__eflags = _t335;
						if(_t335 == 0) {
							_t336 = 0xc0000017;
							goto L32;
						} else {
							 *(_t335 + 0x44) =  *(_t335 + 0x44) & 0x00000000;
							_t50 = _t335 + 0x48; // 0x48
							_t330 = _t50;
							_t314 = _v32;
							 *((intOrPtr*)(_t335 + 0x3c)) = _t284;
							_t286 = 0;
							 *((short*)(_t335 + 0x30)) = _v48;
							__eflags = _t314;
							if(_t314 != 0) {
								 *(_t335 + 0x18) = _t330;
								__eflags = _t314 - 0x1ba8478;
								 *_t335 = ((0 | _t314 == 0x01ba8478) - 0x00000001 & 0xfffffffb) + 7;
								E01AFF3E0(_t330,  *((intOrPtr*)(_t314 + 4)),  *_t314 & 0x0000ffff);
								_t314 = _v32;
								_t344 = _t344 + 0xc;
								_t286 = 1;
								__eflags = _a8;
								_t330 = _t330 + (( *_t314 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t278 = E01B439F2(_t330);
									_t314 = _v32;
									_t330 = _t278;
								}
							}
							_t298 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t336 = _v68;
								__eflags = 0;
								 *((short*)(_t330 - 2)) = 0;
								goto L32;
							} else {
								_t288 = _t335 + _t286 * 4;
								_v56 = _t288;
								do {
									__eflags = _t314;
									if(_t314 != 0) {
										_t242 =  *(_v60 + _t298 * 4);
										__eflags = _t242;
										if(_t242 == 0) {
											goto L30;
										} else {
											__eflags = _t242 == 5;
											if(_t242 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t288 =  *(_v60 + _t298 * 4);
										 *(_t288 + 0x18) = _t330;
										_t246 =  *(_v60 + _t298 * 4);
										__eflags = _t246 - 8;
										if(_t246 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t246 * 4 +  &M01AE2959))) {
												case 0:
													__ax =  *0x1ba8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E01AFF3E0(__edi,  *0x1ba848c, __ax & 0x0000ffff);
														__eax =  *0x1ba8488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E01AFF3E0(_t330, _v80, _v64);
													_t273 = _v64;
													goto L26;
												case 2:
													 *0x1ba8480 & 0x0000ffff = E01AFF3E0(__edi,  *0x1ba8484,  *0x1ba8480 & 0x0000ffff);
													__eax =  *0x1ba8480 & 0x0000ffff;
													__eax = ( *0x1ba8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E01AFF3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E01AFF3E0(_t330, _v76, _v36);
														_t273 = _v36;
													}
													L26:
													_t344 = _t344 + 0xc;
													_t330 = _t330 + (_t273 >> 1) * 2 + 2;
													__eflags = _t330;
													L27:
													_push(0x3b);
													_pop(_t275);
													 *((short*)(_t330 - 2)) = _t275;
													goto L28;
												case 6:
													__ebx =  *0x1ba575c;
													__eflags = __ebx - 0x1ba575c;
													if(__ebx != 0x1ba575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E01AFF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x1ba575c;
														} while (__ebx != 0x1ba575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1ba8478 & 0x0000ffff = E01AFF3E0(__edi,  *0x1ba847c,  *0x1ba8478 & 0x0000ffff);
													__eax =  *0x1ba8478 & 0x0000ffff;
													__eax = ( *0x1ba8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E01B439F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1ba6e58 & 0x0000ffff = E01AFF3E0(__edi,  *0x1ba6e5c,  *0x1ba6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1ba6e58 & 0x0000ffff;
													__eax = ( *0x1ba6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t298 = _v16;
													_t314 = _v32;
													L29:
													_t288 = _t288 + 4;
													__eflags = _t288;
													_v56 = _t288;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t298 = _t298 + 1;
									_v16 = _t298;
									__eflags = _t298 - _v48;
								} while (_t298 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t246 =  *(_v60 + _t328 * 4);
						if(_t246 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t246 * 4 +  &M01AE2935))) {
							case 0:
								__ax =  *0x1ba8488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t314 =  &_v64;
								_v80 = E01AE2E3E(0,  &_v64);
								_t284 = _t284 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1ba8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1ba8480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E01ACEEF0(0x1ba79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E01ACEB70(__ecx, 0x1ba79a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t220 = _v72;
											__eflags = _t220;
											if(_t220 != 0) {
												L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t220);
											}
											_t221 = _v52;
											__eflags = _t221;
											if(_t221 != 0) {
												__eflags = _t336;
												if(_t336 < 0) {
													L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t221);
													_t221 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t294 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1ba7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E01ACEB70(__ecx, 0x1ba79a0);
										__eax = _v52;
										L36:
										_pop(_t329);
										_pop(_t337);
										__eflags = _v8 ^ _t341;
										_pop(_t285);
										return E01AFB640(_t221, _t285, _v8 ^ _t341, _t314, _t329, _t337);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t280 = _v56;
								if(_v56 != 0) {
									_t314 =  &_v36;
									_t282 = E01AE2E3E(_t280,  &_v36);
									_t294 = _v36;
									_v76 = _t282;
								}
								if(_t294 == 0) {
									goto L44;
								} else {
									_t284 = _t284 + 2 + _t294;
								}
								goto L14;
							case 6:
								__eax =  *0x1ba5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1ba8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1ba8478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1ba6e58 & 0x0000ffff;
								__eax = ( *0x1ba6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t328 = _t328 + 1;
								if(_t328 >= _v48) {
									goto L16;
								} else {
									_t314 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t299 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("scasb");
					 *((intOrPtr*)(_t335 + 0x28)) =  *((intOrPtr*)(_t335 + 0x28)) + _t344;
					asm("scasb");
					_t247 = _t246 + _t344;
					asm("daa");
					asm("scasb");
					 *_t335 =  *_t335 + _t341;
					asm("scasb");
					 *((intOrPtr*)(_t335 + 0x28)) =  *((intOrPtr*)(_t335 + 0x28)) + _t247;
					asm("scasb");
					 *0x1f01ae26 =  *0x1f01ae26 + _t247;
					_pop(_t289);
					_t346 = _t247;
					 *((intOrPtr*)(_t335 - 0x4da4caff)) =  *((intOrPtr*)(_t335 - 0x4da4caff)) - _t299;
					 *1 =  *1 + _t344;
					 *((intOrPtr*)(_t335 - 0x51d77fff)) =  *((intOrPtr*)(_t335 - 0x51d77fff)) - _t341;
					_t338 = _t335 + _t335;
					asm("daa");
					asm("scasb");
					 *_t338 =  *_t338 + _t289;
					 *((intOrPtr*)(_t338 - 0x51d7b1ff)) =  *((intOrPtr*)(_t338 - 0x51d7b1ff)) - _t299;
					_a35 = _a35 + _t289;
					asm("scasb");
					_pop(_t290);
					asm("scasb");
					 *((intOrPtr*)(_t346 + _t290 * 2)) =  *((intOrPtr*)(_t346 + _t290 * 2)) + _t338;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x1b8ff00);
					E01B0D08C(_t290, _t330, _t338);
					_v44 =  *[fs:0x18];
					_t331 = 0;
					 *_a24 = 0;
					_t291 = _a12;
					__eflags = _t291;
					if(_t291 == 0) {
						_t253 = 0xc0000100;
					} else {
						_v8 = 0;
						_t339 = 0xc0000100;
						_v52 = 0xc0000100;
						_t255 = 4;
						while(1) {
							_v40 = _t255;
							__eflags = _t255;
							if(_t255 == 0) {
								break;
							}
							_t304 = _t255 * 0xc;
							_v48 = _t304;
							__eflags = _t291 -  *((intOrPtr*)(_t304 + 0x1a91664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t270 = E01AFE5C0(_a8,  *((intOrPtr*)(_t304 + 0x1a91668)), _t291);
									_t346 = _t346 + 0xc;
									__eflags = _t270;
									if(__eflags == 0) {
										_t339 = E01B351BE(_t291,  *((intOrPtr*)(_v48 + 0x1a9166c)), _a16, _t331, _t339, __eflags, _a20, _a24);
										_v52 = _t339;
										break;
									} else {
										_t255 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t255 = _t255 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t339;
						__eflags = _t339;
						if(_t339 < 0) {
							__eflags = _t339 - 0xc0000100;
							if(_t339 == 0xc0000100) {
								_t300 = _a4;
								__eflags = _t300;
								if(_t300 != 0) {
									_v36 = _t300;
									__eflags =  *_t300 - _t331;
									if( *_t300 == _t331) {
										_t339 = 0xc0000100;
										goto L76;
									} else {
										_t319 =  *((intOrPtr*)(_v44 + 0x30));
										_t257 =  *((intOrPtr*)(_t319 + 0x10));
										__eflags =  *((intOrPtr*)(_t257 + 0x48)) - _t300;
										if( *((intOrPtr*)(_t257 + 0x48)) == _t300) {
											__eflags =  *(_t319 + 0x1c);
											if( *(_t319 + 0x1c) == 0) {
												L106:
												_t339 = E01AE2AE4( &_v36, _a8, _t291, _a16, _a20, _a24);
												_v32 = _t339;
												__eflags = _t339 - 0xc0000100;
												if(_t339 != 0xc0000100) {
													goto L69;
												} else {
													_t331 = 1;
													_t300 = _v36;
													goto L75;
												}
											} else {
												_t260 = E01AC6600( *(_t319 + 0x1c));
												__eflags = _t260;
												if(_t260 != 0) {
													goto L106;
												} else {
													_t300 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t339 = E01AE2C50(_t300, _a8, _t291, _a16, _a20, _a24, _t331);
											L76:
											_v32 = _t339;
											goto L69;
										}
									}
									goto L108;
								} else {
									E01ACEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t339 = _a24;
									_t267 = E01AE2AE4( &_v36, _a8, _t291, _a16, _a20, _t339);
									_v32 = _t267;
									__eflags = _t267 - 0xc0000100;
									if(_t267 == 0xc0000100) {
										_v32 = E01AE2C50(_v36, _a8, _t291, _a16, _a20, _t339, 1);
									}
									_v8 = _t331;
									E01AE2ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t253 = _t339;
					}
					L70:
					return E01B0D0D1(_t253);
				}
				L108:
			}























































                                        0x01ae2584
                                        0x01ae2586
                                        0x01ae2590
                                        0x01ae2596
                                        0x01ae2597
                                        0x01ae2598
                                        0x01ae2599
                                        0x01ae259e
                                        0x01ae25a4
                                        0x01ae25a9
                                        0x01ae25ac
                                        0x01ae25ae
                                        0x01ae25b1
                                        0x01ae25b2
                                        0x01ae25b5
                                        0x01ae25b8
                                        0x01ae25bb
                                        0x01ae25bc
                                        0x01ae25bf
                                        0x01ae25c2
                                        0x01ae25c5
                                        0x01ae25c6
                                        0x01ae25cb
                                        0x01ae25ce
                                        0x01ae25d8
                                        0x01ae25db
                                        0x01ae25dd
                                        0x01ae25de
                                        0x01ae25e1
                                        0x01ae25e3
                                        0x01ae25e9
                                        0x01ae26da
                                        0x01ae26da
                                        0x01ae26dd
                                        0x01ae26e2
                                        0x01b25b56
                                        0x00000000
                                        0x01ae26e8
                                        0x01ae26f9
                                        0x01ae26fb
                                        0x01ae26fe
                                        0x01ae2700
                                        0x01b25b60
                                        0x00000000
                                        0x01ae2706
                                        0x01ae2706
                                        0x01ae270a
                                        0x01ae270a
                                        0x01ae270d
                                        0x01ae2713
                                        0x01ae2716
                                        0x01ae2718
                                        0x01ae271c
                                        0x01ae271e
                                        0x01b25b6c
                                        0x01b25b6f
                                        0x01b25b7f
                                        0x01b25b89
                                        0x01b25b8e
                                        0x01b25b93
                                        0x01b25b96
                                        0x01b25b9c
                                        0x01b25ba0
                                        0x01b25ba3
                                        0x01b25bab
                                        0x01b25bb0
                                        0x01b25bb3
                                        0x01b25bb3
                                        0x01b25ba3
                                        0x01ae2724
                                        0x01ae2726
                                        0x01ae2729
                                        0x01ae272c
                                        0x01ae279d
                                        0x01ae279d
                                        0x01ae27a0
                                        0x01ae27a2
                                        0x00000000
                                        0x01ae272e
                                        0x01ae272e
                                        0x01ae2731
                                        0x01ae2734
                                        0x01ae2734
                                        0x01ae2736
                                        0x01b25bc1
                                        0x01b25bc1
                                        0x01b25bc4
                                        0x00000000
                                        0x01b25bca
                                        0x01b25bca
                                        0x01b25bcd
                                        0x00000000
                                        0x01b25bd3
                                        0x00000000
                                        0x01b25bd3
                                        0x01b25bcd
                                        0x01ae273c
                                        0x01ae273c
                                        0x01ae2742
                                        0x01ae2747
                                        0x01ae274a
                                        0x01ae274d
                                        0x01ae2750
                                        0x00000000
                                        0x01ae2756
                                        0x01ae2756
                                        0x00000000
                                        0x01ae2902
                                        0x01ae2908
                                        0x01ae290b
                                        0x00000000
                                        0x01ae2911
                                        0x01ae291c
                                        0x01ae2921
                                        0x00000000
                                        0x01ae2921
                                        0x00000000
                                        0x00000000
                                        0x01ae2880
                                        0x01ae2887
                                        0x01ae288c
                                        0x00000000
                                        0x00000000
                                        0x01ae2805
                                        0x01ae280a
                                        0x01ae2814
                                        0x01ae2816
                                        0x00000000
                                        0x00000000
                                        0x01ae281e
                                        0x01ae2821
                                        0x01ae2823
                                        0x00000000
                                        0x01ae2829
                                        0x01ae2829
                                        0x01ae2831
                                        0x01ae283c
                                        0x01ae283e
                                        0x00000000
                                        0x01ae283e
                                        0x00000000
                                        0x00000000
                                        0x01ae284e
                                        0x01ae2850
                                        0x01ae2851
                                        0x01ae2854
                                        0x01ae2857
                                        0x01ae285a
                                        0x01ae285c
                                        0x01ae285d
                                        0x00000000
                                        0x00000000
                                        0x01ae275d
                                        0x01ae2761
                                        0x00000000
                                        0x01ae2767
                                        0x01ae276e
                                        0x01ae2773
                                        0x01ae2773
                                        0x01ae2776
                                        0x01ae2778
                                        0x01ae277e
                                        0x01ae277e
                                        0x01ae2781
                                        0x01ae2781
                                        0x01ae2783
                                        0x01ae2784
                                        0x00000000
                                        0x00000000
                                        0x01b25bd8
                                        0x01b25bde
                                        0x01b25be4
                                        0x01b25be6
                                        0x01b25be8
                                        0x01b25be9
                                        0x01b25bee
                                        0x01b25bf8
                                        0x01b25bff
                                        0x01b25c01
                                        0x01b25c04
                                        0x01b25c07
                                        0x01b25c0b
                                        0x01b25c0d
                                        0x01b25c0d
                                        0x01b25c15
                                        0x01b25c18
                                        0x01b25c1b
                                        0x01b25c1b
                                        0x01b25c1e
                                        0x00000000
                                        0x00000000
                                        0x01ae28c3
                                        0x01ae28c8
                                        0x01ae28d2
                                        0x01ae28d4
                                        0x01ae28d8
                                        0x01ae28db
                                        0x01b25c26
                                        0x01b25c28
                                        0x01b25c2d
                                        0x01b25c2d
                                        0x00000000
                                        0x00000000
                                        0x01b25c34
                                        0x01b25c36
                                        0x01b25c49
                                        0x01b25c4e
                                        0x01b25c54
                                        0x01b25c5b
                                        0x01b25c5d
                                        0x01b25c60
                                        0x01ae2788
                                        0x01ae2788
                                        0x01ae278b
                                        0x01ae278e
                                        0x01ae278e
                                        0x01ae278e
                                        0x01ae2791
                                        0x00000000
                                        0x00000000
                                        0x01ae2756
                                        0x01ae2750
                                        0x00000000
                                        0x01ae2794
                                        0x01ae2794
                                        0x01ae2795
                                        0x01ae2798
                                        0x01ae2798
                                        0x00000000
                                        0x01ae2734
                                        0x01ae272c
                                        0x01ae2700
                                        0x01ae25ef
                                        0x01ae25ef
                                        0x01ae25ef
                                        0x01ae25f2
                                        0x01ae25f8
                                        0x00000000
                                        0x00000000
                                        0x01ae25fe
                                        0x00000000
                                        0x01ae28e6
                                        0x01ae28ec
                                        0x01ae28ef
                                        0x01ae28f5
                                        0x01ae28f8
                                        0x01ae28f8
                                        0x00000000
                                        0x01ae28f8
                                        0x00000000
                                        0x00000000
                                        0x01ae2866
                                        0x01ae2866
                                        0x01ae2876
                                        0x01ae2879
                                        0x00000000
                                        0x00000000
                                        0x01ae27e0
                                        0x01ae27e7
                                        0x01ae27e9
                                        0x01ae27eb
                                        0x01b25afd
                                        0x00000000
                                        0x01b25afd
                                        0x00000000
                                        0x00000000
                                        0x01ae2633
                                        0x01ae2638
                                        0x01ae263b
                                        0x01ae263c
                                        0x01ae263e
                                        0x01ae2640
                                        0x01ae2642
                                        0x01ae2647
                                        0x01ae2649
                                        0x01ae264e
                                        0x01ae2650
                                        0x01ae2653
                                        0x01ae2659
                                        0x01ae26a2
                                        0x01ae26a7
                                        0x01ae26ac
                                        0x01ae26b2
                                        0x01b25b11
                                        0x01b25b15
                                        0x01b25b17
                                        0x00000000
                                        0x01ae26b8
                                        0x01ae26b8
                                        0x01ae26ba
                                        0x01ae27a6
                                        0x01ae27a6
                                        0x01ae27a9
                                        0x01ae27ab
                                        0x01ae27b9
                                        0x01ae27b9
                                        0x01ae27be
                                        0x01ae27c1
                                        0x01ae27c3
                                        0x01ae27c5
                                        0x01ae27c7
                                        0x01b25c74
                                        0x01b25c79
                                        0x01b25c79
                                        0x01ae27c7
                                        0x00000000
                                        0x01ae26c0
                                        0x01ae26c0
                                        0x01ae26c3
                                        0x01ae26c6
                                        0x01ae26c6
                                        0x01ae26c9
                                        0x01ae26c9
                                        0x00000000
                                        0x01ae26c9
                                        0x01ae26ba
                                        0x01ae265b
                                        0x01ae265b
                                        0x01ae265e
                                        0x01ae2667
                                        0x01ae266d
                                        0x01ae2677
                                        0x01ae267c
                                        0x01ae267f
                                        0x01ae2681
                                        0x01b25b49
                                        0x01b25b4e
                                        0x01ae27cd
                                        0x01ae27d0
                                        0x01ae27d1
                                        0x01ae27d2
                                        0x01ae27d4
                                        0x01ae27dd
                                        0x01ae2687
                                        0x01ae2687
                                        0x01ae268a
                                        0x01ae268b
                                        0x01ae268e
                                        0x01ae268f
                                        0x01ae2691
                                        0x01ae2696
                                        0x01ae2698
                                        0x01ae269d
                                        0x01ae269f
                                        0x00000000
                                        0x01ae269f
                                        0x01ae2681
                                        0x00000000
                                        0x00000000
                                        0x01ae2846
                                        0x00000000
                                        0x00000000
                                        0x01ae2605
                                        0x01ae260a
                                        0x01ae260c
                                        0x01ae2611
                                        0x01ae2616
                                        0x01ae2619
                                        0x01ae2619
                                        0x01ae261e
                                        0x00000000
                                        0x01ae2624
                                        0x01ae2627
                                        0x01ae2627
                                        0x00000000
                                        0x00000000
                                        0x01b25b1f
                                        0x00000000
                                        0x00000000
                                        0x01ae2894
                                        0x01ae289b
                                        0x01ae289d
                                        0x01ae28a1
                                        0x01b25b2b
                                        0x01b25b2e
                                        0x01b25b2e
                                        0x01ae28a7
                                        0x01ae28a9
                                        0x01b25b04
                                        0x01b25b09
                                        0x01b25b09
                                        0x01b25b09
                                        0x00000000
                                        0x00000000
                                        0x01b25b35
                                        0x01b25b3c
                                        0x01ae28fb
                                        0x01ae28fb
                                        0x01ae26cc
                                        0x01ae26cc
                                        0x01ae26d0
                                        0x00000000
                                        0x01ae26d2
                                        0x01ae26d2
                                        0x00000000
                                        0x01ae26d2
                                        0x00000000
                                        0x00000000
                                        0x01ae25fe
                                        0x01ae292d
                                        0x01ae292f
                                        0x01ae2930
                                        0x01ae2935
                                        0x01ae2937
                                        0x01ae2938
                                        0x01ae293b
                                        0x01ae293c
                                        0x01ae293e
                                        0x01ae293f
                                        0x01ae2940
                                        0x01ae2942
                                        0x01ae2944
                                        0x01ae2947
                                        0x01ae2948
                                        0x01ae294e
                                        0x01ae2951
                                        0x01ae2952
                                        0x01ae2958
                                        0x01ae295a
                                        0x01ae2960
                                        0x01ae2962
                                        0x01ae2963
                                        0x01ae2964
                                        0x01ae2966
                                        0x01ae296c
                                        0x01ae296f
                                        0x01ae2972
                                        0x01ae2977
                                        0x01ae2978
                                        0x01ae297d
                                        0x01ae297e
                                        0x01ae297f
                                        0x01ae2980
                                        0x01ae2981
                                        0x01ae2982
                                        0x01ae2983
                                        0x01ae2984
                                        0x01ae2985
                                        0x01ae2986
                                        0x01ae2987
                                        0x01ae2988
                                        0x01ae2989
                                        0x01ae298a
                                        0x01ae298b
                                        0x01ae298c
                                        0x01ae298d
                                        0x01ae298e
                                        0x01ae298f
                                        0x01ae2990
                                        0x01ae2992
                                        0x01ae2997
                                        0x01ae29a3
                                        0x01ae29a6
                                        0x01ae29ab
                                        0x01ae29ad
                                        0x01ae29b0
                                        0x01ae29b2
                                        0x01b25c80
                                        0x01ae29b8
                                        0x01ae29b8
                                        0x01ae29bb
                                        0x01ae29c0
                                        0x01ae29c5
                                        0x01ae29c6
                                        0x01ae29c6
                                        0x01ae29c9
                                        0x01ae29cb
                                        0x00000000
                                        0x00000000
                                        0x01ae29cd
                                        0x01ae29d0
                                        0x01ae29d9
                                        0x01ae29db
                                        0x01ae29dd
                                        0x01ae2a7f
                                        0x01ae2a84
                                        0x01ae2a87
                                        0x01ae2a89
                                        0x01b25ca1
                                        0x01b25ca3
                                        0x00000000
                                        0x01ae2a8f
                                        0x01ae2a8f
                                        0x00000000
                                        0x01ae2a8f
                                        0x00000000
                                        0x01ae29e3
                                        0x01ae29e3
                                        0x01ae29e3
                                        0x00000000
                                        0x01ae29e3
                                        0x01ae29dd
                                        0x00000000
                                        0x01ae29db
                                        0x01ae29e6
                                        0x01ae29e9
                                        0x01ae29eb
                                        0x01ae29ed
                                        0x01ae29f3
                                        0x01ae29f5
                                        0x01ae29f8
                                        0x01ae29fa
                                        0x01ae2a97
                                        0x01ae2a9a
                                        0x01ae2a9d
                                        0x01ae2add
                                        0x00000000
                                        0x01ae2a9f
                                        0x01ae2aa2
                                        0x01ae2aa5
                                        0x01ae2aa8
                                        0x01ae2aab
                                        0x01b25cab
                                        0x01b25caf
                                        0x01b25cc5
                                        0x01b25cda
                                        0x01b25cdc
                                        0x01b25cdf
                                        0x01b25ce5
                                        0x00000000
                                        0x01b25ceb
                                        0x01b25ced
                                        0x01b25cee
                                        0x00000000
                                        0x01b25cee
                                        0x01b25cb1
                                        0x01b25cb4
                                        0x01b25cb9
                                        0x01b25cbb
                                        0x00000000
                                        0x01b25cbd
                                        0x01b25cbd
                                        0x00000000
                                        0x01b25cbd
                                        0x01b25cbb
                                        0x01ae2ab1
                                        0x01ae2ab1
                                        0x01ae2ac4
                                        0x01ae2ac6
                                        0x01ae2ac6
                                        0x00000000
                                        0x01ae2ac6
                                        0x01ae2aab
                                        0x00000000
                                        0x01ae2a00
                                        0x01ae2a09
                                        0x01ae2a0e
                                        0x01ae2a21
                                        0x01ae2a24
                                        0x01ae2a35
                                        0x01ae2a3a
                                        0x01ae2a3d
                                        0x01ae2a42
                                        0x01ae2a59
                                        0x01ae2a59
                                        0x01ae2a5c
                                        0x01ae2a5f
                                        0x01ae2a5f
                                        0x01ae29fa
                                        0x01ae29f3
                                        0x01ae2a64
                                        0x01ae2a64
                                        0x01ae2a6b
                                        0x01ae2a6b
                                        0x01ae2a6d
                                        0x01ae2a72
                                        0x01ae2a72
                                        0x00000000

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: PATH
                                        • API String ID: 0-1036084923
                                        • Opcode ID: d3adfc0a3704b8fddc8f8c94b8fee677592c45524a0d77ce228cbcd7a50b1312
                                        • Instruction ID: 1190f4ea3554615311bbbcfb14ae9367add265ffca9baa80a0b3226bc3630078
                                        • Opcode Fuzzy Hash: d3adfc0a3704b8fddc8f8c94b8fee677592c45524a0d77ce228cbcd7a50b1312
                                        • Instruction Fuzzy Hash: E2C1A0B1E40219DFDB29DF99D985BAEBBF9FF48740F48412AE501AB250D734A841CB60
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABC962 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 42%
                                        			E01ABC962(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				intOrPtr _t22;
				void* _t26;
				void* _t27;
				void* _t32;
				intOrPtr _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x1bad360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E01ACEEF0(0x1ba70a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E01B3F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E01ACEB70(_t29, 0x1ba70a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E01AFB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E01B3F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x1ba70c0; // 0x0
					while(_t38 != 0x1ba70c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x1bab1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}


















                                        0x01abc96a
                                        0x01abc974
                                        0x01abc988
                                        0x01abc98a
                                        0x01b27c9d
                                        0x01b27c9f
                                        0x01b27ca4
                                        0x01b27cae
                                        0x01b27cf0
                                        0x01b27cf5
                                        0x01b27cfa
                                        0x01abc992
                                        0x01abc996
                                        0x01abc997
                                        0x01abc998
                                        0x01abc9a3
                                        0x01abc9a3
                                        0x01b27cb0
                                        0x01b27cb7
                                        0x01b27cbb
                                        0x00000000
                                        0x00000000
                                        0x01b27cbd
                                        0x01b27ce8
                                        0x01b27cc5
                                        0x01b27cc8
                                        0x01b27cca
                                        0x01b27cd0
                                        0x01b27cd6
                                        0x01b27cde
                                        0x01b27ce4
                                        0x01b27ce4
                                        0x01b27cd0
                                        0x00000000
                                        0x01b27ce8
                                        0x01abc990
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 4e1fec38f745a10c2c3e1ad0cb60a7cd92567adc2971e510384740ea4c14684a
                                        • Instruction ID: b4e2be5278523616114e89d5ce7c12d8b24cc187b9a35d8808056053e9879cbb
                                        • Opcode Fuzzy Hash: 4e1fec38f745a10c2c3e1ad0cb60a7cd92567adc2971e510384740ea4c14684a
                                        • Instruction Fuzzy Hash: 621125313086129BCB28AF3DDC8692B7BE5FBA8610F40016DF94583651DF20EC14C7D1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEFAB0 Relevance: 1.6, Strings: 1, Instructions: 306COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 80%
                                        			E01AEFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E01ACEEF0(0x1ba7b60);
					_t134 =  *0x1ba7b84; // 0x77e07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x1ba7b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x1ba7b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E01AC6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E01AC76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E01B58938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E01ABB150();
													}
													_t116 = E01B56D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E01AC75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x1ba8638; // 0x0
																	_t122 = L01AC38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E01AC76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E01AC76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L01AEFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L01AC70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E01AEFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E01AEFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E01AEFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E01AEFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E01AEFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x1ba7b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x1ba7b84 = _t75;
						_t73 = E01ACEB70(_t134, 0x1ba7b60);
						if( *0x1ba7b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E01ACFF60( *0x1ba7b20);
							}
						}
						goto L5;
					}
				}
			}

















































                                        0x01aefab0
                                        0x01aefab2
                                        0x01aefab3
                                        0x01aefab4
                                        0x01aefabc
                                        0x01aefac0
                                        0x01aefb14
                                        0x01aefb17
                                        0x01aefac2
                                        0x01aefac8
                                        0x01aefacd
                                        0x01aefad3
                                        0x01aefad3
                                        0x01aefadd
                                        0x01aefb18
                                        0x01aefb1b
                                        0x01aefb1d
                                        0x01aefb1e
                                        0x01aefb1f
                                        0x01aefb20
                                        0x01aefb21
                                        0x01aefb22
                                        0x01aefb23
                                        0x01aefb24
                                        0x01aefb25
                                        0x01aefb26
                                        0x01aefb27
                                        0x01aefb28
                                        0x01aefb29
                                        0x01aefb2a
                                        0x01aefb2b
                                        0x01aefb2c
                                        0x01aefb2d
                                        0x01aefb2e
                                        0x01aefb2f
                                        0x01aefb3a
                                        0x01aefb3b
                                        0x01aefb3e
                                        0x01aefb41
                                        0x01aefb44
                                        0x01aefb47
                                        0x01aefb4a
                                        0x01aefb4d
                                        0x01aefb53
                                        0x01b2bdcb
                                        0x01b2bdcb
                                        0x01aefb59
                                        0x01aefb5b
                                        0x01aefb5b
                                        0x01aefb5e
                                        0x01b2bdd5
                                        0x01b2bdd8
                                        0x00000000
                                        0x01b2bdda
                                        0x00000000
                                        0x01b2bdda
                                        0x01aefb64
                                        0x01aefb64
                                        0x01aefb64
                                        0x01aefb67
                                        0x01aefb6e
                                        0x01aefb70
                                        0x01aefb72
                                        0x00000000
                                        0x01aefb78
                                        0x01aefb7a
                                        0x01aefb7a
                                        0x01aefb7d
                                        0x01aefb80
                                        0x01b2bddf
                                        0x01b2bde1
                                        0x00000000
                                        0x01b2bde3
                                        0x00000000
                                        0x01b2bde3
                                        0x01aefb86
                                        0x01aefb86
                                        0x01aefb86
                                        0x01aefb8b
                                        0x01aefb90
                                        0x01aefb92
                                        0x01aefb94
                                        0x01aefb9a
                                        0x01aefb9b
                                        0x01aefba1
                                        0x01b2bde8
                                        0x01b2bdeb
                                        0x01b2bded
                                        0x01b2beb5
                                        0x01b2beb5
                                        0x01b2bebb
                                        0x01b2bebd
                                        0x01b2bec3
                                        0x01b2bed2
                                        0x01b2bedd
                                        0x01b2bedd
                                        0x01b2beed
                                        0x00000000
                                        0x01b2bdf3
                                        0x01b2bdfe
                                        0x01b2be06
                                        0x01b2be0b
                                        0x01b2be0d
                                        0x01b2be0f
                                        0x01b2be14
                                        0x01b2be19
                                        0x01b2be20
                                        0x01b2be25
                                        0x01b2be27
                                        0x01b2be35
                                        0x01b2be39
                                        0x01b2be46
                                        0x01b2be4f
                                        0x01b2be54
                                        0x01b2be56
                                        0x01b2bef8
                                        0x01b2bef8
                                        0x00000000
                                        0x01b2be5c
                                        0x01b2be5c
                                        0x01b2be60
                                        0x00000000
                                        0x01b2be66
                                        0x01b2be66
                                        0x01b2be7f
                                        0x01b2be84
                                        0x01b2be87
                                        0x01b2be89
                                        0x01b2be8b
                                        0x01b2be99
                                        0x01b2be9d
                                        0x01b2bea0
                                        0x01b2beac
                                        0x01b2beaf
                                        0x01b2beb1
                                        0x01b2beb3
                                        0x01b2beb3
                                        0x00000000
                                        0x01b2bea2
                                        0x01b2bea2
                                        0x00000000
                                        0x01b2bea2
                                        0x01b2be8d
                                        0x01b2be8d
                                        0x01b2be92
                                        0x00000000
                                        0x01b2be92
                                        0x01b2be8b
                                        0x01b2be60
                                        0x01b2be3b
                                        0x01b2be3b
                                        0x01b2be3e
                                        0x00000000
                                        0x01b2be40
                                        0x01b2be40
                                        0x01b2be44
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b2be44
                                        0x01b2be3e
                                        0x01b2be29
                                        0x01b2be29
                                        0x00000000
                                        0x01b2be29
                                        0x01b2be27
                                        0x00000000
                                        0x01aefba7
                                        0x01aefba7
                                        0x01aefbab
                                        0x01b2bf02
                                        0x01aefbb1
                                        0x01aefbb1
                                        0x01aefbb8
                                        0x01aefbbd
                                        0x01aefbbd
                                        0x01aefbbf
                                        0x01aefbbf
                                        0x01aefbc5
                                        0x01aefbcb
                                        0x01aefbf8
                                        0x01aefbf8
                                        0x01aefbfa
                                        0x00000000
                                        0x01aefc00
                                        0x01aefc00
                                        0x01aefc03
                                        0x00000000
                                        0x01aefc09
                                        0x01aefc09
                                        0x01aefc0f
                                        0x01aefc15
                                        0x01aefc23
                                        0x01aefc23
                                        0x01aefc25
                                        0x01aefc27
                                        0x01aefc75
                                        0x01aefc7c
                                        0x01aefc84
                                        0x00000000
                                        0x01aefc29
                                        0x01aefc29
                                        0x01aefc2d
                                        0x01aefc30
                                        0x01b2bf0f
                                        0x00000000
                                        0x01aefc36
                                        0x01aefc38
                                        0x01aefc3b
                                        0x01aefc41
                                        0x01b2bf17
                                        0x01b2bf19
                                        0x01b2bf48
                                        0x01b2bf4b
                                        0x00000000
                                        0x01b2bf1b
                                        0x01b2bf22
                                        0x01b2bf24
                                        0x01b2bf26
                                        0x00000000
                                        0x01b2bf2c
                                        0x01b2bf37
                                        0x01b2bf39
                                        0x01b2bf3b
                                        0x00000000
                                        0x01b2bf41
                                        0x01b2bf41
                                        0x01b2bf41
                                        0x01b2bf41
                                        0x01b2bf45
                                        0x00000000
                                        0x01b2bf45
                                        0x01b2bf3b
                                        0x01b2bf26
                                        0x00000000
                                        0x01aefc47
                                        0x01aefc47
                                        0x01aefc49
                                        0x01aefcb2
                                        0x01aefcb4
                                        0x01aefcb6
                                        0x01aefcdc
                                        0x01aefcdc
                                        0x00000000
                                        0x01aefcb8
                                        0x01aefcc3
                                        0x01aefcc5
                                        0x01aefcc7
                                        0x00000000
                                        0x01aefcc9
                                        0x01aefcc9
                                        0x01aefccd
                                        0x00000000
                                        0x01aefccd
                                        0x01aefcc7
                                        0x00000000
                                        0x01aefc4b
                                        0x01aefc4b
                                        0x01aefc4e
                                        0x01aefc4e
                                        0x01aefc51
                                        0x01aefc51
                                        0x01aefc54
                                        0x01aefc5a
                                        0x01aefc5c
                                        0x01aefc5f
                                        0x01aefc61
                                        0x01aefc63
                                        0x01aefc65
                                        0x01aefc67
                                        0x01aefc6e
                                        0x01aefc72
                                        0x01aefc72
                                        0x01aefc72
                                        0x01aefc72
                                        0x01aefc67
                                        0x01aefc61
                                        0x00000000
                                        0x01aefc5a
                                        0x01aefc49
                                        0x01aefc41
                                        0x01aefc30
                                        0x01aefc27
                                        0x01aefc03
                                        0x01aefbcd
                                        0x01aefbd3
                                        0x01aefbd9
                                        0x01aefbdc
                                        0x01aefbde
                                        0x01aefc99
                                        0x01aefc9b
                                        0x01aefc9d
                                        0x01aefcd5
                                        0x01aefcd5
                                        0x01aefc89
                                        0x01aefc89
                                        0x00000000
                                        0x01aefc9f
                                        0x01aefc9f
                                        0x01aefca3
                                        0x00000000
                                        0x01aefca3
                                        0x00000000
                                        0x01aefbe4
                                        0x01aefbe4
                                        0x01aefbe4
                                        0x01aefbe4
                                        0x01aefbe9
                                        0x01aefbf2
                                        0x00000000
                                        0x01aefbf2
                                        0x01aefbde
                                        0x01aefbcb
                                        0x01aefbab
                                        0x01aefc8b
                                        0x01aefc8b
                                        0x01aefc8c
                                        0x01aefb80
                                        0x01aefb72
                                        0x01aefb5e
                                        0x01aefc8d
                                        0x01aefc91
                                        0x01aefadf
                                        0x01aefadf
                                        0x01aefae1
                                        0x01aefae4
                                        0x01aefae7
                                        0x01aefaec
                                        0x01aefaf8
                                        0x01aefb00
                                        0x01aefb07
                                        0x01aefb0f
                                        0x01aefb0f
                                        0x01aefb07
                                        0x00000000
                                        0x01aefaf8
                                        0x01aefadd

                                        Strings
                                        • *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 01B2BE0F
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
                                        • API String ID: 0-865735534
                                        • Opcode ID: f7e192ca13021b7da52197511afa4047ab3e0a09bde859c8ade4a0dfa28f650d
                                        • Instruction ID: 075eacc408ef243fb4c9a99ff917f8151ff5a20a2a0d931b8186c2e7087df6fa
                                        • Opcode Fuzzy Hash: f7e192ca13021b7da52197511afa4047ab3e0a09bde859c8ade4a0dfa28f650d
                                        • Instruction Fuzzy Hash: D8A10671B006568FEB29DB68C554BBAB7F5EF84710F1445ADEA0ACB681EF30D805CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB2D8A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 63%
                                        			E01AB2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x1ba5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x1ba7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E01AF97C0();
				}
				if( *0x1ba79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x1ba79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E01AE1624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E01AD7D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E01B4FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E01AF9520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E01AEE18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								E01B0DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x1ba6901;
								_push(_t109);
								_v52 = _t98;
								if( *0x1ba6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E01AF9980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E01AF95D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E01AD7D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E01AD7D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E01B37016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E01B4FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x1ba5350;
							if(_t109 != 0x1ba5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E01B4FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E01B45720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}




































                                        0x01ab2d8a
                                        0x01ab2d8a
                                        0x01ab2d92
                                        0x01ab2d96
                                        0x01ab2d9e
                                        0x01ab2da0
                                        0x01ab2da3
                                        0x01ab2da5
                                        0x01ab2da8
                                        0x01ab2dab
                                        0x01ab2db2
                                        0x01b0f9aa
                                        0x01b0f9ab
                                        0x01b0f9ae
                                        0x01b0f9ae
                                        0x01ab2db8
                                        0x01ab2dc2
                                        0x01b0f9b9
                                        0x01b0f9be
                                        0x01b0f9bf
                                        0x01b0f9bf
                                        0x01ab2dcf
                                        0x01b0f9c9
                                        0x01ab2dd5
                                        0x01ab2dd5
                                        0x01ab2dd5
                                        0x01ab2dde
                                        0x01ab2de1
                                        0x01ab2e70
                                        0x01ab2e72
                                        0x01ab2e72
                                        0x01ab2de7
                                        0x01ab2deb
                                        0x01ab2e7c
                                        0x01ab2e83
                                        0x01ab2e85
                                        0x01ab2e8b
                                        0x01ab2e8d
                                        0x01ab2e92
                                        0x01ab2e92
                                        0x01ab2e85
                                        0x01ab2df1
                                        0x01ab2df7
                                        0x01ab2df9
                                        0x01ab2df9
                                        0x01ab2dfc
                                        0x01ab2dff
                                        0x01ab2e02
                                        0x00000000
                                        0x01ab2e05
                                        0x01ab2e0c
                                        0x01b0f9d9
                                        0x01ab2e12
                                        0x01ab2e12
                                        0x01ab2e12
                                        0x01ab2e1a
                                        0x01b0f9e3
                                        0x01b0f9e9
                                        0x01b0f9f0
                                        0x01b0f9f6
                                        0x01b0f9f8
                                        0x01b0f9f8
                                        0x01b0f9f0
                                        0x01ab2e23
                                        0x01b0fa02
                                        0x01b0fa03
                                        0x01b0fa05
                                        0x01b0fa06
                                        0x00000000
                                        0x01ab2e29
                                        0x01ab2e29
                                        0x01ab2e2e
                                        0x01ab2e34
                                        0x01ab2e3e
                                        0x00000000
                                        0x00000000
                                        0x01ab2e44
                                        0x01ab2e47
                                        0x01ab2e4d
                                        0x00000000
                                        0x00000000
                                        0x01ab2e4f
                                        0x01ab2e54
                                        0x00000000
                                        0x00000000
                                        0x01ab2e5a
                                        0x01ab2e5f
                                        0x01ab2e9a
                                        0x01ab2ea4
                                        0x01ab2ea5
                                        0x01ab2ea8
                                        0x01ab2eaf
                                        0x01ab2eb2
                                        0x01ab2eb5
                                        0x01b0fae9
                                        0x01b0faeb
                                        0x01b0faed
                                        0x01b0faef
                                        0x01b0faf7
                                        0x01b0faf8
                                        0x01b0fafd
                                        0x01b0faff
                                        0x01b0fb04
                                        0x01b0fb04
                                        0x01b0faff
                                        0x01ab2ec0
                                        0x01ab2ec4
                                        0x01ab2ec6
                                        0x01ab2ec8
                                        0x01b0fb14
                                        0x01b0fb18
                                        0x01b0fb1e
                                        0x01b0fb21
                                        0x01b0fb21
                                        0x01ab2ece
                                        0x01ab2ece
                                        0x01ab2ece
                                        0x01ab2ed7
                                        0x01ab2e61
                                        0x01ab2e63
                                        0x01b0fa6b
                                        0x01b0fa71
                                        0x01b0fa76
                                        0x01b0fa78
                                        0x01b0fa8a
                                        0x01b0fa7a
                                        0x01b0fa83
                                        0x01b0fa83
                                        0x01b0fa8f
                                        0x01b0fa91
                                        0x01b0fa97
                                        0x01b0fa9d
                                        0x01b0faa4
                                        0x01b0faaa
                                        0x01b0faaf
                                        0x01b0fab1
                                        0x01b0fac3
                                        0x01b0fab3
                                        0x01b0fabc
                                        0x01b0fabc
                                        0x01b0fac8
                                        0x01b0facb
                                        0x01b0fadf
                                        0x01b0fadf
                                        0x01b0facb
                                        0x01b0faa4
                                        0x01b0fa91
                                        0x01ab2e6f
                                        0x01ab2e6f
                                        0x01ab2e5f
                                        0x01b0fa13
                                        0x01b0fa15
                                        0x01b0fa17
                                        0x01b0fa1f
                                        0x01b0fa21
                                        0x01b0fa22
                                        0x01b0fa25
                                        0x01b0fa28
                                        0x01b0fa2f
                                        0x01b0fa2f
                                        0x01b0fa2a
                                        0x01b0fa2a
                                        0x01b0fa2a
                                        0x01b0fa31
                                        0x01b0fa34
                                        0x01b0fa36
                                        0x01b0fa3c
                                        0x01b0fa3e
                                        0x01b0fa41
                                        0x01b0fa43
                                        0x01b0fa45
                                        0x01b0fa45
                                        0x01b0fa41
                                        0x01b0fa3c
                                        0x01b0fa4a
                                        0x01b0fa4f
                                        0x01b0fa51
                                        0x01b0fa53
                                        0x01b0fa56
                                        0x01b0fa5b
                                        0x01b0fa5e
                                        0x00000000
                                        0x01b0fa5e
                                        0x01ab2e23

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: RTL: Re-Waiting
                                        • API String ID: 0-316354757
                                        • Opcode ID: ecd3f41d545fe2a13fd77fb2191182d4ba93e44e5eb35a835b968c4ff2bdb759
                                        • Instruction ID: 51b18739989dac59e4746593d03f711e9c24d6cd8259322ed8ba18a1f37db4ae
                                        • Opcode Fuzzy Hash: ecd3f41d545fe2a13fd77fb2191182d4ba93e44e5eb35a835b968c4ff2bdb759
                                        • Instruction Fuzzy Hash: B0613571B00685AFEB37DB6CC884BBE7FB9EB44314F1802ABE511972D2C734A9418781
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B80EA5 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 80%
                                        			E01B80EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E01B7FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E01B81074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E01AF9730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E01B7A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E01B7A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x1ba8b04 >> 0x14) + (_v44 -  *0x1ba8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E01AD7D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E01B7138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E01AD7D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E01B6FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x1ba8724 & 0x00000008) != 0) {
						E01B752F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E01B815B5(0x1ba8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}
























