Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Mcafe.exe

Overview

General Information

Sample Name:Mcafe.exe
Analysis ID:877004
MD5:76166c4ad30e3da0060f41fe59e465f1
SHA1:31d887a689a2a6fab9723589bd02d5c15ec09924
SHA256:908d00c0d3a8fe68b7cb0da154143ac81e357b1ca043ff25ac3581d2186defcb

Detection

Score:3
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Tries to load missing DLLs
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Program does not show much activity (idle)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)

Classification

  • System is w10x64
  • Mcafe.exe (PID: 6080 cmdline: C:\Users\user\Desktop\Mcafe.exe MD5: 76166C4AD30E3DA0060F41FE59E465F1)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Mcafe.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_VS2019_nondev_m_r\WindowsPlayer_Master