                                        0x01b80eb7
                                        0x01b80eb9
                                        0x01b80ec0
                                        0x01b80ec2
                                        0x01b80ecd
                                        0x01b8105b
                                        0x01b8105b
                                        0x01b81061
                                        0x01b81066
                                        0x01b81066
                                        0x01b8106b
                                        0x01b81073
                                        0x01b81073
                                        0x01b80ed3
                                        0x01b80ed6
                                        0x01b80edc
                                        0x01b80ee0
                                        0x01b80ee7
                                        0x01b80ef0
                                        0x01b80ef5
                                        0x01b80efa
                                        0x01b80efc
                                        0x01b80efd
                                        0x01b80f03
                                        0x01b80f04
                                        0x01b80f06
                                        0x01b80f07
                                        0x01b80f09
                                        0x01b80f0e
                                        0x01b80f14
                                        0x01b80f23
                                        0x01b80f2d
                                        0x01b80f34
                                        0x01b80f34
                                        0x01b80f14
                                        0x01b80f52
                                        0x00000000
                                        0x00000000
                                        0x01b80f58
                                        0x01b80f73
                                        0x01b80f74
                                        0x01b80f79
                                        0x01b80f7d
                                        0x01b80f80
                                        0x01b80f86
                                        0x01b80fab
                                        0x01b80fb5
                                        0x01b80fc6
                                        0x01b80fd1
                                        0x01b80fe3
                                        0x01b80fd3
                                        0x01b80fdc
                                        0x01b80fdc
                                        0x01b80feb
                                        0x01b81009
                                        0x01b81009
                                        0x01b81015
                                        0x01b81027
                                        0x01b81017
                                        0x01b81020
                                        0x01b81020
                                        0x01b8102f
                                        0x01b8103c
                                        0x01b8103c
                                        0x01b81048
                                        0x01b81050
                                        0x01b81050
                                        0x01b81055
                                        0x00000000
                                        0x01b81055
                                        0x01b80f88
                                        0x01b80f9e
                                        0x01b80fa2
                                        0x01b80fa9
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b80fa9
                                        0x00000000

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: `
                                        • API String ID: 0-2679148245
                                        • Opcode ID: 4571c26a94db923de672cd6d924b6473c539f466ac40b71136f8ccdac865c5d4
                                        • Instruction ID: 0bcc21f5c87829dafbd2d2bb518dde0dd1e1e95825c157472cd735f4d9273d97
                                        • Opcode Fuzzy Hash: 4571c26a94db923de672cd6d924b6473c539f466ac40b71136f8ccdac865c5d4
                                        • Instruction Fuzzy Hash: B951A3713043429FD729EF28D980B5B7BE5EBC8B44F0449ACF59697290D771E80AC761
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEF0BF Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 75%
                                        			E01AEF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E01AD4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E01AF9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E01AF9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E01AF95D0();
							goto L11;
						} else {
							_t109 = L01AD4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E01AFF3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E01AF95D0();
										L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

























                                        0x01aef0d3
                                        0x01aef0d9
                                        0x01aef0e0
                                        0x01aef0e7
                                        0x01aef0f2
                                        0x01aef0f4
                                        0x01aef0f8
                                        0x01aef100
                                        0x01aef108
                                        0x01aef10d
                                        0x01aef115
                                        0x01aef116
                                        0x01aef11f
                                        0x01aef123
                                        0x01aef124
                                        0x01aef12c
                                        0x01aef130
                                        0x01aef134
                                        0x01aef13d
                                        0x01aef144
                                        0x01aef14b
                                        0x01aef152
                                        0x01b2bab0
                                        0x01b2bab0
                                        0x01aef158
                                        0x01aef158
                                        0x01aef15a
                                        0x01aef160
                                        0x01aef165
                                        0x01aef166
                                        0x01aef16f
                                        0x01aef173
                                        0x01b2baa7
                                        0x01b2baa7
                                        0x01b2baab
                                        0x00000000
                                        0x01aef179
                                        0x01aef18d
                                        0x01aef191
                                        0x01b2baa2
                                        0x00000000
                                        0x01aef197
                                        0x01aef19b
                                        0x01aef1a2
                                        0x01aef1a9
                                        0x01aef1af
                                        0x01aef1b2
                                        0x01aef1b6
                                        0x01aef1b9
                                        0x01aef1c4
                                        0x01aef1d8
                                        0x01aef1df
                                        0x01aef1e3
                                        0x01aef1eb
                                        0x01aef1ee
                                        0x01aef1f4
                                        0x01aef20f
                                        0x01b2bab7
                                        0x01b2babb
                                        0x01b2bacc
                                        0x01b2bad1
                                        0x01aef215
                                        0x01aef218
                                        0x01aef226
                                        0x01aef22b
                                        0x00000000
                                        0x01aef22b
                                        0x01aef1f6
                                        0x01aef1f6
                                        0x01aef1f9
                                        0x01aef1fb
                                        0x01aef1fb
                                        0x01aef1f4
                                        0x01aef191
                                        0x01aef173
                                        0x01aef152
                                        0x01aef203

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: @
                                        • API String ID: 0-2766056989
                                        • Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                        • Instruction ID: 5973a714c652413be856adeb402524a3f1900d9c3bf34e88ab7849925609709f
                                        • Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                        • Instruction Fuzzy Hash: DC518D725047119FC321DF69C940A6BBBF8FF58710F00892EFA9687690EBB4E904CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B33540 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 75%
                                        			E01B33540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x1bad360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E01AF0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E01B33706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E01AFFA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E01B33540;
						E01AFFA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E01B0DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E01B40C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E01AF97C0();
					}
					return E01AFB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E01B33971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E01B33884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E01AFFA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E01AF9650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E01B33787(_a4,  &_v352, _t80);
						}
					}
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E01AF95D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}































                                        0x01b33552
                                        0x01b3355a
                                        0x01b3355d
                                        0x01b33566
                                        0x01b33567
                                        0x01b3357e
                                        0x01b3358f
                                        0x01b335a1
                                        0x01b335a5
                                        0x01b3366b
                                        0x01b3366b
                                        0x01b3366d
                                        0x01b33672
                                        0x01b33679
                                        0x01b33685
                                        0x01b3368d
                                        0x01b3369d
                                        0x01b336a7
                                        0x01b336b8
                                        0x01b336c6
                                        0x01b336c7
                                        0x01b336dc
                                        0x01b336e1
                                        0x01b336e7
                                        0x01b336e9
                                        0x01b336e9
                                        0x01b33703
                                        0x01b33703
                                        0x01b335b5
                                        0x01b335c0
                                        0x01b335c4
                                        0x00000000
                                        0x00000000
                                        0x01b335ca
                                        0x01b335d7
                                        0x01b335e2
                                        0x01b335e6
                                        0x01b335e8
                                        0x01b335f5
                                        0x01b335fa
                                        0x01b33603
                                        0x01b33604
                                        0x01b33609
                                        0x01b3360a
                                        0x01b33612
                                        0x01b33613
                                        0x01b3361e
                                        0x01b33622
                                        0x01b33628
                                        0x01b3362f
                                        0x01b3362f
                                        0x01b33636
                                        0x01b33638
                                        0x01b3363b
                                        0x01b33642
                                        0x01b33642
                                        0x01b33636
                                        0x01b33657
                                        0x01b33657
                                        0x01b3365c
                                        0x01b33662
                                        0x01b33669
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: BinaryHash
                                        • API String ID: 0-2202222882
                                        • Opcode ID: 482e625b07688520fd52b7ac6136d156649e0749dce1cda0014fd336e3e462b0
                                        • Instruction ID: 41008543d9e2bdb3ec1498e48497ba4e9308778a0b3f43c72b2f3c3980ff8e53
                                        • Opcode Fuzzy Hash: 482e625b07688520fd52b7ac6136d156649e0749dce1cda0014fd336e3e462b0
                                        • Instruction Fuzzy Hash: 1C4122B290452D9EDF259A90CD81F9FB77CAB44714F0045E5B709AB250DB309E988F94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B805AC Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 71%
                                        			E01B805AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E01B807DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E01AF9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E01B7A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E01B7A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E01B81293(_t79, _v40, E01B807DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E01AD7D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E01B7138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

















                                        0x01b805c5
                                        0x01b805ca
                                        0x01b805d3
                                        0x01b806db
                                        0x01b806db
                                        0x01b806dd
                                        0x01b806e3
                                        0x01b806e3
                                        0x01b805dd
                                        0x01b805e7
                                        0x01b805f6
                                        0x01b80600
                                        0x01b80607
                                        0x01b80610
                                        0x01b80615
                                        0x01b8061a
                                        0x01b8061c
                                        0x01b8061e
                                        0x01b80624
                                        0x01b80625
                                        0x01b80627
                                        0x01b80628
                                        0x01b80631
                                        0x01b80640
                                        0x01b8064d
                                        0x01b80654
                                        0x01b80654
                                        0x01b80631
                                        0x01b8066d
                                        0x01b80674
                                        0x00000000
                                        0x00000000
                                        0x01b80692
                                        0x01b8069e
                                        0x01b806b0
                                        0x01b806a0
                                        0x01b806a9
                                        0x01b806a9
                                        0x01b806b8
                                        0x01b806d6
                                        0x01b806d6
                                        0x00000000

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: `
                                        • API String ID: 0-2679148245
                                        • Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                        • Instruction ID: fc7a2b26da5f545f4e0afb2ce6aeec09fec336dc730762c53abbed8a18837a68
                                        • Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                        • Instruction Fuzzy Hash: AD3108322007056BE714FE28CD44F977BD9EBC4B98F144165FA549B280D770E908C791
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B33884 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 72%
                                        			E01B33884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E01AF9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L01AD4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E01AF9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}















                                        0x01b33893
                                        0x01b33896
                                        0x01b33899
                                        0x01b3389f
                                        0x01b338a0
                                        0x01b338a4
                                        0x01b338a9
                                        0x01b338ac
                                        0x01b338ad
                                        0x01b338ae
                                        0x01b338af
                                        0x01b338b1
                                        0x01b338b4
                                        0x01b338bb
                                        0x01b338bc
                                        0x01b338bd
                                        0x01b338c4
                                        0x01b338c8
                                        0x01b338ca
                                        0x01b338ca
                                        0x01b338d5
                                        0x01b3393e
                                        0x01b33940
                                        0x01b33942
                                        0x01b33952
                                        0x01b33954
                                        0x01b33961
                                        0x01b33961
                                        0x01b33967
                                        0x01b3396e
                                        0x01b3396e
                                        0x01b33947
                                        0x01b3394c
                                        0x00000000
                                        0x01b3394c
                                        0x01b338ea
                                        0x01b338ee
                                        0x01b338f8
                                        0x01b338f9
                                        0x01b338ff
                                        0x01b33900
                                        0x01b33902
                                        0x01b33903
                                        0x01b3390b
                                        0x01b3390f
                                        0x01b33950
                                        0x00000000
                                        0x01b33950
                                        0x01b33915
                                        0x01b3391d
                                        0x01b3391d
                                        0x01b33922
                                        0x01b33926
                                        0x00000000
                                        0x01b33928
                                        0x01b3392b
                                        0x01b3392b
                                        0x01b33935
                                        0x01b33937
                                        0x01b33937
                                        0x00000000
                                        0x01b33935
                                        0x01b33926
                                        0x01b338f0
                                        0x00000000

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: BinaryName
                                        • API String ID: 0-215506332
                                        • Opcode ID: f9d9430c947d0b9d243b462935a10cdedc80031fed90c247f5d9ce6e2dc0e778
                                        • Instruction ID: 937e74bbb318c51701a0bf70acdd04253113114337d71c3e782a9319a6709c6c
                                        • Opcode Fuzzy Hash: f9d9430c947d0b9d243b462935a10cdedc80031fed90c247f5d9ce6e2dc0e778
                                        • Instruction Fuzzy Hash: 6831C572D0151AFFEB19DA58C945E6BFBB4FBC0720F0142A9E916A7260D7319E50C7A0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AED294 Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 33%
                                        			E01AED294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x1bad360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E01AD4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E01AFB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E01AF98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E01AF95D0();
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

































                                        0x01aed29c
                                        0x01aed2a6
                                        0x01aed2b1
                                        0x01aed2b5
                                        0x01aed2b6
                                        0x01aed2bc
                                        0x01aed2bd
                                        0x01aed2be
                                        0x01aed2bf
                                        0x01aed2c2
                                        0x01aed2c4
                                        0x01aed2cc
                                        0x01aed384
                                        0x01aed34b
                                        0x01aed34f
                                        0x01aed350
                                        0x01aed351
                                        0x01aed35c
                                        0x01aed35c
                                        0x01aed2d6
                                        0x01aed2da
                                        0x01aed2e1
                                        0x01aed361
                                        0x01aed369
                                        0x01aed36d
                                        0x01aed2e3
                                        0x01aed2e3
                                        0x01aed2e3
                                        0x01aed2e5
                                        0x01aed2ed
                                        0x01aed2f5
                                        0x01aed2fa
                                        0x01aed302
                                        0x01aed303
                                        0x01aed30b
                                        0x01aed30f
                                        0x01aed313
                                        0x01aed318
                                        0x01aed31c
                                        0x01aed320
                                        0x01aed379
                                        0x01aed37d
                                        0x00000000
                                        0x00000000
                                        0x01b2affe
                                        0x01b2b001
                                        0x01b2b011
                                        0x00000000
                                        0x01aed322
                                        0x01aed322
                                        0x01aed330
                                        0x01aed337
                                        0x01aed35d
                                        0x01aed339
                                        0x01aed33f
                                        0x01aed38c
                                        0x01aed38c
                                        0x01aed33f
                                        0x01aed349
                                        0x00000000
                                        0x01aed349

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: @
                                        • API String ID: 0-2766056989
                                        • Opcode ID: ff8493b8293265cd63f236266a1dccf2cdb891a5bd0e79ef5898e22fd5018a4d
                                        • Instruction ID: 9e24325488ef7a6a00799afd62d05af74a259a9129b35b20313cf21351bdf4a6
                                        • Opcode Fuzzy Hash: ff8493b8293265cd63f236266a1dccf2cdb891a5bd0e79ef5898e22fd5018a4d
                                        • Instruction Fuzzy Hash: 3131BFB55083069FC321DFA8C984A6BBBF8EB89654F04092EF99593250E734DD08CB92
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC1B8F Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 72%
                                        			E01AC1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E01AFBB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E01AFA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E01AFA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L01AD4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}









                                        0x01ac1b8f
                                        0x01ac1b9a
                                        0x01ac1b9c
                                        0x01ac1b9e
                                        0x01ac1ba3
                                        0x01b17010
                                        0x01b17010
                                        0x00000000
                                        0x01ac1ba9
                                        0x01ac1ba9
                                        0x01ac1bae
                                        0x00000000
                                        0x01ac1bc5
                                        0x01ac1bca
                                        0x01ac1bcf
                                        0x01ac1bd0
                                        0x01ac1bd1
                                        0x01ac1bd2
                                        0x01ac1bd6
                                        0x01ac1bdc
                                        0x01ac1be0
                                        0x01b16ffc
                                        0x01b17000
                                        0x00000000
                                        0x01b17006
                                        0x01b17009
                                        0x01b17009
                                        0x01ac1be6
                                        0x01ac1bec
                                        0x01ac1c0b
                                        0x01ac1c0b
                                        0x01ac1c0c
                                        0x01ac1c11
                                        0x01ac1c12
                                        0x01ac1c15
                                        0x01ac1c1b
                                        0x01ac1c1f
                                        0x01ac1c31
                                        0x01ac1c33
                                        0x01b17026
                                        0x01b17026
                                        0x01ac1c21
                                        0x01ac1c24
                                        0x01ac1c24
                                        0x01ac1bee
                                        0x01ac1bee
                                        0x01ac1bf2
                                        0x01ac1c3a
                                        0x01ac1bf4
                                        0x01ac1bf4
                                        0x01ac1c05
                                        0x01ac1c05
                                        0x01ac1c09
                                        0x01ac1c3e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ac1c09
                                        0x01ac1bec
                                        0x01ac1be0
                                        0x01ac1bae
                                        0x01ac1c2e

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: WindowsExcludedProcs
                                        • API String ID: 0-3583428290
                                        • Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                        • Instruction ID: 351ac3628598dda3bc66ad1cee30e2d02698766fe3e9f0cd21f014f052eb7183
                                        • Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                        • Instruction Fuzzy Hash: 9821F87B704219EBDB22DB9DC944FABBBBDEF45A50F064469FA04CB205DA34DD0187A0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ADF716 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ADF716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}











                                        0x01adf71d
                                        0x01adf722
                                        0x01adf726
                                        0x01b24770
                                        0x01adf765
                                        0x01adf769
                                        0x01adf769
                                        0x01adf732
                                        0x01b2477a
                                        0x00000000
                                        0x01b2477a
                                        0x01adf738
                                        0x01adf73a
                                        0x01adf73c
                                        0x01adf73f
                                        0x01adf746
                                        0x01adf778
                                        0x01adf7a9
                                        0x01adf7a9
                                        0x01adf754
                                        0x01adf75a
                                        0x01adf75d
                                        0x01adf75f
                                        0x01adf761
                                        0x01adf76f
                                        0x01adf771
                                        0x01adf771
                                        0x01adf76f
                                        0x01adf763
                                        0x00000000
                                        0x01adf763
                                        0x01adf77d
                                        0x01adf7a3
                                        0x01adf7a5
                                        0x00000000
                                        0x01adf7a5
                                        0x01adf77f
                                        0x01adf782
                                        0x01adf784
                                        0x01adf786
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01adf788
                                        0x01adf748
                                        0x01adf74d
                                        0x01adf78d
                                        0x01adf793
                                        0x01adf7b7
                                        0x01adf7bc
                                        0x00000000
                                        0x01adf7bc
                                        0x01adf798
                                        0x00000000
                                        0x00000000
                                        0x01adf79d
                                        0x01adf7b0
                                        0x00000000
                                        0x01adf7b0
                                        0x01adf79f
                                        0x00000000
                                        0x01adf74f
                                        0x01adf74f
                                        0x00000000
                                        0x01adf74f

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: Actx
                                        • API String ID: 0-89312691
                                        • Opcode ID: fae6768c9d482c20429beb0cfcca9df7c79861ccc24d5ec69977b74b62bccda9
                                        • Instruction ID: 42bf2ab72569ad2c7d02beb299e117bf70506a1d88211d03201f0d8c94c4dc8a
                                        • Opcode Fuzzy Hash: fae6768c9d482c20429beb0cfcca9df7c79861ccc24d5ec69977b74b62bccda9
                                        • Instruction Fuzzy Hash: 9B11BE34B04E028FEB294E1CC8907F776A5AB85224F2A452AE477CB791DB70C8438340
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B68DF1 Relevance: 1.3, Strings: 1, Instructions: 45COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 71%
                                        			E01B68DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x1b90d50);
				E01B0D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E01B45720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = E01B0DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				E01B0DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E01B0D130(_t34, _t39, _t40);
			}





                                        0x01b68df1
                                        0x01b68df1
                                        0x01b68df1
                                        0x01b68df1
                                        0x01b68df1
                                        0x01b68df1
                                        0x01b68df3
                                        0x01b68df8
                                        0x01b68dfd
                                        0x01b68e00
                                        0x01b68e0e
                                        0x01b68e2a
                                        0x01b68e36
                                        0x01b68e38
                                        0x01b68e3c
                                        0x01b68e46
                                        0x01b68e46
                                        0x01b68e36
                                        0x01b68e50
                                        0x01b68e56
                                        0x01b68e59
                                        0x01b68e5c
                                        0x01b68e60
                                        0x01b68e67
                                        0x01b68e6d
                                        0x01b68e73
                                        0x01b68e74
                                        0x01b68eb1
                                        0x01b68ebd

                                        Strings
                                        • Critical error detected %lx, xrefs: 01B68E21
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID: Critical error detected %lx
                                        • API String ID: 0-802127002
                                        • Opcode ID: a9c50f8b148be18c9f055147ff9576ee4f91042c0d559551b11323f1778686c4
                                        • Instruction ID: 1a049c09821891c128becfbcb386f7879c94d19f53e523d5c4919820309652cf
                                        • Opcode Fuzzy Hash: a9c50f8b148be18c9f055147ff9576ee4f91042c0d559551b11323f1778686c4
                                        • Instruction Fuzzy Hash: C2113976D14348DBDF29DFE9890579CBBB4BB14314F2042ADE5696B2D2C7340602CF14
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B85BA5 Relevance: .6, Instructions: 592COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 88%
                                        			E01B85BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x1b91178);
				E01B0D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E01B84C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E01AFD000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E01B85542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x1ba60e8;
								if( *0x1ba60e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x1ba60e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E01AF9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E01AF6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E01AFF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E01AFF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E01AFF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E01AFFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E01AFFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E01AFF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E01AFF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E01B84CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E01B0D130(_t427, _t494, _t511);
				}
			}










































































                                        0x01b85ba5
                                        0x01b85baa
                                        0x01b85baf
                                        0x01b85bb4
                                        0x01b85bb6
                                        0x01b85bbc
                                        0x01b85bbe
                                        0x01b85bc4
                                        0x01b85bcd
                                        0x01b85bd3
                                        0x01b85bd6
                                        0x01b85bdc
                                        0x01b85be0
                                        0x01b85be3
                                        0x01b85beb
                                        0x01b85bf2
                                        0x01b85bf8
                                        0x01b85bfe
                                        0x01b85c04
                                        0x01b85c0e
                                        0x01b85c18
                                        0x01b85c1f
                                        0x01b85c25
                                        0x01b85c2a
                                        0x01b85c2c
                                        0x01b85c32
                                        0x01b85c3a
                                        0x01b85c3f
                                        0x01b85c42
                                        0x01b85c48
                                        0x01b85c5b
                                        0x01b85c5b
                                        0x01b85c2c
                                        0x01b85cb7
                                        0x01b85cb9
                                        0x01b85cbf
                                        0x01b85cc2
                                        0x01b85cca
                                        0x01b85ccb
                                        0x01b85ccb
                                        0x01b85cd1
                                        0x01b85cd7
                                        0x01b85cda
                                        0x01b85ce1
                                        0x01b85ce4
                                        0x01b85ce7
                                        0x01b85ced
                                        0x01b85cf3
                                        0x01b85cf9
                                        0x01b85cff
                                        0x01b85d08
                                        0x01b85d0a
                                        0x01b85d0e
                                        0x01b85d10
                                        0x00000000
                                        0x00000000
                                        0x01b85d16
                                        0x01b85d1a
                                        0x00000000
                                        0x00000000
                                        0x01b85d20
                                        0x01b85d22
                                        0x01b85d25
                                        0x01b85d2f
                                        0x01b85d2f
                                        0x01b85d33
                                        0x01b85d3d
                                        0x01b85d49
                                        0x01b85d4b
                                        0x00000000
                                        0x00000000
                                        0x01b85d5a
                                        0x01b85d5d
                                        0x01b85d60
                                        0x00000000
                                        0x00000000
                                        0x01b85d66
                                        0x01b85d69
                                        0x00000000
                                        0x00000000
                                        0x01b85d6f
                                        0x01b85d6f
                                        0x01b85d73
                                        0x01b85d79
                                        0x01b85d7f
                                        0x01b85d86
                                        0x01b85d95
                                        0x01b85d98
                                        0x01b85dba
                                        0x01b85dcb
                                        0x01b85dce
                                        0x01b85dd3
                                        0x01b85dd6
                                        0x01b85dd8
                                        0x01b85de6
                                        0x01b85dec
                                        0x01b85dee
                                        0x01b85df1
                                        0x01b85df3
                                        0x01b8635a
                                        0x01b8635a
                                        0x00000000
                                        0x01b8635a
                                        0x01b85dfe
                                        0x01b85e02
                                        0x01b85e05
                                        0x01b85e07
                                        0x01b85e10
                                        0x01b85e13
                                        0x01b85e1b
                                        0x01b85e1c
                                        0x01b85e21
                                        0x01b85e22
                                        0x01b85e23
                                        0x01b85e25
                                        0x01b85e2a
                                        0x01b85e2c
                                        0x01b85e2e
                                        0x01b85e36
                                        0x01b85e39
                                        0x01b85e42
                                        0x01b85e47
                                        0x01b85e4d
                                        0x01b85e54
                                        0x01b85e54
                                        0x01b85e54
                                        0x01b85e2e
                                        0x01b85e5c
                                        0x01b85e5f
                                        0x01b85e62
                                        0x01b85e64
                                        0x01b85e6b
                                        0x01b85e70
                                        0x01b85e7a
                                        0x01b85e7a
                                        0x01b85e7a
                                        0x01b85e6b
                                        0x01b85e7e
                                        0x01b85e7f
                                        0x01b85e7f
                                        0x01b85e81
                                        0x01b85e87
                                        0x01b85e8b
                                        0x01b85e8c
                                        0x01b85e8c
                                        0x01b85e8c
                                        0x01b85e9a
                                        0x01b85e9c
                                        0x01b85ea2
                                        0x01b85ea6
                                        0x01b85f50
                                        0x01b85f50
                                        0x01b85f57
                                        0x01b85f66
                                        0x01b85f66
                                        0x01b85f66
                                        0x01b85f68
                                        0x01b85f6a
                                        0x01b863d0
                                        0x00000000
                                        0x01b85f70
                                        0x01b85f70
                                        0x01b85f91
                                        0x01b85f9c
                                        0x01b85f9e
                                        0x01b85fa4
                                        0x01b85fa6
                                        0x01b8638c
                                        0x01b86392
                                        0x01b863a1
                                        0x01b863a7
                                        0x01b863af
                                        0x01b863af
                                        0x01b863bd
                                        0x01b863d8
                                        0x00000000
                                        0x01b863d8
                                        0x01b85fac
                                        0x01b85fb2
                                        0x01b85fb4
                                        0x01b85fbd
                                        0x01b85fc6
                                        0x01b85fce
                                        0x01b85fd4
                                        0x01b85fdc
                                        0x01b85fec
                                        0x01b85fed
                                        0x01b85fee
                                        0x01b85fef
                                        0x01b85ff9
                                        0x01b85ffa
                                        0x01b85ffb
                                        0x01b85ffc
                                        0x01b86000
                                        0x01b86004
                                        0x01b86012
                                        0x01b86012
                                        0x01b86018
                                        0x01b86019
                                        0x01b8601a
                                        0x01b8601b
                                        0x01b8601c
                                        0x01b86020
                                        0x01b86059
                                        0x01b8605c
                                        0x01b86061
                                        0x01b86061
                                        0x01b86022
                                        0x01b86022
                                        0x01b86022
                                        0x01b86025
                                        0x01b8602a
                                        0x01b8602b
                                        0x01b86031
                                        0x01b86037
                                        0x01b86038
                                        0x01b8603e
                                        0x01b86048
                                        0x01b86049
                                        0x01b8604a
                                        0x01b8604b
                                        0x01b8604c
                                        0x01b8604d
                                        0x01b86053
                                        0x01b86054
                                        0x01b86054
                                        0x01b86062
                                        0x01b86065
                                        0x01b86067
                                        0x01b8606a
                                        0x01b86070
                                        0x01b86075
                                        0x01b86076
                                        0x01b86081
                                        0x01b86087
                                        0x01b86095
                                        0x01b86099
                                        0x01b8609e
                                        0x01b860a4
                                        0x01b860ae
                                        0x01b860b0
                                        0x01b860b3
                                        0x01b860b6
                                        0x01b860b8
                                        0x01b860ba
                                        0x01b860ba
                                        0x01b860ba
                                        0x01b860ba
                                        0x01b860be
                                        0x01b860c0
                                        0x01b860c5
                                        0x01b860c5
                                        0x01b860c5
                                        0x01b860c6
                                        0x01b860cd
                                        0x01b86114
                                        0x01b860cf
                                        0x01b860cf
                                        0x01b860d4
                                        0x01b860d5
                                        0x01b860da
                                        0x01b860db
                                        0x01b860e1
                                        0x01b860e2
                                        0x01b860e8
                                        0x01b860f8
                                        0x01b860fd
                                        0x01b860fe
                                        0x01b86102
                                        0x01b86104
                                        0x01b86107
                                        0x01b86109
                                        0x01b8610b
                                        0x01b8610b
                                        0x01b8610b
                                        0x01b8610b
                                        0x01b8610f
                                        0x01b8610f
                                        0x01b86117
                                        0x01b8611a
                                        0x01b8611f
                                        0x01b86125
                                        0x01b86134
                                        0x01b86139
                                        0x01b8613f
                                        0x01b86146
                                        0x01b86148
                                        0x01b8614b
                                        0x01b8614d
                                        0x01b8614f
                                        0x01b8614f
                                        0x01b8614f
                                        0x01b8614f
                                        0x01b86153
                                        0x01b86159
                                        0x01b86159
                                        0x01b8615c
                                        0x01b86163
                                        0x01b86169
                                        0x01b8616c
                                        0x01b86172
                                        0x01b86181
                                        0x01b86186
                                        0x01b86187
                                        0x01b8618b
                                        0x01b86191
                                        0x01b86195
                                        0x01b861a3
                                        0x01b861bb
                                        0x01b861c0
                                        0x01b861c3
                                        0x01b861cc
                                        0x01b861d0
                                        0x01b861dc
                                        0x01b861de
                                        0x01b861e1
                                        0x01b861e4
                                        0x01b861e6
                                        0x01b861e8
                                        0x01b861e8
                                        0x01b861e8
                                        0x01b861e8
                                        0x01b861e6
                                        0x01b861ec
                                        0x01b861f3
                                        0x01b86203
                                        0x01b86209
                                        0x01b8620a
                                        0x01b86216
                                        0x01b8621d
                                        0x01b86227
                                        0x01b86241
                                        0x01b86246
                                        0x01b8624c
                                        0x01b86257
                                        0x01b86259
                                        0x01b8625c
                                        0x01b8625e
                                        0x01b86260
                                        0x01b86260
                                        0x01b86260
                                        0x01b86260
                                        0x01b8625e
                                        0x01b86264
                                        0x01b86267
                                        0x01b86269
                                        0x01b86315
                                        0x01b86315
                                        0x01b8631b
                                        0x01b8631e
                                        0x01b86324
                                        0x01b86327
                                        0x01b8632f
                                        0x01b86330
                                        0x01b86333
                                        0x01b8633a
                                        0x01b8633c
                                        0x01b86335
                                        0x01b86335
                                        0x01b86335
                                        0x01b8633f
                                        0x01b86342
                                        0x01b8634c
                                        0x01b86352
                                        0x01b86355
                                        0x01b86355
                                        0x01b86359
                                        0x00000000
                                        0x01b8626f
                                        0x01b86275
                                        0x01b86275
                                        0x01b86278
                                        0x01b8627e
                                        0x01b8627e
                                        0x01b86281
                                        0x01b86287
                                        0x01b8628d
                                        0x01b86298
                                        0x01b8629c
                                        0x01b862a2
                                        0x01b8629e
                                        0x01b8629e
                                        0x01b8629e
                                        0x01b862a7
                                        0x01b862a7
                                        0x01b862aa
                                        0x01b862b0
                                        0x01b862f0
                                        0x01b862f0
                                        0x01b862f2
                                        0x01b862f8
                                        0x01b862fd
                                        0x01b862b2
                                        0x01b862b2
                                        0x01b862b2
                                        0x01b862b5
                                        0x01b862dd
                                        0x01b862e2
                                        0x01b862e5
                                        0x01b862b7
                                        0x01b862b8
                                        0x01b862bb
                                        0x01b862bd
                                        0x01b862c0
                                        0x01b862c4
                                        0x01b862cd
                                        0x01b862cd
                                        0x01b862c0
                                        0x01b862bb
                                        0x01b862b5
                                        0x01b86302
                                        0x01b86303
                                        0x01b86305
                                        0x01b86305
                                        0x01b86305
                                        0x01b8630c
                                        0x01b8630c
                                        0x00000000
                                        0x01b8627e
                                        0x01b86269
                                        0x01b85eac
                                        0x01b85ebb
                                        0x01b85ebe
                                        0x01b85ecb
                                        0x01b85ecb
                                        0x01b85ece
                                        0x01b85ece
                                        0x01b85ed4
                                        0x01b85ed7
                                        0x01b85ed9
                                        0x01b85edb
                                        0x01b85edb
                                        0x01b85ee1
                                        0x01b85ee1
                                        0x01b85ee3
                                        0x01b85f20
                                        0x01b85f20
                                        0x01b85ee5
                                        0x01b85ee5
                                        0x01b85ee5
                                        0x01b85ee8
                                        0x01b85f11
                                        0x01b85f18
                                        0x01b85eea
                                        0x01b85eea
                                        0x01b85eed
                                        0x01b85ef2
                                        0x01b85ef8
                                        0x01b85efb
                                        0x01b85f0a
                                        0x01b85f0a
                                        0x01b85eed
                                        0x01b85ee8
                                        0x01b85f22
                                        0x01b85f28
                                        0x00000000
                                        0x00000000
                                        0x01b85f30
                                        0x01b85f31
                                        0x01b85f37
                                        0x01b85f3a
                                        0x01b85f3d
                                        0x01b85f44
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b85f46
                                        0x01b85f48
                                        0x01b85f4d
                                        0x00000000
                                        0x01b85f4d
                                        0x01b85dda
                                        0x01b85ddf
                                        0x00000000
                                        0x01b85ddf
                                        0x01b85dd8
                                        0x01b85da7
                                        0x01b85da9
                                        0x01b85dac
                                        0x01b85dae
                                        0x00000000
                                        0x01b85db4
                                        0x01b85db4
                                        0x00000000
                                        0x01b85db4
                                        0x01b85dae
                                        0x01b85d88
                                        0x01b85d8d
                                        0x01b86363
                                        0x01b86369
                                        0x01b8636a
                                        0x01b86370
                                        0x01b86372
                                        0x01b8637a
                                        0x01b8637b
                                        0x01b8637d
                                        0x00000000
                                        0x00000000
                                        0x01b8637f
                                        0x01b86385
                                        0x00000000
                                        0x01b86385
                                        0x01b85d38
                                        0x01b85d3b
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b85d3b
                                        0x01b85d27
                                        0x01b85d29
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b86360
                                        0x00000000
                                        0x01b86360
                                        0x01b85c10
                                        0x01b85c10
                                        0x01b863da
                                        0x01b863e5
                                        0x01b863e5

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: a9463c8f609d9ea775b21f8afce1daa0038d6cedc644f27931380df3cae425a2
                                        • Instruction ID: 8a5c43b282d11ee82779b45a669673dd2a764ce48949b67f19b911334eae77c5
                                        • Opcode Fuzzy Hash: a9463c8f609d9ea775b21f8afce1daa0038d6cedc644f27931380df3cae425a2
                                        • Instruction Fuzzy Hash: A7424975900229CFDB28DF68C980BA9BBB1FF49704F1481EAD94DEB242E7749985CF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AD4120 Relevance: .4, Instructions: 444COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 92%
                                        			E01AD4120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x1bad360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E01AEF232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E01AD6E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L01AD4620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E01AD6E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M01AD45F8))) {
												case 0:
													_v568 = 0x1a91078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x1a911c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L01AD4620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E01AFF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E01AFF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E01AB52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E01ACEB70(1, 0x1ba79a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E01ACAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E01AF95D0();
																			L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E01AFB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E01AF3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E01AFB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}















































































                                        0x01ad4128
                                        0x01ad4135
                                        0x01ad413c
                                        0x01ad4141
                                        0x01ad4145
                                        0x01ad4147
                                        0x01ad414e
                                        0x01ad4151
                                        0x01ad4159
                                        0x01ad415c
                                        0x01ad4160
                                        0x01ad4164
                                        0x01ad4168
                                        0x01ad416c
                                        0x01ad417f
                                        0x01ad4181
                                        0x01ad446a
                                        0x01ad446a
                                        0x01ad418c
                                        0x01ad4195
                                        0x01ad4199
                                        0x01ad4432
                                        0x01ad4439
                                        0x01ad443d
                                        0x01ad4442
                                        0x01ad4447
                                        0x00000000
                                        0x01ad419f
                                        0x01ad41a3
                                        0x01ad41b1
                                        0x01ad41b9
                                        0x01ad41bd
                                        0x01ad45db
                                        0x01ad45db
                                        0x00000000
                                        0x01ad41c3
                                        0x01ad41c3
                                        0x01ad41ce
                                        0x01ad41d4
                                        0x01b1e138
                                        0x01b1e13e
                                        0x01b1e169
                                        0x01b1e16d
                                        0x01b1e19e
                                        0x01b1e16f
                                        0x01b1e16f
                                        0x01b1e175
                                        0x01b1e179
                                        0x01b1e18f
                                        0x01b1e193
                                        0x00000000
                                        0x01b1e199
                                        0x00000000
                                        0x01b1e199
                                        0x01b1e193
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ad41da
                                        0x01ad41da
                                        0x01ad41df
                                        0x01ad41e4
                                        0x01ad41ec
                                        0x01ad4203
                                        0x01ad4207
                                        0x01b1e1fd
                                        0x01ad4222
                                        0x01ad4226
                                        0x01b1e1f3
                                        0x01b1e1f3
                                        0x01ad422c
                                        0x01ad422c
                                        0x01ad4233
                                        0x01b1e1ed
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ad4239
                                        0x01ad4239
                                        0x01ad4239
                                        0x01ad4239
                                        0x01ad4233
                                        0x01ad4226
                                        0x01ad41ee
                                        0x01ad41ee
                                        0x01ad41f4
                                        0x01ad4575
                                        0x01b1e1b1
                                        0x01b1e1b1
                                        0x00000000
                                        0x01ad457b
                                        0x01ad457b
                                        0x01ad4582
                                        0x01b1e1ab
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ad4588
                                        0x01ad4588
                                        0x01ad458c
                                        0x01b1e1c4
                                        0x01b1e1c4
                                        0x00000000
                                        0x01ad4592
                                        0x01ad4592
                                        0x01ad4599
                                        0x01b1e1be
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ad459f
                                        0x01ad459f
                                        0x01ad45a3
                                        0x01b1e1d7
                                        0x01b1e1e4
                                        0x00000000
                                        0x01ad45a9
                                        0x01ad45a9
                                        0x01ad45b0
                                        0x01b1e1d1
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ad45b6
                                        0x01ad45b6
                                        0x01ad45b6
                                        0x00000000
                                        0x01ad45b6
                                        0x01ad45b0
                                        0x01ad45a3
                                        0x01ad4599
                                        0x01ad458c
                                        0x01ad4582
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ad41f4
                                        0x01ad423e
                                        0x01ad4241
                                        0x01ad45c0
                                        0x01ad45c4
                                        0x00000000
                                        0x01ad45ca
                                        0x01ad45ca
                                        0x00000000
                                        0x01b1e207
                                        0x01b1e20f
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ad45d1
                                        0x00000000
                                        0x00000000
                                        0x01ad45ca
                                        0x00000000
                                        0x01ad4247
                                        0x01ad4247
                                        0x01ad4247
                                        0x01ad4249
                                        0x01ad4249
                                        0x01ad4249
                                        0x01ad4251
                                        0x01ad4251
                                        0x01ad4257
                                        0x01ad425f
                                        0x01ad426e
                                        0x01ad4270
                                        0x01ad427a
                                        0x01b1e219
                                        0x01b1e219
                                        0x01ad4280
                                        0x01ad4282
                                        0x01ad4456
                                        0x01ad45ea
                                        0x00000000
                                        0x01ad45f0
                                        0x01b1e223
                                        0x00000000
                                        0x01b1e223
                                        0x01ad445c
                                        0x01ad445c
                                        0x00000000
                                        0x01ad445c
                                        0x00000000
                                        0x01ad4288
                                        0x01ad428c
                                        0x01b1e298
                                        0x01ad4292
                                        0x01ad4292
                                        0x01ad429e
                                        0x01ad42a3
                                        0x01ad42a7
                                        0x01ad42ac
                                        0x01b1e22d
                                        0x01ad42b2
                                        0x01ad42b2
                                        0x01ad42b9
                                        0x01ad42bc
                                        0x01ad42c2
                                        0x01ad42ca
                                        0x01ad42cd
                                        0x01ad42cd
                                        0x01ad42d4
                                        0x01ad433f
                                        0x01ad433f
                                        0x01ad42d6
                                        0x01ad42d6
                                        0x01ad42d9
                                        0x01ad42dd
                                        0x01ad42eb
                                        0x01b1e23a
                                        0x01ad42f1
                                        0x01ad4305
                                        0x01ad430d
                                        0x01ad4315
                                        0x01ad4318
                                        0x01ad431f
                                        0x01ad4322
                                        0x01ad432e
                                        0x01ad433b
                                        0x01ad433b
                                        0x00000000
                                        0x01ad432e
                                        0x01ad42eb
                                        0x01ad434c
                                        0x01ad434e
                                        0x01ad4352
                                        0x01ad4359
                                        0x01ad435e
                                        0x01ad4361
                                        0x01ad436e
                                        0x01ad438a
                                        0x01ad438e
                                        0x01ad4396
                                        0x01ad439e
                                        0x01ad43a1
                                        0x01ad43ad
                                        0x01ad43bb
                                        0x01ad43bb
                                        0x01ad43ad
                                        0x01ad436e
                                        0x01ad43bf
                                        0x01ad43c5
                                        0x01ad4463
                                        0x01ad4463
                                        0x01ad43ce
                                        0x01ad43d5
                                        0x01ad43d9
                                        0x01ad43df
                                        0x01ad4475
                                        0x01ad4479
                                        0x01ad4491
                                        0x01ad4491
                                        0x01ad4479
                                        0x01ad43e5
                                        0x01ad43eb
                                        0x01ad43f4
                                        0x01ad43f6
                                        0x01ad43f9
                                        0x01ad43fc
                                        0x01ad43ff
                                        0x01ad44e8
                                        0x01ad44ed
                                        0x01ad44f3
                                        0x01b1e247
                                        0x00000000
                                        0x01ad44f9
                                        0x01ad4504
                                        0x01ad4508
                                        0x01ad450f
                                        0x01b1e269
                                        0x00000000
                                        0x01ad4515
                                        0x01ad4519
                                        0x01ad4531
                                        0x01ad4534
                                        0x01ad4537
                                        0x01ad453e
                                        0x01ad4541
                                        0x01ad454a
                                        0x01b1e255
                                        0x01b1e255
                                        0x01b1e25b
                                        0x01b1e25e
                                        0x01b1e261
                                        0x01b1e261
                                        0x01ad4555
                                        0x01ad4559
                                        0x01ad455d
                                        0x01b1e26d
                                        0x01b1e270
                                        0x01b1e274
                                        0x01b1e27a
                                        0x01b1e27d
                                        0x01b1e28e
                                        0x01b1e28e
                                        0x01ad4563
                                        0x01ad4563
                                        0x01ad4569
                                        0x01ad4569
                                        0x00000000
                                        0x01ad455d
                                        0x01ad450f
                                        0x00000000
                                        0x01ad44f3
                                        0x01ad43ff
                                        0x01ad4405
                                        0x01ad4405
                                        0x01ad4405
                                        0x01ad42ac
                                        0x01ad428c
                                        0x01ad4282
                                        0x01ad4407
                                        0x01ad440d
                                        0x01b1e2af
                                        0x01b1e2af
                                        0x01ad4413
                                        0x01ad4413
                                        0x00000000
                                        0x01ad41d4
                                        0x00000000
                                        0x01ad41c3
                                        0x01ad41bd
                                        0x01ad4415
                                        0x01ad4415
                                        0x01ad4416
                                        0x01ad4417
                                        0x01ad4429
                                        0x01ad416e
                                        0x01ad416e
                                        0x01ad4175
                                        0x01ad4498
                                        0x01ad449f
                                        0x01b1e12d
                                        0x00000000
                                        0x01b1e133
                                        0x00000000
                                        0x01b1e133
                                        0x01ad44a5
                                        0x01ad44a5
                                        0x01ad44aa
                                        0x00000000
                                        0x01ad44bb
                                        0x01ad44ca
                                        0x01ad44d6
                                        0x01ad44d7
                                        0x01ad44d8
                                        0x01ad44e3
                                        0x01ad44e3
                                        0x01ad44aa
                                        0x01ad417b
                                        0x01ad417b
                                        0x01ad417b
                                        0x00000000
                                        0x01ad417b
                                        0x01ad4175
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 11593f594c5d532015eee213640aaa35576bca860bc4581ec2f3bf19d211a991
                                        • Instruction ID: 5d697cde4573f34c2dafe671b268397d2d6787cf0b75fc14f75c7292435c99c7
                                        • Opcode Fuzzy Hash: 11593f594c5d532015eee213640aaa35576bca860bc4581ec2f3bf19d211a991
                                        • Instruction Fuzzy Hash: 02F18C706086118FC729CF69C480A7ABBF1FF88714F49496EF986CBA51E734D891CB52
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE20A0 Relevance: .4, Instructions: 420COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 92%
                                        			E01AE20A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1ba8714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E01AE2EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E01AE2EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E01AB58EC(_t240);
									_t221 =  *0x1ba5cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1ba5cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E01AF4A2C(0x1ba6e40, 0x1af4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E01AD7D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1a95c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E01AEF6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E01AEF6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E01B37016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L01AD2400(_t267 + 0x20);
															}
															L01AD2400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E01AE2397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E01AD2280(_t134, 0x1ba8608);
									__eflags =  *0x1ba6e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E01ACFFB0(_t198, _t241, 0x1ba8608);
										__eflags = _t253;
										if(_t253 != 0) {
											L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1ba6e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1ba8608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E01AE6B90(_t210,  &_v64);
										_t262 =  *0x1ba8608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E01AEE180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E01AF97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E01AF006A(0x1ba8608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1ba8608);
												E01AFB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1ba6904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1ba6e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E01ACFFB0(_t198, _t240, 0x1ba8608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E01AF00C2(0x1ba8608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}











































































                                        0x01ae20a0
                                        0x01ae20a8
                                        0x01ae20ad
                                        0x01ae20b3
                                        0x01ae20b8
                                        0x01ae20c2
                                        0x01ae20c7
                                        0x01ae20cb
                                        0x01ae20d2
                                        0x01ae2263
                                        0x01ae2266
                                        0x01b25836
                                        0x01b25836
                                        0x00000000
                                        0x01ae226c
                                        0x01ae226c
                                        0x01ae2270
                                        0x01ae2274
                                        0x01ae20e2
                                        0x01ae20e2
                                        0x01ae20e6
                                        0x01ae20ee
                                        0x01b257dc
                                        0x01b257de
                                        0x01b257ec
                                        0x01b257ec
                                        0x01b257f1
                                        0x01b257f3
                                        0x01b257f8
                                        0x00000000
                                        0x01b257f8
                                        0x01b257e0
                                        0x01b257e4
                                        0x01b257ea
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b257ea
                                        0x01ae20f4
                                        0x01ae20f4
                                        0x01ae20f8
                                        0x01ae20f8
                                        0x01ae20fc
                                        0x01ae2100
                                        0x01ae2106
                                        0x01ae2201
                                        0x01ae2206
                                        0x01ae220b
                                        0x01ae220e
                                        0x01ae22a9
                                        0x01ae22ac
                                        0x00000000
                                        0x00000000
                                        0x01ae22b2
                                        0x01ae22b5
                                        0x01b25801
                                        0x01b25806
                                        0x00000000
                                        0x00000000
                                        0x01b25810
                                        0x01b25815
                                        0x01b25818
                                        0x00000000
                                        0x00000000
                                        0x01b2581e
                                        0x01ae22bb
                                        0x01ae22bb
                                        0x01ae2218
                                        0x01ae2218
                                        0x01ae221c
                                        0x01ae2220
                                        0x01ae2222
                                        0x01ae22c2
                                        0x01ae22c4
                                        0x01ae22dc
                                        0x01ae22dc
                                        0x01ae22e1
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ae22e7
                                        0x01ae22c8
                                        0x01ae22cd
                                        0x01ae22d3
                                        0x01ae22d6
                                        0x01b25823
                                        0x01b25825
                                        0x01b25827
                                        0x00000000
                                        0x00000000
                                        0x01b2582d
                                        0x00000000
                                        0x01b2582d
                                        0x00000000
                                        0x01ae2228
                                        0x01ae2228
                                        0x00000000
                                        0x01ae2228
                                        0x01ae2222
                                        0x01ae2214
                                        0x01ae2214
                                        0x00000000
                                        0x01ae2114
                                        0x01ae2114
                                        0x01ae2114
                                        0x01ae211a
                                        0x01ae211c
                                        0x01ae2348
                                        0x01ae234d
                                        0x01b25840
                                        0x01b25845
                                        0x01b25848
                                        0x01b2584e
                                        0x01b2584e
                                        0x01b25848
                                        0x01ae2353
                                        0x01ae2355
                                        0x01ae2388
                                        0x01ae2388
                                        0x01ae2368
                                        0x01ae236a
                                        0x01ae236c
                                        0x01ae238f
                                        0x00000000
                                        0x01ae236e
                                        0x01ae236e
                                        0x01ae218e
                                        0x01ae218e
                                        0x01ae2191
                                        0x01ae2195
                                        0x01b25a03
                                        0x01b25a06
                                        0x01b25a0c
                                        0x01b25a0f
                                        0x01b25a11
                                        0x01b25a13
                                        0x01b25a13
                                        0x01b25a19
                                        0x01b25a1f
                                        0x00000000
                                        0x01ae219b
                                        0x01ae219b
                                        0x01ae21a0
                                        0x01ae2282
                                        0x01ae2284
                                        0x01ae2284
                                        0x01ae2284
                                        0x01ae2284
                                        0x01ae21a6
                                        0x01ae21a9
                                        0x01ae21ac
                                        0x01ae21ae
                                        0x01ae21b3
                                        0x01ae228b
                                        0x01ae2290
                                        0x01ae2379
                                        0x01ae2296
                                        0x01ae2298
                                        0x01ae2298
                                        0x01ae2290
                                        0x01ae21b9
                                        0x01ae21be
                                        0x01ae22a2
                                        0x01ae22a2
                                        0x01ae21c4
                                        0x01ae21c8
                                        0x01ae21cc
                                        0x01ae21d0
                                        0x01ae21d4
                                        0x01ae21de
                                        0x01ae21e3
                                        0x01b25a29
                                        0x01b25a2c
                                        0x00000000
                                        0x00000000
                                        0x01b25a3b
                                        0x00000000
                                        0x01ae21e9
                                        0x01ae21e9
                                        0x01ae21e9
                                        0x01ae21ee
                                        0x01ae21f1
                                        0x01b25a45
                                        0x01b25a4b
                                        0x01b25a52
                                        0x01b25a58
                                        0x01b25a5d
                                        0x01b25a5f
                                        0x01b25a71
                                        0x01b25a61
                                        0x01b25a6a
                                        0x01b25a6a
                                        0x01b25a76
                                        0x01b25a79
                                        0x01b25a7f
                                        0x01b25a83
                                        0x01b25a85
                                        0x01b25a87
                                        0x01b25a87
                                        0x01b25a8c
                                        0x01b25a91
                                        0x01b25a97
                                        0x01b25a9f
                                        0x01b25aa0
                                        0x01b25aa1
                                        0x01b25aa6
                                        0x01b25aab
                                        0x01b25ab1
                                        0x01b25ab3
                                        0x01b25ab9
                                        0x01b25aca
                                        0x01b25ad4
                                        0x01b25ad4
                                        0x01b25ade
                                        0x01b25ade
                                        0x01b25aab
                                        0x01b25a79
                                        0x01b25a52
                                        0x01ae21f7
                                        0x01ae21f9
                                        0x01ae21fe
                                        0x01ae21fe
                                        0x01ae21e3
                                        0x01ae2195
                                        0x01ae236c
                                        0x01ae2122
                                        0x01ae2122
                                        0x01ae2124
                                        0x01ae2231
                                        0x01ae2236
                                        0x01ae2236
                                        0x01ae2238
                                        0x01ae2238
                                        0x01ae2240
                                        0x01ae2242
                                        0x01ae2244
                                        0x01b259fc
                                        0x01ae218c
                                        0x01ae218c
                                        0x00000000
                                        0x01ae218c
                                        0x01ae224a
                                        0x01ae224f
                                        0x01ae2256
                                        0x01ae2304
                                        0x01ae2309
                                        0x01ae230f
                                        0x01ae231e
                                        0x01ae231e
                                        0x01ae231e
                                        0x01ae2320
                                        0x01ae2325
                                        0x01ae232a
                                        0x01ae232c
                                        0x01ae233e
                                        0x01ae233e
                                        0x00000000
                                        0x01ae232c
                                        0x01ae2311
                                        0x01ae2317
                                        0x01ae231a
                                        0x01ae231c
                                        0x01ae2380
                                        0x01ae2380
                                        0x01ae2380
                                        0x01ae2384
                                        0x00000000
                                        0x00000000
                                        0x01ae2386
                                        0x00000000
                                        0x01ae231c
                                        0x01ae225c
                                        0x01ae225c
                                        0x00000000
                                        0x01ae225c
                                        0x01ae212a
                                        0x01ae2134
                                        0x01ae2138
                                        0x01ae213d
                                        0x01b25858
                                        0x01b25863
                                        0x01b25863
                                        0x01b25867
                                        0x01b2586a
                                        0x00000000
                                        0x00000000
                                        0x01b2586c
                                        0x01b2586c
                                        0x01b25871
                                        0x01b25875
                                        0x01b25877
                                        0x01b25997
                                        0x01b2599c
                                        0x01b259a1
                                        0x01b259a7
                                        0x01b259a7
                                        0x00000000
                                        0x01b259a7
                                        0x01b2587d
                                        0x00000000
                                        0x01b2588b
                                        0x01b2588b
                                        0x01b25890
                                        0x01b25892
                                        0x01b25894
                                        0x01b25899
                                        0x01b2589b
                                        0x01b258a0
                                        0x01b258a0
                                        0x01b258aa
                                        0x01b258b2
                                        0x01b258b6
                                        0x01b258be
                                        0x01b258c6
                                        0x01b258c9
                                        0x01b2590d
                                        0x01b25917
                                        0x01b2591a
                                        0x01b2591c
                                        0x01b25920
                                        0x01b25928
                                        0x01b2592a
                                        0x01b2592c
                                        0x01b2592e
                                        0x01b2592e
                                        0x01b258cb
                                        0x01b258cd
                                        0x01b258d8
                                        0x01b258e0
                                        0x01b258f4
                                        0x01b258fe
                                        0x01b258fe
                                        0x01b2593a
                                        0x01b2593e
                                        0x01b25940
                                        0x01b25942
                                        0x00000000
                                        0x01b25944
                                        0x01b25944
                                        0x01b25949
                                        0x01b2594e
                                        0x01b2594e
                                        0x01b25953
                                        0x01b2595b
                                        0x01b25976
                                        0x01b25976
                                        0x01b2597a
                                        0x01b2597f
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b25981
                                        0x01b25981
                                        0x01b25981
                                        0x01b25983
                                        0x01b25988
                                        0x01b2598d
                                        0x01b25991
                                        0x01b25991
                                        0x00000000
                                        0x01b2595d
                                        0x01b2595d
                                        0x01b25963
                                        0x01b25965
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b25967
                                        0x01b25967
                                        0x01b2596b
                                        0x01b2596d
                                        0x00000000
                                        0x00000000
                                        0x01b2596f
                                        0x01b25971
                                        0x01b25971
                                        0x01b25974
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b25974
                                        0x00000000
                                        0x01b25967
                                        0x01b2595b
                                        0x01b25942
                                        0x01b25863
                                        0x01ae2143
                                        0x01ae2143
                                        0x01ae2149
                                        0x01ae214f
                                        0x01ae22f1
                                        0x01ae22f6
                                        0x00000000
                                        0x01ae2173
                                        0x01ae2173
                                        0x01ae217d
                                        0x01ae2181
                                        0x01ae2186
                                        0x01b259ae
                                        0x01b259b2
                                        0x01b259b5
                                        0x01b259b7
                                        0x01b259ba
                                        0x01b259cd
                                        0x01b259d1
                                        0x01b259d5
                                        0x01b259d9
                                        0x01b259db
                                        0x00000000
                                        0x00000000
                                        0x01b259dd
                                        0x01b259dd
                                        0x01b259e1
                                        0x01b259e4
                                        0x01b259e7
                                        0x01b259ee
                                        0x01b259ee
                                        0x01b259f3
                                        0x01b259f3
                                        0x00000000
                                        0x01ae2186
                                        0x01ae214f
                                        0x01ae2106
                                        0x01ae2266
                                        0x01ae20d8
                                        0x01ae20da
                                        0x01ae20e0
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 581e2b97c4258fe6017cd10b99b6c106a3c01e78f38543f74280d5f50b6546c0
                                        • Instruction ID: d7e21de0bdefcf3e33ec7032760557b1d86fd9360fa6156942d20bd156e17602
                                        • Opcode Fuzzy Hash: 581e2b97c4258fe6017cd10b99b6c106a3c01e78f38543f74280d5f50b6546c0
                                        • Instruction Fuzzy Hash: F8F117716083519FE73ACF2CC4487AA7BE9EF85314F08855EE9998B281D775D844CB82
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC849B Relevance: .3, Instructions: 290COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 92%
                                        			E01AC849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x1b8f9c0);
				E01B0D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x1ba7b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E01ACCEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E01AD2280( *[fs:0x30], 0x1ba8550);
						_t139 =  *0x1ba7b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E01AEF3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E01ACFFB0(_t193, _t235, 0x1ba8550);
								L5:
								return E01B0D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E01AB1C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x1ba7b9c; // 0x0
							_t235 = L01AD4620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x1ba7b10; // 0x0
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E01AEA61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E01ACFFB0(_t193, _t235, 0x1ba8550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L01AD77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L01AD77F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x1ba7b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x1ba7b10; // 0x0
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E01AF37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x1ba7b9c; // 0x0
									_t214 = L01AD4620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E01AF37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x1ba7b10 =  *0x1ba7b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x1ba7b04 =  *0x1ba7b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L01AD77F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L01AD77F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x1ba7b08 =  *0x1ba7b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E01AF57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E01AFF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L01AD77F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E01AEA44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L01AD77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E01AF96C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

































                                        0x01ac849b
                                        0x01ac849b
                                        0x01ac849b
                                        0x01ac849b
                                        0x01ac849d
                                        0x01ac84a2
                                        0x01ac84a7
                                        0x01ac84b1
                                        0x01ac84d8
                                        0x00000000
                                        0x01ac84b3
                                        0x01ac84c4
                                        0x01ac84c9
                                        0x01ac84cd
                                        0x01ac84cf
                                        0x01ac84cf
                                        0x01ac84d6
                                        0x01ac84e6
                                        0x01ac84e9
                                        0x01ac84ec
                                        0x01ac84ef
                                        0x01ac84f2
                                        0x01ac84f4
                                        0x01ac84fc
                                        0x01ac8501
                                        0x01ac8506
                                        0x01ac8509
                                        0x01ac86e0
                                        0x01ac86e5
                                        0x01ac86e8
                                        0x01ac86ed
                                        0x01ac86f0
                                        0x01ac86f2
                                        0x01b19afd
                                        0x01b19b02
                                        0x01ac84da
                                        0x01ac84df
                                        0x01ac84df
                                        0x01ac86fa
                                        0x01ac86fd
                                        0x01ac86fe
                                        0x01ac8701
                                        0x01ac8706
                                        0x01ac8709
                                        0x01ac870b
                                        0x00000000
                                        0x00000000
                                        0x01ac8711
                                        0x01ac8725
                                        0x01ac8727
                                        0x01ac872a
                                        0x01ac872c
                                        0x01b19af0
                                        0x01b19af5
                                        0x01ac8732
                                        0x01ac8732
                                        0x01ac8732
                                        0x01ac8735
                                        0x01ac8737
                                        0x01ac8515
                                        0x01ac8515
                                        0x01ac8518
                                        0x01ac851d
                                        0x01ac8523
                                        0x01ac8527
                                        0x01ac852b
                                        0x01ac8537
                                        0x01ac8539
                                        0x01ac853c
                                        0x01ac853e
                                        0x01ac868c
                                        0x01ac8691
                                        0x01ac8699
                                        0x01ac869b
                                        0x01ac8744
                                        0x01ac8748
                                        0x01ac86a1
                                        0x01ac86a1
                                        0x01ac86a1
                                        0x01ac86a4
                                        0x01ac86a8
                                        0x01b19bdf
                                        0x01b19bdf
                                        0x01ac86ae
                                        0x01ac86b0
                                        0x00000000
                                        0x01ac86b6
                                        0x00000000
                                        0x01b19be9
                                        0x01ac86b0
                                        0x01ac8544
                                        0x01ac854a
                                        0x01ac854d
                                        0x01ac8551
                                        0x01ac876e
                                        0x01ac8778
                                        0x01ac877b
                                        0x01ac8780
                                        0x01ac8557
                                        0x01ac8557
                                        0x01ac855d
                                        0x01ac855d
                                        0x01ac856b
                                        0x01ac856e
                                        0x01ac8570
                                        0x01ac8573
                                        0x01ac8576
                                        0x01ac8576
                                        0x01ac8579
                                        0x01ac857b
                                        0x00000000
                                        0x00000000
                                        0x01ac8581
                                        0x01ac85a0
                                        0x01ac85a2
                                        0x01ac85a5
                                        0x01ac85a7
                                        0x01b19b1b
                                        0x01b19b1b
                                        0x01ac862e
                                        0x01ac862e
                                        0x01ac8631
                                        0x01ac8631
                                        0x01ac8634
                                        0x01ac8636
                                        0x01ac8669
                                        0x01ac8669
                                        0x01ac866b
                                        0x01b19bbf
                                        0x01b19bc4
                                        0x01b19bc8
                                        0x01b19bce
                                        0x01b19bce
                                        0x01ac8671
                                        0x01ac8671
                                        0x01ac8674
                                        0x01ac8676
                                        0x01b19bae
                                        0x01b19bae
                                        0x01ac8676
                                        0x01ac867c
                                        0x01ac867e
                                        0x01ac8688
                                        0x01ac8688
                                        0x00000000
                                        0x01ac867e
                                        0x01ac8638
                                        0x01ac8638
                                        0x01ac863b
                                        0x01ac863e
                                        0x01ac863f
                                        0x01ac8642
                                        0x01ac8645
                                        0x01ac8648
                                        0x01ac864d
                                        0x01b19b69
                                        0x01b19b6e
                                        0x01b19b7b
                                        0x01b19b81
                                        0x01b19b85
                                        0x01b19b89
                                        0x01b19ba7
                                        0x01b19b8b
                                        0x01b19b91
                                        0x01b19b9a
                                        0x01b19b9f
                                        0x01b19b9f
                                        0x01ac8788
                                        0x01ac878d
                                        0x01ac8763
                                        0x01ac8763
                                        0x01ac8766
                                        0x00000000
                                        0x01ac8766
                                        0x01b19b70
                                        0x00000000
                                        0x01b19b70
                                        0x01ac8656
                                        0x01ac865a
                                        0x01ac865c
                                        0x01ac8752
                                        0x01ac8756
                                        0x00000000
                                        0x00000000
                                        0x01ac875e
                                        0x00000000
                                        0x01ac875e
                                        0x01ac8662
                                        0x01ac8662
                                        0x01ac8662
                                        0x01ac8666
                                        0x00000000
                                        0x01ac8666
                                        0x01ac85b7
                                        0x01ac85b9
                                        0x01ac85bc
                                        0x01ac85bf
                                        0x01ac85cc
                                        0x01ac85d1
                                        0x01ac85d4
                                        0x01ac85db
                                        0x01ac85de
                                        0x01ac85e0
                                        0x01b19b5f
                                        0x00000000
                                        0x01b19b5f
                                        0x01ac85e6
                                        0x01ac85ea
                                        0x01ac86c3
                                        0x01ac86c5
                                        0x01ac86c8
                                        0x01ac86ca
                                        0x01b19b16
                                        0x00000000
                                        0x01b19b16
                                        0x01ac86d6
                                        0x01ac85f6
                                        0x01ac85f6
                                        0x01ac85f9
                                        0x01ac8602
                                        0x01ac8606
                                        0x01ac860a
                                        0x01ac860b
                                        0x01ac860e
                                        0x01ac8611
                                        0x00000000
                                        0x01ac8611
                                        0x01ac85f3
                                        0x00000000
                                        0x01ac85f3
                                        0x01ac8619
                                        0x01ac861e
                                        0x01ac861e
                                        0x01ac8621
                                        0x01ac8622
                                        0x01ac8623
                                        0x01ac8625
                                        0x01ac862c
                                        0x00000000
                                        0x01ac873d
                                        0x00000000
                                        0x01ac873d
                                        0x01ac8737
                                        0x01ac850f
                                        0x01ac8512
                                        0x00000000
                                        0x01ac8512
                                        0x00000000
                                        0x01ac84d6

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 76cc9c07af62c673f772bb2955935ec7ece5c97f4827697bf3920ecf5cef1f42
                                        • Instruction ID: 62604037e72c80465a0fcd426636db8a89d8b6b8e487551df3fb6d78c9b97aaf
                                        • Opcode Fuzzy Hash: 76cc9c07af62c673f772bb2955935ec7ece5c97f4827697bf3920ecf5cef1f42
                                        • Instruction Fuzzy Hash: F9B16CB0E00249DFDB19DFE9C994AAEFBB5FF48704F54412EE506AB245DB74A841CB80
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABC600 Relevance: .2, Instructions: 225COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 67%
                                        			E01ABC600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x1bad360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E01AC6D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E01AFB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x1ba7b9c; // 0x0
					_t74 = L01AD4620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E01AF9650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L01AD77F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E01AFF3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E01AF13C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L01AD77F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E01AF9650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}










































                                        0x01abc608
                                        0x01abc615
                                        0x01abc625
                                        0x01abc62d
                                        0x01abc635
                                        0x01abc640
                                        0x01abc680
                                        0x01abc687
                                        0x01abc688
                                        0x01abc689
                                        0x01abc694
                                        0x01abc694
                                        0x01abc642
                                        0x01abc64a
                                        0x01abc697
                                        0x01b27a25
                                        0x01b27a2b
                                        0x01b27a2e
                                        0x01b27a30
                                        0x01b27bea
                                        0x01b27bea
                                        0x00000000
                                        0x01b27bea
                                        0x01b27a36
                                        0x01b27a43
                                        0x01b27a48
                                        0x01b27a4c
                                        0x01b27a4e
                                        0x00000000
                                        0x00000000
                                        0x01b27a58
                                        0x01b27a5a
                                        0x01b27a5b
                                        0x01b27a5c
                                        0x01b27a5d
                                        0x01b27a63
                                        0x01b27a64
                                        0x01b27a6a
                                        0x01b27a6c
                                        0x01b27a6e
                                        0x01b279cb
                                        0x01b279cb
                                        0x01b279ce
                                        0x01b279d0
                                        0x01b27a98
                                        0x01b27a9b
                                        0x01b27a9b
                                        0x01b27a9e
                                        0x01b27aa1
                                        0x01b27bbe
                                        0x01b27bbe
                                        0x01b27bc0
                                        0x01b27be0
                                        0x01b27be0
                                        0x01b27a01
                                        0x01b27a01
                                        0x01b27a05
                                        0x01b27a07
                                        0x01b27a15
                                        0x01b27a15
                                        0x01b27a1a
                                        0x00000000
                                        0x01b27a1a
                                        0x01b27bc2
                                        0x01b27bc6
                                        0x01b27bc9
                                        0x01b27bcd
                                        0x01b27bcf
                                        0x01b279e6
                                        0x01b279e6
                                        0x01b279eb
                                        0x01b279eb
                                        0x01b279ef
                                        0x01b279f1
                                        0x00000000
                                        0x00000000
                                        0x01b279f3
                                        0x01b279f5
                                        0x01b279ff
                                        0x01b279ff
                                        0x00000000
                                        0x01b279ff
                                        0x01b279f7
                                        0x01b279fd
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b279fd
                                        0x01b27bd5
                                        0x01b27bd8
                                        0x00000000
                                        0x00000000
                                        0x01b27ba9
                                        0x01b27bac
                                        0x01b27bb0
                                        0x01b27bb1
                                        0x01b27bb1
                                        0x01b27bb6
                                        0x00000000
                                        0x01b27bb6
                                        0x01b27aa7
                                        0x01b27aaa
                                        0x00000000
                                        0x00000000
                                        0x01b27ab2
                                        0x01b27ab3
                                        0x01b27ab5
                                        0x01b27aec
                                        0x01b27aef
                                        0x01b27b25
                                        0x01b27b28
                                        0x01b27b62
                                        0x01b27b64
                                        0x01b27b8f
                                        0x01b27b92
                                        0x01b27b96
                                        0x01b27b98
                                        0x00000000
                                        0x00000000
                                        0x01b27b9e
                                        0x01b27b9f
                                        0x01b27ba3
                                        0x00000000
                                        0x01b27ba3
                                        0x01b27b66
                                        0x01b27b68
                                        0x01b27ae2
                                        0x01b27ae2
                                        0x00000000
                                        0x01b27ae2
                                        0x01b27b6e
                                        0x01b27b72
                                        0x01b27b75
                                        0x01b27b81
                                        0x01b27b85
                                        0x01b27b87
                                        0x00000000
                                        0x00000000
                                        0x01b27b31
                                        0x01b27b34
                                        0x01b27b3c
                                        0x01b27b45
                                        0x01b27b46
                                        0x01b27b4f
                                        0x01b27b51
                                        0x01b27b57
                                        0x01b27b59
                                        0x01b27b59
                                        0x00000000
                                        0x01b27b59
                                        0x01b27b77
                                        0x00000000
                                        0x01b27b77
                                        0x01b27b2a
                                        0x00000000
                                        0x01b27b2a
                                        0x01b27af1
                                        0x01b27af3
                                        0x00000000
                                        0x00000000
                                        0x01b27afb
                                        0x01b27afc
                                        0x01b27afe
                                        0x00000000
                                        0x00000000
                                        0x01b27b00
                                        0x01b27b03
                                        0x00000000
                                        0x00000000
                                        0x01b27b05
                                        0x01b27b09
                                        0x01b27b0d
                                        0x01b27b0f
                                        0x00000000
                                        0x00000000
                                        0x01b27b18
                                        0x01b27b1d
                                        0x00000000
                                        0x01b27b1d
                                        0x01b27ab7
                                        0x01b27ab9
                                        0x00000000
                                        0x00000000
                                        0x01b27abf
                                        0x01b27ac1
                                        0x00000000
                                        0x00000000
                                        0x01b27ac3
                                        0x01b27ac6
                                        0x00000000
                                        0x00000000
                                        0x01b27ac8
                                        0x01b27acc
                                        0x01b27ad0
                                        0x01b27ad2
                                        0x00000000
                                        0x00000000
                                        0x01b27adb
                                        0x00000000
                                        0x01b27adb
                                        0x01b279d6
                                        0x01b279d9
                                        0x01b279dc
                                        0x01b27a91
                                        0x01b27a94
                                        0x00000000
                                        0x01b27a94
                                        0x01b279e2
                                        0x00000000
                                        0x01b279e2
                                        0x01b27a74
                                        0x01b27a7a
                                        0x00000000
                                        0x00000000
                                        0x01b27a8a
                                        0x01b27a21
                                        0x01b27a21
                                        0x00000000
                                        0x01b27a21
                                        0x01abc650
                                        0x01abc651
                                        0x01abc656
                                        0x01abc65c
                                        0x01abc65d
                                        0x01abc663
                                        0x01abc664
                                        0x01abc66a
                                        0x01abc66e
                                        0x01b279c5
                                        0x01b279c7
                                        0x00000000
                                        0x01b279c7
                                        0x01abc67a
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6eb42391d4a601bb96ed325732fea9c3c995e24c10d5625b39897c4f533449bc
                                        • Instruction ID: 6e55e0f1760c6150e207693df7c54900e362bf67e329376828407b4b2d5e98e6
                                        • Opcode Fuzzy Hash: 6eb42391d4a601bb96ed325732fea9c3c995e24c10d5625b39897c4f533449bc
                                        • Instruction Fuzzy Hash: A381E5716043119BDB2ACE58C890F6B77E4EB94360F1449AEFE49CB201DB30DD49C799
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B4B8D0 Relevance: .2, Instructions: 199COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 39%
                                        			E01B4B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x1ba7b9c; // 0x0
				_t124 = L01AD4620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E01AF9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E01AF95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E01AF95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L01AD77F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E01AF9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E01AF95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x1ba7b9c; // 0x0
									_t92 = L01AD4620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E01AF9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E01ABA7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E01B4E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E01B4E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E01AF95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}




















                                        0x01b4b8d9
                                        0x01b4b8e4
                                        0x00000000
                                        0x01b4b8e6
                                        0x01b4b8f3
                                        0x01b4b8f5
                                        0x01b4b8f5
                                        0x01b4b8f8
                                        0x01b4b920
                                        0x01b4b924
                                        0x01b4b936
                                        0x01b4b939
                                        0x01b4b93d
                                        0x01b4b948
                                        0x01b4b9a0
                                        0x01b4b9a0
                                        0x01b4b9a4
                                        0x01b4b9bf
                                        0x01b4b9c4
                                        0x01b4b9c6
                                        0x01b4b9cd
                                        0x01b4b9d1
                                        0x01b4bad4
                                        0x01b4bad8
                                        0x01b4bada
                                        0x01b4badc
                                        0x01b4badc
                                        0x01b4badf
                                        0x01b4bae0
                                        0x01b4bae2
                                        0x01b4bae4
                                        0x01b4baec
                                        0x01b4baee
                                        0x01b4baf0
                                        0x01b4baf0
                                        0x01b4baec
                                        0x01b4bafb
                                        0x01b4bafc
                                        0x01b4bafe
                                        0x01b4bb01
                                        0x01b4bb01
                                        0x00000000
                                        0x01b4bb06
                                        0x01b4b9d7
                                        0x01b4b9db
                                        0x01b4b9db
                                        0x01b4b9de
                                        0x01b4b9de
                                        0x01b4b9e4
                                        0x01b4b9e7
                                        0x01b4b9ea
                                        0x01b4b9ec
                                        0x01b4b9ef
                                        0x01b4b9f3
                                        0x01b4ba1b
                                        0x01b4ba1b
                                        0x01b4ba23
                                        0x01b4ba24
                                        0x01b4ba27
                                        0x01b4ba2a
                                        0x01b4ba2b
                                        0x01b4ba2e
                                        0x01b4ba30
                                        0x01b4ba37
                                        0x01b4ba3f
                                        0x01b4ba9c
                                        0x01b4baa2
                                        0x01b4bb13
                                        0x01b4bb15
                                        0x01b4baae
                                        0x01b4baae
                                        0x01b4bab3
                                        0x01b4bab5
                                        0x01b4baba
                                        0x01b4bac8
                                        0x01b4bac8
                                        0x01b4baba
                                        0x01b4bacd
                                        0x01b4bacf
                                        0x00000000
                                        0x01b4bacf
                                        0x01b4bb1a
                                        0x00000000
                                        0x01b4bb1c
                                        0x01b4baa7
                                        0x01b4bb11
                                        0x00000000
                                        0x01b4bb11
                                        0x01b4baa9
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b4ba41
                                        0x01b4ba41
                                        0x01b4ba41
                                        0x01b4ba58
                                        0x01b4ba5d
                                        0x01b4ba62
                                        0x00000000
                                        0x00000000
                                        0x01b4ba64
                                        0x01b4ba67
                                        0x01b4ba68
                                        0x01b4ba69
                                        0x01b4ba6c
                                        0x01b4ba6f
                                        0x01b4ba71
                                        0x01b4ba78
                                        0x01b4ba80
                                        0x00000000
                                        0x00000000
                                        0x01b4ba90
                                        0x01b4ba90
                                        0x01b4ba97
                                        0x00000000
                                        0x01b4ba97
                                        0x01b4b9f5
                                        0x01b4b9f7
                                        0x01b4b9f7
                                        0x01b4b9fa
                                        0x01b4ba03
                                        0x01b4ba07
                                        0x01b4ba0c
                                        0x01b4ba10
                                        0x01b4ba17
                                        0x00000000
                                        0x01b4b9f7
                                        0x01b4b9a6
                                        0x01b4b9a8
                                        0x01b4b9af
                                        0x01b4b9b3
                                        0x00000000
                                        0x00000000
                                        0x01b4b9b9
                                        0x00000000
                                        0x01b4b9b9
                                        0x01b4b94d
                                        0x01b4b98f
                                        0x01b4b995
                                        0x01b4b999
                                        0x01b4b960
                                        0x01b4b967
                                        0x01b4b968
                                        0x01b4b96a
                                        0x00000000
                                        0x01b4b96a
                                        0x01b4b99b
                                        0x01b4b99e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b4b99e
                                        0x01b4b951
                                        0x01b4b954
                                        0x01b4b95a
                                        0x01b4b95e
                                        0x01b4b972
                                        0x01b4b979
                                        0x01b4b97d
                                        0x01b4b97f
                                        0x01b4b980
                                        0x01b4b982
                                        0x01b4b984
                                        0x00000000
                                        0x01b4b984
                                        0x00000000
                                        0x01b4b926
                                        0x00000000
                                        0x01b4b926

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 1d78d7bb2226028c76445acb8472bd53256266b55674c3b45df1a9a11747e016
                                        • Instruction ID: e1d9f3313cdb49d2aef9258ed1a0c83cc077df815fb2358a1a95ed948fca6fe2
                                        • Opcode Fuzzy Hash: 1d78d7bb2226028c76445acb8472bd53256266b55674c3b45df1a9a11747e016
                                        • Instruction Fuzzy Hash: 39710432200702AFEB39CF28CA84F66BBB5EB44720F158568E755876A0DB75E944EB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B36DC9 Relevance: .2, Instructions: 199COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 79%
                                        			E01B36DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E01B36B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E01AD7D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E01AF9AE0();
					_t87 = L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E01B3795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E01B3795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E01B3795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E01B3795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L01AD4620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E01B36B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E01B36B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E01B36B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E01B36B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E01AD7D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E01AF9AE0();
								L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L01AD2400( &_v36);
							if(_v24 >= 0) {
								_t87 = L01AD2400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L01AD2400( &_v52);
							}
							if(_v28 >= 0) {
								return L01AD2400( &_v60);
							}
						}
					}
				}
				return _t87;
			}































                                        0x01b36dd4
                                        0x01b36dde
                                        0x01b36de1
                                        0x01b36de3
                                        0x01b36de6
                                        0x01b36de9
                                        0x01b36dec
                                        0x01b36def
                                        0x01b36df2
                                        0x01b36df5
                                        0x01b36dfe
                                        0x01b36e04
                                        0x01b36e09
                                        0x01b36e0d
                                        0x01b36e18
                                        0x01b36e1b
                                        0x01b36e22
                                        0x01b36e2d
                                        0x01b36e30
                                        0x01b36e36
                                        0x01b36e42
                                        0x01b36e4d
                                        0x01b36e50
                                        0x01b36e55
                                        0x01b36e5c
                                        0x01b36e6e
                                        0x01b36e5e
                                        0x01b36e67
                                        0x01b36e67
                                        0x01b36e73
                                        0x01b36e74
                                        0x01b36e77
                                        0x01b36e7c
                                        0x01b36e7d
                                        0x01b36e8e
                                        0x01b36e93
                                        0x01b36e9c
                                        0x01b36ea8
                                        0x01b36eab
                                        0x01b36eac
                                        0x01b36eb3
                                        0x01b36ecd
                                        0x01b36edc
                                        0x01b36ee2
                                        0x01b36ee5
                                        0x01b36ef2
                                        0x01b36efb
                                        0x01b36f01
                                        0x01b36f06
                                        0x01b36f0b
                                        0x01b36f11
                                        0x01b36f1a
                                        0x01b36f22
                                        0x01b36f26
                                        0x01b36f26
                                        0x01b36f33
                                        0x01b36f41
                                        0x01b36f44
                                        0x01b36f47
                                        0x01b36f54
                                        0x01b36f65
                                        0x01b36f77
                                        0x01b36f7c
                                        0x01b36f82
                                        0x01b36f91
                                        0x01b36f99
                                        0x01b36fa3
                                        0x01b36fae
                                        0x01b36fae
                                        0x01b36fba
                                        0x01b36fbb
                                        0x01b36fbc
                                        0x01b36fc1
                                        0x01b36fc2
                                        0x01b36fd3
                                        0x01b36fd8
                                        0x01b36fd8
                                        0x01b36fdf
                                        0x01b36fe8
                                        0x01b36fee
                                        0x01b36fee
                                        0x01b36ff5
                                        0x01b36ffb
                                        0x01b36ffb
                                        0x01b37004
                                        0x00000000
                                        0x01b3700a
                                        0x01b37004
                                        0x01b36eb3
                                        0x01b36e9c
                                        0x01b37015

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                        • Instruction ID: b9a69cb4e476a005e217acc56793425d194d27b8bad99e67345ee632dec201d2
                                        • Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                        • Instruction Fuzzy Hash: 32719E71A0060AEFCB15DFA8C984AEEFBB8FF88314F104169E505E7250DB30EA51CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB52A5 Relevance: .2, Instructions: 161COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 78%
                                        			E01AB52A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E01ACEEF0(0x1ba79a0);
					_t104 =  *0x1ba8210; // 0x1572bf8
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E01ACEB70(_t93, 0x1ba79a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E01AF9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E01ACEEF0(0x1ba79a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E01ACEB70(0, 0x1ba79a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x1572c05
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E01AEF0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E01ACEEF0(0x1ba79a0);
									__eflags =  *0x1ba8210 - _t104; // 0x1572bf8
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x1ba8210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E01B34888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E01ACEB70(_t95, 0x1ba79a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E01AF95D0();
											L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E01AF95D0();
											L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E01ACEB70(_t93, 0x1ba79a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E01AF95D0();
										L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E01AF95D0();
										L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E01AEF0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

























                                        0x01ab52a5
                                        0x01ab52ad
                                        0x01ab52b0
                                        0x01ab52b3
                                        0x01ab52b7
                                        0x01ab52ba
                                        0x01ab52bf
                                        0x01ab52c4
                                        0x01ab52cc
                                        0x00000000
                                        0x00000000
                                        0x01ab52ce
                                        0x01ab52d9
                                        0x01ab52dd
                                        0x01ab52e7
                                        0x01ab52f7
                                        0x01ab52f9
                                        0x01ab52fd
                                        0x01b10dcf
                                        0x01b10dd5
                                        0x01b10dd6
                                        0x01b10dd7
                                        0x01b10dd8
                                        0x01b10dd9
                                        0x01b10dde
                                        0x01b10ddf
                                        0x01b10de0
                                        0x01b10de1
                                        0x01b10de2
                                        0x01b10de5
                                        0x01b10dea
                                        0x01b10dec
                                        0x01b10f60
                                        0x01b10f64
                                        0x01b10f70
                                        0x01b10f76
                                        0x01b10f79
                                        0x01b10f79
                                        0x00000000
                                        0x01b10f64
                                        0x01b10df2
                                        0x01b10df7
                                        0x01b10e04
                                        0x01b10e0d
                                        0x01b10e0d
                                        0x01b10e10
                                        0x01b10e1a
                                        0x01b10e1c
                                        0x01b10e4c
                                        0x01b10e52
                                        0x01b10e61
                                        0x01b10e67
                                        0x01b10e6b
                                        0x01b10e70
                                        0x01b10e76
                                        0x01b10ed7
                                        0x01b10edc
                                        0x01b10ee0
                                        0x01b10ee6
                                        0x01b10eea
                                        0x01b10eed
                                        0x01b10ef0
                                        0x01b10ef3
                                        0x01b10ef6
                                        0x01b10ef9
                                        0x01b10efe
                                        0x01b10f01
                                        0x01b10f01
                                        0x01b10f0b
                                        0x01b10f12
                                        0x01b10f16
                                        0x01b10f18
                                        0x01b10f1b
                                        0x01b10f2c
                                        0x01b10f31
                                        0x01b10f31
                                        0x01b10f35
                                        0x01b10f39
                                        0x01b10f3a
                                        0x01b10f3c
                                        0x01b10f3f
                                        0x01b10f50
                                        0x01b10f55
                                        0x01b10f55
                                        0x01b10f59
                                        0x01ab52eb
                                        0x01ab52f1
                                        0x01ab52f1
                                        0x01b10e7d
                                        0x01b10e84
                                        0x01b10e88
                                        0x01b10e8a
                                        0x01b10e8d
                                        0x01b10e9e
                                        0x01b10ea3
                                        0x01b10ea3
                                        0x01b10ea7
                                        0x01b10eaf
                                        0x01b10eb3
                                        0x01b10eb9
                                        0x01b10eb9
                                        0x01b10ebc
                                        0x01b10ecd
                                        0x01b10ecd
                                        0x00000000
                                        0x01b10eb3
                                        0x01b10e21
                                        0x01b10e2b
                                        0x01b10e2f
                                        0x01b10e30
                                        0x01b10e3a
                                        0x01b10e3f
                                        0x01b10e41
                                        0x00000000
                                        0x00000000
                                        0x01b10e47
                                        0x00000000
                                        0x01b10e47
                                        0x01b10df9
                                        0x01b10dfe
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b10dfe
                                        0x01ab5303
                                        0x01ab5307
                                        0x00000000
                                        0x01ab5309
                                        0x00000000
                                        0x01ab5309
                                        0x01ab5307
                                        0x01ab52e9
                                        0x01ab52e9
                                        0x00000000
                                        0x01ab52e9
                                        0x01ab530e
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9d0e8bcec23079ce52c4becb86d3fa8977ef2aad01946c8c2a397a9410c8d46c
                                        • Instruction ID: fb107ecb6fa358ca30dcafecf5b8cb97478dc68e1f4d98b8b267804c5a9b7fd0
                                        • Opcode Fuzzy Hash: 9d0e8bcec23079ce52c4becb86d3fa8977ef2aad01946c8c2a397a9410c8d46c
                                        • Instruction Fuzzy Hash: F2510E71209382AFD325EF68CA81B67BBE8FF50710F14091EF48583652E770E844CBA2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE2AE4 Relevance: .2, Instructions: 159COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AE2AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x1ba8204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x1ba8208; // 0x1ba8207
				_t8 = _t57 + 0x1ba8208; // 0x1ba8207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x1ba8450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x1ba821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x1ba6d5c; // 0x7f570654
							_t72 =  *0x1ba6d5c; // 0x7f570654
							_t75 =  *0x1ba6d5c; // 0x7f570654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x1ba6d5c; // 0x7f570654
							_t84 =  *0x1ba6d5c; // 0x7f570654
							_t87 =  *0x1ba6d5c; // 0x7f570654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E01AFF3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}






































                                        0x01ae2ae4
                                        0x01ae2aec
                                        0x01ae2aef
                                        0x01ae2af4
                                        0x01ae2af7
                                        0x01ae2afd
                                        0x01ae2b92
                                        0x01ae2b92
                                        0x01ae2b97
                                        0x01ae2b9c
                                        0x01ae2b9c
                                        0x01ae2b03
                                        0x01ae2b06
                                        0x01ae2b09
                                        0x01ae2b09
                                        0x01ae2b0f
                                        0x01ae2b15
                                        0x01ae2b15
                                        0x01ae2b1b
                                        0x01ae2b1e
                                        0x01ae2b21
                                        0x01ae2b26
                                        0x01ae2b29
                                        0x01ae2b81
                                        0x01ae2b84
                                        0x01ae2c0e
                                        0x01ae2c15
                                        0x01ae2c24
                                        0x01ae2c24
                                        0x01ae2b8a
                                        0x01ae2b8a
                                        0x01ae2b8a
                                        0x01ae2b8a
                                        0x01ae2b90
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ae2b4a
                                        0x01ae2b4a
                                        0x01ae2b4d
                                        0x01ae2b53
                                        0x00000000
                                        0x00000000
                                        0x01ae2b55
                                        0x01ae2b58
                                        0x01ae2bb7
                                        0x01b25d1b
                                        0x01b25d37
                                        0x01b25d47
                                        0x01b25d53
                                        0x01ae2bbd
                                        0x01ae2bbd
                                        0x01ae2bbd
                                        0x01ae2bb7
                                        0x01ae2b5d
                                        0x01ae2c2f
                                        0x01b25d5b
                                        0x01b25d77
                                        0x01b25d87
                                        0x01b25d93
                                        0x01ae2c35
                                        0x01ae2c35
                                        0x01ae2c35
                                        0x01ae2c2f
                                        0x01ae2b65
                                        0x01ae2b9f
                                        0x01ae2ba2
                                        0x01ae2b67
                                        0x01ae2b67
                                        0x01ae2b69
                                        0x01ae2b6b
                                        0x01ae2b6e
                                        0x01ae2bc9
                                        0x01ae2bcc
                                        0x01ae2bcf
                                        0x01ae2bd4
                                        0x01ae2bd6
                                        0x01ae2bd6
                                        0x01ae2bdb
                                        0x01ae2c02
                                        0x01ae2c05
                                        0x01ae2c07
                                        0x00000000
                                        0x01ae2c07
                                        0x01ae2be0
                                        0x01ae2c00
                                        0x01ae2c3f
                                        0x01ae2c3f
                                        0x00000000
                                        0x01ae2c00
                                        0x01ae2be5
                                        0x01ae2be7
                                        0x01ae2bec
                                        0x01ae2bf4
                                        0x01ae2bf6
                                        0x00000000
                                        0x01ae2bf6
                                        0x01ae2b70
                                        0x01ae2b76
                                        0x01ae2b2b
                                        0x01ae2b2b
                                        0x01ae2b2d
                                        0x01ae2b2f
                                        0x01ae2b32
                                        0x01ae2b35
                                        0x01ae2b3a
                                        0x00000000
                                        0x01ae2b40
                                        0x01ae2b43
                                        0x01ae2b45
                                        0x01ae2b47
                                        0x01ae2b4a
                                        0x01ae2b4d
                                        0x01ae2b53
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ae2b53
                                        0x01ae2b78
                                        0x01ae2b78
                                        0x01ae2b7b
                                        0x01ae2b7e
                                        0x00000000
                                        0x01ae2b7e
                                        0x01ae2b76
                                        0x01ae2ba5
                                        0x01ae2ba5
                                        0x01ae2ba8
                                        0x01ae2bad
                                        0x00000000
                                        0x00000000
                                        0x01ae2baf
                                        0x01ae2baf
                                        0x01ae2bc2
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: bbe4936b65c76f8dd193c29d76079e3e30e2d66b585d7359263059419820566f
                                        • Instruction ID: ab13b915a59355a4b3e48ff5e899affdc3cc7a4563c2fe854009c4ebddc6b002
                                        • Opcode Fuzzy Hash: bbe4936b65c76f8dd193c29d76079e3e30e2d66b585d7359263059419820566f
                                        • Instruction Fuzzy Hash: DE51B176A001258FCB28CF1DC894ABDB7F5FB8870071A845BE856AB315DB30AE51CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B7AE44 Relevance: .2, Instructions: 152COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 86%
                                        			E01B7AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E01B7C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E01B7ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E01B7FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E01B7EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E01AD7D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E01B71608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E01B81536(0x1ba8ae4, (_t74 -  *0x1ba8b04 >> 0x14) + (_t74 -  *0x1ba8b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L01B7C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E01B7A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E01B5CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E01B7ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}



















                                        0x01b7ae44
                                        0x01b7ae4c
                                        0x01b7ae53
                                        0x01b7ae55
                                        0x01b7ae5c
                                        0x01b7ae64
                                        0x01b7ae68
                                        0x01b7ae75
                                        0x01b7ae75
                                        0x01b7ae78
                                        0x01b7ae7a
                                        0x01b7ae7c
                                        0x01b7ae7f
                                        0x01b7aea8
                                        0x01b7aeab
                                        0x01b7aead
                                        0x00000000
                                        0x00000000
                                        0x01b7aeb3
                                        0x01b7aeb8
                                        0x01b7aebb
                                        0x01b7aebd
                                        0x00000000
                                        0x01b7ae81
                                        0x01b7ae88
                                        0x01b7ae8f
                                        0x01b7ae9b
                                        0x01b7ae96
                                        0x01b7ae96
                                        0x01b7ae96
                                        0x01b7aea0
                                        0x01b7aea3
                                        0x01b7aebf
                                        0x01b7aebf
                                        0x01b7aec3
                                        0x01b7aec9
                                        0x01b7af0d
                                        0x01b7af14
                                        0x01b7af3d
                                        0x01b7af3d
                                        0x01b7af41
                                        0x01b7af44
                                        0x01b7af67
                                        0x01b7af67
                                        0x01b7af6a
                                        0x01b7afca
                                        0x01b7afd1
                                        0x00000000
                                        0x01b7afd1
                                        0x01b7af6c
                                        0x01b7af6d
                                        0x01b7af75
                                        0x01b7af7c
                                        0x01b7af7e
                                        0x01b7af80
                                        0x01b7af85
                                        0x01b7af87
                                        0x01b7af99
                                        0x01b7af89
                                        0x01b7af92
                                        0x01b7af92
                                        0x01b7af9e
                                        0x01b7afa1
                                        0x01b7afa3
                                        0x01b7afa9
                                        0x01b7afb0
                                        0x01b7afb2
                                        0x01b7afb4
                                        0x01b7afbc
                                        0x01b7afbc
                                        0x01b7afb4
                                        0x01b7afb0
                                        0x00000000
                                        0x01b7afa1
                                        0x01b7af4f
                                        0x01b7af57
                                        0x01b7af5c
                                        0x01b7af5e
                                        0x00000000
                                        0x00000000
                                        0x01b7af60
                                        0x01b7af64
                                        0x01b7af64
                                        0x00000000
                                        0x01b7af64
                                        0x01b7af1a
                                        0x01b7af25
                                        0x00000000
                                        0x00000000
                                        0x01b7af27
                                        0x01b7af28
                                        0x01b7af33
                                        0x00000000
                                        0x01b7aed0
                                        0x01b7aed0
                                        0x01b7aed2
                                        0x01b7aee1
                                        0x01b7aee4
                                        0x00000000
                                        0x00000000
                                        0x01b7aee6
                                        0x01b7aeec
                                        0x00000000
                                        0x00000000
                                        0x01b7aefb
                                        0x01b7af07
                                        0x01b7afd3
                                        0x01b7afdb
                                        0x01b7afdb
                                        0x00000000
                                        0x01b7af07
                                        0x01b7aed6
                                        0x01b7aed8
                                        0x01b7aedf
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b7aedf
                                        0x01b7aec9

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 12292e77bd6aa3a7d6d3993e6a03c75fb4373708a850e247593422d124605daf
                                        • Instruction ID: 9e5f1dcc8319e3a256d3f4d5115d3c4d0d20762486b2ff0e50ad30c3e14ef3cb
                                        • Opcode Fuzzy Hash: 12292e77bd6aa3a7d6d3993e6a03c75fb4373708a850e247593422d124605daf
                                        • Instruction Fuzzy Hash: FA4115717002119BDB6EAA3DC894B3FBB99EF84610F1C4699F936CB2C0D730D801C691
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ADDBE9 Relevance: .1, Instructions: 149COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 86%
                                        			E01ADDBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E01ABCC50(E01AB4510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E01AD7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E01B88ED6(_t102, _t98);
						}
						_t76 = _v44;
						E01AD2280(_t58, _v44);
						E01ADDD82(_v44, _t102, _t98);
						E01ADB944(_t102, _v5);
						return E01ACFFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x1ba8628; // 0x0
							_v28 = _t67;
							_t68 =  *0x1ba862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x1ba8628; // 0x0
						_t105 = _v28;
						_t80 =  *0x1ba862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x1b7fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}









































                                        0x01addbe9
                                        0x01addbf2
                                        0x01addbf7
                                        0x01addbf9
                                        0x01addbfc
                                        0x01addc00
                                        0x01addc03
                                        0x01addc14
                                        0x01addd54
                                        0x01addd54
                                        0x01addd54
                                        0x01addc18
                                        0x01addc1d
                                        0x01addc1d
                                        0x01addc32
                                        0x01addc3b
                                        0x01addc3e
                                        0x01addc46
                                        0x01addd5b
                                        0x01addd62
                                        0x01addd64
                                        0x01addd67
                                        0x01addd69
                                        0x01addd6b
                                        0x01addd6e
                                        0x01addd70
                                        0x01addd73
                                        0x01addd73
                                        0x00000000
                                        0x01addc4c
                                        0x01addc4e
                                        0x01b23ae3
                                        0x01b23ae8
                                        0x01b23aea
                                        0x01addce7
                                        0x01addce9
                                        0x01addcec
                                        0x01addcee
                                        0x01addcf0
                                        0x01addcf3
                                        0x01addcf5
                                        0x01b23af2
                                        0x01b23af5
                                        0x01b23af5
                                        0x01addd06
                                        0x01addd08
                                        0x01addd0b
                                        0x01addd12
                                        0x01b23b08
                                        0x01addd18
                                        0x01addd18
                                        0x01addd18
                                        0x01addd20
                                        0x01addd23
                                        0x01b23b16
                                        0x01b23b16
                                        0x01addd29
                                        0x01addd2d
                                        0x01addd36
                                        0x01addd40
                                        0x01addd51
                                        0x01addd51
                                        0x01addc54
                                        0x01addc59
                                        0x01addc59
                                        0x01addc5e
                                        0x01addc5e
                                        0x01addc63
                                        0x01addc66
                                        0x01addc6b
                                        0x01addc78
                                        0x01addc7b
                                        0x01addc81
                                        0x01addc81
                                        0x01addc83
                                        0x01addc89
                                        0x00000000
                                        0x00000000
                                        0x01addd7b
                                        0x01addd7b
                                        0x01addc8f
                                        0x01addc8f
                                        0x01addc92
                                        0x01addc99
                                        0x01addc9f
                                        0x01addca5
                                        0x01addcaa
                                        0x01addcaa
                                        0x01addcb3
                                        0x01addcb8
                                        0x01addcbb
                                        0x01addcc1
                                        0x01addccf
                                        0x01addcd2
                                        0x01addcd5
                                        0x01addcd7
                                        0x01addcda
                                        0x01addcdc
                                        0x01addcdc
                                        0x01addce2
                                        0x01addce4
                                        0x00000000
                                        0x01addce4

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0350f9187665481b1531b98a2b807e331d784908788b0d7a266f6e1477172405
                                        • Instruction ID: 320ac45f5d3d7891466c80dc7027022294465d463bb852f4c5f60de6a1798605
                                        • Opcode Fuzzy Hash: 0350f9187665481b1531b98a2b807e331d784908788b0d7a266f6e1477172405
                                        • Instruction Fuzzy Hash: 9751B171E01A16CFCF14CFACC580AAEBBF5BB49310F248559D596A7384DB31A944CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ACEF40 Relevance: .1, Instructions: 147COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 96%
                                        			E01ACEF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E01AB9080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x77cfc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E01AB2D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}




























                                        0x01acef4b
                                        0x01acef4d
                                        0x01acef57
                                        0x01acf0bd
                                        0x01acf0c2
                                        0x01acf0d2
                                        0x01acf0d2
                                        0x01acf0c2
                                        0x01acef5d
                                        0x01acef5f
                                        0x01acef67
                                        0x01acef6a
                                        0x01acef6d
                                        0x01acef74
                                        0x01acef7f
                                        0x01acef82
                                        0x01acef82
                                        0x01acef86
                                        0x01acef88
                                        0x01acef8c
                                        0x01acef8f
                                        0x01acef8f
                                        0x01acef8f
                                        0x00000000
                                        0x01acef91
                                        0x01acef93
                                        0x01acefc4
                                        0x01acefc4
                                        0x01acefc4
                                        0x01acefca
                                        0x01acefd0
                                        0x01acf0a6
                                        0x00000000
                                        0x00000000
                                        0x01acf0af
                                        0x01b1bb06
                                        0x01b1bb0a
                                        0x01acf0b5
                                        0x01acf0b5
                                        0x01acf0b5
                                        0x01acf0b5
                                        0x00000000
                                        0x01acefd6
                                        0x01acefd9
                                        0x01acf0de
                                        0x01acf0e2
                                        0x01acefdf
                                        0x01acefdf
                                        0x01acefdf
                                        0x01acefe5
                                        0x01b1bafc
                                        0x01b1bafc
                                        0x01acefe5
                                        0x01acefeb
                                        0x01acefed
                                        0x01acf00f
                                        0x01acf011
                                        0x01acf01a
                                        0x01acf01d
                                        0x01acf021
                                        0x01acf028
                                        0x01acf029
                                        0x01acf029
                                        0x01acf02c
                                        0x00000000
                                        0x01acf02c
                                        0x01aceff3
                                        0x01aceff9
                                        0x01acf0ea
                                        0x01acf0ed
                                        0x01acf0ef
                                        0x00000000
                                        0x01acf0ef
                                        0x01acf003
                                        0x01b1bb12
                                        0x01acf045
                                        0x01acf049
                                        0x01acf051
                                        0x01acf09e
                                        0x01acf0a0
                                        0x01acf0a0
                                        0x01acf09e
                                        0x01acf053
                                        0x01acf064
                                        0x01acf064
                                        0x01acf06b
                                        0x01b1bb1a
                                        0x01b1bb1a
                                        0x01acf071
                                        0x01acf071
                                        0x01acf07d
                                        0x01acf082
                                        0x01acf08f
                                        0x01acf08f
                                        0x01acf009
                                        0x01acf00d
                                        0x00000000
                                        0x01acf00d
                                        0x01acefd0
                                        0x01acef97
                                        0x01acefa5
                                        0x01acefaa
                                        0x00000000
                                        0x01acefac
                                        0x01acefac
                                        0x01acefac
                                        0x00000000
                                        0x01acefb2
                                        0x01acf036
                                        0x01acf03a
                                        0x01acf040
                                        0x01acf090
                                        0x00000000
                                        0x01acf092
                                        0x01acf042
                                        0x00000000
                                        0x01acf042
                                        0x01acefb7
                                        0x01acefb9
                                        0x01acefbc
                                        0x01acefb0
                                        0x01acefb0
                                        0x00000000
                                        0x01acefbe
                                        0x01acefbe
                                        0x01acefc1
                                        0x00000000
                                        0x01acefc1
                                        0x01acefbc
                                        0x01acefaa
                                        0x01acef91

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                        • Instruction ID: a9bb82a785a442468450702fb0ab8ecaad34b0cae63597e6bc28167194ffffc9
                                        • Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                        • Instruction Fuzzy Hash: EA510230A0424ADFEB25CB6CC1C07AEBFB2EF05B24F1881ADC55597282D375A989C791
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B8740D Relevance: .1, Instructions: 141COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 84%
                                        			E01B8740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E01B0D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E01AFF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L01AD4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L01AD4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E01AFF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L01AD4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}





















                                        0x01b8740d
                                        0x01b8740d
                                        0x01b87412
                                        0x01b87413
                                        0x01b87416
                                        0x01b87418
                                        0x01b8741c
                                        0x01b8741f
                                        0x01b87422
                                        0x01b87422
                                        0x01b87428
                                        0x01b8742a
                                        0x01b8742a
                                        0x01b87451
                                        0x01b87432
                                        0x01b8744f
                                        0x01b8744f
                                        0x00000000
                                        0x01b87434
                                        0x01b87438
                                        0x01b87443
                                        0x01b87517
                                        0x01b87517
                                        0x01b8751a
                                        0x01b87535
                                        0x01b87520
                                        0x01b87527
                                        0x01b8752c
                                        0x01b87531
                                        0x01b87533
                                        0x00000000
                                        0x01b87533
                                        0x00000000
                                        0x01b87531
                                        0x01b8754b
                                        0x01b8754f
                                        0x01b8755c
                                        0x01b8755c
                                        0x01b8755f
                                        0x01b87560
                                        0x01b87561
                                        0x01b87562
                                        0x01b87563
                                        0x01b87568
                                        0x01b8756a
                                        0x01b8756c
                                        0x01b8756d
                                        0x01b8756d
                                        0x01b8756f
                                        0x01b87572
                                        0x01b87574
                                        0x01b87577
                                        0x01b8757c
                                        0x01b8757f
                                        0x00000000
                                        0x01b87551
                                        0x01b87551
                                        0x01b87551
                                        0x01b87553
                                        0x01b87553
                                        0x01b87449
                                        0x01b87449
                                        0x01b8744c
                                        0x01b8744c
                                        0x00000000
                                        0x01b8744c
                                        0x01b87443
                                        0x01b8750e
                                        0x01b87514
                                        0x01b87514
                                        0x01b87455
                                        0x01b87469
                                        0x01b8746d
                                        0x00000000
                                        0x01b87473
                                        0x01b87473
                                        0x01b87476
                                        0x01b87480
                                        0x01b87484
                                        0x01b8748e
                                        0x01b87493
                                        0x01b87493
                                        0x01b87496
                                        0x01b87499
                                        0x01b874a1
                                        0x01b874b1
                                        0x01b874b5
                                        0x00000000
                                        0x01b874bb
                                        0x01b874c1
                                        0x01b874c1
                                        0x01b874c4
                                        0x01b874c5
                                        0x01b874c6
                                        0x01b874c7
                                        0x01b874c8
                                        0x01b874cd
                                        0x00000000
                                        0x01b874d3
                                        0x01b874d3
                                        0x01b874d6
                                        0x01b874d8
                                        0x01b874db
                                        0x01b874dd
                                        0x01b874e0
                                        0x01b874e7
                                        0x01b874ee
                                        0x01b874ee
                                        0x01b874f4
                                        0x01b874f9
                                        0x00000000
                                        0x01b874fb
                                        0x01b874fb
                                        0x01b874fd
                                        0x01b87500
                                        0x01b87503
                                        0x01b87505
                                        0x01b87505
                                        0x01b874f9
                                        0x00000000
                                        0x01b874cd
                                        0x01b874b5
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                        • Instruction ID: fc79c4552a2ee698ea8ced9c0ea51badc018286cffbb50bee8b87f36268f59e1
                                        • Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                        • Instruction Fuzzy Hash: 9751D071600646EFDB1ADF18C580A96FBB4FF45708F24C1EAE9088F212E771E945CBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE2990 Relevance: .1, Instructions: 133COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 97%
                                        			E01AE2990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x1b8ff00);
				E01B0D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x1a91664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E01AFE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x1a91668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E01B351BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x1a9166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E01AE2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E01AC6600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E01AE2C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E01ACEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E01AE2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E01AE2C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E01AE2ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E01B0D0D1(_t62);
				goto L28;
			}





















                                        0x01ae2990
                                        0x01ae2992
                                        0x01ae2997
                                        0x01ae29a3
                                        0x01ae29a6
                                        0x01ae29ab
                                        0x01ae29ad
                                        0x01ae29b2
                                        0x01b25c80
                                        0x01ae29b8
                                        0x01ae29b8
                                        0x01ae29bb
                                        0x01ae29c0
                                        0x01ae29c5
                                        0x01ae29c6
                                        0x01ae29c6
                                        0x01ae29cb
                                        0x00000000
                                        0x00000000
                                        0x01ae29cd
                                        0x01ae29d0
                                        0x01ae29d9
                                        0x01ae29db
                                        0x01ae29dd
                                        0x01ae2a7f
                                        0x01ae2a84
                                        0x01ae2a87
                                        0x01ae2a89
                                        0x01b25ca1
                                        0x01b25ca3
                                        0x00000000
                                        0x01ae2a8f
                                        0x01ae2a8f
                                        0x00000000
                                        0x01ae2a8f
                                        0x00000000
                                        0x01ae29e3
                                        0x01ae29e3
                                        0x01ae29e3
                                        0x00000000
                                        0x01ae29e3
                                        0x01ae29dd
                                        0x00000000
                                        0x01ae29db
                                        0x01ae29e6
                                        0x01ae29e9
                                        0x01ae29eb
                                        0x01ae29ed
                                        0x01ae29f3
                                        0x01ae29f5
                                        0x01ae29f8
                                        0x01ae29fa
                                        0x01ae2a97
                                        0x01ae2a9a
                                        0x01ae2a9d
                                        0x01ae2add
                                        0x00000000
                                        0x01ae2a9f
                                        0x01ae2aa2
                                        0x01ae2aa5
                                        0x01ae2aa8
                                        0x01ae2aab
                                        0x01b25cab
                                        0x01b25caf
                                        0x01b25cc5
                                        0x01b25cda
                                        0x01b25cdc
                                        0x01b25cdf
                                        0x01b25ce5
                                        0x00000000
                                        0x01b25ceb
                                        0x01b25ced
                                        0x01b25cee
                                        0x00000000
                                        0x01b25cee
                                        0x01b25cb1
                                        0x01b25cb4
                                        0x01b25cb9
                                        0x01b25cbb
                                        0x00000000
                                        0x01b25cbd
                                        0x01b25cbd
                                        0x00000000
                                        0x01b25cbd
                                        0x01b25cbb
                                        0x01ae2ab1
                                        0x01ae2ab1
                                        0x01ae2ac4
                                        0x01ae2ac6
                                        0x01ae2ac6
                                        0x00000000
                                        0x01ae2ac6
                                        0x01ae2aab
                                        0x00000000
                                        0x01ae2a00
                                        0x01ae2a09
                                        0x01ae2a0e
                                        0x01ae2a21
                                        0x01ae2a24
                                        0x01ae2a35
                                        0x01ae2a3a
                                        0x01ae2a3d
                                        0x01ae2a42
                                        0x01ae2a59
                                        0x01ae2a59
                                        0x01ae2a5c
                                        0x01ae2a5f
                                        0x01ae2a5f
                                        0x01ae29fa
                                        0x01ae29f3
                                        0x01ae2a64
                                        0x01ae2a64
                                        0x01ae2a6b
                                        0x01ae2a6b
                                        0x01ae2a6d
                                        0x01ae2a72
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 113166d13ac08a86bf68b0a0d20c7888fe7ff9edfd18f667fadb0bcb9512a7f2
                                        • Instruction ID: 88b3e9905d5c5f682d1cbb563915fac52cc5fc5efe97c9e33d1deab9a83a8dd3
                                        • Opcode Fuzzy Hash: 113166d13ac08a86bf68b0a0d20c7888fe7ff9edfd18f667fadb0bcb9512a7f2
                                        • Instruction Fuzzy Hash: A1518F7190021ADFDF29DF99C944AEEBBB9FF48350F04815AE914AB260D7319D92CF90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE4BAD Relevance: .1, Instructions: 131COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 85%
                                        			E01AE4BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x1bad360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E01ABCC50(_t86);
					L11:
					return E01AFB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x1ba8504
				E01AD2280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E01AFFA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E01AFB0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L01AD4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E01ABCCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x1ba8504
								E01ACFFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E01AE4F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}


























                                        0x01ae4bad
                                        0x01ae4bbf
                                        0x01ae4bc2
                                        0x01ae4bc6
                                        0x01ae4bcd
                                        0x01ae4bd9
                                        0x01b267fe
                                        0x01b26800
                                        0x01ae4ccc
                                        0x01ae4ccd
                                        0x01ae4cb7
                                        0x01ae4cc9
                                        0x01ae4cc9
                                        0x01ae4bdf
                                        0x01ae4be5
                                        0x00000000
                                        0x00000000
                                        0x01ae4beb
                                        0x01ae4bef
                                        0x00000000
                                        0x00000000
                                        0x01ae4bf5
                                        0x01ae4bf9
                                        0x01ae4c06
                                        0x01ae4c0b
                                        0x01ae4c17
                                        0x01ae4c1c
                                        0x01ae4c1f
                                        0x01ae4c25
                                        0x01ae4c33
                                        0x01ae4c3d
                                        0x01ae4c40
                                        0x01ae4c43
                                        0x01ae4c47
                                        0x01ae4c4d
                                        0x01ae4c53
                                        0x01ae4c54
                                        0x01ae4c55
                                        0x01ae4c56
                                        0x01ae4c5b
                                        0x01ae4c5c
                                        0x01ae4c63
                                        0x01ae4c6b
                                        0x00000000
                                        0x00000000
                                        0x01b26776
                                        0x01b26784
                                        0x01b26784
                                        0x01b2679f
                                        0x01b267a7
                                        0x01b267af
                                        0x01b267ce
                                        0x00000000
                                        0x01b267b1
                                        0x01b267b7
                                        0x01b267b8
                                        0x01b267c1
                                        0x01b267d3
                                        0x01b267d9
                                        0x01b267dd
                                        0x01ae4c94
                                        0x01ae4c94
                                        0x01ae4c98
                                        0x01ae4c9c
                                        0x01ae4ca3
                                        0x01b267f4
                                        0x01b267f4
                                        0x01ae4cb5
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ae4cb5
                                        0x01ae4c79
                                        0x01ae4c7e
                                        0x01ae4c89
                                        0x01ae4c8b
                                        0x01ae4c8f
                                        0x01ae4c8f
                                        0x00000000
                                        0x01ae4c89
                                        0x01b267c3
                                        0x00000000
                                        0x01b267c3
                                        0x01b267af
                                        0x01ae4c73
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 4e5dfd4c88ac9f23ccdb8ddb9810f20057896b39bf669f13d6b0caee18232605
                                        • Instruction ID: 7817071ea50860be7be3aad498a2d5c9a6b4e5e7b5d7564f4709c05dab05f3d5
                                        • Opcode Fuzzy Hash: 4e5dfd4c88ac9f23ccdb8ddb9810f20057896b39bf669f13d6b0caee18232605
                                        • Instruction Fuzzy Hash: 0441C531A002299BDB21DF68C944FEA77F8EF49710F0504A9ED08EB251E734DE84CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE4D3B Relevance: .1, Instructions: 131COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 78%
                                        			E01AE4D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x1bad360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E01AFFA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x1ba7bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E01AFB0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L01AD4620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E01ABCCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E01AFB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E01AFF380(_t67 + 0xc, 0x1a95138, 0x10) == 0) {
								 *0x1ba60d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E01AE4F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E01AE4E70(0x1ba86b0, 0x1ae5690, 0, 0) != 0) {
					_t46 = E01ABCCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}




















                                        0x01ae4d3b
                                        0x01ae4d4d
                                        0x01ae4d53
                                        0x01ae4d58
                                        0x01ae4d65
                                        0x01ae4d6c
                                        0x01ae4d71
                                        0x01ae4d77
                                        0x01ae4d7f
                                        0x01ae4d8c
                                        0x01ae4d8e
                                        0x01ae4dad
                                        0x01ae4db0
                                        0x01ae4db7
                                        0x01ae4db8
                                        0x01ae4db9
                                        0x01ae4dba
                                        0x01ae4dbb
                                        0x01ae4dc1
                                        0x01ae4dc8
                                        0x01ae4dcc
                                        0x01ae4dd5
                                        0x01ae4dde
                                        0x01ae4ddf
                                        0x01ae4de0
                                        0x01ae4de1
                                        0x01ae4de6
                                        0x01ae4de7
                                        0x01ae4de9
                                        0x01ae4df3
                                        0x00000000
                                        0x00000000
                                        0x01b26c7c
                                        0x01b26c8a
                                        0x01b26c8a
                                        0x01b26c9d
                                        0x01b26ca7
                                        0x01b26cac
                                        0x01b26cb2
                                        0x01b26cb9
                                        0x00000000
                                        0x01b26cbf
                                        0x01b26cbf
                                        0x00000000
                                        0x01b26cbf
                                        0x01b26cb9
                                        0x01ae4dfb
                                        0x01b26ccf
                                        0x01b26cd3
                                        0x01ae4e32
                                        0x01ae4e39
                                        0x01b26ce0
                                        0x01b26cf2
                                        0x01b26cf2
                                        0x01b26ce0
                                        0x01ae4e3f
                                        0x01ae4e41
                                        0x01ae4e51
                                        0x01ae4e51
                                        0x01ae4e03
                                        0x01ae4e03
                                        0x01ae4e09
                                        0x01ae4e0f
                                        0x01ae4e57
                                        0x00000000
                                        0x00000000
                                        0x01ae4e1b
                                        0x01ae4e30
                                        0x01ae4e5b
                                        0x01ae4e5b
                                        0x00000000
                                        0x01ae4e30
                                        0x01ae4e11
                                        0x01ae4e11
                                        0x01ae4e16
                                        0x00000000
                                        0x01ae4e16
                                        0x01ae4e01
                                        0x00000000
                                        0x01ae4e01
                                        0x01ae4da5
                                        0x01b26c6b
                                        0x00000000
                                        0x01ae4dab
                                        0x01ae4dab
                                        0x00000000
                                        0x01ae4dab

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: e232f5b96dd49d63198bde72c8c56c272e72a3e049255468922028a646f7dd5b
                                        • Instruction ID: d02b83fb6b41ae7df44a01180cd0e525f884f87c2eedeb0731d9137dd55a6268
                                        • Opcode Fuzzy Hash: e232f5b96dd49d63198bde72c8c56c272e72a3e049255468922028a646f7dd5b
                                        • Instruction Fuzzy Hash: 4241D1B1A40318AFEB36DF18CD84FAAB7E9EB18710F04409AE909D7281D774DD44CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B7AA16 Relevance: .1, Instructions: 120COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01B7AA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E01B7ABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E01B7AB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E01B7AC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E01B5CB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L01AD77F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E01AD7D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E01B7131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E01B5CB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}



















                                        0x01b7aa1f
                                        0x01b7aa21
                                        0x01b7aa23
                                        0x01b7aa2b
                                        0x01b7aa30
                                        0x01b7aa36
                                        0x01b7aa39
                                        0x01b7aa42
                                        0x01b7aa75
                                        0x01b7aa7a
                                        0x01b7aa7c
                                        0x01b7aa7c
                                        0x01b7aa88
                                        0x01b7aa8a
                                        0x01b7aa8f
                                        0x01b7ab02
                                        0x01b7ab04
                                        0x01b7aa99
                                        0x01b7aaa8
                                        0x01b7aaaf
                                        0x01b7aab3
                                        0x01b7aacc
                                        0x01b7aad1
                                        0x01b7aad6
                                        0x01b7aae0
                                        0x01b7aaf3
                                        0x01b7aaf9
                                        0x01b7aafe
                                        0x01b7aafe
                                        0x01b7aaf3
                                        0x01b7aad6
                                        0x01b7aab3
                                        0x01b7ab07
                                        0x01b7ab0a
                                        0x01b7ab11
                                        0x01b7ab23
                                        0x01b7ab13
                                        0x01b7ab1c
                                        0x01b7ab1c
                                        0x01b7ab2b
                                        0x01b7ab44
                                        0x01b7ab44
                                        0x01b7ab51
                                        0x01b7ab51
                                        0x01b7aa44
                                        0x01b7aa47
                                        0x01b7aa4c
                                        0x00000000
                                        0x00000000
                                        0x01b7aa5a
                                        0x01b7aa64
                                        0x01b7aa72
                                        0x00000000
                                        0x01b7aa66
                                        0x01b7aa66
                                        0x01b7aa68
                                        0x01b7aa6a
                                        0x00000000
                                        0x01b7aa6a

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                        • Instruction ID: 454b1f80093842a34ecd1a4dcddf56982dc14cf93129869bf06c22b4e23dda95
                                        • Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                        • Instruction Fuzzy Hash: 0131F532B006056BEF599B79C885BBFFBABDF80210F0944A9E925E7391DB749D00C750
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC8A0A Relevance: .1, Instructions: 120COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 94%
                                        			E01AC8A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x1bad360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E01AFB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E01ACE9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x1a91180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E01AE1DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E01AF3C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E01AC8999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}



























                                        0x01ac8a0a
                                        0x01ac8a1c
                                        0x01ac8a23
                                        0x01ac8a2e
                                        0x01ac8a30
                                        0x01ac8a36
                                        0x01ac8a3c
                                        0x01ac8a3e
                                        0x01ac8a4a
                                        0x01ac8a52
                                        0x01ac8a9c
                                        0x01ac8aae
                                        0x01ac8a58
                                        0x01ac8a5e
                                        0x01ac8a6a
                                        0x01ac8a6f
                                        0x01ac8a75
                                        0x01ac8a7d
                                        0x01ac8a85
                                        0x01ac8a86
                                        0x01ac8a89
                                        0x01ac8a93
                                        0x01ac8a99
                                        0x01ac8a9b
                                        0x00000000
                                        0x01ac8aaf
                                        0x01ac8abe
                                        0x01ac8ac3
                                        0x01ac8acb
                                        0x01ac8ad7
                                        0x01ac8ae0
                                        0x01ac8af1
                                        0x00000000
                                        0x01ac8af1
                                        0x01ac8acd
                                        0x01ac8ad5
                                        0x01ac8afb
                                        0x01ac8afd
                                        0x01ac8aff
                                        0x01ac8b07
                                        0x01ac8b22
                                        0x01ac8b24
                                        0x01ac8b2a
                                        0x01ac8b2e
                                        0x01ac8b3f
                                        0x01ac8b78
                                        0x01ac8b41
                                        0x01ac8b52
                                        0x01ac8b54
                                        0x01ac8b5c
                                        0x01ac8b74
                                        0x01ac8b74
                                        0x01ac8b5c
                                        0x01ac8b3f
                                        0x01ac8b5e
                                        0x01ac8b61
                                        0x01ac8b64
                                        0x01ac8b64
                                        0x01ac8b6c
                                        0x01ac8b6c
                                        0x01ac8b11
                                        0x01b19cd5
                                        0x01b19cd5
                                        0x01ac8b17
                                        0x01ac8b1a
                                        0x01ac8b1a
                                        0x00000000
                                        0x01ac8ad5
                                        0x01ac8a89

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 1a6b9ccf70e69162e7a9b010b6801513f8f6b2d6981a9ecdcae18705851e3adb
                                        • Instruction ID: 528461cf6e5c8c7fd99117f124cc477a487c9842bf3f1c3aae9f0ab0f40384f0
                                        • Opcode Fuzzy Hash: 1a6b9ccf70e69162e7a9b010b6801513f8f6b2d6981a9ecdcae18705851e3adb
                                        • Instruction Fuzzy Hash: C2416FB0A0022D9BDB24DF59C888AAAB7F4FB54700F1145EEE91997252E7749E84CF60
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B7FDE2 Relevance: .1, Instructions: 116COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 76%
                                        			E01B7FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E01B7FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E01B80A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E01AD7D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E01B71608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E01B82B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E01B7C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E01B7DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E01AD7D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E01B7A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}










                                        0x01b7fde7
                                        0x01b7fde8
                                        0x01b7fdec
                                        0x01b7fdee
                                        0x01b7fdf5
                                        0x01b7fdf7
                                        0x01b7fdfc
                                        0x01b7fe19
                                        0x01b7fe22
                                        0x01b7fe26
                                        0x01b7fec6
                                        0x01b7fecd
                                        0x01b7fed5
                                        0x01b7fee7
                                        0x01b7fed7
                                        0x01b7fee0
                                        0x01b7fee0
                                        0x01b7feef
                                        0x01b7ff00
                                        0x01b7ff02
                                        0x01b7ff07
                                        0x01b7ff07
                                        0x00000000
                                        0x01b7feef
                                        0x01b7fe33
                                        0x01b7fe55
                                        0x01b7fe59
                                        0x01b7fe5b
                                        0x01b7fe5e
                                        0x01b7fe69
                                        0x01b7fe6d
                                        0x01b7fe6d
                                        0x01b7fe69
                                        0x01b7fe35
                                        0x01b7fe41
                                        0x01b7fe41
                                        0x01b7fe79
                                        0x01b7fe8b
                                        0x01b7fe7b
                                        0x01b7fe84
                                        0x01b7fe84
                                        0x01b7fe93
                                        0x00000000
                                        0x01b7fea8
                                        0x01b7feba
                                        0x00000000
                                        0x01b7feba
                                        0x01b7fdfe
                                        0x01b7fe01
                                        0x01b7fe02
                                        0x01b7fe08
                                        0x01b7ff0c
                                        0x01b7ff14
                                        0x01b7ff14

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                        • Instruction ID: aab99baa0cf9f1037c2ccd6b43a67b12c58c565ec579c5e1a85d503580156bc7
                                        • Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                        • Instruction Fuzzy Hash: C33126322006416FD72A9B6CC844F7ABBAAEB85A40F0845DCE9768B342DB70DC41C764
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B7EA55 Relevance: .1, Instructions: 111COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 70%
                                        			E01B7EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E01AD2280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E01B7E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E01ABF900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E01ACFFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E01B7AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E01B7BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E01AD7D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E01B6FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E01ACFFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E01B7A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}






















                                        0x01b7ea55
                                        0x01b7ea66
                                        0x01b7ea68
                                        0x01b7ea6c
                                        0x01b7ea6f
                                        0x01b7ea72
                                        0x01b7ea75
                                        0x01b7ea7a
                                        0x01b7ea7a
                                        0x01b7ea7e
                                        0x01b7ea80
                                        0x01b7ea85
                                        0x01b7ea8b
                                        0x01b7eab5
                                        0x01b7eabc
                                        0x01b7eabf
                                        0x01b7eabf
                                        0x01b7eaca
                                        0x01b7eace
                                        0x01b7ead0
                                        0x01b7eae4
                                        0x01b7eaeb
                                        0x01b7eaf0
                                        0x01b7eaf5
                                        0x01b7eb09
                                        0x01b7eb0d
                                        0x01b7eb1d
                                        0x01b7eb2d
                                        0x01b7eb38
                                        0x01b7eb3d
                                        0x01b7eb41
                                        0x01b7eb4a
                                        0x01b7eb60
                                        0x01b7eb4c
                                        0x01b7eb52
                                        0x01b7eb59
                                        0x01b7eb59
                                        0x01b7eb68
                                        0x01b7eb71
                                        0x01b7eb71
                                        0x01b7ea8d
                                        0x01b7ea8f
                                        0x01b7ea92
                                        0x01b7ea97
                                        0x01b7ea97
                                        0x01b7ea9b
                                        0x01b7ea9c
                                        0x01b7ea9e
                                        0x01b7eaa6
                                        0x01b7eaa6
                                        0x01b7eb7e

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                        • Instruction ID: 24723dcc9b9b245176a631d0a4337b6b2ace3e545b4fe4958cafb9d2ffa710c0
                                        • Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                        • Instruction Fuzzy Hash: F431C1326047069BC719DF28C980A6BB7AAFFD4210F044AADF56287741DB30E805CBA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B369A6 Relevance: .1, Instructions: 108COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 69%
                                        			E01B369A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x1bad360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L01AC6C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E01B36BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E01AF9980() >= 0) {
							E01AD2280(_t56, 0x1ba8778);
							_t77 = 1;
							_t68 = 1;
							if( *0x1ba8774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x1ba8774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E01ABB6F0(0x1a9c338, 0x1a9c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E01AF9520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E01AF95D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E01ACFFB0(_t68, _t77, 0x1ba8778);
				}
				_pop(_t78);
				return E01AFB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}
































                                        0x01b369b5
                                        0x01b369be
                                        0x01b369c3
                                        0x01b369c9
                                        0x01b369cc
                                        0x01b369d1
                                        0x01b369d3
                                        0x01b369de
                                        0x01b369e1
                                        0x01b369ea
                                        0x01b369f6
                                        0x01b369fe
                                        0x01b36a13
                                        0x01b36a14
                                        0x01b36a15
                                        0x01b36a16
                                        0x01b36a1e
                                        0x01b36a26
                                        0x01b36a31
                                        0x01b36a36
                                        0x01b36a37
                                        0x01b36a40
                                        0x01b36a49
                                        0x01b36a4a
                                        0x01b36a53
                                        0x01b36a59
                                        0x01b36a5d
                                        0x01b36a5e
                                        0x01b36a64
                                        0x01b36a67
                                        0x01b36a6a
                                        0x01b36a6d
                                        0x01b36a70
                                        0x01b36a77
                                        0x01b36a7d
                                        0x01b36a86
                                        0x01b36a89
                                        0x01b36a9c
                                        0x01b36a9f
                                        0x01b36aa2
                                        0x01b36aa5
                                        0x01b36aaf
                                        0x01b36ab1
                                        0x01b36ab8
                                        0x01b36ab9
                                        0x01b36abb
                                        0x01b36abe
                                        0x01b36ac5
                                        0x01b36ac5
                                        0x01b36aaf
                                        0x01b36a40
                                        0x01b36a26
                                        0x01b369fe
                                        0x01b36ace
                                        0x01b36ad0
                                        0x01b36ad3
                                        0x01b36ad8
                                        0x01b36adf
                                        0x01b36adf
                                        0x01b36ae8
                                        0x01b36aef
                                        0x01b36aef
                                        0x01b36af9
                                        0x01b36b06

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5c827cba690636397dfe4e292790f9e10d3124213dce595a4a41df30219a6916
                                        • Instruction ID: 0f4b317d81a23caa026c9a4ad0269c20a3af125af04e85f500dd7d727afa0de1
                                        • Opcode Fuzzy Hash: 5c827cba690636397dfe4e292790f9e10d3124213dce595a4a41df30219a6916
                                        • Instruction Fuzzy Hash: A9416CB1D00209AFDB24DFA9D941BFEBBF4EF48714F14816AE914A7250EB709A16CB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB5210 Relevance: .1, Instructions: 107COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 85%
                                        			E01AB5210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E01AB52A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E01AF95D0();
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E01ACEB70(_t54, 0x1ba79a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E01AF95D0();
								L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E01ACEB70(_t54, 0x1ba79a0);
						}
						return _t52;
					}
					L5:
					_t33 = E01AFF3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E01ACEB70(_t54, 0x1ba79a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E01AF95D0();
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}














                                        0x01ab5220
                                        0x01ab5224
                                        0x01b10d13
                                        0x01b10d16
                                        0x01b10d19
                                        0x01ab522a
                                        0x01ab522a
                                        0x01ab522d
                                        0x01ab522d
                                        0x01ab5231
                                        0x01ab5235
                                        0x01ab5239
                                        0x01b10d5c
                                        0x01b10d62
                                        0x00000000
                                        0x00000000
                                        0x01b10d6a
                                        0x01b10d7b
                                        0x01b10d7f
                                        0x01b10d81
                                        0x01b10d84
                                        0x01b10d95
                                        0x01b10d95
                                        0x01b10d6c
                                        0x01b10d71
                                        0x01b10d71
                                        0x01b10d9a
                                        0x00000000
                                        0x01ab524a
                                        0x01ab524a
                                        0x01ab5250
                                        0x01b10d24
                                        0x01b10d35
                                        0x01b10d39
                                        0x01b10d3b
                                        0x01b10d3e
                                        0x01b10d50
                                        0x01b10d50
                                        0x01b10d26
                                        0x01b10d2b
                                        0x01b10d2b
                                        0x00000000
                                        0x01b10d55
                                        0x01ab5256
                                        0x01ab525b
                                        0x01ab5265
                                        0x01b10da7
                                        0x01ab526b
                                        0x01ab526e
                                        0x01ab5272
                                        0x01b10db1
                                        0x01b10db4
                                        0x01b10dc5
                                        0x01b10dc5
                                        0x01ab5272
                                        0x01ab5278
                                        0x01ab527e
                                        0x01ab528a
                                        0x01ab528c
                                        0x01ab528d
                                        0x00000000
                                        0x01ab5280
                                        0x01ab5282
                                        0x01ab5288
                                        0x01ab529f
                                        0x01ab5292
                                        0x00000000
                                        0x01ab5292
                                        0x00000000
                                        0x01ab5288
                                        0x01ab527e

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 79554bbea0137bb1f2009222865226d5c4560361bc2ae79d4dd8046eef4edead
                                        • Instruction ID: 4d0fce53467fe386552f6ec5dbf2bc5d524670f288f993c6f2ad9ffa1a088dd5
                                        • Opcode Fuzzy Hash: 79554bbea0137bb1f2009222865226d5c4560361bc2ae79d4dd8046eef4edead
                                        • Instruction Fuzzy Hash: 42314B31646641EFC72AAF28C981F7A7B79FF10720F96466AF9154B1A5DB30EC40C690
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF3D43 Relevance: .1, Instructions: 106COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AF3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E01AC7B60(0, _t61, 0x1a911c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E01AC7B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L01AD4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}
















                                        0x01af3d4c
                                        0x01af3d50
                                        0x01af3d55
                                        0x01af3d5e
                                        0x01b2e79a
                                        0x00000000
                                        0x01b2e79a
                                        0x01af3d68
                                        0x01b2e789
                                        0x01af3d9d
                                        0x01af3da3
                                        0x01af3daf
                                        0x01af3db5
                                        0x01af3dbc
                                        0x01af3dc4
                                        0x01af3dc9
                                        0x01af3dce
                                        0x01b2e7ae
                                        0x01b2e7ae
                                        0x01af3dde
                                        0x01af3de2
                                        0x01af3de7
                                        0x01af3e0d
                                        0x01af3e13
                                        0x01af3e16
                                        0x01af3e1e
                                        0x01af3e25
                                        0x01af3e28
                                        0x00000000
                                        0x00000000
                                        0x01af3e2a
                                        0x01af3e2f
                                        0x01af3e37
                                        0x01af3e37
                                        0x00000000
                                        0x01af3e37
                                        0x01af3e31
                                        0x00000000
                                        0x01af3e31
                                        0x01af3e20
                                        0x01af3e20
                                        0x01af3e35
                                        0x00000000
                                        0x01af3de9
                                        0x01af3de9
                                        0x01af3de9
                                        0x01af3dee
                                        0x01af3dfd
                                        0x01af3dff
                                        0x01af3e02
                                        0x01af3e05
                                        0x01af3e05
                                        0x00000000
                                        0x01af3df0
                                        0x01af3de7
                                        0x01b2e78f
                                        0x01b2e794
                                        0x01af3d79
                                        0x01af3d84
                                        0x01af3d89
                                        0x01af3d8e
                                        0x00000000
                                        0x01b2e7a4
                                        0x01af3d96
                                        0x01af3d9a
                                        0x00000000
                                        0x01af3d9a
                                        0x00000000
                                        0x01b2e794
                                        0x01af3d6e
                                        0x01af3d73
                                        0x00000000
                                        0x01b2e7b5
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 303b43ea9ceb816eac3e7576a8a806311e51ed21779b37e1b6c04a4ef6a1275a
                                        • Instruction ID: dce2ae6e7e3f1f8ab4049996751e432dfc167adc2c582e873e1c0179c48b0bc6
                                        • Opcode Fuzzy Hash: 303b43ea9ceb816eac3e7576a8a806311e51ed21779b37e1b6c04a4ef6a1275a
                                        • Instruction Fuzzy Hash: 97319271605615DBDB298FAEC441A7ABBF5FF45710709846EFA4ACB3A0E730D844C790
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEA61C Relevance: .1, Instructions: 106COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 78%
                                        			E01AEA61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x1b90220);
				E01B0D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x1ba7b9c; // 0x0
				_t55 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E01B0D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x1ba7b10 =  *0x1ba7b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x1ba536c; // 0x77e05368
					if( *_t51 != 0x1ba5368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x1ba5368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x1ba536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E01AEA70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}


















                                        0x01aea61c
                                        0x01aea61e
                                        0x01aea623
                                        0x01aea628
                                        0x01aea62b
                                        0x01aea62d
                                        0x01aea648
                                        0x01aea64a
                                        0x01aea64f
                                        0x01b29b44
                                        0x01aea6ec
                                        0x01aea6f1
                                        0x01aea6f1
                                        0x01aea655
                                        0x01aea657
                                        0x01aea65a
                                        0x01aea65d
                                        0x01aea662
                                        0x01aea663
                                        0x01aea667
                                        0x01aea668
                                        0x01aea66d
                                        0x01aea706
                                        0x01aea706
                                        0x01b29bda
                                        0x01b29be6
                                        0x01b29beb
                                        0x00000000
                                        0x01b29beb
                                        0x01aea679
                                        0x01b29b7a
                                        0x00000000
                                        0x01b29b7a
                                        0x01aea683
                                        0x01aea6f4
                                        0x01aea6f7
                                        0x01aea6f9
                                        0x01aea6fd
                                        0x01aea6a0
                                        0x01aea6a0
                                        0x01aea6ad
                                        0x01aea6af
                                        0x01aea6b4
                                        0x01b29ba7
                                        0x01b29bac
                                        0x00000000
                                        0x00000000
                                        0x01b29bc6
                                        0x01b29bce
                                        0x01b29bd1
                                        0x01b29bd3
                                        0x01b29bd3
                                        0x00000000
                                        0x01b29bd1
                                        0x01aea6bd
                                        0x01aea6c3
                                        0x01aea6c6
                                        0x01aea6d2
                                        0x01aea701
                                        0x01aea704
                                        0x00000000
                                        0x01aea704
                                        0x01aea6d4
                                        0x01aea6d6
                                        0x01aea6d9
                                        0x01aea6db
                                        0x01aea6e1
                                        0x01aea6e6
                                        0x01aea6e8
                                        0x01aea6e8
                                        0x01aea6ea
                                        0x00000000
                                        0x01aea6ea
                                        0x01aea688
                                        0x01aea692
                                        0x01aea694
                                        0x01aea699
                                        0x00000000
                                        0x00000000
                                        0x01aea69d
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: b8b957cf4430a3bb9d89760bb6ae737938eaef9d3b4bd84d7953ea5d3af797cf
                                        • Instruction ID: 2b7a83f760c08ff6f55ea88d320e01f17f051a02be134fbe4dfe53f556156911
                                        • Opcode Fuzzy Hash: b8b957cf4430a3bb9d89760bb6ae737938eaef9d3b4bd84d7953ea5d3af797cf
                                        • Instruction Fuzzy Hash: 444189B5A04215DFCB19CF58C8A4B99BBF1FF89304F1980A9E909EB384C774A901CF90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ADC182 Relevance: .1, Instructions: 104COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 68%
                                        			E01ADC182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E01AD7D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E01B88D34(_v8, _t80);
					}
					E01AD2280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E01ACFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E01B88833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E01ACFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E01AFB180();
						if(_a4 != 0) {
							E01AD2280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E01ADBB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E01ADBB2D(_t16, _t15);
						E01ADB944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E01ACFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E01ACFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E01ACFFB0(0, __ecx, _t24);
				}
				return 0;
			}
















                                        0x01adc18d
                                        0x01adc18f
                                        0x01adc191
                                        0x01adc19b
                                        0x01adc1a0
                                        0x01adc1d4
                                        0x01adc1de
                                        0x01b22d6e
                                        0x01adc1e4
                                        0x01adc1e4
                                        0x01adc1e4
                                        0x01adc1ec
                                        0x01b22d7d
                                        0x01b22d7d
                                        0x01adc1f3
                                        0x01adc1ff
                                        0x01b22d88
                                        0x01b22d8d
                                        0x01b22d94
                                        0x01b22d94
                                        0x01b22d9f
                                        0x01b22da4
                                        0x01b22dab
                                        0x01b22db0
                                        0x01b22db2
                                        0x01b22db3
                                        0x01b22db4
                                        0x01b22dbc
                                        0x01b22dc3
                                        0x01b22dc3
                                        0x01adc205
                                        0x01adc205
                                        0x01adc208
                                        0x01adc20e
                                        0x01adc211
                                        0x01adc216
                                        0x01adc219
                                        0x01adc21f
                                        0x01adc222
                                        0x01adc22c
                                        0x01adc234
                                        0x01adc23a
                                        0x01adc23f
                                        0x01adc245
                                        0x01adc24b
                                        0x01adc251
                                        0x01adc25a
                                        0x01adc276
                                        0x01adc27d
                                        0x01adc27d
                                        0x01adc25c
                                        0x01adc25c
                                        0x00000000
                                        0x01adc25e
                                        0x01adc1a4
                                        0x01adc1aa
                                        0x01adc1b3
                                        0x01adc265
                                        0x01adc26c
                                        0x01adc26c
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                        • Instruction ID: b5c1d9149422313417bf01cf57f641844acd48fba55b92402e90871df8e3bad0
                                        • Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                        • Instruction Fuzzy Hash: 98317A72A01A47BFD709EBB4C580BE9FB64FF52210F48419ED01D87205DB346A0ACBE0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B37016 Relevance: .1, Instructions: 104COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 76%
                                        			E01B37016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x1bad360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E01B36B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E01B36B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E01AD7D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E01AF9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E01AFB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L01AD4620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}






















                                        0x01b37016
                                        0x01b3701e
                                        0x01b3702b
                                        0x01b37033
                                        0x01b37037
                                        0x01b3703c
                                        0x01b3703e
                                        0x01b37041
                                        0x01b37045
                                        0x01b3704a
                                        0x01b37050
                                        0x01b37055
                                        0x01b3705a
                                        0x01b37062
                                        0x01b37062
                                        0x01b3705a
                                        0x01b37064
                                        0x01b37064
                                        0x01b37067
                                        0x01b37071
                                        0x01b37096
                                        0x01b3709b
                                        0x01b370a2
                                        0x01b370a6
                                        0x01b370a7
                                        0x01b370ad
                                        0x01b370b3
                                        0x01b370b6
                                        0x01b370bb
                                        0x01b370c3
                                        0x01b370c3
                                        0x01b370c6
                                        0x01b370cd
                                        0x01b370dd
                                        0x01b370e0
                                        0x01b370e2
                                        0x01b370e2
                                        0x01b370ee
                                        0x01b37101
                                        0x01b370f0
                                        0x01b370f9
                                        0x01b370f9
                                        0x01b3710a
                                        0x01b3710e
                                        0x01b37112
                                        0x01b37117
                                        0x01b37118
                                        0x01b37118
                                        0x01b370bb
                                        0x01b3711d
                                        0x01b37123
                                        0x01b37131
                                        0x01b37131
                                        0x01b37136
                                        0x01b3713d
                                        0x01b3713e
                                        0x01b3713f
                                        0x01b3714a
                                        0x01b3714a
                                        0x01b37084
                                        0x01b37088
                                        0x00000000
                                        0x01b3708e
                                        0x01b3708e
                                        0x01b37092
                                        0x00000000
                                        0x01b37092

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8027f5429f03667b53f58ed4d0a636f336c7e2c8b87920236dc87f78e9f03b1c
                                        • Instruction ID: 0434048040ba7fd821e82c01d0b546b4800a0d8c7c83b93bcf6fc210290f9b89
                                        • Opcode Fuzzy Hash: 8027f5429f03667b53f58ed4d0a636f336c7e2c8b87920236dc87f78e9f03b1c
                                        • Instruction Fuzzy Hash: 9831E4B2604B419BC324DF68C941A6BB7E5FFC8700F044A6DF99587690EB30E914CBA5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEA70E Relevance: .1, Instructions: 96COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 92%
                                        			E01AEA70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x1ba7b10; // 0x0
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x1ba7b10 = 8;
					 *0x1ba7b14 = 0x1ba7b0c;
					 *0x1ba7b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x1
					E01AEA990(0x1ba7b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L01AEA840(__edx, __ecx, __ecx, _t52, 0x1ba7b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x1ba7b10; // 0x0
					_t3 = _t37 + 0x27; // 0x27
					__eflags = _t3 >> 5 -  *0x1ba7b18; // 0x0
					if(__eflags > 0) {
						_t38 =  *0x1ba7b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x27
						_v8 = _t4 >> 5;
						_t50 = L01AD4620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x1ba7b18 = _v8;
						_t8 = _t52 + 7; // 0x7
						E01AFF3E0(_t50,  *0x1ba7b14, _t8 >> 3);
						_t28 =  *0x1ba7b14; // 0x0
						__eflags = _t28 - 0x1ba7b0c;
						if(_t28 != 0x1ba7b0c) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x8
						 *0x1ba7b14 = _t50;
						_t48 = _v12;
						 *0x1ba7b10 = _t9;
						goto L6;
					}
					 *0x1ba7b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}
















                                        0x01aea713
                                        0x01aea714
                                        0x01aea717
                                        0x01aea71d
                                        0x01aea720
                                        0x01aea722
                                        0x01aea727
                                        0x01aea74a
                                        0x01aea754
                                        0x01aea75e
                                        0x01aea768
                                        0x01aea76a
                                        0x01aea773
                                        0x01aea78b
                                        0x01aea790
                                        0x01aea792
                                        0x01aea741
                                        0x01aea741
                                        0x01aea743
                                        0x01aea749
                                        0x01aea749
                                        0x01aea732
                                        0x01aea73a
                                        0x01aea797
                                        0x01aea79d
                                        0x01aea7a3
                                        0x01aea7a9
                                        0x01aea7b6
                                        0x01aea7bc
                                        0x01aea7ca
                                        0x01aea7e0
                                        0x01aea7e2
                                        0x01aea7e4
                                        0x01b29bf2
                                        0x00000000
                                        0x01b29bf2
                                        0x01aea7ed
                                        0x01aea7f2
                                        0x01aea800
                                        0x01aea805
                                        0x01aea80d
                                        0x01aea812
                                        0x01b29c08
                                        0x01b29c08
                                        0x01aea818
                                        0x01aea81b
                                        0x01aea821
                                        0x01aea824
                                        0x00000000
                                        0x01aea824
                                        0x01aea7ae
                                        0x00000000
                                        0x01aea7ae
                                        0x01aea73c
                                        0x01aea73e
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: ad8ce9f30fb12c3406dd41511afb3fa1a0b72bb33094f33fd917dfa0bbdb3a39
                                        • Instruction ID: cdf474e7c701eeef8cfb9b3871f622403c39866a8098879a6545d49f5c36e205
                                        • Opcode Fuzzy Hash: ad8ce9f30fb12c3406dd41511afb3fa1a0b72bb33094f33fd917dfa0bbdb3a39
                                        • Instruction Fuzzy Hash: ED31E1F2668201AFC725CF18D8A5F69BBF9FB84710FD4499AE206C7244DB729901CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE61A0 Relevance: .1, Instructions: 93COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 97%
                                        			E01AE61A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E01AE5E50(0x1a967cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E01B89D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E01ABF7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}



















                                        0x01ae61b3
                                        0x01ae61b5
                                        0x01ae61bd
                                        0x01ae61c3
                                        0x01ae61c7
                                        0x01ae61d2
                                        0x01ae61ff
                                        0x01ae61ff
                                        0x01ae6201
                                        0x01ae6207
                                        0x01ae6207
                                        0x01ae61d4
                                        0x01ae61d9
                                        0x00000000
                                        0x00000000
                                        0x01ae61df
                                        0x01ae61e2
                                        0x00000000
                                        0x00000000
                                        0x01ae61e6
                                        0x01ae61e8
                                        0x01ae61ee
                                        0x01ae61ee
                                        0x01ae61f9
                                        0x01b2762f
                                        0x01b27632
                                        0x01b27635
                                        0x01b27639
                                        0x01b27640
                                        0x01b2766e
                                        0x01b27675
                                        0x00000000
                                        0x00000000
                                        0x01b27681
                                        0x01b27689
                                        0x01b2768d
                                        0x01b27691
                                        0x01b27695
                                        0x01b27699
                                        0x01b276af
                                        0x01b276b5
                                        0x01b276b7
                                        0x01b276b7
                                        0x01b276d7
                                        0x01b276dc
                                        0x00000000
                                        0x01b276dc
                                        0x01b276a2
                                        0x01b276a9
                                        0x01b27651
                                        0x01b27653
                                        0x01b27653
                                        0x01b27656
                                        0x01b27656
                                        0x00000000
                                        0x01b27656
                                        0x01b27644
                                        0x01b27646
                                        0x01b27648
                                        0x01b27648
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 59b3e1f97acf763e81594745c8e904039187e6eb80db4101e66bba6163271158
                                        • Instruction ID: 9045eed2a835315a45b05ee3a9d78e14ce82208d2cbc1697c8aec78a8d98c6f6
                                        • Opcode Fuzzy Hash: 59b3e1f97acf763e81594745c8e904039187e6eb80db4101e66bba6163271158
                                        • Instruction Fuzzy Hash: 87317A716053118FE365CF0DC904B26BBE4FFA8B00F0449ADF99897251EB70E804CB95
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABAA16 Relevance: .1, Instructions: 93COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 95%
                                        			E01ABAA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x1bad360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x1ba7b9c; // 0x0
					_t53 = L01AD4620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E01AFB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E01AFF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L01AC6C59(_t53, _t51, _t58) != 0) {
							_t28 = E01AE5E50(0x1a9c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E01AEB230(_v32, _v28, 0x1a9c2d8, 1,  &_v24);
								_t28 = E01ABF7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}




















                                        0x01abaa25
                                        0x01abaa29
                                        0x01abaa2d
                                        0x01abaa30
                                        0x01abaa37
                                        0x01abaa3c
                                        0x01b14458
                                        0x01b14458
                                        0x01b14472
                                        0x01b14474
                                        0x01b14476
                                        0x01abaa64
                                        0x01abaa74
                                        0x01b1447c
                                        0x01b14483
                                        0x01b14492
                                        0x01abaa52
                                        0x01abaa54
                                        0x01abaa5e
                                        0x01b144a8
                                        0x01b144ad
                                        0x01b144af
                                        0x01b144b6
                                        0x01b144b6
                                        0x01b144b9
                                        0x01b144bc
                                        0x01b144cd
                                        0x01b144d3
                                        0x01b144d6
                                        0x01b144e1
                                        0x01b144e1
                                        0x01b144e6
                                        0x01b144e8
                                        0x01b144fb
                                        0x01b144fb
                                        0x01b144e8
                                        0x00000000
                                        0x01abaa5e
                                        0x01b14476
                                        0x01abaa42
                                        0x01abaa46
                                        0x01abaa48
                                        0x01abaa4c
                                        0x00000000
                                        0x00000000
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: ce965c27b7c76474c133e9b2e11e51707c02513f29051a0ebc5c8266eaddb04c
                                        • Instruction ID: 8c82ca057308b2cc390f2f79f35671c93591906e62cd9e366d9239a1b5066dd0
                                        • Opcode Fuzzy Hash: ce965c27b7c76474c133e9b2e11e51707c02513f29051a0ebc5c8266eaddb04c
                                        • Instruction Fuzzy Hash: 2131E571A0061AABCF159FA8CE81ABFB7B8FF04700F41406DF905EB244EB349950C7A0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF8EC7 Relevance: .1, Instructions: 92COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 93%
                                        			E01AF8EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x1bad360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E01AE4E70(0x1ba86e4, 0x1af9490, 0, 0);
					if( *0x1ba53e8 > 5 && E01AF8F33(0x1ba53e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x1ba53e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x1ba53e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x1a9bc46;
						_t48 = E01B37B9C(0x1ba53e8, 0x1a9bc46, _t67, 0x1ba53e8, _t70,  &_v140);
					}
				}
				return E01AFB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}











































                                        0x01af8ec7
                                        0x01af8ed9
                                        0x01af8edc
                                        0x01af8ee6
                                        0x01af8ee9
                                        0x01af8eee
                                        0x01af8efc
                                        0x01af8f08
                                        0x01b31349
                                        0x01b31353
                                        0x01b3135d
                                        0x01b31366
                                        0x01b3136f
                                        0x01b31375
                                        0x01b3137c
                                        0x01b31385
                                        0x01b31390
                                        0x01b31391
                                        0x01b3139c
                                        0x01b3139d
                                        0x01b313a6
                                        0x01b313ac
                                        0x01b313b2
                                        0x01b313b5
                                        0x01b313bc
                                        0x01b313bf
                                        0x01b313c2
                                        0x01b313c5
                                        0x01b313c8
                                        0x01b313cb
                                        0x01b313ce
                                        0x01b313d1
                                        0x01b313d4
                                        0x01b313d7
                                        0x01b313da
                                        0x01b313dd
                                        0x01b313e0
                                        0x01b313e3
                                        0x01b313e6
                                        0x01b313e9
                                        0x01b313f6
                                        0x01b31400
                                        0x01b31400
                                        0x01af8f08
                                        0x01af8f32

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 08bafc80092490ff12dc918bc26587a87cd88f325f017aec0afc9be3ac7abc6e
                                        • Instruction ID: caa347912bd4c863c8541589db1edc5e70d918d2cd3102fc7b77d7e4d8dedf23
                                        • Opcode Fuzzy Hash: 08bafc80092490ff12dc918bc26587a87cd88f325f017aec0afc9be3ac7abc6e
                                        • Instruction Fuzzy Hash: DD4171B1D00218AFDB24CFAAD981AADFBF4FB48710F5041AEE649E7640E7745A84CF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEE730 Relevance: .1, Instructions: 89COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 74%
                                        			E01AEE730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E01AF9670() < 0) {
					E01B0DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x1ba7b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L01AD4620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M01AEE810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

















                                        0x01aee730
                                        0x01aee736
                                        0x01aee738
                                        0x01aee73d
                                        0x01aee73e
                                        0x01aee740
                                        0x01aee749
                                        0x01aee765
                                        0x01aee76a
                                        0x01aee76b
                                        0x01aee76c
                                        0x01aee76d
                                        0x01aee76e
                                        0x01aee76f
                                        0x01aee775
                                        0x01aee777
                                        0x01aee77e
                                        0x01b2b675
                                        0x01aee784
                                        0x01aee784
                                        0x01aee789
                                        0x01aee7a8
                                        0x01aee7ac
                                        0x01aee807
                                        0x01aee7ae
                                        0x01aee7ae
                                        0x01aee7b1
                                        0x01aee7b4
                                        0x01aee7b9
                                        0x01aee7c0
                                        0x01aee7c4
                                        0x01aee7ca
                                        0x01aee7cc
                                        0x00000000
                                        0x01aee7d3
                                        0x01aee7d6
                                        0x00000000
                                        0x00000000
                                        0x01aee7ff
                                        0x01aee802
                                        0x00000000
                                        0x00000000
                                        0x01aee7f9
                                        0x01aee7fc
                                        0x00000000
                                        0x00000000
                                        0x01aee7f3
                                        0x01aee7f6
                                        0x00000000
                                        0x00000000
                                        0x01aee7ed
                                        0x01aee7f0
                                        0x00000000
                                        0x00000000
                                        0x01aee7e7
                                        0x01aee7ea
                                        0x00000000
                                        0x00000000
                                        0x01b2b685
                                        0x01b2b688
                                        0x00000000
                                        0x00000000
                                        0x01b2b682
                                        0x00000000
                                        0x00000000
                                        0x01aee7cc
                                        0x01aee7d9
                                        0x01aee7dc
                                        0x01aee7de
                                        0x01aee7de
                                        0x01aee7ac
                                        0x01aee7e4
                                        0x01aee74b
                                        0x01aee751
                                        0x01aee759
                                        0x01aee761
                                        0x01aee761

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0bf234d39a65f8b228770b661bfab3d433f9fccefda1d3d2861aa0cfb9627301
                                        • Instruction ID: 86da30eb74cc57ac4f93ddfceafb419519ead7c71467ecf13916d1d7387cbedf
                                        • Opcode Fuzzy Hash: 0bf234d39a65f8b228770b661bfab3d433f9fccefda1d3d2861aa0cfb9627301
                                        • Instruction Fuzzy Hash: 00316D75A54249EFD745CF58D845B9ABBE4FB09314F14825AFA08CB341D631ED80CBA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEBC2C Relevance: .1, Instructions: 88COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 67%
                                        			E01AEBC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x1ba6100; // 0x5
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E01AD2280(0xd, 0x8a3f1a0);
				_t41 =  *0x1ba60f8; // 0x0
				if(_t41 != 0) {
					 *0x1ba60f8 =  *_t41;
					 *0x1ba60fc =  *0x1ba60fc + 0xffff;
				}
				E01ACFFB0(_t41, 0x800, 0x8a3f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x1ba60f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L01AD4620(0x1ba6100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x1ba6100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}










                                        0x01aebc36
                                        0x01aebc42
                                        0x01aebc45
                                        0x01aebc4a
                                        0x01aebd35
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01aebc50
                                        0x01aebc50
                                        0x01aebc58
                                        0x01aebc5a
                                        0x01aebc60
                                        0x00000000
                                        0x00000000
                                        0x01b2a4f2
                                        0x01b2a4f6
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b2a4fc
                                        0x01aebc79
                                        0x01aebc7e
                                        0x01aebc86
                                        0x01aebd16
                                        0x01aebd20
                                        0x01aebd20
                                        0x01aebc8d
                                        0x01aebc94
                                        0x01aebcbd
                                        0x01aebcca
                                        0x01aebccb
                                        0x01aebccc
                                        0x01aebccd
                                        0x01aebcce
                                        0x01aebcd4
                                        0x01aebcea
                                        0x01aebcee
                                        0x01aebcf2
                                        0x01aebd00
                                        0x01aebd04
                                        0x00000000
                                        0x01aebc96
                                        0x01aebcab
                                        0x01aebcaf
                                        0x01aebd2c
                                        0x01aebd2c
                                        0x01aebd09
                                        0x00000000
                                        0x01aebd09
                                        0x01aebcb1
                                        0x01aebcb5
                                        0x01aebcbb
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01aebcbb

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 1e673e032d6ffd7ae1b12489b7e2d58ef9d68dd2382f429dfc2b916e757ab7c1
                                        • Instruction ID: bb4ce9d85a6ed125b4ef44e4c458c2ddfe14fa3cbaf6d9851ea7f1d0bdde0df7
                                        • Opcode Fuzzy Hash: 1e673e032d6ffd7ae1b12489b7e2d58ef9d68dd2382f429dfc2b916e757ab7c1
                                        • Instruction Fuzzy Hash: 77310EB2A006169FCB22DF58C4C9BA677B4FF18310F490079ED59DB206EB35D9498BE0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB9100 Relevance: .1, Instructions: 87COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 76%
                                        			E01AB9100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x1b8f6e8);
				E01B0D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E01B888F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E01B0D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x1ba86c0; // 0x15707b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x1ba86b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E01AD2280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E01B888F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E01AFAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x1bab1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x1ba84c0;
										if(_t69 >=  *0x1ba84c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E01B89063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E01AB922A(_t82);
							_t53 = E01AD7D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E01B88B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x1ba86c0; // 0x15707b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x1ba86b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x1ba86bc;
										_t72 = 0x1ba86b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E01AB9240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x1ba86c4;
									_t72 = 0x1ba86c0;
									L18:
									E01AE9B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}


















                                        0x01ab9100
                                        0x01ab9100
                                        0x01ab9100
                                        0x01ab9100
                                        0x01ab9102
                                        0x01ab9107
                                        0x01ab910c
                                        0x01ab9110
                                        0x01ab9115
                                        0x01ab9136
                                        0x01ab9143
                                        0x01b137e4
                                        0x01b137e4
                                        0x01ab9149
                                        0x01ab914e
                                        0x01ab914e
                                        0x01ab9117
                                        0x01ab911d
                                        0x00000000
                                        0x00000000
                                        0x01ab911f
                                        0x01ab9125
                                        0x00000000
                                        0x01ab9151
                                        0x01ab9158
                                        0x01ab915d
                                        0x01ab9161
                                        0x01ab9168
                                        0x01b13715
                                        0x00000000
                                        0x01ab916e
                                        0x01ab916e
                                        0x01ab9175
                                        0x01ab9177
                                        0x01ab917e
                                        0x01ab917f
                                        0x01ab9182
                                        0x01ab9182
                                        0x01ab9187
                                        0x01ab9187
                                        0x01ab918a
                                        0x01ab918d
                                        0x01ab918f
                                        0x01ab9192
                                        0x01ab9195
                                        0x01ab9198
                                        0x01ab9198
                                        0x01ab9198
                                        0x01ab919a
                                        0x00000000
                                        0x00000000
                                        0x01b1371f
                                        0x01b13721
                                        0x01b13727
                                        0x01b1372f
                                        0x01b13733
                                        0x01b13735
                                        0x01b13738
                                        0x01b1373b
                                        0x01b1373d
                                        0x01b13740
                                        0x00000000
                                        0x00000000
                                        0x01b13746
                                        0x01b13749
                                        0x00000000
                                        0x00000000
                                        0x01b1374f
                                        0x01b13751
                                        0x00000000
                                        0x00000000
                                        0x01b13757
                                        0x01b13759
                                        0x01b1375c
                                        0x01b1375c
                                        0x01b1375e
                                        0x01b1375e
                                        0x01b13761
                                        0x01b13764
                                        0x00000000
                                        0x00000000
                                        0x01b13766
                                        0x01b13768
                                        0x01b137a3
                                        0x01b137a3
                                        0x01b137a5
                                        0x01b137a7
                                        0x01b137ad
                                        0x01b137b0
                                        0x01b137b2
                                        0x01b137bc
                                        0x01b137c2
                                        0x01b137c2
                                        0x01b137b2
                                        0x01ab9187
                                        0x01ab9187
                                        0x01ab918a
                                        0x01ab918d
                                        0x01ab918f
                                        0x01ab9192
                                        0x01ab9195
                                        0x00000000
                                        0x01ab9195
                                        0x00000000
                                        0x01ab9187
                                        0x01b1376a
                                        0x01b1376a
                                        0x01b1376c
                                        0x01b1376c
                                        0x01b1376f
                                        0x01b13775
                                        0x00000000
                                        0x00000000
                                        0x01b13777
                                        0x01b13779
                                        0x00000000
                                        0x00000000
                                        0x01b13782
                                        0x01b13787
                                        0x01b13789
                                        0x01b13790
                                        0x01b13790
                                        0x01b1378b
                                        0x01b1378b
                                        0x01b1378b
                                        0x01b13792
                                        0x01b13795
                                        0x01b13795
                                        0x01b13798
                                        0x01b13798
                                        0x01b1379b
                                        0x01b1379b
                                        0x01ab91a3
                                        0x01ab91a9
                                        0x01ab91b0
                                        0x01ab91b4
                                        0x01ab91b4
                                        0x01ab91bb
                                        0x01ab91c0
                                        0x01ab91c5
                                        0x01ab91c7
                                        0x01b137da
                                        0x01ab91cd
                                        0x01ab91cd
                                        0x01ab91cd
                                        0x01ab91d2
                                        0x01ab91d5
                                        0x01ab9239
                                        0x01ab9239
                                        0x01ab91d7
                                        0x01ab91db
                                        0x01ab91e1
                                        0x01ab91e7
                                        0x01ab91fd
                                        0x01ab9203
                                        0x01ab921e
                                        0x01ab9223
                                        0x00000000
                                        0x01ab9223
                                        0x01ab9205
                                        0x01ab9208
                                        0x01ab920c
                                        0x01ab9214
                                        0x01ab9214
                                        0x01ab91e9
                                        0x01ab91e9
                                        0x01ab91ee
                                        0x01ab91f3
                                        0x01ab91f3
                                        0x01ab91f3
                                        0x01ab91e7
                                        0x00000000
                                        0x01ab91db
                                        0x01ab9187
                                        0x01ab9168

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: fbcd2348e8e59b120b9892ac6366567a181f5a3eafd8bc6ee327800cb49fbe11
                                        • Instruction ID: 88828696e3aafba42630eb9065ebf281f908c0f178e17979025334bfebf936bc
                                        • Opcode Fuzzy Hash: fbcd2348e8e59b120b9892ac6366567a181f5a3eafd8bc6ee327800cb49fbe11
                                        • Instruction Fuzzy Hash: F031B1B1A04385DFEB66DFACD0C8BDEBBB5BB48318F58818DD60467252C330A980DB51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE1DB5 Relevance: .1, Instructions: 87COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 60%
                                        			E01AE1DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E01ADF460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L01AD4620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E01ADF460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}












                                        0x01ae1dc2
                                        0x01ae1dc5
                                        0x01ae1dc7
                                        0x01ae1dcc
                                        0x01ae1dce
                                        0x01ae1dd6
                                        0x01ae1ddf
                                        0x01ae1de0
                                        0x01ae1de1
                                        0x01ae1de5
                                        0x01ae1de8
                                        0x01ae1def
                                        0x01ae1df0
                                        0x01ae1df6
                                        0x01ae1df7
                                        0x01ae1dfe
                                        0x01ae1e1a
                                        0x00000000
                                        0x00000000
                                        0x01ae1e0b
                                        0x01ae1e12
                                        0x01ae1e12
                                        0x01ae1e00
                                        0x01ae1e00
                                        0x01ae1e05
                                        0x01ae1e1e
                                        0x01ae1e23
                                        0x01b2570f
                                        0x01b25713
                                        0x00000000
                                        0x00000000
                                        0x01b25719
                                        0x01b25719
                                        0x01ae1e2c
                                        0x01ae1e2d
                                        0x01ae1e2e
                                        0x01ae1e2f
                                        0x01ae1e31
                                        0x01ae1e32
                                        0x01ae1e35
                                        0x01ae1e3d
                                        0x01b25723
                                        0x01b2573d
                                        0x01b2573d
                                        0x00000000
                                        0x01b25723
                                        0x01ae1e49
                                        0x01ae1e4e
                                        0x01ae1e4e
                                        0x01ae1e09
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                        • Instruction ID: 2df83cdf578140c761ea35730c4ea609688e7ab824c0f7f9f3bb9b4d4af1f5ac
                                        • Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                        • Instruction Fuzzy Hash: F521B0B2600529FFD721CF99CD94EBBBBBDEF85640F154055FA06A7250D634AE01CBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B36C0A Relevance: .1, Instructions: 79COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 77%
                                        			E01B36C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E01AD7D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x1ba7b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L01AD4620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E01AFF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E01AD7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E01AF9AE0();
						_t23 = L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}












                                        0x01b36c0a
                                        0x01b36c0f
                                        0x01b36c10
                                        0x01b36c13
                                        0x01b36c15
                                        0x01b36c19
                                        0x01b36c1c
                                        0x01b36c21
                                        0x01b36c28
                                        0x01b36c3a
                                        0x01b36c2a
                                        0x01b36c33
                                        0x01b36c33
                                        0x01b36c3f
                                        0x01b36c48
                                        0x01b36c4d
                                        0x01b36c60
                                        0x01b36c65
                                        0x01b36c69
                                        0x01b36c73
                                        0x01b36c79
                                        0x01b36c7f
                                        0x01b36c86
                                        0x01b36c90
                                        0x01b36c94
                                        0x01b36ca6
                                        0x01b36cb2
                                        0x01b36cbd
                                        0x01b36cbd
                                        0x01b36cc3
                                        0x01b36cc7
                                        0x01b36ccb
                                        0x01b36cd0
                                        0x01b36cd1
                                        0x01b36ce2
                                        0x01b36ce2
                                        0x01b36c69
                                        0x01b36ced

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: cd54a10cd83144ad681f72246ac2b715de12bd70f26e30a65bd0436eba9962e4
                                        • Instruction ID: f440f3159e4554c068323143a8782649f96b0e2dcc95f2a78d75fe7a3703fdcf
                                        • Opcode Fuzzy Hash: cd54a10cd83144ad681f72246ac2b715de12bd70f26e30a65bd0436eba9962e4
                                        • Instruction Fuzzy Hash: 92219C72A00645BFD715DBA8D980F2AB7A8FF48704F1400A9F905C7790D734ED20CBA4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF90AF Relevance: .1, Instructions: 76COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 82%
                                        			E01AF90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E01B0D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E01AEE5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L01AD4620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E01AFF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E01AEA2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}


























                                        0x01af90af
                                        0x01af90b8
                                        0x01af90bb
                                        0x01af90bf
                                        0x01af90c2
                                        0x01af90c2
                                        0x01af90c8
                                        0x01af90cb
                                        0x01af90cd
                                        0x01b314d7
                                        0x01b314eb
                                        0x01b314eb
                                        0x00000000
                                        0x01b314eb
                                        0x01b314db
                                        0x01b314e6
                                        0x00000000
                                        0x01b314f2
                                        0x01b314e8
                                        0x00000000
                                        0x01b314e8
                                        0x01af90d8
                                        0x01af90da
                                        0x01af90dd
                                        0x01af90e5
                                        0x00000000
                                        0x01af9139
                                        0x01af90fa
                                        0x01af90fe
                                        0x01af9142
                                        0x00000000
                                        0x01af9142
                                        0x01af9104
                                        0x01af9107
                                        0x01af910b
                                        0x01af9110
                                        0x01af9118
                                        0x01af9147
                                        0x01af9148
                                        0x01af914f
                                        0x01af9150
                                        0x01af9151
                                        0x01af9152
                                        0x01af9156
                                        0x01af915d
                                        0x01af9160
                                        0x01af9168
                                        0x01af916c
                                        0x01af91bc
                                        0x01af91be
                                        0x00000000
                                        0x01af91be
                                        0x01af916e
                                        0x01af9173
                                        0x01af9176
                                        0x00000000
                                        0x00000000
                                        0x01af917c
                                        0x01af9180
                                        0x01af91b5
                                        0x00000000
                                        0x01af91b5
                                        0x01af9182
                                        0x01af9185
                                        0x01af9189
                                        0x00000000
                                        0x00000000
                                        0x01af918e
                                        0x01af9190
                                        0x01af9198
                                        0x00000000
                                        0x00000000
                                        0x01af91a0
                                        0x00000000
                                        0x01af91ad
                                        0x01af91ad
                                        0x01af91b0
                                        0x01af91b1
                                        0x00000000
                                        0x01af9185
                                        0x01af911a
                                        0x01af911c
                                        0x01af911f
                                        0x01af9125
                                        0x01af9127
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                        • Instruction ID: 48313b87db258b4ffe0a55ee746a4cbef353cf16b22c12a272cb91aa95d52775
                                        • Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                        • Instruction Fuzzy Hash: 2B217C71A00305EFDB21DF99C944EAAFBF8EB54314F1488BEFA49A7251D330A9148F90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE3B7A Relevance: .1, Instructions: 75COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 59%
                                        			E01AE3B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x1ba84c4; // 0x0
				_v12 = 1;
				_v8 =  *0x1ba84c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x1ba84c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E01AFAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E01AFFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x1ba84c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x1ba84c4; // 0x0
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}












                                        0x01ae3b89
                                        0x01ae3b96
                                        0x01ae3ba1
                                        0x01ae3bab
                                        0x01ae3bb5
                                        0x01ae3bb9
                                        0x01b26298
                                        0x01ae3bbf
                                        0x01ae3bc2
                                        0x01ae3bc3
                                        0x01ae3bc9
                                        0x01ae3bca
                                        0x01ae3bcc
                                        0x01ae3bcd
                                        0x01ae3bd4
                                        0x01ae3bd6
                                        0x01ae3bdb
                                        0x01ae3bea
                                        0x01ae3bf7
                                        0x01ae3bfb
                                        0x01ae3bff
                                        0x01ae3c09
                                        0x01ae3c0a
                                        0x01ae3c0b
                                        0x01ae3c0f
                                        0x01ae3c14
                                        0x01ae3c18
                                        0x01ae3c18
                                        0x01ae3bfb
                                        0x01ae3c1b
                                        0x01ae3c30
                                        0x01ae3c30
                                        0x01ae3c3d

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 7538075a62fb91f7205fefa83a34ab74bdf014275c0149e5d73d57e636ef1ece
                                        • Instruction ID: 5ae53e71e16089dc94b48de145600ff9e011bdb9e43caabb80ca659d006e5492
                                        • Opcode Fuzzy Hash: 7538075a62fb91f7205fefa83a34ab74bdf014275c0149e5d73d57e636ef1ece
                                        • Instruction Fuzzy Hash: C721A7B2A00105AFCB14DF98CD81F6ABBBDFF44708F150068E6099B651D771ED15CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B36CF0 Relevance: .1, Instructions: 74COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 80%
                                        			E01B36CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E01AD7D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E01AD7D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x1a95c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E01AEF6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E01AEF6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E01B37016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L01AD2400( &_v52);
								}
								_t21 = L01AD2400( &_v28);
							}
						}
					}
				}
				return _t21;
			}



















                                        0x01b36cfb
                                        0x01b36d00
                                        0x01b36d02
                                        0x01b36d06
                                        0x01b36d0a
                                        0x01b36d0e
                                        0x01b36d19
                                        0x01b36d2b
                                        0x01b36d1b
                                        0x01b36d24
                                        0x01b36d24
                                        0x01b36d33
                                        0x01b36d39
                                        0x01b36d46
                                        0x01b36d4f
                                        0x01b36d61
                                        0x01b36d51
                                        0x01b36d5a
                                        0x01b36d5a
                                        0x01b36d69
                                        0x01b36d6b
                                        0x01b36d6d
                                        0x01b36d6f
                                        0x01b36d6f
                                        0x01b36d74
                                        0x01b36d79
                                        0x01b36d7a
                                        0x01b36d7f
                                        0x01b36d82
                                        0x01b36d88
                                        0x01b36d89
                                        0x01b36d90
                                        0x01b36d94
                                        0x01b36da7
                                        0x01b36db1
                                        0x01b36db1
                                        0x01b36dbb
                                        0x01b36dbb
                                        0x01b36d90
                                        0x01b36d69
                                        0x01b36d46
                                        0x01b36dc6

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 64fbe3a80bae775b0700fcbd1c2c7fef0bf5a5e7cb68029a450aa80deb582360
                                        • Instruction ID: ed0cbc11adaf768c9d3e5ea3ce2684d86bed8916821d59d518b55e8bc30c1950
                                        • Opcode Fuzzy Hash: 64fbe3a80bae775b0700fcbd1c2c7fef0bf5a5e7cb68029a450aa80deb582360
                                        • Instruction Fuzzy Hash: D321F272500645AFD715DF68CA48BABBBECEFD1740F040596FA80C7251EB34CA58C6A2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B8070D Relevance: .1, Instructions: 72COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 67%
                                        			E01B8070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E01B807DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E01B7AFDE( &_v8,  &_v12);
					E01B81293(_t38, _v28, _t60);
					if(E01AD7D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E01B714FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}













                                        0x01b8071b
                                        0x01b80724
                                        0x01b80734
                                        0x01b80738
                                        0x01b8074b
                                        0x01b8074b
                                        0x01b80753
                                        0x01b80753
                                        0x01b80759
                                        0x01b8075d
                                        0x01b80774
                                        0x01b80779
                                        0x01b8077d
                                        0x01b80789
                                        0x01b80795
                                        0x01b807a7
                                        0x01b80797
                                        0x01b807a0
                                        0x01b807a0
                                        0x01b807af
                                        0x01b807c4
                                        0x01b807cd
                                        0x01b807cd
                                        0x01b807af
                                        0x01b807dc

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                        • Instruction ID: 5e8dc1bd354d21f3d091aeb6d64cda6f06db11ba3561f8cb2a6fd7fa321c2083
                                        • Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                        • Instruction Fuzzy Hash: 0821043A2042049FD719FF2CC880B6ABBA5EFD4750F0486A9FD958B385D730D909CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B37794 Relevance: .1, Instructions: 70COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 82%
                                        			E01B37794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x1ba7b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E01AFF3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E01AD7D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E01AF9AE0();
					_t24 = L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}













                                        0x01b37799
                                        0x01b3779a
                                        0x01b3779b
                                        0x01b377a3
                                        0x01b377ab
                                        0x01b377ae
                                        0x01b377b1
                                        0x01b377b1
                                        0x01b377bf
                                        0x01b377c4
                                        0x01b377c8
                                        0x01b377ce
                                        0x01b377d4
                                        0x01b377e0
                                        0x01b377e0
                                        0x01b377d6
                                        0x01b377d6
                                        0x01b377de
                                        0x00000000
                                        0x00000000
                                        0x01b377de
                                        0x01b377e5
                                        0x01b377f0
                                        0x01b377f3
                                        0x01b377f6
                                        0x01b377fd
                                        0x01b37800
                                        0x01b3780c
                                        0x01b37818
                                        0x01b3782b
                                        0x01b3781a
                                        0x01b37823
                                        0x01b37823
                                        0x01b37830
                                        0x01b37831
                                        0x01b37838
                                        0x01b3783d
                                        0x01b3783e
                                        0x01b3784f
                                        0x01b3784f
                                        0x01b3785a

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: d7a48f37a99c4332787f7d3db55ebb00d06c768cad9b8d31917268d17eaa2ded
                                        • Instruction ID: 5156160683389834f8cf1b0527be999d62947ccd4e3baa7016758b7000b1a51b
                                        • Opcode Fuzzy Hash: d7a48f37a99c4332787f7d3db55ebb00d06c768cad9b8d31917268d17eaa2ded
                                        • Instruction Fuzzy Hash: C02181B2500604EFC729DFA9D990E6BBBA9EF88740F10456DF60AD7750DB34E910CB94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ADAE73 Relevance: .1, Instructions: 70COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 96%
                                        			E01ADAE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E01AD7D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E01AD7D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E01AD7D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E01AD7D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E01B37794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}













                                        0x01adae78
                                        0x01adae7c
                                        0x01adae7e
                                        0x01adae81
                                        0x01adae86
                                        0x01adae8d
                                        0x01b22691
                                        0x01adae93
                                        0x01adae93
                                        0x01adae93
                                        0x01adae98
                                        0x01adae9d
                                        0x01b226a2
                                        0x01b226b4
                                        0x01b226a4
                                        0x01b226ad
                                        0x01b226ad
                                        0x01b226b9
                                        0x00000000
                                        0x01b226bb
                                        0x00000000
                                        0x01b226bb
                                        0x01adaea3
                                        0x01adaea3
                                        0x01adaea3
                                        0x01adaeaa
                                        0x01b226c0
                                        0x01b226c9
                                        0x01b226c9
                                        0x01adaeb3
                                        0x01b226d4
                                        0x01b226e1
                                        0x00000000
                                        0x00000000
                                        0x01b226e7
                                        0x01b226ee
                                        0x01b226f0
                                        0x01b226f9
                                        0x01b226f9
                                        0x01b22702
                                        0x01b22708
                                        0x01b22708
                                        0x01b2270b
                                        0x01b2270f
                                        0x01b22711
                                        0x01b22711
                                        0x01b22725
                                        0x01b22725
                                        0x00000000
                                        0x01adaeb9
                                        0x01adaeb9
                                        0x01adaebf
                                        0x01adaebf
                                        0x01adaeb3

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                        • Instruction ID: 1b1cc2ec5c8d26ec6a25cbf4c6d38eb7c1dbd5bc4bc5fba0c9d3931d161b1d0f
                                        • Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                        • Instruction Fuzzy Hash: DB21D473601A919FE72B9B68C948B2577E8EF45340F0900E0ED09CB7A2DB34DC44C690
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEFD9B Relevance: .1, Instructions: 69COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 93%
                                        			E01AEFD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E01AC76E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}










                                        0x01aefd9b
                                        0x01aefda0
                                        0x01aefda1
                                        0x01aefdab
                                        0x01aefdad
                                        0x01aefdb0
                                        0x01aefdb8
                                        0x01aefe0f
                                        0x01aefde6
                                        0x01aefde9
                                        0x01aefdec
                                        0x01b2c0c0
                                        0x01aefdfe
                                        0x01aefe06
                                        0x01aefe06
                                        0x01b2c0c8
                                        0x01aefe2d
                                        0x01aefe2d
                                        0x00000000
                                        0x01aefe2d
                                        0x01b2c0d1
                                        0x01b2c0e0
                                        0x01b2c0e5
                                        0x01b2c0e5
                                        0x01b2c0e8
                                        0x00000000
                                        0x01b2c0e8
                                        0x01aefdf4
                                        0x00000000
                                        0x00000000
                                        0x01aefdf6
                                        0x01aefdfa
                                        0x01aefe1a
                                        0x01aefe1f
                                        0x01aefe1f
                                        0x01aefdfc
                                        0x00000000
                                        0x01aefdfc
                                        0x01aefdcc
                                        0x01aefdd0
                                        0x01aefe26
                                        0x00000000
                                        0x01aefe26
                                        0x01aefdd8
                                        0x01aefddb
                                        0x01aefddd
                                        0x01aefde0
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                        • Instruction ID: 7296893b1582838533499182d842c1158c10a83eac47bb87a958d7923f716f31
                                        • Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                        • Instruction Fuzzy Hash: 2A21AC72600A40DFD735CF4DC684A66FBF5EB94A10F24806EE94987711D731AC04CB80
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEB390 Relevance: .1, Instructions: 63COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 54%
                                        			E01AEB390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E01AD2280(_t12, 0x1ba8608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E01AF00C2(0x1ba8608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}











                                        0x01aeb395
                                        0x01aeb3a2
                                        0x01aeb3a5
                                        0x01aeb3aa
                                        0x01aeb3b2
                                        0x01aeb3ba
                                        0x01aeb3bd
                                        0x01aeb3c0
                                        0x01aeb3c4
                                        0x01aeb3c9
                                        0x01b2a3e9
                                        0x01b2a3ed
                                        0x01b2a3f0
                                        0x01b2a3ff
                                        0x01b2a403
                                        0x01b2a409
                                        0x00000000
                                        0x00000000
                                        0x01b2a40b
                                        0x01b2a40b
                                        0x01b2a40f
                                        0x01b2a415
                                        0x01b2a423
                                        0x01b2a423
                                        0x01b2a415
                                        0x01aeb3d1
                                        0x01aeb3e8
                                        0x01aeb3e8
                                        0x01aeb3d9

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5866150b362b5a7021627b01f2115d00d408821b063680adfcd5e37afc111fb3
                                        • Instruction ID: 6bb4efe6ab94b9261044c6ea0d6470a880804979a868c84513beb44a3aca1ed3
                                        • Opcode Fuzzy Hash: 5866150b362b5a7021627b01f2115d00d408821b063680adfcd5e37afc111fb3
                                        • Instruction Fuzzy Hash: 0F116B377051219BCB1D8A688E85A6BB2A7EFC5330B29416DED16C7B80CA319C02C6A0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB9240 Relevance: .1, Instructions: 63COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 77%
                                        			E01AB9240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x1b8f708);
				E01B0D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E01AF95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E01AF95D0();
				_t33 =  *0x1ba84c4; // 0x0
				L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x1ba84c4; // 0x0
				L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x1ba84c4; // 0x0
				E01AD2280(L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x1ba86b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E01AF95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E01AF95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E01AB9325();
					_t50 =  *0x1ba84c4; // 0x0
					return E01B0D0D1(L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}















                                        0x01ab9240
                                        0x01ab9242
                                        0x01ab9247
                                        0x01ab924c
                                        0x01ab924e
                                        0x01ab9255
                                        0x01ab9257
                                        0x01ab925a
                                        0x01ab925f
                                        0x01ab925f
                                        0x01ab9266
                                        0x01ab9271
                                        0x01ab9276
                                        0x01ab9279
                                        0x01ab927e
                                        0x01ab9295
                                        0x01ab929a
                                        0x01ab92b1
                                        0x01ab92b6
                                        0x01ab92d7
                                        0x01ab92dc
                                        0x01ab92e0
                                        0x01ab92e6
                                        0x01ab92e8
                                        0x01ab92ee
                                        0x01ab9332
                                        0x01ab9333
                                        0x01ab9337
                                        0x01ab9338
                                        0x01ab933a
                                        0x01ab933a
                                        0x01ab933d
                                        0x01ab9342
                                        0x01ab9342
                                        0x01ab9345
                                        0x01ab9349
                                        0x01ab934e
                                        0x01ab9352
                                        0x01ab9357
                                        0x01ab92f4
                                        0x01ab92f4
                                        0x01ab92f6
                                        0x01ab92f9
                                        0x01ab9300
                                        0x01ab9306
                                        0x01ab9324
                                        0x01ab9324

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: fa7a5998458ba72971e405f9c356ed172f5a3e1d5342b7cdd84645051c8d1a22
                                        • Instruction ID: 2090b65a80ef1e04ebdb2d3de980589eadca9f1b446b1f2027e64139c5879524
                                        • Opcode Fuzzy Hash: fa7a5998458ba72971e405f9c356ed172f5a3e1d5342b7cdd84645051c8d1a22
                                        • Instruction Fuzzy Hash: E2217F71041A41DFC726EFA8CA40F56B7F9FF18708F55456CE14A87AA2CB34E941CB44
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B44257 Relevance: .1, Instructions: 60COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 90%
                                        			E01B44257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x1b908d0);
				E01B0D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E01B441E8(__ebx, __edi, __ecx, _t39);
				E01ACEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x1ba87e4;
					_t18 =  *0x1ba87e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x1ba5cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x1ba87e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x1ba87e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L01AB7055(_t31 + 0xfffffff8);
								_t24 =  *0x1ba87e0; // 0x0
								_t18 = _t24 - 1;
								 *0x1ba87e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x1ba5cd0;
				if( *0x1ba5cd0 <= 0) {
					L01AB7055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x1ba87e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x1ba87e8 = _t30;
						 *0x1ba87e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E01B0D0D1(L01B44320());
			}















                                        0x01b44257
                                        0x01b44257
                                        0x01b44257
                                        0x01b44259
                                        0x01b4425e
                                        0x01b44263
                                        0x01b44265
                                        0x01b44273
                                        0x01b44278
                                        0x01b4427c
                                        0x01b4427f
                                        0x01b44281
                                        0x01b44287
                                        0x01b442d7
                                        0x01b442d7
                                        0x01b442da
                                        0x01b4428d
                                        0x01b4428d
                                        0x01b4428f
                                        0x01b44292
                                        0x01b44297
                                        0x01b4429c
                                        0x01b442a0
                                        0x01b442a6
                                        0x01b442a8
                                        0x01b442ae
                                        0x01b442b3
                                        0x00000000
                                        0x01b442ba
                                        0x01b442ba
                                        0x01b442bf
                                        0x01b442c5
                                        0x01b442ca
                                        0x01b442cf
                                        0x01b442d0
                                        0x00000000
                                        0x01b442d0
                                        0x01b442b3
                                        0x00000000
                                        0x01b442a6
                                        0x01b4429c
                                        0x01b442dc
                                        0x01b442dc
                                        0x01b442e3
                                        0x01b44309
                                        0x01b442e5
                                        0x01b442e5
                                        0x01b442e8
                                        0x01b442ee
                                        0x01b442f0
                                        0x00000000
                                        0x01b442f2
                                        0x01b442f2
                                        0x01b442f4
                                        0x01b442f7
                                        0x01b442f9
                                        0x01b44300
                                        0x01b44300
                                        0x01b442f0
                                        0x01b4430e
                                        0x01b4431f

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6d295a620db58e43eec0a3f2551330b1cac8e1d5dd6b6979bbb6e46c62abce65
                                        • Instruction ID: 2fc48e6af092bc80d592f0ad2eefa707dd3c07f4d69b381ce844f48ec24d57aa
                                        • Opcode Fuzzy Hash: 6d295a620db58e43eec0a3f2551330b1cac8e1d5dd6b6979bbb6e46c62abce65
                                        • Instruction Fuzzy Hash: C2218CB0A10601DFCB29DF68D141B24BFF1FB85355BA0C2EEC1098B699EB31D4A1DB02
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE2397 Relevance: .1, Instructions: 59COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 29%
                                        			E01AE2397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x1ba848c != 0) {
					L01ADFAD0(0x1ba8610);
					if( *0x1ba848c == 0) {
						E01ADFA00(0x1ba8610, _t19, _t27, 0x1ba8610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E01AE2581(0x1ba8610, 0x1a950a0, _t26, _t27, _t28);
						E01ADFA00(0x1ba8610, 0x1a950a0, _t27, 0x1ba8610);
					}
				} else {
					L1:
					_t11 =  *0x1ba8614; // 0x0
					if(_t11 == 0) {
						_t11 = E01AF4886(0x1a91088, 1, 0x1ba8614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E01AE2581(0x1ba8610, (_t11 << 4) + 0x1a95070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}















                                        0x01ae23b0
                                        0x01ae23b6
                                        0x01ae2409
                                        0x01ae2415
                                        0x01b25ae9
                                        0x00000000
                                        0x01ae241b
                                        0x01ae241b
                                        0x01ae241d
                                        0x01ae2427
                                        0x01ae242e
                                        0x01ae2430
                                        0x01ae2430
                                        0x01ae23b8
                                        0x01ae23b8
                                        0x01ae23b8
                                        0x01ae23bf
                                        0x01ae23fc
                                        0x01ae23fc
                                        0x01ae23c1
                                        0x01ae23c3
                                        0x01ae23d0
                                        0x01ae23d8
                                        0x01ae23d8
                                        0x01ae23dc
                                        0x01ae23de
                                        0x01ae23e1
                                        0x01ae23e1
                                        0x01ae23ec

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 08d58b4f105283689fd52da9701c86a427d278758844976186b8b4a9784aeb3c
                                        • Instruction ID: a682cd234c9612fbb49a48bd8556c4b0af77b1cb7f0732c4920e0668b156d34d
                                        • Opcode Fuzzy Hash: 08d58b4f105283689fd52da9701c86a427d278758844976186b8b4a9784aeb3c
                                        • Instruction Fuzzy Hash: 3E1166327043126BE735962DAD89B16B6DCFBA0721F0C402BF60397691CAB0E8418B64
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B346A7 Relevance: .1, Instructions: 59COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 93%
                                        			E01B346A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E01AFF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E01AED268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L01AD77F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}











                                        0x01b346b7
                                        0x01b346ba
                                        0x01b346c5
                                        0x01b346c8
                                        0x01b346d0
                                        0x01b346d4
                                        0x01b346e6
                                        0x01b346e9
                                        0x01b346f4
                                        0x01b346ff
                                        0x01b34705
                                        0x01b34706
                                        0x01b3470c
                                        0x01b34713
                                        0x01b3471b
                                        0x01b34723
                                        0x01b34725
                                        0x01b346d6
                                        0x01b346d9
                                        0x01b346db
                                        0x01b346db
                                        0x01b34732

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                        • Instruction ID: 3d984c96032fbdde714de65386a492e44ff1ae1d777b85fd790bd8db6c0f1032
                                        • Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                        • Instruction Fuzzy Hash: E7110272504208BBC7059F9CD9808BEF7B9EF95300F1080AAF9458B350DA318D55D3A4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF37F5 Relevance: .1, Instructions: 57COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 87%
                                        			E01AF37F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E01AD2280(_t6, 0x1ba8550);
				}
				_t29 = E01AF387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E01ACFFB0(0x1ba8550, _t27, 0x1ba8550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}











                                        0x01af37fa
                                        0x01af37fc
                                        0x01af3805
                                        0x01af3808
                                        0x01af3808
                                        0x01af3814
                                        0x01af3818
                                        0x01af3846
                                        0x01af3848
                                        0x01af384b
                                        0x01af384b
                                        0x01af3852
                                        0x00000000
                                        0x01af3854
                                        0x01af3856
                                        0x00000000
                                        0x00000000
                                        0x01af3863
                                        0x00000000
                                        0x01af3863
                                        0x01af381a
                                        0x01af381a
                                        0x01af381f
                                        0x01af386e
                                        0x01af386e
                                        0x01af3871
                                        0x01af3873
                                        0x01af3873
                                        0x01af3868
                                        0x00000000
                                        0x01af3868
                                        0x01af3821
                                        0x01af3826
                                        0x00000000
                                        0x00000000
                                        0x01af3828
                                        0x01af382a
                                        0x01af3841
                                        0x00000000
                                        0x01af3841

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 54accf29b15b443693ae4788568c36d0c28d119762ccc150ec2a22a9c5b447f9
                                        • Instruction ID: 5586e3993c599f7921463414fc9783f31cc5c7cafc2c8f2bd928ffdf203f27df
                                        • Opcode Fuzzy Hash: 54accf29b15b443693ae4788568c36d0c28d119762ccc150ec2a22a9c5b447f9
                                        • Instruction Fuzzy Hash: 2A0196B29056119BCB378B9EDA40E2ABBA6FF85A60F15406DFA458B315DB38DC01C7D0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE002D Relevance: .1, Instructions: 55COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AE002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E01AD7D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E01AD7D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E01AD7D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E01AD7D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}








                                        0x01ae0032
                                        0x01ae0037
                                        0x01ae0043
                                        0x01b24b3a
                                        0x01ae0049
                                        0x01ae0049
                                        0x01ae0049
                                        0x01ae004e
                                        0x01ae0053
                                        0x01b24b48
                                        0x01b24b5a
                                        0x01b24b4a
                                        0x01b24b53
                                        0x01b24b53
                                        0x01b24b5f
                                        0x00000000
                                        0x01b24b61
                                        0x00000000
                                        0x01b24b61
                                        0x01ae0059
                                        0x01ae0059
                                        0x01ae0060
                                        0x01b24b6f
                                        0x01b24b6f
                                        0x01ae0069
                                        0x01b24b83
                                        0x00000000
                                        0x00000000
                                        0x01b24b90
                                        0x01b24b9b
                                        0x01b24b9b
                                        0x01b24ba4
                                        0x00000000
                                        0x00000000
                                        0x01b24baa
                                        0x00000000
                                        0x01ae006f
                                        0x01ae006f
                                        0x00000000
                                        0x01ae006f
                                        0x01ae0069

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                        • Instruction ID: cbf5bcb3b3162c269015e67110d3a7dffa495f3acef283d100b3fe0b7a2a72ef
                                        • Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                        • Instruction Fuzzy Hash: A611A532705A918FE727976CC65CB357BE4EB41764F0D00E0EE09D7E92D768D849C650
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC766D Relevance: .1, Instructions: 54COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 94%
                                        			E01AC766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E01AEF3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E01AEF3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L01AD4620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}










                                        0x01ac7672
                                        0x01ac767f
                                        0x01ac7689
                                        0x01ac76de
                                        0x01ac76de
                                        0x01ac768b
                                        0x01ac7691
                                        0x01ac7693
                                        0x01ac7697
                                        0x00000000
                                        0x01ac7699
                                        0x01ac76a8
                                        0x00000000
                                        0x01ac76aa
                                        0x01ac76ad
                                        0x01ac76b1
                                        0x00000000
                                        0x01ac76b3
                                        0x01ac76b3
                                        0x01ac76b5
                                        0x01ac76ba
                                        0x01ac76bc
                                        0x01ac76bc
                                        0x01ac76c0
                                        0x00000000
                                        0x01ac76c2
                                        0x01ac76ce
                                        0x01ac76ce
                                        0x01ac76c0
                                        0x01ac76b1
                                        0x01ac76a8
                                        0x01ac7697
                                        0x01ac76d9

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                        • Instruction ID: 24d4f3ad9a7243e82a1ede77a2187139cd7ca8ab252845bedf256ad8f1f84d5d
                                        • Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                        • Instruction Fuzzy Hash: FD01A732701119AFD720DE9ECD45E5B7BADEB94F60F280528BA19CF250DA30DD01CBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB9080 Relevance: .1, Instructions: 53COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 69%
                                        			E01AB9080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x1ba85ec;
				E01AD2280(_t48, 0x1ba85ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E01ACFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x1ba538c; // 0x77e06828
					if( *_t84 != 0x1ba5388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x1b8f6e8);
						E01B0D0E8(0x1ba85ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E01B888F5(_t80, _t85, 0x1ba5388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x1ba86c0; // 0x15707b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x1ba86b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E01AD2280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E01B888F5(0x1ba85ec, _t85, 0x1ba5388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E01AFAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x1bab1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x1ba84c0;
																			if(_t82 >=  *0x1ba84c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E01B89063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E01AB922A(_t99);
										_t64 = E01AD7D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E01B88B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x1ba86c0; // 0x15707b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x1ba86b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x1ba86bc;
													_t87 = 0x1ba86b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E01AB9240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x1ba86c4;
												_t87 = 0x1ba86c0;
												L27:
												E01AE9B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E01B0D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x1ba5388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x1ba538c = _t51;
						goto L6;
					}
				}
			}




















                                        0x01ab9082
                                        0x01ab9083
                                        0x01ab9084
                                        0x01ab9085
                                        0x01ab9087
                                        0x01ab9096
                                        0x01ab9098
                                        0x01ab9098
                                        0x01ab909e
                                        0x01ab90a8
                                        0x01ab90e7
                                        0x01ab90e7
                                        0x01ab90aa
                                        0x01ab90b0
                                        0x01ab90b7
                                        0x01ab90bd
                                        0x01ab90dd
                                        0x01ab90e6
                                        0x01ab90bf
                                        0x01ab90bf
                                        0x01ab90c7
                                        0x01ab90cf
                                        0x01ab90f1
                                        0x01ab90f2
                                        0x01ab90f4
                                        0x01ab90f5
                                        0x01ab90f6
                                        0x01ab90f7
                                        0x01ab90f8
                                        0x01ab90f9
                                        0x01ab90fa
                                        0x01ab90fb
                                        0x01ab90fc
                                        0x01ab90fd
                                        0x01ab90fe
                                        0x01ab90ff
                                        0x01ab9100
                                        0x01ab9102
                                        0x01ab9107
                                        0x01ab910c
                                        0x01ab9110
                                        0x01ab9113
                                        0x01ab9115
                                        0x01ab9136
                                        0x01ab913f
                                        0x01ab9143
                                        0x01b137e4
                                        0x01b137e4
                                        0x01ab9117
                                        0x01ab9117
                                        0x01ab911d
                                        0x00000000
                                        0x01ab911f
                                        0x01ab911f
                                        0x01ab9125
                                        0x00000000
                                        0x01ab9127
                                        0x01ab912d
                                        0x01ab9130
                                        0x01ab9134
                                        0x01ab9158
                                        0x01ab915d
                                        0x01ab9161
                                        0x01ab9168
                                        0x01b13715
                                        0x01ab916e
                                        0x01ab916e
                                        0x01ab9175
                                        0x01ab9177
                                        0x01ab917e
                                        0x01ab917f
                                        0x01ab9182
                                        0x01ab9182
                                        0x01ab9187
                                        0x01ab9187
                                        0x01ab918a
                                        0x01ab918d
                                        0x01ab918f
                                        0x01ab9192
                                        0x01ab9195
                                        0x01ab9198
                                        0x01ab9198
                                        0x01ab9198
                                        0x01ab919a
                                        0x00000000
                                        0x00000000
                                        0x01b1371f
                                        0x01b13721
                                        0x01b13727
                                        0x01b1372f
                                        0x01b13733
                                        0x01b13735
                                        0x01b13738
                                        0x01b1373b
                                        0x01b1373d
                                        0x01b13740
                                        0x00000000
                                        0x01b13746
                                        0x01b13746
                                        0x01b13749
                                        0x00000000
                                        0x01b1374f
                                        0x01b1374f
                                        0x01b13751
                                        0x01b13757
                                        0x01b13759
                                        0x01b1375c
                                        0x01b1375c
                                        0x01b1375e
                                        0x01b1375e
                                        0x01b13761
                                        0x01b13764
                                        0x00000000
                                        0x00000000
                                        0x01b13766
                                        0x01b13768
                                        0x01b137a3
                                        0x01b137a3
                                        0x01b137a5
                                        0x01b137a7
                                        0x01b137ad
                                        0x01b137b0
                                        0x01b137b2
                                        0x01b137bc
                                        0x01b137c2
                                        0x01b137c2
                                        0x01b137b2
                                        0x01ab9187
                                        0x01ab9187
                                        0x01ab918a
                                        0x01ab918d
                                        0x01ab918f
                                        0x01ab9192
                                        0x01ab9195
                                        0x00000000
                                        0x01ab9195
                                        0x00000000
                                        0x01b1376a
                                        0x01b1376a
                                        0x01b1376a
                                        0x01b1376c
                                        0x01b1376c
                                        0x01b1376f
                                        0x01b13775
                                        0x00000000
                                        0x00000000
                                        0x01b13777
                                        0x01b13779
                                        0x01b13782
                                        0x01b13787
                                        0x01b13789
                                        0x01b13790
                                        0x01b13790
                                        0x01b1378b
                                        0x01b1378b
                                        0x01b1378b
                                        0x01b13792
                                        0x01b13795
                                        0x00000000
                                        0x01b13795
                                        0x00000000
                                        0x01b13779
                                        0x01b13798
                                        0x00000000
                                        0x01b13798
                                        0x00000000
                                        0x01b13768
                                        0x01b1379b
                                        0x01b1379b
                                        0x01b13751
                                        0x01b13749
                                        0x00000000
                                        0x01b13740
                                        0x01ab91a0
                                        0x01ab91a3
                                        0x01ab91a9
                                        0x01ab91b0
                                        0x00000000
                                        0x01ab91b0
                                        0x01ab9187
                                        0x01ab91b4
                                        0x01ab91b4
                                        0x01ab91bb
                                        0x01ab91c0
                                        0x01ab91c5
                                        0x01ab91c7
                                        0x01b137da
                                        0x01ab91cd
                                        0x01ab91cd
                                        0x01ab91cd
                                        0x01ab91d2
                                        0x01ab91d5
                                        0x01ab9239
                                        0x01ab9239
                                        0x01ab91d7
                                        0x01ab91db
                                        0x01ab91e1
                                        0x01ab91e7
                                        0x01ab91fd
                                        0x01ab9203
                                        0x01ab921e
                                        0x01ab9223
                                        0x00000000
                                        0x01ab9205
                                        0x01ab9205
                                        0x01ab9208
                                        0x01ab920c
                                        0x01ab9214
                                        0x01ab9214
                                        0x01ab920c
                                        0x01ab91e9
                                        0x01ab91e9
                                        0x01ab91ee
                                        0x01ab91f3
                                        0x01ab91f3
                                        0x01ab91f3
                                        0x01ab91e7
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01ab9134
                                        0x01ab9125
                                        0x01ab911d
                                        0x01ab914e
                                        0x01ab90d1
                                        0x01ab90d1
                                        0x01ab90d3
                                        0x01ab90d6
                                        0x01ab90d8
                                        0x00000000
                                        0x01ab90d8
                                        0x01ab90cf

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2673a133985250df6925a5e285837fa173b2b0820607fe19a124adadcf553392
                                        • Instruction ID: f659804671ee7daeaac935ec65954b16c8f9f812210550fd36e8d4fe1955024c
                                        • Opcode Fuzzy Hash: 2673a133985250df6925a5e285837fa173b2b0820607fe19a124adadcf553392
                                        • Instruction Fuzzy Hash: 5201F4B39016408FC3298F08D880B92BBF9FF85324F254066E6068B693C370DC41CBD0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B4C450 Relevance: .1, Instructions: 53COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 46%
                                        			E01B4C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E01AF9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E01AF95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E01AF95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E01AF95D0();
				return L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}






                                        0x01b4c458
                                        0x01b4c45d
                                        0x01b4c466
                                        0x01b4c468
                                        0x01b4c469
                                        0x01b4c46a
                                        0x01b4c46b
                                        0x01b4c46e
                                        0x01b4c46f
                                        0x01b4c471
                                        0x01b4c476
                                        0x01b4c476
                                        0x01b4c47c
                                        0x01b4c47e
                                        0x01b4c480
                                        0x01b4c480
                                        0x01b4c483
                                        0x01b4c484
                                        0x01b4c486
                                        0x01b4c488
                                        0x01b4c48f
                                        0x01b4c491
                                        0x01b4c493
                                        0x01b4c493
                                        0x01b4c48f
                                        0x01b4c498
                                        0x01b4c49e
                                        0x01b4c4ad
                                        0x01b4c4ad
                                        0x01b4c4b2
                                        0x01b4c4b4
                                        0x01b4c4cd

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                        • Instruction ID: 689f8a6843a6062ca7072225f91076c1f0b54af4029ad1018184180de9c582e2
                                        • Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                        • Instruction Fuzzy Hash: 9B01D272140506BFE725AFA9CE80E63FB7DFF64794F008529F20442560CB21ACA0DAA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B84015 Relevance: .0, Instructions: 49COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 86%
                                        			E01B84015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E01AD2280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E01AD2280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x1ba86ac);
					E01ABF900(0x1ba86d4, _t28);
					E01ACFFB0(0x1ba86ac, _t28, 0x1ba86ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E01ACFFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}







                                        0x01b8401a
                                        0x01b8401e
                                        0x01b84023
                                        0x01b84028
                                        0x01b84029
                                        0x01b8402b
                                        0x01b8402f
                                        0x01b84043
                                        0x01b84046
                                        0x01b84051
                                        0x01b84057
                                        0x01b8405f
                                        0x01b84062
                                        0x01b84067
                                        0x01b8406f
                                        0x01b8407c
                                        0x01b8407c
                                        0x01b8408c
                                        0x01b8408c
                                        0x01b84097

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: a75aeeca32b636eebcdf90a5f3019e05222ed11326f2004e20d1497441caad44
                                        • Instruction ID: 66fef544544f5d046d480c9649e8d39034e742509e2758bbd74069ee6a98e24f
                                        • Opcode Fuzzy Hash: a75aeeca32b636eebcdf90a5f3019e05222ed11326f2004e20d1497441caad44
                                        • Instruction Fuzzy Hash: CB018F722019467FD215AB7DCE80E53F7ACFF59A60B000269B50883A11CB34EC11C6E4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B7138A Relevance: .0, Instructions: 48COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 61%
                                        			E01B7138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x1bad360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E01AFFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E01AD7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                        0x01b7138a
                                        0x01b7138a
                                        0x01b71399
                                        0x01b713a3
                                        0x01b713a8
                                        0x01b713aa
                                        0x01b713b5
                                        0x01b713bb
                                        0x01b713c3
                                        0x01b713c6
                                        0x01b713c9
                                        0x01b713d4
                                        0x01b713e6
                                        0x01b713d6
                                        0x01b713df
                                        0x01b713df
                                        0x01b713f1
                                        0x01b713f2
                                        0x01b713f4
                                        0x01b713f9
                                        0x01b7140e

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f1ffea6ed64ede3109a0ca616f937d4b859bff4c03d1bfd7ad16f91359dac480
                                        • Instruction ID: 20108e50c0aa199bb6480ef54b1dfa4c9649e318559f678ec253aa176ed39e1b
                                        • Opcode Fuzzy Hash: f1ffea6ed64ede3109a0ca616f937d4b859bff4c03d1bfd7ad16f91359dac480
                                        • Instruction Fuzzy Hash: 17015271A00219AFDB14EFA9D981FAEBBB8EF44710F40405AF915EB380D7749A15CB94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B714FB Relevance: .0, Instructions: 48COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 61%
                                        			E01B714FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x1bad360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E01AFFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E01AD7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                        0x01b714fb
                                        0x01b714fb
                                        0x01b7150a
                                        0x01b71514
                                        0x01b71519
                                        0x01b7151b
                                        0x01b71526
                                        0x01b7152c
                                        0x01b71534
                                        0x01b71537
                                        0x01b7153a
                                        0x01b71545
                                        0x01b71557
                                        0x01b71547
                                        0x01b71550
                                        0x01b71550
                                        0x01b71562
                                        0x01b71563
                                        0x01b71565
                                        0x01b7156a
                                        0x01b7157f

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 73bd6fc5952e4b8e5a1fbb23d1fb1849b8ca75be612d9e3d576122030cc53174
                                        • Instruction ID: ef4227c44752c6716563d8422af949adf6a15e92804f62dc0452bd3f36280ec0
                                        • Opcode Fuzzy Hash: 73bd6fc5952e4b8e5a1fbb23d1fb1849b8ca75be612d9e3d576122030cc53174
                                        • Instruction Fuzzy Hash: E1019271A00248AFCB14EFA9D941EAEBBB8EF44700F40405AF915EB380D670DA04CB94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB58EC Relevance: .0, Instructions: 47COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 91%
                                        			E01AB58EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x1bad360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x1a95c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E01AB5943() != 0 &&  *0x1ba5320 > 5) {
					E01B37B5E( &_v44, _t27);
					_t22 =  &_v28;
					E01B37B5E( &_v28, _t28);
					_t11 = E01B37B9C(0x1ba5320, 0x1a9bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E01AFB640(_t11, _t17, _v8 ^ _t29, 0x1a9bf15, _t27, _t28);
			}















                                        0x01ab58fb
                                        0x01ab58fe
                                        0x01ab5906
                                        0x01ab590a
                                        0x01ab593c
                                        0x01ab593c
                                        0x01ab590c
                                        0x01ab590c
                                        0x01ab5911
                                        0x00000000
                                        0x01ab5913
                                        0x01ab5913
                                        0x01ab5913
                                        0x01ab5911
                                        0x01ab591d
                                        0x01b11035
                                        0x01b1103c
                                        0x01b1103f
                                        0x01b11056
                                        0x01b11056
                                        0x01ab593b

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 03333b77285174ebd6d2fc337123f90813064e0c3daae57147ab291d0c53c8fc
                                        • Instruction ID: c805352a6fb20292577a2ddbef4348cb859fee0b52cb0b0cce4250acfdb18011
                                        • Opcode Fuzzy Hash: 03333b77285174ebd6d2fc337123f90813064e0c3daae57147ab291d0c53c8fc
                                        • Instruction Fuzzy Hash: F001D471E001499BCB28DB68D8919EE77FCEB85130F8400A9DA05D7244EF30DD018694
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ACB02A Relevance: .0, Instructions: 46COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ACB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E01AD7D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E01B37016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}







                                        0x01acb037
                                        0x01acb039
                                        0x01acb03b
                                        0x01acb040
                                        0x01b1a60e
                                        0x00000000
                                        0x00000000
                                        0x01b1a61d
                                        0x01acb04b
                                        0x01acb04e
                                        0x01b1a627
                                        0x01b1a634
                                        0x00000000
                                        0x00000000
                                        0x01b1a641
                                        0x01b1a653
                                        0x01b1a643
                                        0x01b1a64c
                                        0x01b1a64c
                                        0x01b1a65b
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b1a66c
                                        0x01acb057
                                        0x01acb057
                                        0x01acb057
                                        0x01acb046
                                        0x01acb046
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                        • Instruction ID: a8fbb96fbcce85c27020def748dde2a06f5f1e335ef446ebe4d5f5a21d79848f
                                        • Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                        • Instruction Fuzzy Hash: B50184722019C09FE726C76CC944F667BE8EB85B90F0904E5FA15CB655D739DC40C624
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B81074 Relevance: .0, Instructions: 46COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01B81074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E01B8165E(__ebx, 0x1ba8ae4, (__edx -  *0x1ba8b04 >> 0x14) + (__edx -  *0x1ba8b04 >> 0x14), __edi, __ecx, (__edx -  *0x1ba8b04 >> 0x14) + (__edx -  *0x1ba8b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E01B7AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E01AD7D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E01B6FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}











                                        0x01b81074
                                        0x01b81080
                                        0x01b81082
                                        0x01b8108a
                                        0x01b8108f
                                        0x01b81093
                                        0x01b810ab
                                        0x01b810ab
                                        0x01b810c3
                                        0x01b810cf
                                        0x01b810e1
                                        0x01b810d1
                                        0x01b810da
                                        0x01b810da
                                        0x01b810e9
                                        0x01b810f5
                                        0x01b810f5
                                        0x01b810fe

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: da9d3a7d939050e38601e1c1a64c382f12984b1df8a5487dccc2ac103aebc47f
                                        • Instruction ID: 6c15f4e2ddd0b26fc9f3424ab8951cf2932e5e9a8f3cdeae4e3266ecfe01e5fa
                                        • Opcode Fuzzy Hash: da9d3a7d939050e38601e1c1a64c382f12984b1df8a5487dccc2ac103aebc47f
                                        • Instruction Fuzzy Hash: BD0128726057429FC718EB6CCD40B1A7BE5FB94614F048659F98583690DF34D442CB92
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B6FEC0 Relevance: .0, Instructions: 46COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 59%
                                        			E01B6FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x1bad360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E01AFFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E01AD7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                        0x01b6fec0
                                        0x01b6fec0
                                        0x01b6fecf
                                        0x01b6fed9
                                        0x01b6fede
                                        0x01b6fee0
                                        0x01b6feeb
                                        0x01b6fef3
                                        0x01b6fef6
                                        0x01b6fef9
                                        0x01b6ff04
                                        0x01b6ff16
                                        0x01b6ff06
                                        0x01b6ff0f
                                        0x01b6ff0f
                                        0x01b6ff21
                                        0x01b6ff22
                                        0x01b6ff24
                                        0x01b6ff29
                                        0x01b6ff3e

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 330f73274c89165ea3f26a0a4c65c914fe7486849dffc678f83ef678070d9e03
                                        • Instruction ID: 3b0ae011a6ff3d53cbb099b5be278afa8a8abd53322d84e5b397f15ffa5fd86d
                                        • Opcode Fuzzy Hash: 330f73274c89165ea3f26a0a4c65c914fe7486849dffc678f83ef678070d9e03
                                        • Instruction Fuzzy Hash: F1018871A01209AFDB14EBA9D945FAFB7B8EF55700F40406AFA019B380DA749911C794
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B6FE3F Relevance: .0, Instructions: 46COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 59%
                                        			E01B6FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x1bad360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E01AFFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E01AD7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                        0x01b6fe3f
                                        0x01b6fe3f
                                        0x01b6fe4e
                                        0x01b6fe58
                                        0x01b6fe5d
                                        0x01b6fe5f
                                        0x01b6fe6a
                                        0x01b6fe72
                                        0x01b6fe75
                                        0x01b6fe78
                                        0x01b6fe83
                                        0x01b6fe95
                                        0x01b6fe85
                                        0x01b6fe8e
                                        0x01b6fe8e
                                        0x01b6fea0
                                        0x01b6fea1
                                        0x01b6fea3
                                        0x01b6fea8
                                        0x01b6febd

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: e76e8760f4e5f82a705d7da2c1b0137854c6d05f8e8fb1ce52d149df80e24755
                                        • Instruction ID: fa24f756804a6330d620af3c168634b585abc380601c16aa7dc9c8e45e4a4520
                                        • Opcode Fuzzy Hash: e76e8760f4e5f82a705d7da2c1b0137854c6d05f8e8fb1ce52d149df80e24755
                                        • Instruction Fuzzy Hash: C6018871E00209AFDB14EFA9D845FAFBBB8EF54704F00406AFA009B381DA749911C794
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B88A62 Relevance: .0, Instructions: 44COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 54%
                                        			E01B88A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x1bad360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E01AD7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                        0x01b88a62
                                        0x01b88a71
                                        0x01b88a79
                                        0x01b88a82
                                        0x01b88a85
                                        0x01b88a89
                                        0x01b88a8c
                                        0x01b88a8f
                                        0x01b88a92
                                        0x01b88a95
                                        0x01b88a9f
                                        0x01b88ab1
                                        0x01b88aa1
                                        0x01b88aaa
                                        0x01b88aaa
                                        0x01b88abc
                                        0x01b88abd
                                        0x01b88abf
                                        0x01b88ac4
                                        0x01b88ada

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2f4022dcbfb1abe833a2b074bdc51749b49e1c6c4c073f386c2a6af3c03e367c
                                        • Instruction ID: 92ed3a71cd795fcce202e87e4ea260de1311d818bdd5ffd0c26e08b8bbe12112
                                        • Opcode Fuzzy Hash: 2f4022dcbfb1abe833a2b074bdc51749b49e1c6c4c073f386c2a6af3c03e367c
                                        • Instruction Fuzzy Hash: FF012C71A0021DAFCB04EFA9D9419EEBBB8EF58710F50405AFA05E7391E734A901CBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B88ED6 Relevance: .0, Instructions: 44COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 54%
                                        			E01B88ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x1bad360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E01AD7D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}


















                                        0x01b88ed6
                                        0x01b88ee5
                                        0x01b88eed
                                        0x01b88ef0
                                        0x01b88efa
                                        0x01b88f03
                                        0x01b88f0c
                                        0x01b88f15
                                        0x01b88f24
                                        0x01b88f27
                                        0x01b88f31
                                        0x01b88f43
                                        0x01b88f33
                                        0x01b88f3c
                                        0x01b88f3c
                                        0x01b88f4e
                                        0x01b88f4f
                                        0x01b88f51
                                        0x01b88f56
                                        0x01b88f69

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: b6e796695d45263fea4159fc0305e16082bb1345e5543797640c9925245e5836
                                        • Instruction ID: e581571189bf6a1614a6e4015700901bae39ddfc1eb1c77f2b2ed957276ad84c
                                        • Opcode Fuzzy Hash: b6e796695d45263fea4159fc0305e16082bb1345e5543797640c9925245e5836
                                        • Instruction Fuzzy Hash: 54111E70A0020A9FDB04EFA9D541BAEFBF4FF08700F4442AAE519EB781E7349940CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABDB60 Relevance: .0, Instructions: 43COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ABDB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E01ABDB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E01ABE7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L01ABE8B0(__ecx, _t14, 0xfff);
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}







                                        0x01abdb64
                                        0x01abdb66
                                        0x01abdb6b
                                        0x01abdbaa
                                        0x01abdb71
                                        0x01abdb76
                                        0x01abdb7a
                                        0x01abdba3
                                        0x01abdb7c
                                        0x01abdb87
                                        0x01abdb8b
                                        0x01b14fa1
                                        0x01b14fb3
                                        0x01b14fb8
                                        0x01abdb91
                                        0x01abdb96
                                        0x01abdb98
                                        0x01abdb98
                                        0x01abdb8b
                                        0x01abdb7a
                                        0x01abdb9d
                                        0x01abdba2

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                        • Instruction ID: e3d61e75e2a188fe3ccfbcb86c2780e3e0d3a30d0eb723176770d13d53efadc4
                                        • Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                        • Instruction Fuzzy Hash: 01F0FC332019E39BD7326BD989C0FD7BAAD8FD1B64F1A0035F2059B345CE648C0286D4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABB1E1 Relevance: .0, Instructions: 42COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ABB1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E01AD7D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E01AD7D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E01B37016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}






                                        0x01abb1e8
                                        0x01abb1ea
                                        0x01abb1f3
                                        0x01b14a17
                                        0x01abb1f9
                                        0x01abb1f9
                                        0x01abb1f9
                                        0x01abb201
                                        0x01b14a21
                                        0x01b14a2e
                                        0x00000000
                                        0x00000000
                                        0x01b14a3b
                                        0x01b14a4d
                                        0x01b14a3d
                                        0x01b14a46
                                        0x01b14a46
                                        0x01b14a55
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01abb20a
                                        0x01abb20a
                                        0x01abb20a
                                        0x01abb20a

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                        • Instruction ID: 9e15c1171d0924af4db6a6b62973b5e7014aa9b3ae280e9715fe201c5819aa7b
                                        • Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                        • Instruction Fuzzy Hash: CC01F4336106C09BD32A975DC944FA9BB9CEF92754F4E00A1FA148B6B6EB78C800C724
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B4FE87 Relevance: .0, Instructions: 38COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 46%
                                        			E01B4FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x1bad360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E01AD7D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}
















                                        0x01b4fe96
                                        0x01b4fe9e
                                        0x01b4fea1
                                        0x01b4fead
                                        0x01b4feb3
                                        0x01b4feb9
                                        0x01b4fec3
                                        0x01b4fed5
                                        0x01b4fec5
                                        0x01b4fece
                                        0x01b4fece
                                        0x01b4fee0
                                        0x01b4fee1
                                        0x01b4fee3
                                        0x01b4fee8
                                        0x01b4fefb

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: be1151c2221a2c72b05df8ea430454c2ecd915c43f874875d946fefafe1e9248
                                        • Instruction ID: 6709922a326652468f271841d5cfdaf123a13f6e8cc36b1671861b21c2298117
                                        • Opcode Fuzzy Hash: be1151c2221a2c72b05df8ea430454c2ecd915c43f874875d946fefafe1e9248
                                        • Instruction Fuzzy Hash: 24016270A00209EFCB14DFA8D542A6EB7F4EF04704F504199B509DB382D635D901CB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B7131B Relevance: .0, Instructions: 36COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 48%
                                        			E01B7131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x1bad360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E01AD7D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                        0x01b7131b
                                        0x01b7132a
                                        0x01b71330
                                        0x01b71336
                                        0x01b7133e
                                        0x01b71341
                                        0x01b71344
                                        0x01b7134f
                                        0x01b71361
                                        0x01b71351
                                        0x01b7135a
                                        0x01b7135a
                                        0x01b7136c
                                        0x01b7136d
                                        0x01b7136f
                                        0x01b71374
                                        0x01b71387

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 91cae9125f7cc356bc5317c453451ffc45deb6cf611ad3526e38121f9089bb3e
                                        • Instruction ID: bb18b2dc2892e9aca872dd8a46f9f8f535098b27ee51f2b54196549f164af281
                                        • Opcode Fuzzy Hash: 91cae9125f7cc356bc5317c453451ffc45deb6cf611ad3526e38121f9089bb3e
                                        • Instruction Fuzzy Hash: A8013C71A01209AFCB04EFE9D645AAEB7F4FF18700F404099F955EB381E6349A00CB54
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B88F6A Relevance: .0, Instructions: 36COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 48%
                                        			E01B88F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x1bad360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E01AD7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                        0x01b88f6a
                                        0x01b88f79
                                        0x01b88f81
                                        0x01b88f84
                                        0x01b88f8b
                                        0x01b88f91
                                        0x01b88f94
                                        0x01b88f9e
                                        0x01b88fb0
                                        0x01b88fa0
                                        0x01b88fa9
                                        0x01b88fa9
                                        0x01b88fbb
                                        0x01b88fbc
                                        0x01b88fbe
                                        0x01b88fc3
                                        0x01b88fd6

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2f290371ae36e8dcbfe12c1ce1f48977efd73347a7a3e4f8659092e8031a201b
                                        • Instruction ID: 706d5c0f3467a23b960b317dca7e498fe971012e3d83bce14c854642b1785d0d
                                        • Opcode Fuzzy Hash: 2f290371ae36e8dcbfe12c1ce1f48977efd73347a7a3e4f8659092e8031a201b
                                        • Instruction Fuzzy Hash: 1F014F74A0020DAFDB04EFA8D645AAEB7F4EF18700F504499FA05EB390EB34DA00CB94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B71608 Relevance: .0, Instructions: 34COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 46%
                                        			E01B71608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x1bad360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E01AD7D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}














                                        0x01b71608
                                        0x01b71617
                                        0x01b7161d
                                        0x01b71625
                                        0x01b71628
                                        0x01b7162b
                                        0x01b71636
                                        0x01b71648
                                        0x01b71638
                                        0x01b71641
                                        0x01b71641
                                        0x01b71653
                                        0x01b71654
                                        0x01b71656
                                        0x01b7165b
                                        0x01b7166e

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 13775ff995cfb7b20ff35199ae5b40f2137ef8c2d1f08a03a21addca332b787a
                                        • Instruction ID: 3bdcac523153a85df51e32f4bbbc67e27fe8476dc7ce34f9e562f61f693f02c9
                                        • Opcode Fuzzy Hash: 13775ff995cfb7b20ff35199ae5b40f2137ef8c2d1f08a03a21addca332b787a
                                        • Instruction Fuzzy Hash: EEF04F71A00248EFDB14EFE9D545AAEB7F4EF14300F444099BA15EB281E634DA00CB54
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ADC577 Relevance: .0, Instructions: 33COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ADC577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E01ADC5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x1a911cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E01B888F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}









                                        0x01adc577
                                        0x01adc57d
                                        0x01adc581
                                        0x01adc5b5
                                        0x01adc5b9
                                        0x01adc5ce
                                        0x01adc5ce
                                        0x01adc5ca
                                        0x00000000
                                        0x01adc5ca
                                        0x01adc5c4
                                        0x01adc5c8
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01adc5ad
                                        0x00000000
                                        0x01adc5af

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 05091015a3968c9c01dab0b850740017c61a075e01814d9647aa3e0f4757b535
                                        • Instruction ID: 1f48d31b9b67340fb71885b326a58a7c11252f76eadd8a2960defa366324e250
                                        • Opcode Fuzzy Hash: 05091015a3968c9c01dab0b850740017c61a075e01814d9647aa3e0f4757b535
                                        • Instruction Fuzzy Hash: 65F0BEB2995E919FEB36D73CC108B227FE99B15670FD884AFD5178720BC7A4D880C250
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B72073 Relevance: .0, Instructions: 32COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 94%
                                        			E01B72073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E01B6FD22(__ecx);
				_t19 =  *0x1ba849c - _t3; // 0x344defb1
				if(_t19 == 0) {
					__eflags = _t17 -  *0x1ba8748; // 0x0
					if(__eflags <= 0) {
						E01B71C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x1ba8724 & 0x00000004;
							if(( *0x1ba8724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x1ba8724; // 0x0
					return E01B68DF1(__ebx, 0xc0000374, 0x1ba5890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}







                                        0x01b72076
                                        0x01b72078
                                        0x01b7207d
                                        0x01b72083
                                        0x01b720a4
                                        0x01b720aa
                                        0x01b720ac
                                        0x01b720b7
                                        0x01b720ba
                                        0x01b720bc
                                        0x01b720c9
                                        0x01b720c9
                                        0x01b720d0
                                        0x01b720d2
                                        0x00000000
                                        0x01b720d2
                                        0x01b720be
                                        0x01b720c3
                                        0x01b720c5
                                        0x01b720c7
                                        0x00000000
                                        0x00000000
                                        0x01b720c7
                                        0x01b720bc
                                        0x01b720d4
                                        0x01b72085
                                        0x01b72085
                                        0x01b720a3
                                        0x01b720a3

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: e24ba98a6cc0888d418430bc9fd54d542537135474ac16d9cec2a0dd81d15169
                                        • Instruction ID: b1dbb52b55e0fdc554f49ce83132f8154eb500be64a0d77f1985da8970ffe5cd
                                        • Opcode Fuzzy Hash: e24ba98a6cc0888d418430bc9fd54d542537135474ac16d9cec2a0dd81d15169
                                        • Instruction Fuzzy Hash: 30F0553B4291954ADF3F6B3CB0023E13F96E769110F8900CAD8B05B609CB388993DB30
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF927A Relevance: .0, Instructions: 32COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 54%
                                        			E01AF927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E01AFFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E01AF92C6(_t11, _t14);
				}
				return _t11;
			}





                                        0x01af9295
                                        0x01af9299
                                        0x01af929f
                                        0x01af92aa
                                        0x01af92ad
                                        0x01af92ae
                                        0x01af92af
                                        0x01af92b0
                                        0x01af92b4
                                        0x01af92bb
                                        0x01af92bb
                                        0x01af92c5

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                        • Instruction ID: 695367dfd616c3b95b5766028cdef05dbc4fd4f50843f98d6350154b9c060e34
                                        • Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                        • Instruction Fuzzy Hash: 57E0ED32240A016BE721AF8ACC80B0376A9AF92724F00407CBA001E282CAF6D80887A0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B88D34 Relevance: .0, Instructions: 32COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 43%
                                        			E01B88D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x1bad360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E01AD7D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}













                                        0x01b88d34
                                        0x01b88d43
                                        0x01b88d4b
                                        0x01b88d4e
                                        0x01b88d52
                                        0x01b88d5c
                                        0x01b88d6e
                                        0x01b88d5e
                                        0x01b88d67
                                        0x01b88d67
                                        0x01b88d79
                                        0x01b88d7a
                                        0x01b88d7c
                                        0x01b88d81
                                        0x01b88d94

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 526efbcaa60860ae81b84ba6a6fa7c8ad46ad7e3410e733a2ed249da0c0ac9b5
                                        • Instruction ID: 05f75a9b52314970c78132692bd8a360adbf68c6e1c59f5d7141355110cbb51e
                                        • Opcode Fuzzy Hash: 526efbcaa60860ae81b84ba6a6fa7c8ad46ad7e3410e733a2ed249da0c0ac9b5
                                        • Instruction Fuzzy Hash: E7F0B470A046099FDB18FFB8D541B6EB7B4EF14700F508099F905EB280EA34D900CB54
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B88B58 Relevance: .0, Instructions: 31COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 36%
                                        			E01B88B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x1bad360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E01AD7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                        0x01b88b67
                                        0x01b88b6f
                                        0x01b88b72
                                        0x01b88b7d
                                        0x01b88b8f
                                        0x01b88b7f
                                        0x01b88b88
                                        0x01b88b88
                                        0x01b88b9a
                                        0x01b88b9b
                                        0x01b88b9d
                                        0x01b88ba2
                                        0x01b88bb5

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 7e5468b616833e8e41dc8e62e086bc57b8caadf6cb9b9b78b4799a76b8d9539b
                                        • Instruction ID: e110d58c659b572927cf22ff7339387ae926eff041536b9f798ff93c8bd03455
                                        • Opcode Fuzzy Hash: 7e5468b616833e8e41dc8e62e086bc57b8caadf6cb9b9b78b4799a76b8d9539b
                                        • Instruction Fuzzy Hash: CFF05EB0A14259ABDB14EBA8DA06A6EB7B4EF44704F440499BA05DB280EB34D900C794
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B88CD6 Relevance: .0, Instructions: 31COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 36%
                                        			E01B88CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x1bad360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E01AD7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E01AFB640(E01AF9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                        0x01b88ce5
                                        0x01b88ced
                                        0x01b88cf0
                                        0x01b88cfb
                                        0x01b88d0d
                                        0x01b88cfd
                                        0x01b88d06
                                        0x01b88d06
                                        0x01b88d18
                                        0x01b88d19
                                        0x01b88d1b
                                        0x01b88d20
                                        0x01b88d33

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f0190bae6a268ed56561c85b4df31a7f87f54a549072b8a036e7296220183837
                                        • Instruction ID: 351ed269bcd4beabe802832a94e126b2c00204adc3cd9229875e19a466c62428
                                        • Opcode Fuzzy Hash: f0190bae6a268ed56561c85b4df31a7f87f54a549072b8a036e7296220183837
                                        • Instruction Fuzzy Hash: 94F08270A04609ABDB04EFE9D946EAEB7B4EF19604F50019DF916EB281EA34D904CB54
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AD746D Relevance: .0, Instructions: 31COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 88%
                                        			E01AD746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E01ACEB70(__ecx, 0x1ba79a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E01AF95D0();
							L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}









                                        0x01ad746d
                                        0x01ad746d
                                        0x01ad746d
                                        0x01ad7471
                                        0x01ad7488
                                        0x01b1f92d
                                        0x01ad748e
                                        0x01ad7491
                                        0x01ad7495
                                        0x01b1f937
                                        0x01b1f93a
                                        0x01b1f94e
                                        0x01b1f953
                                        0x01b1f956
                                        0x01b1f956
                                        0x01ad7495
                                        0x00000000
                                        0x01ad7488
                                        0x01ad7473
                                        0x01ad7478
                                        0x01ad747d
                                        0x01ad7481
                                        0x00000000
                                        0x01ad7481
                                        0x01ad747d
                                        0x01ad747a
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 04fd049976f6127d8eecd5f20356865f2f079f7d8b5ae2171511ae704816af12
                                        • Instruction ID: b9b4cb55f584b2bd3fac0bfc10eada48d404f90486530ecb57f3fb0fbdf03f33
                                        • Opcode Fuzzy Hash: 04fd049976f6127d8eecd5f20356865f2f079f7d8b5ae2171511ae704816af12
                                        • Instruction Fuzzy Hash: 41F02470504945AACF0B97FCC540B79BF71AF00258F580259E453AB062E724C800C7C5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AB4F2E Relevance: .0, Instructions: 31COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AB4F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E01B888F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E01ADC5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x1a91030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}









                                        0x01ab4f2e
                                        0x01ab4f34
                                        0x01ab4f38
                                        0x01b10b85
                                        0x01b10b85
                                        0x01b10b89
                                        0x01b10b9a
                                        0x01b10b9a
                                        0x01b10b9f
                                        0x00000000
                                        0x01b10b9f
                                        0x01b10b94
                                        0x01b10b98
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01b10b98
                                        0x01ab4f3e
                                        0x01ab4f48
                                        0x00000000
                                        0x01ab4f6e
                                        0x00000000
                                        0x01ab4f70

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 74a36903144c9a4f1586d50b22c31e88c28e608b047357f3105c54c7a4b19d9e
                                        • Instruction ID: 215ac3dcafacd50bff85c65b4a342b33c20928d9f91cc2d0e0a029edf9d7a3b0
                                        • Opcode Fuzzy Hash: 74a36903144c9a4f1586d50b22c31e88c28e608b047357f3105c54c7a4b19d9e
                                        • Instruction Fuzzy Hash: 0CF0B4715256858FD765EB2CC144B2377D4FB08A74F9644A5E406C751EC724D8C0C640
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEA44B Relevance: .0, Instructions: 29COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AEA44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x1ba7b9c; // 0x0
				_t15 = __ecx;
				_t16 = L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E01AFFA60(_t17, 0, _t15 << 2);
				return _t17;
			}







                                        0x01aea44b
                                        0x01aea453
                                        0x01aea472
                                        0x01aea476
                                        0x00000000
                                        0x01aea493
                                        0x01aea47a
                                        0x01aea47f
                                        0x01aea486
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 61b2c6e1a2d8fd3154beb8edeca8f3d937f7f314b11878e91f78657af71c011a
                                        • Instruction ID: fee0cc9e753b27f1fd73d61f89ddc416a7bf3aa73a03584fdd9e99df09529faf
                                        • Opcode Fuzzy Hash: 61b2c6e1a2d8fd3154beb8edeca8f3d937f7f314b11878e91f78657af71c011a
                                        • Instruction Fuzzy Hash: 5CE09273A01422ABD2225B58AC00F66B3ADEBE4651F0A8039F605C7214DA28DD11C7E0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABF358 Relevance: .0, Instructions: 28COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 79%
                                        			E01ABF358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E01AEF3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L01AD4620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}






                                        0x01abf35d
                                        0x01abf361
                                        0x01abf367
                                        0x01abf372
                                        0x01abf38c
                                        0x01abf38c
                                        0x01abf394

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                        • Instruction ID: 2e0b98874247015396d8f39483f80fce8e8d0f83f16fb257623c68ac62883679
                                        • Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                        • Instruction Fuzzy Hash: 36E0DF32A42118FFDB21AAD99E05FAABFACEB58A60F040195FA08D7150D5719E00C3D0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ACFF60 Relevance: .0, Instructions: 22COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ACFF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x1a911a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E01B888F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E01AD0050(_t14);
				}
			}










                                        0x01acff66
                                        0x01acff6b
                                        0x00000000
                                        0x01acff8f
                                        0x00000000
                                        0x01acff8f

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 89da45357c488118c716b5a548e9b8a80804d0dc787d2ae4bad5fb62422c59cc
                                        • Instruction ID: e5d9881e04efc48fff67291e1d640683d1dadd9f4d30ff78d669843f80a4f852
                                        • Opcode Fuzzy Hash: 89da45357c488118c716b5a548e9b8a80804d0dc787d2ae4bad5fb62422c59cc
                                        • Instruction Fuzzy Hash: 2AE0DFB0205206AFDB3ADB59D140F293BAADB52E31F19805DE00A4B102C621DA80C2CA
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B441E8 Relevance: .0, Instructions: 21COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 82%
                                        			E01B441E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x1b908f0);
				_t5 = E01B0D08C(__ebx, __edi, __esi);
				if( *0x1ba87ec == 0) {
					E01ACEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x1ba87ec == 0) {
						 *0x1ba87f0 = 0x1ba87ec;
						 *0x1ba87ec = 0x1ba87ec;
						 *0x1ba87e8 = 0x1ba87e4;
						 *0x1ba87e4 = 0x1ba87e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L01B44248();
				}
				return E01B0D0D1(_t5);
			}





                                        0x01b441e8
                                        0x01b441ea
                                        0x01b441ef
                                        0x01b441fb
                                        0x01b44206
                                        0x01b4420b
                                        0x01b44216
                                        0x01b4421d
                                        0x01b44222
                                        0x01b4422c
                                        0x01b44231
                                        0x01b44231
                                        0x01b44236
                                        0x01b4423d
                                        0x01b4423d
                                        0x01b44247

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 656dd69561a24cd9ccb9c0641968726f279504af1cbbe9db06b23071bccdc627
                                        • Instruction ID: 812c747c616019d3b63060f1dd0f892c34865f30714644182824b37427431b67
                                        • Opcode Fuzzy Hash: 656dd69561a24cd9ccb9c0641968726f279504af1cbbe9db06b23071bccdc627
                                        • Instruction Fuzzy Hash: 7EF06579920701DFCFB9EFA9D5027183EB4F758322F9081AAD10487AC8D73449A5DF02
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B6D380 Relevance: .0, Instructions: 21COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01B6D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L01ABE8B0(__ecx, _a4, 0xfff);
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}




                                        0x01b6d38a
                                        0x01b6d39b
                                        0x01b6d3b1
                                        0x00000000
                                        0x01b6d3b6
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                        • Instruction ID: c60c38db8d573895e280810a0925053a053c521e17e4b9af13905f74fd87b651
                                        • Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                        • Instruction Fuzzy Hash: ABE0C231380645BBDB265E84CD40FA9BB1ADB607A0F104031FE495A691C6769C91DAC4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AEA185 Relevance: .0, Instructions: 20COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AEA185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x1ba67e4 >= 0xa) {
					if(_t5 < 0x1ba6800 || _t5 >= 0x1ba6900) {
						return L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E01AD0010(0x1ba67e0, _t5);
				}
			}





                                        0x01aea190
                                        0x01aea1a6
                                        0x01aea1c2
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x01aea192
                                        0x01aea192
                                        0x01aea19f
                                        0x01aea19f

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: ec5bebd8c21beaf5fb148e80a7e490c9b902549f5ead55e299a2a8d8e6e87535
                                        • Instruction ID: a8c73c9fb40583ce64cb8ed4282dc00cac1a0afe491d40b833c0d40ecd5245a7
                                        • Opcode Fuzzy Hash: ec5bebd8c21beaf5fb148e80a7e490c9b902549f5ead55e299a2a8d8e6e87535
                                        • Instruction Fuzzy Hash: 3FD02EE31341006AC62D2301CE18B253B92F784760FBE888DF2074B9A0EB70C8D0820A
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE16E0 Relevance: .0, Instructions: 17COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AE16E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E01AE1710(0x1ba67e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L01AD4620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}





                                        0x01ae16e8
                                        0x01ae16ef
                                        0x01ae16f3
                                        0x01ae16fe
                                        0x00000000
                                        0x01ae1700
                                        0x01ae170d
                                        0x01ae170d
                                        0x01ae16f2
                                        0x01ae16f2
                                        0x01ae16f2
                                        0x01ae16f2

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f19e215bfc3fb8e5078b01d64e4c8fe9d001245a8e694a5395a8fc9bc398c99a
                                        • Instruction ID: 0c41d15d2b9338e6711c944c6e036a18adfc85d3bae9a157527f54efa79f5f12
                                        • Opcode Fuzzy Hash: f19e215bfc3fb8e5078b01d64e4c8fe9d001245a8e694a5395a8fc9bc398c99a
                                        • Instruction Fuzzy Hash: DDD0A77124010192EA2D5F149948B143691EB94B81F38045CF207498D0DFB0CC92E888
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B353CA Relevance: .0, Instructions: 16COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01B353CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E01ACEB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}








                                        0x01b353ca
                                        0x01b353ce
                                        0x01b353d9
                                        0x01b353de
                                        0x01b353e1
                                        0x01b353e1
                                        0x01b353e6
                                        0x01b353f3
                                        0x00000000
                                        0x01b353f8
                                        0x01b353fb

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                        • Instruction ID: f76bf6f441ee63e566dd44c2a92fa05cdbcb21aaa4f8ececf2d920a9571a537e
                                        • Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                        • Instruction Fuzzy Hash: DFE08C32A006809BCF26DB8CCA90F5EBBF5FB84B00F150448A0095B620C734AC00CB00
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ACAAB0 Relevance: .0, Instructions: 12COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ACAAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}




                                        0x01acaab6
                                        0x01acaabb
                                        0x01b1a442
                                        0x00000000
                                        0x01b1a448
                                        0x01b1a454
                                        0x01b1a454
                                        0x01acaac1
                                        0x01acaac1
                                        0x01acaac6
                                        0x01acaac6

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                        • Instruction ID: 7061104bedf9eb9b37cca5bc2a0683c7b07267d8d984606f6be499dba534f853
                                        • Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                        • Instruction Fuzzy Hash: 3CD0E935352990CFD71BDB1DC554B1577A4FB44B44FC504D4E541CB766E72DE944CA00
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE35A1 Relevance: .0, Instructions: 12COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AE35A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E01ACEB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}






                                        0x01ae35a1
                                        0x01ae35a1
                                        0x01ae35a5
                                        0x01ae35ab
                                        0x01ae35ab
                                        0x01ae35b5
                                        0x00000000
                                        0x01ae35c1
                                        0x01ae35b7

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                        • Instruction ID: 437cca41f7c662537d0867eb5f7f385fcc3c6f88c0ad5931d05a828d901e9658
                                        • Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                        • Instruction Fuzzy Hash: 75D0C931551185DEEF52AB74C21C7787BF2BF00718F582069D54607A52C33A4A5AD621
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABDB40 Relevance: .0, Instructions: 11COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ABDB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L01AD4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}





                                        0x01abdb4d
                                        0x01abdb54
                                        0x01abdb5f
                                        0x01abdb56
                                        0x01abdb56
                                        0x01abdb5c
                                        0x01abdb5c

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                        • Instruction ID: 70dd625bfa75cbaf24780158ce4293e1db77cbaa928602740ec2bccb05917498
                                        • Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                        • Instruction Fuzzy Hash: 47C08C30280A41AAEB221F20CE41B407AA4BB10B09F4404A06302DA4F0DB78D801E600
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B3A537 Relevance: .0, Instructions: 11COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01B3A537(intOrPtr _a4, intOrPtr _a8) {

				return L01AD8E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}



                                        0x01b3a553

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                        • Instruction ID: ee2c133152ad5e1d67bfad76769d46c90b2c44e7d9dfbb94da32c9f4c4b33532
                                        • Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                        • Instruction Fuzzy Hash: 1DC08C33080648BBCB126F81CD00F067F2AFBA4B60F008010FA080B570CA3AE970EB84
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AD3A1C Relevance: .0, Instructions: 10COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AD3A1C(intOrPtr _a4) {
				void* _t5;

				return L01AD4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}




                                        0x01ad3a35

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                        • Instruction ID: b04486499b99ed8dba5a5c1d3d71e36560e326d79a88da573375bd0a89a6becd
                                        • Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                        • Instruction Fuzzy Hash: 91C04C32180648BBC7126E45DD41F15BB69E7A4B60F154021B6050A9618576ED61D598
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01ABAD30 Relevance: .0, Instructions: 10COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01ABAD30(intOrPtr _a4) {

				return L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}



                                        0x01abad49

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                        • Instruction ID: ba6d660f3f008e899d73e016c96be3d6cccb9993934bae2535316342d56b85cb
                                        • Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                        • Instruction Fuzzy Hash: 22C02B330C0648BBC7126F85CE00F01BF2DE7A0B60F010020F6040B671C932EC60D588
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AC76E2 Relevance: .0, Instructions: 10COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AC76E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L01AD77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}




                                        0x01ac76e4
                                        0x00000000
                                        0x01ac76f8
                                        0x01ac76fd

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                        • Instruction ID: f1b4983fc145460bebf9044fd46bc0e14bc607f6da62c939469cf71ff14b6a4c
                                        • Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                        • Instruction Fuzzy Hash: EBC08C701415805AEB2A578CCE22B203A50AB08B08F88099CAA02094A2C368A802CA08
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE36CC Relevance: .0, Instructions: 10COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AE36CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L01AD4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}



                                        0x01ae36d2
                                        0x01ae36e8
                                        0x01ae36d4
                                        0x01ae36e5
                                        0x01ae36e5

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                        • Instruction ID: 1083ff3dc52baf294ba52eb554930949e7e24eb04c0682477760f28026eb8091
                                        • Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                        • Instruction Fuzzy Hash: 63C02B70150840FBDB151F30CE40F15B294FF00A21F640354B222468F0D5389C00D500
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AD7D50 Relevance: .0, Instructions: 7COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AD7D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}




                                        0x01ad7d56
                                        0x01ad7d5b
                                        0x01ad7d60
                                        0x01ad7d5d
                                        0x01ad7d5d
                                        0x01ad7d5d

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                        • Instruction ID: 4ee91a6400315260bfb4285b353583d34cb62b665cccf0b048af397bcc62d189
                                        • Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                        • Instruction Fuzzy Hash: 4EB092353019408FCE1ADF18C080B1533E4BB45A44B8400D4E401CBA21D229E8008900
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE2ACB Relevance: .0, Instructions: 5COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E01AE2ACB() {
				void* _t5;

				return E01ACEB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}




                                        0x01ae2adc

                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                        • Instruction ID: a23d7a617c74472d2989e778e3927da693397a7e59d281db82ad8a53d5e2bcd6
                                        • Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                        • Instruction Fuzzy Hash: F8B01232D10441CFCF02EF40C710B297731FB00B50F058494900127930C228AC01CB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF99D0 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: aff1c1d00e9b1c286166ce10a414d49dbe8bf85401c517397f033a31850ec20a
                                        • Instruction ID: 783dd38dca199aa16a4155d5243e3947c922bc7c5095bb59e6ae5a63bfaec754
                                        • Opcode Fuzzy Hash: aff1c1d00e9b1c286166ce10a414d49dbe8bf85401c517397f033a31850ec20a
                                        • Instruction Fuzzy Hash: AB9002A221100042D11961D944047060445A7E1241F51C056A215455CCC6A98C716165
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9950 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 56193386d3eb36e50e5cc570f6c60db17a653059debb1f6eb925e36ba1b64f35
                                        • Instruction ID: ab3db53c7529f82f15667ec73eff24d26e4499fa60ff202bfe59d7e302bf65cc
                                        • Opcode Fuzzy Hash: 56193386d3eb36e50e5cc570f6c60db17a653059debb1f6eb925e36ba1b64f35
                                        • Instruction Fuzzy Hash: 419002A220140403D15565D948046070405A7D0342F51C055A206455DECBA98C617175
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF98A0 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 59d6363e789f656737b1ff37287bebc76ae81ce9015f1622f7b7488bd4f212bf
                                        • Instruction ID: 0d8f0035cc70154407351ed7e5eb556a900fa506d1ffba3bad7096839c768456
                                        • Opcode Fuzzy Hash: 59d6363e789f656737b1ff37287bebc76ae81ce9015f1622f7b7488bd4f212bf
                                        • Instruction Fuzzy Hash: 2290026230100402D11761D944146060409E7D1385F91C056E142455DDC7A58963B172
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9820 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 748a165655efed23f98ead39a129933506b0d64ec2bfdc4d8d1b4a03d17e7dcc
                                        • Instruction ID: 7327c9b5ddc8f2e3af675c93e806a995d2134aaff95baa09a1e838339851b1dd
                                        • Opcode Fuzzy Hash: 748a165655efed23f98ead39a129933506b0d64ec2bfdc4d8d1b4a03d17e7dcc
                                        • Instruction Fuzzy Hash: 6290027224100402D15671D944046060409B7D0281F91C056A042455CEC7D58A66BAA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AFB040 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 4edbf719e863e5e5add7cc3b89f758f457a3265e5e52da1c936b77c4a29d876c
                                        • Instruction ID: 51096d6c88aaec405620b6e0f343fa0800e3d66f9bb385418e34159ccdeec5c2
                                        • Opcode Fuzzy Hash: 4edbf719e863e5e5add7cc3b89f758f457a3265e5e52da1c936b77c4a29d876c
                                        • Instruction Fuzzy Hash: 2C9002A2601140434555B1D948044065415B7E1341391C165A0454568CC7E88865A2A5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AFA3B0 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 551d1fc99d11fafb242e1b36f3f420da18b27bb960f68289c436c12c6d137c41
                                        • Instruction ID: 9fa138cb8abdf06e3128745e0d2650d2c9b82c0cb8bd817555a65a214e36f3d4
                                        • Opcode Fuzzy Hash: 551d1fc99d11fafb242e1b36f3f420da18b27bb960f68289c436c12c6d137c41
                                        • Instruction Fuzzy Hash: 5090027220144002D15571D9844460B5405B7E0341F51C455E042555CCC7958866A261
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9B00 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 74363acc25a4281d6904f0f47a930c41539554a4752f7c358528bdfdaeb1bc66
                                        • Instruction ID: aa9398abe3eac231209db5dc485ea9d0d65a5d34a1a160aac53cec86d7a15a45
                                        • Opcode Fuzzy Hash: 74363acc25a4281d6904f0f47a930c41539554a4752f7c358528bdfdaeb1bc66
                                        • Instruction Fuzzy Hash: 0290026224100802D15571D984147070406E7D0641F51C055A002455CDC796897576F1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9A80 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: fc2759deae16c3ca0795b9791f4db966688a04500ad797ef0481a958ac1c83fd
                                        • Instruction ID: 80fd3ea2b546c17c7e2de02c552640945a163681e578b683c67737304648526a
                                        • Opcode Fuzzy Hash: fc2759deae16c3ca0795b9791f4db966688a04500ad797ef0481a958ac1c83fd
                                        • Instruction Fuzzy Hash: 8890026220144442D15562D94804B0F4505A7E1242F91C05DA415655CCCA9588656761
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9A10 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 926b3f22fdd9ffbf03bdca4fa173ee0436a3031c4d5bcd755abe6bbb161e58e6
                                        • Instruction ID: 646336a6ad9de598dc49425f989cd8d503b25c3551287aed4b4a38d7baf2fad9
                                        • Opcode Fuzzy Hash: 926b3f22fdd9ffbf03bdca4fa173ee0436a3031c4d5bcd755abe6bbb161e58e6
                                        • Instruction Fuzzy Hash: 9290027220140402D11561D948087470405A7D0342F51C055A516455DEC7E5C8A17571
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF95F0 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 3f14a56a524da84d796f98fc811a6831853e7a3ee18c1cea75ec5a7725276d65
                                        • Instruction ID: 26b53eafe305a8979b8033753ba7c6324063785d947754012e3c8d528b2a89bd
                                        • Opcode Fuzzy Hash: 3f14a56a524da84d796f98fc811a6831853e7a3ee18c1cea75ec5a7725276d65
                                        • Instruction Fuzzy Hash: 0590027220100802D11961D948046860405A7D0341F51C055A602465DED7E588A17171
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9520 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 73f8fcaa28e39601d4bed2534e3818362681c59acacf4e48bb1e96c6f6e687c9
                                        • Instruction ID: 1ca6f26cd95f3bb626a211c3f2ffe3e1b39de948189a2d364d1dfcfe5a0770f9
                                        • Opcode Fuzzy Hash: 73f8fcaa28e39601d4bed2534e3818362681c59acacf4e48bb1e96c6f6e687c9
                                        • Instruction Fuzzy Hash: FB9002E2201140924515A2D98404B0A4905A7E0241B51C05AE1054568CC6A58861A175
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AFAD30 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 62f4c593fccaeee1190ed0715edc0f13d4a413c6d21118d3f769a91b6926ae3a
                                        • Instruction ID: 096ce1e96664905815f4b309952ceb3cfa2f3ef897b30016d37a6905c25179d5
                                        • Opcode Fuzzy Hash: 62f4c593fccaeee1190ed0715edc0f13d4a413c6d21118d3f769a91b6926ae3a
                                        • Instruction Fuzzy Hash: 0A900272A0500012915571D948146464406B7E0781B55C055A051455CCCAD48A6563E1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9560 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: e565e3fa6592e993768ae7e7192fc178ac7f9edf1cda1d68aee7f9c62f45f749
                                        • Instruction ID: 5972b1a1e861d1149f58dd9132bb6c0a84d4b5bd66904a5eaeae0790b8528d3f
                                        • Opcode Fuzzy Hash: e565e3fa6592e993768ae7e7192fc178ac7f9edf1cda1d68aee7f9c62f45f749
                                        • Instruction Fuzzy Hash: 0590026622100002015AA5D9060450B0845B7D6391391C059F1416598CC7A188756361
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9730 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: ca2dd7157654126b38fcbd75687a91798b09207508c677dbf9afb83003c9f7b6
                                        • Instruction ID: dce384a706d823e338fa5fd1ee53c1e5699bd41ce200435036042d9a5b95c87c
                                        • Opcode Fuzzy Hash: ca2dd7157654126b38fcbd75687a91798b09207508c677dbf9afb83003c9f7b6
                                        • Instruction Fuzzy Hash: 9090026260500402D15571D954187060415A7D0241F51D055A002455CDC7D98A6576E1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AFA710 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5b9c6e5496a11920fcd081cac2e7664b48c3d254b8b1acaa72155f1970398527
                                        • Instruction ID: bacfc6b318c6c6e3561ed2edb16074fc23314d36570c87ef02758e6fd62203af
                                        • Opcode Fuzzy Hash: 5b9c6e5496a11920fcd081cac2e7664b48c3d254b8b1acaa72155f1970398527
                                        • Instruction Fuzzy Hash: 87900272301000529515A6D95804A4A4505A7F0341B51D059A401455CCC6D488716161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9760 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9bc03f8205c7915b6c45d40d0c5928f7929c09c1fb0a3852177d33315019a2ee
                                        • Instruction ID: 54da32db04ad382ec8c877d237ffde21f9a058a23d7903813586965561e77b06
                                        • Opcode Fuzzy Hash: 9bc03f8205c7915b6c45d40d0c5928f7929c09c1fb0a3852177d33315019a2ee
                                        • Instruction Fuzzy Hash: 4790027220100403D11561D955087070405A7D0241F51D455A042455CDD7D688617161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AFA770 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 524b9925b46d03baed4f0b41b4f8422af1b2c308593d6006b0f490c4967a619b
                                        • Instruction ID: 210f92d01d8254389b478c86c73005ef3bf62237307d3661e161ebcbd5d91356
                                        • Opcode Fuzzy Hash: 524b9925b46d03baed4f0b41b4f8422af1b2c308593d6006b0f490c4967a619b
                                        • Instruction Fuzzy Hash: EB90027620504442D51565D95804A870405A7D0345F51D455A042459CDC7D48871B161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9770 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9d7bbb4643844e4e746d07821cff65ef58fb5b16de73eeb9594e6efa84286959
                                        • Instruction ID: 51fb247c8821694d22a0863a33525e01d36dcce2032c2ff9a8c4fb83d93e3c25
                                        • Opcode Fuzzy Hash: 9d7bbb4643844e4e746d07821cff65ef58fb5b16de73eeb9594e6efa84286959
                                        • Instruction Fuzzy Hash: DE90026220504442D11565D95408A060405A7D0245F51D055A106459DDC7B58861B171
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF96D0 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 0c1e1b4b3e9416bc4971ff5378452de4acb604673bad7a336901bd130a4d222d
                                        • Instruction ID: a2b3cbd8fae24a085a03a1b327a77644dba416df322d4f07030db90c7ff0e2bd
                                        • Opcode Fuzzy Hash: 0c1e1b4b3e9416bc4971ff5378452de4acb604673bad7a336901bd130a4d222d
                                        • Instruction Fuzzy Hash: 0090027220100842D11561D94404B460405A7E0341F51C05AA012465CDC795C8617561
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9610 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 566fbf44881ab61548d1211674f0e4419d4bf615c91242eff593d1b0dc7886d5
                                        • Instruction ID: 5604c5a428eac48906e0ab1a2aa5d7c6efffb486611b0ed21d9a38a10a667f5b
                                        • Opcode Fuzzy Hash: 566fbf44881ab61548d1211674f0e4419d4bf615c91242eff593d1b0dc7886d5
                                        • Instruction Fuzzy Hash: 4C90027260500802D16571D944147460405A7D0341F51C055A002465CDC7D58A6576E1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9650 Relevance: .0, Instructions: 4COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: e34fe118a8773155c879762b11b95e9a567db98283780088e080c0fbcd29c9ce
                                        • Instruction ID: a675e3a1e38e8180ba748db24cd8918b896351af0c0990b098caff071d0022f6
                                        • Opcode Fuzzy Hash: e34fe118a8773155c879762b11b95e9a567db98283780088e080c0fbcd29c9ce
                                        • Instruction Fuzzy Hash: 8B90027220504842D15571D94404A460415A7D0345F51C055A006469CDD7A58D65B6A1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AF9670 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                        • Instruction ID: bf9ed48f2c9427003f6fd50c658f98b7465ef5ff9c2d2a4fa6ffa30a2520368e
                                        • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                        • Instruction Fuzzy Hash:
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01AE645B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 26%
                                        			E01AE645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x1bad360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E01AFFA60( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E01AD2280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E01ACFFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x1bab1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E01AFB640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}


































                                        0x01ae645b
                                        0x01ae6463
                                        0x01ae646d
                                        0x01ae6475
                                        0x01ae647a
                                        0x01ae647e
                                        0x01ae6480
                                        0x01ae648c
                                        0x01ae6490
                                        0x01ae6495
                                        0x01ae6498
                                        0x01ae649b
                                        0x01ae649f
                                        0x01ae64a1
                                        0x01b27c07
                                        0x01b27c09
                                        0x01b27c0c
                                        0x00000000
                                        0x01ae64a7
                                        0x01ae64a7
                                        0x01ae64aa
                                        0x01b27bf7
                                        0x01b27c00
                                        0x00000000
                                        0x01b27bf9
                                        0x01b27bf9
                                        0x01b27bf9
                                        0x01ae64b0
                                        0x01ae64b0
                                        0x01ae64b2
                                        0x01ae64b2
                                        0x01ae64b3
                                        0x01ae64ba
                                        0x01ae6553
                                        0x01ae655e
                                        0x01ae6566
                                        0x01ae656c
                                        0x01ae6575
                                        0x01ae657f
                                        0x01ae6585
                                        0x01ae6588
                                        0x01ae6588
                                        0x01ae64c7
                                        0x01ae64cb
                                        0x01ae64ce
                                        0x01ae64d3
                                        0x01ae64da
                                        0x01ae64e5
                                        0x01ae64ed
                                        0x01ae64f1
                                        0x01ae64f5
                                        0x01ae64f6
                                        0x01ae64fa
                                        0x01ae6502
                                        0x01ae6503
                                        0x01ae6504
                                        0x01ae6507
                                        0x01ae651a
                                        0x01ae6524
                                        0x01ae6524
                                        0x01ae6526
                                        0x01ae6526
                                        0x01ae64aa
                                        0x01ae652c
                                        0x01ae652d
                                        0x01ae652e
                                        0x01ae6539

                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: DebugPrintTimes
                                        • String ID: 0$0
                                        • API String ID: 3446177414-203156872
                                        • Opcode ID: 102d8ab968a734e8aab674596cefdfbc62351dd181d159d7896561b175cf5568
                                        • Instruction ID: d57f57031b6fb25b18ee82fb94ba78e24f5f4dfeecbf0a9c38e7e191faa0e73a
                                        • Opcode Fuzzy Hash: 102d8ab968a734e8aab674596cefdfbc62351dd181d159d7896561b175cf5568
                                        • Instruction Fuzzy Hash: 25415BB16047069FD311CF28C544A5ABBE5FB99714F04496EF58CDB301D731EA09CB96
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 01B4FDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 53%
                                        			E01B4FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E01AFCE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E01B45720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E01B45720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}










                                        0x01b4fdda
                                        0x01b4fde2
                                        0x01b4fde5
                                        0x01b4fdec
                                        0x01b4fdfa
                                        0x01b4fdff
                                        0x01b4fe0a
                                        0x01b4fe0f
                                        0x01b4fe17
                                        0x01b4fe1e
                                        0x01b4fe19
                                        0x01b4fe19
                                        0x01b4fe19
                                        0x01b4fe20
                                        0x01b4fe21
                                        0x01b4fe22
                                        0x01b4fe25
                                        0x01b4fe40

                                        APIs
                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01B4FDFA
                                        Strings
                                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 01B4FE2B
                                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 01B4FE01
                                        Memory Dump Source
                                        • Source File: 00000008.00000002.562708462.0000000001A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A90000, based on PE: true
                                        • Associated: 00000008.00000002.566832735.0000000001BAB000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000008.00000002.566860104.0000000001BAF000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_8_2_1a90000_Packing list.jbxd
                                        Similarity
                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                        • API String ID: 885266447-3903918235
                                        • Opcode ID: 292c9ad9c056bdd44c7aca19d5ad9e08d00055b28cfc89ee57f4960b09aa5b09
                                        • Instruction ID: a4e252fd11834c22ebcd1778ffac427d5f02ebc2a8b7db0998b562b54dc3d8ff
                                        • Opcode Fuzzy Hash: 292c9ad9c056bdd44c7aca19d5ad9e08d00055b28cfc89ee57f4960b09aa5b09
                                        • Instruction Fuzzy Hash: 50F0F672240601BFEA341A8ADC02F33BF5AEB44B30F144359F628565D1DB62F83096F1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Execution Graph

                                        Execution Coverage:4.6%
                                        Dynamic/Decrypted Code Coverage:2.1%
                                        Signature Coverage:0%
                                        Total number of Nodes:681
                                        Total number of Limit Nodes:79
                                        execution_graph 32101 32f080d 32104 32ecef0 32101->32104 32105 32ecf16 32104->32105 32112 32d9c80 32105->32112 32107 32ecf22 32108 32ecf46 32107->32108 32120 32d8ca0 32107->32120 32152 32ebac0 32108->32152 32113 32d9c8d 32112->32113 32155 32d9bd0 32112->32155 32115 32d9c94 32113->32115 32167 32d9b70 32113->32167 32115->32107 32121 32d8cc7 32120->32121 32586 32db100 32121->32586 32123 32d8cd9 32590 32dae50 32123->32590 32125 32d8cf6 32133 32d8cfd 32125->32133 32635 32dad80 LdrLoadDll 32125->32635 32127 32d8fad 32127->32108 32129 32d8d6c 32129->32127 32130 32ed540 2 API calls 32129->32130 32131 32d8d82 32130->32131 32132 32ed540 2 API calls 32131->32132 32134 32d8d93 32132->32134 32133->32127 32594 32de4f0 32133->32594 32135 32ed540 2 API calls 32134->32135 32136 32d8da4 32135->32136 32606 32dc310 32136->32606 32138 32d8db1 32139 32e6450 9 API calls 32138->32139 32140 32d8dc3 32139->32140 32141 32e6450 9 API calls 32140->32141 32142 32d8dd3 32141->32142 32143 32d8df5 32142->32143 32144 32e6450 9 API calls 32142->32144 32145 32e6450 9 API calls 32143->32145 32151 32d8e38 32143->32151 32146 32d8dee 32144->32146 32148 32d8e0a 32145->32148 32636 32dc460 LdrLoadDll 32146->32636 32148->32151 32637 32dcdc0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 32148->32637 32151->32127 32618 32d8920 32151->32618 32153 32ebadf 32152->32153 32154 32ec3e0 LdrLoadDll 32152->32154 32154->32153 32186 32e9fa0 32155->32186 32159 32d9bf6 32159->32113 32160 32d9bec 32160->32159 32193 32ec790 32160->32193 32162 32d9c33 32162->32159 32204 32d9a10 32162->32204 32164 32d9c53 32210 32d9480 LdrLoadDll 32164->32210 32166 32d9c65 32166->32113 32560 32eca80 32167->32560 32170 32eca80 LdrLoadDll 32171 32d9b9b 32170->32171 32172 32eca80 LdrLoadDll 32171->32172 32173 32d9bb1 32172->32173 32174 32de2b0 32173->32174 32175 32de2c9 32174->32175 32568 32daf80 32175->32568 32177 32de2dc 32572 32eb5f0 32177->32572 32180 32d9ca5 32180->32107 32182 32de302 32183 32de32d 32182->32183 32578 32eb670 32182->32578 32185 32eb8a0 2 API calls 32183->32185 32185->32180 32187 32e9faf 32186->32187 32211 32e6860 32187->32211 32189 32d9be3 32190 32e9e50 32189->32190 32191 32e9e65 32190->32191 32217 32eba10 LdrLoadDll 32190->32217 32191->32160 32194 32ec7a9 32193->32194 32218 32e6450 32194->32218 32196 32ec7c1 32197 32ec7ca 32196->32197 32257 32ec5d0 32196->32257 32197->32162 32199 32ec7de 32199->32197 32274 32eb310 32199->32274 32207 32d9a2a 32204->32207 32538 32d7290 32204->32538 32206 32d9a31 32206->32164 32207->32206 32551 32d7550 32207->32551 32210->32166 32212 32e686e 32211->32212 32214 32e687a 32211->32214 32212->32214 32216 32e6ce0 LdrLoadDll 32212->32216 32214->32189 32215 32e69cc 32215->32189 32216->32215 32217->32191 32219 32e6793 32218->32219 32229 32e6464 32218->32229 32219->32196 32222 32e6582 32222->32196 32223 32e6578 32285 32eb870 32223->32285 32224 32e6595 32288 32eb770 32224->32288 32227 32e65bc 32228 32ed370 2 API calls 32227->32228 32232 32e65c8 32228->32232 32229->32219 32282 32eb060 32229->32282 32230 32e6757 32233 32eb8a0 2 API calls 32230->32233 32231 32e676d 32353 32e6140 LdrLoadDll NtReadFile NtClose 32231->32353 32232->32222 32232->32230 32232->32231 32237 32e6660 32232->32237 32234 32e675e 32233->32234 32234->32196 32236 32e6780 32236->32196 32238 32e66c7 32237->32238 32240 32e666f 32237->32240 32238->32230 32239 32e66da 32238->32239 32346 32eb6f0 32239->32346 32241 32e6688 32240->32241 32242 32e6674 32240->32242 32245 32e668d 32241->32245 32246 32e66a5 32241->32246 32345 32e6000 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 32242->32345 32291 32e60a0 32245->32291 32246->32234 32303 32e5dc0 32246->32303 32249 32e667e 32249->32196 32251 32e673a 32350 32eb8a0 32251->32350 32252 32e669b 32252->32196 32255 32e66bd 32255->32196 32256 32e6746 32256->32196 32259 32ec5eb 32257->32259 32258 32ec5fd 32258->32199 32259->32258 32375 32ed2f0 32259->32375 32261 32ec61d 32378 32e5a10 32261->32378 32263 32ec640 32263->32258 32264 32e5a10 3 API calls 32263->32264 32266 32ec662 32264->32266 32266->32258 32410 32e6da0 32266->32410 32267 32ec6ea 32268 32ec6fa 32267->32268 32505 32ec360 LdrLoadDll 32267->32505 32421 32ec1d0 32268->32421 32271 32ec728 32500 32eb2d0 32271->32500 32273 32ec752 32273->32199 32273->32273 32275 32ec3e0 LdrLoadDll 32274->32275 32276 32eb32c 32275->32276 32531 487967a 32276->32531 32277 32eb347 32279 32ed370 32277->32279 32534 32eba80 32279->32534 32281 32ec839 32281->32162 32354 32ec3e0 32282->32354 32284 32e6549 32284->32222 32284->32223 32284->32224 32286 32eb88c NtDeleteFile 32285->32286 32287 32ec3e0 LdrLoadDll 32285->32287 32286->32222 32287->32286 32289 32eb78c NtCreateFile 32288->32289 32290 32ec3e0 LdrLoadDll 32288->32290 32289->32227 32290->32289 32292 32e60bc 32291->32292 32293 32eb6f0 LdrLoadDll 32292->32293 32294 32e60dd 32293->32294 32295 32e60f8 32294->32295 32296 32e60e4 32294->32296 32297 32eb8a0 2 API calls 32295->32297 32298 32eb8a0 2 API calls 32296->32298 32299 32e6101 32297->32299 32300 32e60ed 32298->32300 32358 32ed580 LdrLoadDll RtlAllocateHeap 32299->32358 32300->32252 32302 32e610c 32302->32252 32304 32e5e0b 32303->32304 32306 32e5e3e 32303->32306 32305 32eb6f0 LdrLoadDll 32304->32305 32308 32e5e26 32305->32308 32307 32e5f89 32306->32307 32310 32e5e5a 32306->32310 32309 32eb6f0 LdrLoadDll 32307->32309 32311 32eb8a0 2 API calls 32308->32311 32315 32e5fa4 32309->32315 32312 32eb6f0 LdrLoadDll 32310->32312 32313 32e5e2f 32311->32313 32314 32e5e75 32312->32314 32313->32255 32317 32e5e7c 32314->32317 32318 32e5e91 32314->32318 32371 32eb730 LdrLoadDll 32315->32371 32320 32eb8a0 2 API calls 32317->32320 32321 32e5eac 32318->32321 32322 32e5e96 32318->32322 32319 32e5fde 32323 32eb8a0 2 API calls 32319->32323 32324 32e5e85 32320->32324 32330 32e5eb1 32321->32330 32359 32ed540 32321->32359 32325 32eb8a0 2 API calls 32322->32325 32326 32e5fe9 32323->32326 32324->32255 32327 32e5e9f 32325->32327 32326->32255 32327->32255 32339 32e5ec3 32330->32339 32362 32eb820 32330->32362 32331 32e5f17 32332 32e5f2e 32331->32332 32370 32eb6b0 LdrLoadDll 32331->32370 32334 32e5f4a 32332->32334 32335 32e5f35 32332->32335 32336 32eb8a0 2 API calls 32334->32336 32337 32eb8a0 2 API calls 32335->32337 32338 32e5f53 32336->32338 32337->32339 32340 32e5f7f 32338->32340 32365 32ed140 32338->32365 32339->32255 32340->32255 32342 32e5f6a 32343 32ed370 2 API calls 32342->32343 32344 32e5f73 32343->32344 32344->32255 32345->32249 32347 32ec3e0 LdrLoadDll 32346->32347 32348 32e6722 32347->32348 32349 32eb730 LdrLoadDll 32348->32349 32349->32251 32351 32ec3e0 LdrLoadDll 32350->32351 32352 32eb8bc NtClose 32351->32352 32352->32256 32353->32236 32356 32ec3ef 32354->32356 32357 32ec465 32354->32357 32355 32e6860 LdrLoadDll 32355->32357 32356->32355 32356->32357 32357->32284 32358->32302 32372 32eba40 32359->32372 32361 32ed558 32361->32330 32363 32ec3e0 LdrLoadDll 32362->32363 32364 32eb83c NtReadFile 32363->32364 32364->32331 32366 32ed14d 32365->32366 32367 32ed164 32365->32367 32366->32367 32368 32ed540 2 API calls 32366->32368 32367->32342 32369 32ed17b 32368->32369 32369->32342 32370->32332 32371->32319 32373 32ec3e0 LdrLoadDll 32372->32373 32374 32eba5c RtlAllocateHeap 32373->32374 32374->32361 32506 32eb950 32375->32506 32377 32ed31d 32377->32261 32379 32e5a21 32378->32379 32380 32e5a29 32378->32380 32379->32263 32409 32e5cfc 32380->32409 32509 32ee520 32380->32509 32382 32e5a7d 32383 32ee520 2 API calls 32382->32383 32386 32e5a88 32383->32386 32384 32e5ad6 32387 32ee520 2 API calls 32384->32387 32386->32384 32388 32ee650 3 API calls 32386->32388 32523 32ee5c0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 32386->32523 32390 32e5aea 32387->32390 32388->32386 32389 32e5b47 32391 32ee520 2 API calls 32389->32391 32390->32389 32514 32ee650 32390->32514 32392 32e5b5d 32391->32392 32394 32e5b9a 32392->32394 32396 32ee650 3 API calls 32392->32396 32395 32ee520 2 API calls 32394->32395 32397 32e5ba5 32395->32397 32396->32392 32398 32e5bdf 32397->32398 32399 32ee650 3 API calls 32397->32399 32520 32ee580 32398->32520 32399->32397 32402 32ee580 2 API calls 32403 32e5cde 32402->32403 32404 32ee580 2 API calls 32403->32404 32405 32e5ce8 32404->32405 32406 32ee580 2 API calls 32405->32406 32407 32e5cf2 32406->32407 32408 32ee580 2 API calls 32407->32408 32408->32409 32409->32263 32411 32e6db1 32410->32411 32412 32e6450 9 API calls 32411->32412 32417 32e6dc7 32412->32417 32413 32e6dd0 32413->32267 32414 32e6e07 32415 32ed370 2 API calls 32414->32415 32416 32e6e18 32415->32416 32416->32267 32417->32413 32417->32414 32418 32e6e53 32417->32418 32419 32ed370 2 API calls 32418->32419 32420 32e6e58 32419->32420 32420->32267 32422 32ec1e4 32421->32422 32423 32ec060 LdrLoadDll 32421->32423 32524 32ec060 32422->32524 32423->32422 32425 32ec1ed 32426 32ec060 LdrLoadDll 32425->32426 32427 32ec1f6 32426->32427 32428 32ec060 LdrLoadDll 32427->32428 32429 32ec1ff 32428->32429 32430 32ec060 LdrLoadDll 32429->32430 32431 32ec208 32430->32431 32432 32ec060 LdrLoadDll 32431->32432 32433 32ec211 32432->32433 32434 32ec060 LdrLoadDll 32433->32434 32435 32ec21d 32434->32435 32436 32ec060 LdrLoadDll 32435->32436 32437 32ec226 32436->32437 32438 32ec060 LdrLoadDll 32437->32438 32439 32ec22f 32438->32439 32440 32ec060 LdrLoadDll 32439->32440 32441 32ec238 32440->32441 32442 32ec060 LdrLoadDll 32441->32442 32443 32ec241 32442->32443 32444 32ec060 LdrLoadDll 32443->32444 32445 32ec24a 32444->32445 32446 32ec060 LdrLoadDll 32445->32446 32447 32ec256 32446->32447 32448 32ec060 LdrLoadDll 32447->32448 32449 32ec25f 32448->32449 32450 32ec060 LdrLoadDll 32449->32450 32451 32ec268 32450->32451 32452 32ec060 LdrLoadDll 32451->32452 32453 32ec271 32452->32453 32454 32ec060 LdrLoadDll 32453->32454 32455 32ec27a 32454->32455 32456 32ec060 LdrLoadDll 32455->32456 32457 32ec283 32456->32457 32458 32ec060 LdrLoadDll 32457->32458 32459 32ec28f 32458->32459 32460 32ec060 LdrLoadDll 32459->32460 32461 32ec298 32460->32461 32462 32ec060 LdrLoadDll 32461->32462 32463 32ec2a1 32462->32463 32464 32ec060 LdrLoadDll 32463->32464 32465 32ec2aa 32464->32465 32466 32ec060 LdrLoadDll 32465->32466 32467 32ec2b3 32466->32467 32468 32ec060 LdrLoadDll 32467->32468 32469 32ec2bc 32468->32469 32470 32ec060 LdrLoadDll 32469->32470 32471 32ec2c8 32470->32471 32472 32ec060 LdrLoadDll 32471->32472 32473 32ec2d1 32472->32473 32474 32ec060 LdrLoadDll 32473->32474 32475 32ec2da 32474->32475 32476 32ec060 LdrLoadDll 32475->32476 32477 32ec2e3 32476->32477 32478 32ec060 LdrLoadDll 32477->32478 32479 32ec2ec 32478->32479 32480 32ec060 LdrLoadDll 32479->32480 32481 32ec2f5 32480->32481 32482 32ec060 LdrLoadDll 32481->32482 32483 32ec301 32482->32483 32484 32ec060 LdrLoadDll 32483->32484 32485 32ec30a 32484->32485 32486 32ec060 LdrLoadDll 32485->32486 32487 32ec313 32486->32487 32488 32ec060 LdrLoadDll 32487->32488 32489 32ec31c 32488->32489 32490 32ec060 LdrLoadDll 32489->32490 32491 32ec325 32490->32491 32492 32ec060 LdrLoadDll 32491->32492 32493 32ec32e 32492->32493 32494 32ec060 LdrLoadDll 32493->32494 32495 32ec33a 32494->32495 32496 32ec060 LdrLoadDll 32495->32496 32497 32ec343 32496->32497 32498 32ec060 LdrLoadDll 32497->32498 32499 32ec34c 32498->32499 32499->32271 32501 32ec3e0 LdrLoadDll 32500->32501 32502 32eb2ec 32501->32502 32530 4879860 LdrInitializeThunk 32502->32530 32503 32eb303 32503->32273 32505->32268 32507 32ec3e0 LdrLoadDll 32506->32507 32508 32eb96c NtAllocateVirtualMemory 32507->32508 32508->32377 32510 32ee536 32509->32510 32511 32ee530 32509->32511 32512 32ed540 2 API calls 32510->32512 32511->32382 32513 32ee55c 32512->32513 32513->32382 32515 32ee5c0 32514->32515 32516 32ee61d 32515->32516 32517 32ed540 2 API calls 32515->32517 32516->32390 32518 32ee5fa 32517->32518 32519 32ed370 2 API calls 32518->32519 32519->32516 32521 32e5cd4 32520->32521 32522 32ed370 2 API calls 32520->32522 32521->32402 32522->32521 32523->32386 32525 32ec07b 32524->32525 32526 32e6860 LdrLoadDll 32525->32526 32527 32ec09b 32526->32527 32528 32e6860 LdrLoadDll 32527->32528 32529 32ec14f 32527->32529 32528->32529 32529->32425 32530->32503 32532 4879681 32531->32532 32533 487968f LdrInitializeThunk 32531->32533 32532->32277 32533->32277 32535 32eba8f 32534->32535 32536 32ec3e0 LdrLoadDll 32535->32536 32537 32eba9c RtlFreeHeap 32536->32537 32537->32281 32539 32d729b 32538->32539 32540 32d72a0 32538->32540 32539->32207 32541 32ed2f0 2 API calls 32540->32541 32544 32d72c5 32541->32544 32542 32d7328 32542->32207 32543 32eb2d0 2 API calls 32543->32544 32544->32542 32544->32543 32545 32d732e 32544->32545 32549 32ed2f0 2 API calls 32544->32549 32554 32eb9d0 32544->32554 32547 32d7354 32545->32547 32548 32eb9d0 2 API calls 32545->32548 32547->32207 32550 32d7345 32548->32550 32549->32544 32550->32207 32552 32d756e 32551->32552 32553 32eb9d0 2 API calls 32551->32553 32552->32164 32553->32552 32555 32ec3e0 LdrLoadDll 32554->32555 32556 32eb9ec 32555->32556 32559 48796e0 LdrInitializeThunk 32556->32559 32557 32eba03 32557->32544 32559->32557 32561 32ecaa3 32560->32561 32564 32dac30 32561->32564 32565 32dac54 32564->32565 32566 32d9b8a 32565->32566 32567 32dac90 LdrLoadDll 32565->32567 32566->32170 32567->32566 32569 32dafa3 32568->32569 32571 32db020 32569->32571 32584 32eb0a0 LdrLoadDll 32569->32584 32571->32177 32573 32ec3e0 LdrLoadDll 32572->32573 32574 32de2eb 32573->32574 32574->32180 32575 32ebbe0 32574->32575 32576 32ec3e0 LdrLoadDll 32575->32576 32577 32ebbff LookupPrivilegeValueW 32576->32577 32577->32182 32579 32eb676 32578->32579 32580 32ec3e0 LdrLoadDll 32579->32580 32581 32eb68c 32580->32581 32585 4879910 LdrInitializeThunk 32581->32585 32582 32eb6ab 32582->32183 32584->32571 32585->32582 32587 32db127 32586->32587 32588 32daf80 LdrLoadDll 32587->32588 32589 32db156 32588->32589 32589->32123 32591 32dae74 32590->32591 32638 32eb0a0 LdrLoadDll 32591->32638 32593 32daeae 32593->32125 32595 32de51c 32594->32595 32596 32db100 LdrLoadDll 32595->32596 32597 32de52e 32596->32597 32639 32de3c0 32597->32639 32600 32de549 32602 32de554 32600->32602 32604 32eb8a0 2 API calls 32600->32604 32601 32de561 32603 32de572 32601->32603 32605 32eb8a0 2 API calls 32601->32605 32602->32129 32603->32129 32604->32602 32605->32603 32607 32dc326 32606->32607 32608 32dc330 32606->32608 32607->32138 32609 32daf80 LdrLoadDll 32608->32609 32610 32dc3a1 32609->32610 32611 32dae50 LdrLoadDll 32610->32611 32612 32dc3b5 32611->32612 32613 32dc3d8 32612->32613 32614 32daf80 LdrLoadDll 32612->32614 32613->32138 32615 32dc3f4 32614->32615 32616 32e6450 9 API calls 32615->32616 32617 32dc449 32616->32617 32617->32138 32658 32de7b0 32618->32658 32620 32d893a 32631 32d8c91 32620->32631 32663 32e5d50 32620->32663 32622 32d8996 32623 32ee520 2 API calls 32622->32623 32622->32631 32624 32d8b36 32623->32624 32625 32ee650 3 API calls 32624->32625 32627 32d8b4b 32625->32627 32626 32d7290 4 API calls 32633 32d8b9e 32626->32633 32627->32633 32720 32d3660 10 API calls 32627->32720 32631->32127 32633->32626 32633->32631 32634 32d7550 2 API calls 32633->32634 32666 32dc040 32633->32666 32716 32de750 32633->32716 32721 32de1c0 21 API calls 32633->32721 32634->32633 32635->32133 32636->32143 32637->32151 32638->32593 32640 32de3c3 32639->32640 32641 32daf80 LdrLoadDll 32640->32641 32648 32de490 32640->32648 32642 32de3fc 32641->32642 32649 32eb350 32642->32649 32644 32de43e 32652 32eb390 32644->32652 32647 32eb8a0 2 API calls 32647->32648 32648->32600 32648->32601 32650 32eb36c 32649->32650 32651 32ec3e0 LdrLoadDll 32649->32651 32650->32644 32651->32650 32653 32eb3ac 32652->32653 32654 32ec3e0 LdrLoadDll 32652->32654 32657 4879fe0 LdrInitializeThunk 32653->32657 32654->32653 32655 32de484 32655->32647 32657->32655 32659 32de7cf 32658->32659 32660 32e6860 LdrLoadDll 32658->32660 32661 32de7dd 32659->32661 32662 32de7d6 SetErrorMode 32659->32662 32660->32659 32661->32620 32662->32661 32664 32e5d76 32663->32664 32722 32de580 32663->32722 32664->32622 32667 32dc059 32666->32667 32668 32dc05f 32666->32668 32741 32ddee0 32667->32741 32748 32d9770 32668->32748 32671 32dc06c 32672 32dc302 32671->32672 32673 32ee650 3 API calls 32671->32673 32672->32633 32674 32dc088 32673->32674 32675 32dc09c 32674->32675 32676 32de750 2 API calls 32674->32676 32757 32eb120 32675->32757 32676->32675 32679 32dc1d0 32774 32dbfe0 LdrLoadDll LdrInitializeThunk 32679->32774 32680 32eb310 2 API calls 32681 32dc11a 32680->32681 32681->32679 32686 32dc126 32681->32686 32683 32dc1ef 32684 32dc1f7 32683->32684 32775 32dbf50 LdrLoadDll NtClose LdrInitializeThunk 32683->32775 32685 32eb8a0 2 API calls 32684->32685 32688 32dc201 32685->32688 32686->32672 32689 32dc179 32686->32689 32692 32eb420 2 API calls 32686->32692 32688->32633 32691 32eb8a0 2 API calls 32689->32691 32690 32dc219 32690->32684 32693 32dc220 32690->32693 32694 32dc196 32691->32694 32692->32689 32695 32dc238 32693->32695 32776 32dbed0 LdrLoadDll LdrInitializeThunk 32693->32776 32761 32ea6f0 32694->32761 32777 32eb1a0 LdrLoadDll 32695->32777 32699 32dc1ad 32699->32672 32764 32d76f0 32699->32764 32700 32dc24c 32778 32dbd50 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 32700->32778 32703 32dc270 32705 32dc2bd 32703->32705 32779 32eb1d0 LdrLoadDll 32703->32779 32781 32eb230 LdrLoadDll 32705->32781 32708 32dc2cb 32710 32eb8a0 2 API calls 32708->32710 32709 32dc28e 32709->32705 32780 32eb260 LdrLoadDll 32709->32780 32711 32dc2d5 32710->32711 32712 32eb8a0 2 API calls 32711->32712 32714 32dc2df 32712->32714 32714->32672 32715 32d76f0 3 API calls 32714->32715 32715->32672 32717 32de763 32716->32717 32810 32eb2a0 32717->32810 32720->32633 32721->32633 32723 32de59d 32722->32723 32729 32eb3d0 32723->32729 32726 32de5e5 32726->32664 32730 32eb3ec 32729->32730 32731 32ec3e0 LdrLoadDll 32729->32731 32739 48799a0 LdrInitializeThunk 32730->32739 32731->32730 32732 32de5de 32732->32726 32734 32eb420 32732->32734 32735 32ec3e0 LdrLoadDll 32734->32735 32736 32eb43c 32735->32736 32740 4879780 LdrInitializeThunk 32736->32740 32737 32de60e 32737->32664 32739->32732 32740->32737 32782 32dd090 32741->32782 32743 32de002 32744 32ed540 2 API calls 32743->32744 32745 32de011 32744->32745 32745->32668 32747 32ddefe 32747->32743 32795 32ea580 32747->32795 32750 32d978b 32748->32750 32749 32d98ab 32749->32671 32750->32749 32751 32de3c0 3 API calls 32750->32751 32752 32d988c 32751->32752 32753 32d98ba 32752->32753 32754 32d98a1 32752->32754 32756 32eb8a0 2 API calls 32752->32756 32753->32671 32809 32d6300 LdrLoadDll 32754->32809 32756->32754 32758 32eb136 32757->32758 32759 32ec3e0 LdrLoadDll 32758->32759 32760 32dc0f0 32759->32760 32760->32672 32760->32679 32760->32680 32762 32de750 2 API calls 32761->32762 32763 32ea722 32761->32763 32762->32763 32763->32699 32765 32d7708 32764->32765 32766 32dac30 LdrLoadDll 32765->32766 32767 32d7723 32766->32767 32768 32e6860 LdrLoadDll 32767->32768 32769 32d7733 32768->32769 32770 32d773c PostThreadMessageW 32769->32770 32771 32d776d 32769->32771 32770->32771 32772 32d7750 32770->32772 32771->32633 32773 32d775a PostThreadMessageW 32772->32773 32773->32771 32774->32683 32775->32690 32776->32695 32777->32700 32778->32703 32779->32709 32780->32705 32781->32708 32783 32dd0c3 32782->32783 32801 32db240 32783->32801 32785 32dd0d5 32805 32db3b0 32785->32805 32787 32dd0f3 32788 32db3b0 LdrLoadDll 32787->32788 32789 32dd109 32788->32789 32790 32de580 3 API calls 32789->32790 32791 32dd12d 32790->32791 32792 32dd134 32791->32792 32808 32ed580 LdrLoadDll RtlAllocateHeap 32791->32808 32792->32747 32794 32dd144 32794->32747 32796 32ea596 32795->32796 32797 32e6860 LdrLoadDll 32796->32797 32799 32ea59d 32797->32799 32798 32ea5c7 32798->32743 32799->32798 32800 32ea5b4 CreateThread 32799->32800 32800->32743 32802 32db267 32801->32802 32803 32daf80 LdrLoadDll 32802->32803 32804 32db2a3 32803->32804 32804->32785 32806 32daf80 LdrLoadDll 32805->32806 32807 32db3c9 32805->32807 32806->32807 32807->32787 32808->32794 32809->32749 32811 32ec3e0 LdrLoadDll 32810->32811 32812 32eb2bc 32811->32812 32815 4879840 LdrInitializeThunk 32812->32815 32813 32de78e 32813->32633 32815->32813 32817 4879540 LdrInitializeThunk 32820 32e1220 32821 32e12b8 32820->32821 32822 32daf80 LdrLoadDll 32821->32822 32823 32e1356 32822->32823 32824 32daf80 LdrLoadDll 32823->32824 32825 32e1371 32824->32825 32855 32dc840 32825->32855 32828 32e150e 32829 32e151f 32828->32829 32867 32e0350 9 API calls 32828->32867 32833 32e1504 32834 32eb8a0 2 API calls 32833->32834 32834->32828 32835 32e13cc 32836 32eb8a0 2 API calls 32835->32836 32837 32e140f 32836->32837 32864 32ed610 LdrLoadDll 32837->32864 32839 32e1448 32840 32e144f 32839->32840 32841 32dc840 2 API calls 32839->32841 32842 32e1473 32841->32842 32842->32829 32843 32eb530 2 API calls 32842->32843 32844 32e1498 32843->32844 32845 32e149f 32844->32845 32846 32e14eb 32844->32846 32848 32eb8a0 2 API calls 32845->32848 32847 32eb8a0 2 API calls 32846->32847 32849 32e14f5 32847->32849 32850 32e14a9 32848->32850 32865 32e0990 LdrLoadDll 32850->32865 32852 32e14c6 32852->32829 32866 32e0fa0 9 API calls 32852->32866 32854 32e14dc 32856 32dc865 32855->32856 32868 32eb4a0 32856->32868 32859 32eb530 32860 32ec3e0 LdrLoadDll 32859->32860 32861 32eb54c 32860->32861 32874 4879650 LdrInitializeThunk 32861->32874 32862 32e13c1 32862->32833 32862->32835 32864->32839 32865->32852 32866->32854 32867->32829 32869 32ec3e0 LdrLoadDll 32868->32869 32870 32eb4bc 32869->32870 32873 48796d0 LdrInitializeThunk 32870->32873 32871 32dc8d9 32871->32828 32871->32859 32873->32871 32874->32862 32875 32eac40 32876 32ed540 2 API calls 32875->32876 32877 32eac57 32876->32877 32896 32d92c0 32877->32896 32879 32eac72 32880 32eaca7 32879->32880 32881 32eac93 32879->32881 32884 32ed2f0 2 API calls 32880->32884 32882 32ed370 2 API calls 32881->32882 32883 32eac9d 32882->32883 32885 32ead0e 32884->32885 32886 32ed2f0 2 API calls 32885->32886 32887 32ead27 32886->32887 32893 32eaff7 32887->32893 32902 32ed330 LdrLoadDll 32887->32902 32889 32eafdc 32890 32eafe3 32889->32890 32889->32893 32891 32ed370 2 API calls 32890->32891 32892 32eafed 32891->32892 32894 32ed370 2 API calls 32893->32894 32895 32eb04c 32894->32895 32897 32d92e5 32896->32897 32898 32dac30 LdrLoadDll 32897->32898 32899 32d9318 32898->32899 32901 32d933d 32899->32901 32903 32dc780 32899->32903 32901->32879 32902->32889 32904 32dc7ac 32903->32904 32905 32eb5f0 LdrLoadDll 32904->32905 32906 32dc7c5 32905->32906 32907 32dc7cc 32906->32907 32914 32eb630 32906->32914 32907->32901 32911 32dc807 32912 32eb8a0 2 API calls 32911->32912 32913 32dc82a 32912->32913 32913->32901 32915 32ec3e0 LdrLoadDll 32914->32915 32916 32eb64c 32915->32916 32922 4879710 LdrInitializeThunk 32916->32922 32917 32dc7ef 32917->32907 32919 32ebc20 32917->32919 32920 32ec3e0 LdrLoadDll 32919->32920 32921 32ebc3f 32920->32921 32921->32911 32922->32917 32923 32ea440 32924 32ed2f0 2 API calls 32923->32924 32926 32ea47b 32923->32926 32924->32926 32925 32ea576 32926->32925 32927 32dac30 LdrLoadDll 32926->32927 32928 32ea4bb 32927->32928 32929 32e6860 LdrLoadDll 32928->32929 32931 32ea4da 32929->32931 32930 32ea4f0 Sleep 32930->32931 32931->32925 32931->32930 32934 32ea090 LdrLoadDll 32931->32934 32935 32ea290 LdrLoadDll 32931->32935 32934->32931 32935->32931

                                        Executed Functions

                                        Function 032EB76A Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 366 32eb76a-32eb7c1 call 32ec3e0 NtCreateFile
                                        APIs
                                        • NtCreateFile.NTDLL(00000060,00000005,00000000,032E65BC,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,032E65BC,00000000,00000005,00000060,00000000,00000000), ref: 032EB7BD
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateFile
                                        • String ID:
                                        • API String ID: 823142352-0
                                        • Opcode ID: 2ea7e1762526458ab2e0b9c46155db409f5b042dc084c9680e5a41c18e67171e
                                        • Instruction ID: 138447ec0ce416974dc744dcec52201818775a224030e65614e77459ef873f92
                                        • Opcode Fuzzy Hash: 2ea7e1762526458ab2e0b9c46155db409f5b042dc084c9680e5a41c18e67171e
                                        • Instruction Fuzzy Hash: 1601B6B2200208AFCB58CF98DC85EDB37A9AF8C354F118248FA59D7241C630E851CBA4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EB770 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 369 32eb770-32eb786 370 32eb78c-32eb7c1 NtCreateFile 369->370 371 32eb787 call 32ec3e0 369->371 371->370
                                        APIs
                                        • NtCreateFile.NTDLL(00000060,00000005,00000000,032E65BC,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,032E65BC,00000000,00000005,00000060,00000000,00000000), ref: 032EB7BD
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateFile
                                        • String ID:
                                        • API String ID: 823142352-0
                                        • Opcode ID: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
                                        • Instruction ID: 99575f2e3c003edb404c88f7d28e46e8e99340310b2d5b00413ab5125b96a581
                                        • Opcode Fuzzy Hash: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
                                        • Instruction Fuzzy Hash: 68F0BDB2210208AFCB08CF88DC85EEB37ADAF8C754F018208BA0997240C630E851CBA4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EB820 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 389 32eb820-32eb869 call 32ec3e0 NtReadFile
                                        APIs
                                        • NtReadFile.NTDLL(032E6780,E888802B,FFFFFFFF,032E6434,00000206,?,032E6780,00000206,032E6434,FFFFFFFF,E888802B,032E6780,00000206,00000000), ref: 032EB865
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: FileRead
                                        • String ID:
                                        • API String ID: 2738559852-0
                                        • Opcode ID: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
                                        • Instruction ID: a77a8976a2446da5d738608d4c8abe925201ccc79cc36be689512e679dbdb3c5
                                        • Opcode Fuzzy Hash: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
                                        • Instruction Fuzzy Hash: 5FF0AFB6210208AFCB14DF89DC85EEB77ADAF8C754F118248BA1DA7241D630E811CBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EB950 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 392 32eb950-32eb98d call 32ec3e0 NtAllocateVirtualMemory
                                        APIs
                                        • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,032D2D11,00002000,00003000,00000004), ref: 032EB989
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateMemoryVirtual
                                        • String ID:
                                        • API String ID: 2167126740-0
                                        • Opcode ID: ff407167e8468b06ad404ccbb9f5efcd270d3cf321b6c6ce0313f5831c1888d1
                                        • Instruction ID: 927a78f1287c12df57cb98d34b827e5690da2b9a6adf8da827063a56c80a61d2
                                        • Opcode Fuzzy Hash: ff407167e8468b06ad404ccbb9f5efcd270d3cf321b6c6ce0313f5831c1888d1
                                        • Instruction Fuzzy Hash: 2FF015B6210218AFCB18DF89DC81EAB77ADAF88650F018108FE0997241C630F810CBB4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EB89A Relevance: 1.5, APIs: 1, Instructions: 23nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtClose.NTDLL(032E675E,00000206,?,032E675E,00000005,FFFFFFFF), ref: 032EB8C5
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Close
                                        • String ID:
                                        • API String ID: 3535843008-0
                                        • Opcode ID: cdc80ae59924bd67f14d68c29527860faaed2035ea891762b9627abd8517bcfb
                                        • Instruction ID: a8722ffb4387b22615a58d7a0f3591ff64f4e0fcfc1951609f856526622b2e9a
                                        • Opcode Fuzzy Hash: cdc80ae59924bd67f14d68c29527860faaed2035ea891762b9627abd8517bcfb
                                        • Instruction Fuzzy Hash: ADE08C76200220ABD710EFA8DC89EC77B68DF48B60F014551FA1C6B241C631EA00CBE0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EB86A Relevance: 1.5, APIs: 1, Instructions: 22filenativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtDeleteFile.NTDLL(032E6582,00000206,?,032E6582,00000005,00000018,?,?,00000000,00000206,?), ref: 032EB895
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: DeleteFile
                                        • String ID:
                                        • API String ID: 4033686569-0
                                        • Opcode ID: 1586fea9f8375092dba52db37b1aa1bd078adc00538dd41d3c555658562ea756
                                        • Instruction ID: 0b21b20aac998d9dc15b45920d762d44971b722bbabb0ab7f11a90303d94dd4a
                                        • Opcode Fuzzy Hash: 1586fea9f8375092dba52db37b1aa1bd078adc00538dd41d3c555658562ea756
                                        • Instruction Fuzzy Hash: F7E08CB52043546BD721EFA8CC85ED73F58EF4A660F144498FA5D5F282C532E501C7E0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EB870 Relevance: 1.5, APIs: 1, Instructions: 20filenativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtDeleteFile.NTDLL(032E6582,00000206,?,032E6582,00000005,00000018,?,?,00000000,00000206,?), ref: 032EB895
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: DeleteFile
                                        • String ID:
                                        • API String ID: 4033686569-0
                                        • Opcode ID: 126503524c9acbe21b9fd4f7b6543455c439e56fec7c83ecdd5a34c5492c7759
                                        • Instruction ID: 368bf5e732f5b0d194ec40e7068688092fef4ff56916a70144e4f6edf01adabf
                                        • Opcode Fuzzy Hash: 126503524c9acbe21b9fd4f7b6543455c439e56fec7c83ecdd5a34c5492c7759
                                        • Instruction Fuzzy Hash: B8D01776210314ABD710EB98DC89E977BACEF48660F114455BA1D9B241C670FA008BE0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EB8A0 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • NtClose.NTDLL(032E675E,00000206,?,032E675E,00000005,FFFFFFFF), ref: 032EB8C5
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Close
                                        • String ID:
                                        • API String ID: 3535843008-0
                                        • Opcode ID: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
                                        • Instruction ID: 00d3481b643983638138776e2962aa99543c76161347770aaa4ed285c570eec1
                                        • Opcode Fuzzy Hash: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
                                        • Instruction Fuzzy Hash: 9FD01776210314ABD614EBA8DC89E9B7BACDF48660F014155BA1D9B242C670FA008BE0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 048795D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 14aed4b9215355a7803ca447bd82037434418aff754ff9dbf7f9c7cdca074833
                                        • Instruction ID: 668024f7d11613b3258b62406c204fc157050477a39b30566b8ce753b8075fdf
                                        • Opcode Fuzzy Hash: 14aed4b9215355a7803ca447bd82037434418aff754ff9dbf7f9c7cdca074833
                                        • Instruction Fuzzy Hash: BE9002A120200003610571598414A16404B97F0245B51C525E20096A4DC565D8957165
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: cb4aebaffda55ee58cc9ceeebaef4e60856a45cb1414f2d8b58415ff32088ed8
                                        • Instruction ID: 1e7778d6aee0fd99856b89aaafdd433f3b2028ed554fdd43108a44042b2f6ede
                                        • Opcode Fuzzy Hash: cb4aebaffda55ee58cc9ceeebaef4e60856a45cb1414f2d8b58415ff32088ed8
                                        • Instruction Fuzzy Hash: 99900265211000032105B5594704907008797E5395351C525F200A664CD661D8656161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 048796D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: ad9853b180354349ddf43d5593960e1d687169e00f619199a9f93f89bdb103e7
                                        • Instruction ID: fc3df9d2b126234e4e49e552ad14c69942acbfc2bacc105e43b7dfd58e1f0825
                                        • Opcode Fuzzy Hash: ad9853b180354349ddf43d5593960e1d687169e00f619199a9f93f89bdb103e7
                                        • Instruction Fuzzy Hash: 6990027120100842F10071598404F46004697F0345F51C51AE1119768D8655D8557561
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 048796E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: c8c91ced2eefc5501c2df2f569afd723f9b62376c0b137de71c4c0a84b2d016b
                                        • Instruction ID: f763d4764f7d2f015f6e09dd40c792fd3183cddf5c860ae4b97d39252fea99e5
                                        • Opcode Fuzzy Hash: c8c91ced2eefc5501c2df2f569afd723f9b62376c0b137de71c4c0a84b2d016b
                                        • Instruction Fuzzy Hash: 2190027120108802F1107159C404B4A004697E0345F55C915E541976CD86D5D8957161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879650 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: eb00bc5dd60d9fa7f57b428c19cad745bad73cf53156896b2117663c20de142b
                                        • Instruction ID: 35b2ac6996825344f10ccf6661092e1476b178e62bda9d2194e73b6dbdbcc2a2
                                        • Opcode Fuzzy Hash: eb00bc5dd60d9fa7f57b428c19cad745bad73cf53156896b2117663c20de142b
                                        • Instruction Fuzzy Hash: A490027120504842F14071598404E46005697E0349F51C515E10597A8D9665DD59B6A1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: d1cc6dcdf7a2c0b8a6b7793a2d79754006b6be75cb32c6b4a8dbc4113f010198
                                        • Instruction ID: bd32bf7c5e78f7000d4002e7b212815f1e1a19d83f031d9607e13760aae10dbd
                                        • Opcode Fuzzy Hash: d1cc6dcdf7a2c0b8a6b7793a2d79754006b6be75cb32c6b4a8dbc4113f010198
                                        • Instruction Fuzzy Hash: 6090027120100802F18071598404A4A004697E1345F91C519E101A768DCA55DA5D77E1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: f9badab6486bca8a196e1adf1bef7512e9bb1304306781f9bb66c97863c38243
                                        • Instruction ID: ca8134da3c36e5b2ee65513d3f91caaec3e3ab79394ba8f93aee5d2df4d8c145
                                        • Opcode Fuzzy Hash: f9badab6486bca8a196e1adf1bef7512e9bb1304306781f9bb66c97863c38243
                                        • Instruction Fuzzy Hash: 6790026921300002F18071599408A0A004697E1246F91D919E100A66CCC955D86D6361
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: ea4110478ca31278ad61234f6ea9ce8eb0793e06bdfc3cbbb559f4ed6790504d
                                        • Instruction ID: 8420980e46c2ce40a16e0ad9cdeec5dd03ab5655d3e3c176a42cca86cd61477b
                                        • Opcode Fuzzy Hash: ea4110478ca31278ad61234f6ea9ce8eb0793e06bdfc3cbbb559f4ed6790504d
                                        • Instruction Fuzzy Hash: D290027131114402F1107159C404B06004697E1245F51C915E181966CD86D5D8957162
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 11e27f505d7e5591d9b50ebc2c110c6add995975276582c8c45f047ad1c8d0d1
                                        • Instruction ID: ad3c7fbe93b5c3066ae3480b8b097d51de676ff0b5ffc95e327b165f011ebf4f
                                        • Opcode Fuzzy Hash: 11e27f505d7e5591d9b50ebc2c110c6add995975276582c8c45f047ad1c8d0d1
                                        • Instruction Fuzzy Hash: 9990027120100402F10075999408A46004697F0345F51D515E6019669EC6A5D8957171
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 51fcc739614a9ea7e024dea1d921a97205a5f0a5d133e7d0b4868d305eccdc08
                                        • Instruction ID: 1fcc0cc3b1ec398368d27cd00e11ca28d021a1da7ff30fb68629c6ded9f7653d
                                        • Opcode Fuzzy Hash: 51fcc739614a9ea7e024dea1d921a97205a5f0a5d133e7d0b4868d305eccdc08
                                        • Instruction Fuzzy Hash: 59900261242041527545B15984049074047A7F0285791C516E2409A64C8566E85AE661
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 43edc05202c9390f1561539c151816c2c616ab1acb65951e6853ae6bb902fa78
                                        • Instruction ID: 1047f2f8504e5e1dbeca0f3691b82a9f87e65a1c758e149b257664b2c00d3cc9
                                        • Opcode Fuzzy Hash: 43edc05202c9390f1561539c151816c2c616ab1acb65951e6853ae6bb902fa78
                                        • Instruction Fuzzy Hash: 3690027120100413F11171598504B07004A97E0285F91C916E141966CD9696D956B161
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 048799A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: eea4b8b4864ed92174382ae70b5684471e27bb7f7a023817e514829b148d4721
                                        • Instruction ID: c2a98481ffef34cd6ad24a8056f55aa9f8866e559758a876667793e45091ed0f
                                        • Opcode Fuzzy Hash: eea4b8b4864ed92174382ae70b5684471e27bb7f7a023817e514829b148d4721
                                        • Instruction Fuzzy Hash: 1D9002A134100442F10071598414F060046D7F1345F51C519E2059668D8659DC567166
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 4e48cfe0badccc412d0207611d0df27cfe632784cd1c0f2fe0737f8bf1f572dd
                                        • Instruction ID: 7489db12047048ef637df57e0e69442ff4ccda0bfc0e1caaec43c27df30c3919
                                        • Opcode Fuzzy Hash: 4e48cfe0badccc412d0207611d0df27cfe632784cd1c0f2fe0737f8bf1f572dd
                                        • Instruction Fuzzy Hash: D59002B120100402F14071598404B46004697E0345F51C515E6059668E8699DDD976A5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 04879A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 77a56143934389986ecc23d938f6b153cb004f89c3f73c8ebaef1ff4028d2c52
                                        • Instruction ID: c4962646f9e6c547015f28d56cbcc9ef6a4ce08e321a3030af829a8dd20e2b1c
                                        • Opcode Fuzzy Hash: 77a56143934389986ecc23d938f6b153cb004f89c3f73c8ebaef1ff4028d2c52
                                        • Instruction Fuzzy Hash: 5090026121180042F20075698C14F07004697E0347F51C619E1149668CC955D8656561
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EA440 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • Sleep.KERNELBASE(000007D0), ref: 032EA4FB
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Sleep
                                        • String ID: net.dll$wininet.dll
                                        • API String ID: 3472027048-1269752229
                                        • Opcode ID: 81005a8b42f74516fdab03980fb7480c25308471b72c7414637c5cf4a1385309
                                        • Instruction ID: 084d81a05098381bfb2fd4f3790d8c571802e3ab90a441e383d4a93cc51b5079
                                        • Opcode Fuzzy Hash: 81005a8b42f74516fdab03980fb7480c25308471b72c7414637c5cf4a1385309
                                        • Instruction Fuzzy Hash: 3A31B2B5A02700ABC725DFA4C891FD7B7B8BF88700F40411EFA1E9B241D770A585CBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EA434 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80sleepCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • Sleep.KERNELBASE(000007D0), ref: 032EA4FB
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Sleep
                                        • String ID: net.dll$wininet.dll
                                        • API String ID: 3472027048-1269752229
                                        • Opcode ID: d8eb40d448f484c76d2f7daab46d80831db51d6e134f66a1f2e2c3c27a4b4733
                                        • Instruction ID: 098e744afc560cd58db985eeba3cd02097e7c7e14822e7798e61619218f79a91
                                        • Opcode Fuzzy Hash: d8eb40d448f484c76d2f7daab46d80831db51d6e134f66a1f2e2c3c27a4b4733
                                        • Instruction Fuzzy Hash: 6231E1B6A11700ABD724DF64C8D5F9BBBB8EB88300F04815EFA1D5B241D3B0A485CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032D76F0 Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        APIs
                                        • PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 032D774A
                                        • PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 032D776B
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: MessagePostThread
                                        • String ID:
                                        • API String ID: 1836367815-0
                                        • Opcode ID: a059c8f3f9a5b0d059d6fbfe44b0ea9bd008ff1ef4e010066cc8f803c562098a
                                        • Instruction ID: a37a5470a1179c5a936affd4939d2ee6957a3d9de58d422ca81debdd7585ee97
                                        • Opcode Fuzzy Hash: a059c8f3f9a5b0d059d6fbfe44b0ea9bd008ff1ef4e010066cc8f803c562098a
                                        • Instruction Fuzzy Hash: A301A232AA03287BEB21E6949D42FBE776C9B00A50F040518FF04BE1C0E6E8794647F5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032DAC30 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 351 32dac30-32dac4c 352 32dac54-32dac59 351->352 353 32dac4f call 32ee240 351->353 354 32dac5f-32dac6d call 32ee660 352->354 355 32dac5b-32dac5e 352->355 353->352 358 32dac7d-32dac8e call 32ec980 354->358 359 32dac6f-32dac7a call 32ee8e0 354->359 364 32daca7-32dacaa 358->364 365 32dac90-32daca4 LdrLoadDll 358->365 359->358 365->364
                                        APIs
                                        • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 032DACA2
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: Load
                                        • String ID:
                                        • API String ID: 2234796835-0
                                        • Opcode ID: 62c3ffbce92043490c7bede5a65ac648de3f678336ff7b1d74e1096a45fd6b73
                                        • Instruction ID: c97e266cd4d8795fc37d191aa07312093a6fa0dc78f66f82582a53d04a605ca4
                                        • Opcode Fuzzy Hash: 62c3ffbce92043490c7bede5a65ac648de3f678336ff7b1d74e1096a45fd6b73
                                        • Instruction Fuzzy Hash: 840125BAD1020EA7DF10EBE4DC42FDDB3789B44208F044595E9199B141F671E754CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EA57D Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 372 32ea57d-32ea57e 373 32ea596-32ea5a8 call 32e6860 372->373 374 32ea580-32ea595 372->374 377 32ea5aa-32ea5c6 call 32f092f CreateThread 373->377 378 32ea5c7-32ea5cc 373->378 374->373
                                        APIs
                                        • CreateThread.KERNELBASE(00000000,00000000,-00000002,AEB2F114,00000000,00000000,?,?,?,AEB2F114,?), ref: 032EA5BC
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateThread
                                        • String ID:
                                        • API String ID: 2422867632-0
                                        • Opcode ID: 6d0672a84d4d44c23ef894f23ac81207f5a8dbd47f6376b06c44c6c6a69b50ac
                                        • Instruction ID: 782d1b4d32714fa9d623d5507a597255708e043a9d9842a1c21879f98ca6c759
                                        • Opcode Fuzzy Hash: 6d0672a84d4d44c23ef894f23ac81207f5a8dbd47f6376b06c44c6c6a69b50ac
                                        • Instruction Fuzzy Hash: C7F0277669635037E321E1249C03F9BB64C8B81B10F150069F6889F3C2D4D0BA4042E4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EA580 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 381 32ea580-32ea5a8 call 32e6860 385 32ea5aa-32ea5c6 call 32f092f CreateThread 381->385 386 32ea5c7-32ea5cc 381->386
                                        APIs
                                        • CreateThread.KERNELBASE(00000000,00000000,-00000002,AEB2F114,00000000,00000000,?,?,?,AEB2F114,?), ref: 032EA5BC
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: CreateThread
                                        • String ID:
                                        • API String ID: 2422867632-0
                                        • Opcode ID: d118d4a0e3d732ec0e66e6ec54e8f8d24c9a409c239f7e53284d129fc135f0a3
                                        • Instruction ID: 9d1266ee73e9068bc60648d3a56b25ae847c334fbe1a9d96303100ec791ac898
                                        • Opcode Fuzzy Hash: d118d4a0e3d732ec0e66e6ec54e8f8d24c9a409c239f7e53284d129fc135f0a3
                                        • Instruction Fuzzy Hash: DBE06D3379130436E320A1A9AC02FABB39CDB84B21F54002AFA0DEA2C1E591F54102A8
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EBA72 Relevance: 1.5, APIs: 1, Instructions: 26memoryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 395 32eba72-32eba74 396 32eba8f-32eba97 call 32ec3e0 395->396 397 32eba76-32eba8e 395->397 400 32eba9c-32ebab1 RtlFreeHeap 396->400 397->396
                                        APIs
                                        • RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 032EBAAD
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: FreeHeap
                                        • String ID:
                                        • API String ID: 3298025750-0
                                        • Opcode ID: 3345f9df1790888e27736a75bbfe1149ab4c5f03125def5b3615d150306d2349
                                        • Instruction ID: 5dd94b0af15ef40fc6e2b847ca45b29a766e82f592a1f4e21c7342dbc46a5512
                                        • Opcode Fuzzy Hash: 3345f9df1790888e27736a75bbfe1149ab4c5f03125def5b3615d150306d2349
                                        • Instruction Fuzzy Hash: 6DE092B5200214AFCB14DF95DC48EEB3B6CEF89364F058145F9295B241C930E940CBB0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EBBE0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                        Download Yara Rule
                                        APIs
                                        • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,032DE302,032DE302,00000000,00000000,?,?), ref: 032EBC10
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: LookupPrivilegeValue
                                        • String ID:
                                        • API String ID: 3899507212-0
                                        • Opcode ID: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
                                        • Instruction ID: 454315a71b830416498dfdab365d111b92cb1d501da484ca09da83d2d93918c2
                                        • Opcode Fuzzy Hash: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
                                        • Instruction Fuzzy Hash: F7E01AB52003186BD710DF89CC85EE737ADAF88650F118154FA095B241C630E8108AB1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EBA40 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                        Download Yara Rule

                                        Control-flow Graph

                                        • Executed
                                        • Not Executed
                                        control_flow_graph 401 32eba40-32eba71 call 32ec3e0 RtlAllocateHeap
                                        APIs
                                        • RtlAllocateHeap.NTDLL(032E5EE6,?,032E66BD,032E66BD,?,032E5EE6,?,?,?,?,?,00000000,00000005,00000206), ref: 032EBA6D
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: AllocateHeap
                                        • String ID:
                                        • API String ID: 1279760036-0
                                        • Opcode ID: 71d30878ffc0fd6371cee718eb9878eb3463dfa7e001799ef66c66478ee65a27
                                        • Instruction ID: 724b29e097f6fc1149f38fdcb00576da5f989c91cfa43c820f81eb3e923377b3
                                        • Opcode Fuzzy Hash: 71d30878ffc0fd6371cee718eb9878eb3463dfa7e001799ef66c66478ee65a27
                                        • Instruction Fuzzy Hash: 96E012B5200218ABDB18EF99DC85EAB37ACAF88650F018154FA099B241C630F910CAB0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032EBA80 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 032EBAAD
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: FreeHeap
                                        • String ID:
                                        • API String ID: 3298025750-0
                                        • Opcode ID: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
                                        • Instruction ID: a29edc11658318afec8f661201eb7086be2bf69928a87c67f25f6bae99ee3651
                                        • Opcode Fuzzy Hash: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
                                        • Instruction Fuzzy Hash: 96E012B5210218ABDB14EF89DC89EAB37ACAF88750F018154FA099B241CA30E914CAB0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032DE7A7 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                        Download Yara Rule
                                        APIs
                                        • SetErrorMode.KERNELBASE(00008003,?,032D893A,?), ref: 032DE7DB
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ErrorMode
                                        • String ID:
                                        • API String ID: 2340568224-0
                                        • Opcode ID: 67334f595b7b081f99f73be3be8b5ddb3639558aecd58c25c25cc93478a1766f
                                        • Instruction ID: 7d52ee83d069932ff958dc80cdb24bf51bfdc40a9a8f4132fbcf63674980845d
                                        • Opcode Fuzzy Hash: 67334f595b7b081f99f73be3be8b5ddb3639558aecd58c25c25cc93478a1766f
                                        • Instruction Fuzzy Hash: 4FE0C235654304AAF710D7A0CC43F9A36949F54240F0A01A4E909EF6D3D6A0D1414914
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 032DE7B0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                        Download Yara Rule
                                        APIs
                                        • SetErrorMode.KERNELBASE(00008003,?,032D893A,?), ref: 032DE7DB
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682654257.00000000032D0000.00000040.80000000.00040000.00000000.sdmp, Offset: 032D0000, based on PE: false
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_32d0000_raserver.jbxd
                                        Yara matches
                                        Similarity
                                        • API ID: ErrorMode
                                        • String ID:
                                        • API String ID: 2340568224-0
                                        • Opcode ID: f3f26d7c8288b8e0b5f03f8d6a43ee7e1a1d1a6e9deb22a31248c31fbacccb18
                                        • Instruction ID: 4fd863a9335d7c77d6c3823be83aacb86442ccbac6dc7c9fd8a08b638aaae4fe
                                        • Opcode Fuzzy Hash: f3f26d7c8288b8e0b5f03f8d6a43ee7e1a1d1a6e9deb22a31248c31fbacccb18
                                        • Instruction Fuzzy Hash: 79D0A77165030877F610E6E59C47F1A72CC9B48A00F090070FA09EB3C2D960F1404164
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0487967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: InitializeThunk
                                        • String ID:
                                        • API String ID: 2994545307-0
                                        • Opcode ID: 9462a56c5365b1fe7920c3be50954d8371b0dafa9d7a7310454d19cc95ef7f90
                                        • Instruction ID: c3f158cbffe681782324011edb5aa16bb8419f4a5f2411f302db49c9ffd2aa82
                                        • Opcode Fuzzy Hash: 9462a56c5365b1fe7920c3be50954d8371b0dafa9d7a7310454d19cc95ef7f90
                                        • Instruction Fuzzy Hash: 69B02BB18010C0C5F700E7604608F17390077E0300F13C611D2024340A0338D080F1B1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Non-executed Functions

                                        Function 048CFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 53%
                                        			E048CFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0487CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E048C5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E048C5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}










                                        0x048cfdda
                                        0x048cfde2
                                        0x048cfde5
                                        0x048cfdec
                                        0x048cfdfa
                                        0x048cfdff
                                        0x048cfe0a
                                        0x048cfe0f
                                        0x048cfe17
                                        0x048cfe1e
                                        0x048cfe19
                                        0x048cfe19
                                        0x048cfe19
                                        0x048cfe20
                                        0x048cfe21
                                        0x048cfe22
                                        0x048cfe25
                                        0x048cfe40

                                        APIs
                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 048CFDFA
                                        Strings
                                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 048CFE2B
                                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 048CFE01
                                        Memory Dump Source
                                        • Source File: 00000013.00000002.682832403.0000000004810000.00000040.00000800.00020000.00000000.sdmp, Offset: 04810000, based on PE: true
                                        • Associated: 00000013.00000002.684523109.000000000492B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        • Associated: 00000013.00000002.684541829.000000000492F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                        Joe Sandbox IDA Plugin
                                        • Snapshot File: hcaresult_19_2_4810000_raserver.jbxd
                                        Similarity
                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                        • API String ID: 885266447-3903918235
                                        • Opcode ID: 605522a0dd70d6945dde57a4cabd0fde6adfc4129ab3261a67748569c2962b06
                                        • Instruction ID: 6295d618810b006220675eb6e9af9ca639fe96f2a550b802e2b20bd5b90019ed
                                        • Opcode Fuzzy Hash: 605522a0dd70d6945dde57a4cabd0fde6adfc4129ab3261a67748569c2962b06
                                        • Instruction Fuzzy Hash: 67F0FC32640111FFEA201A45DC05F237B5ADB44730F144718F724965D1DAB2F86096F5
                                        Uniqueness

                                        Uniqueness Score: -1.00%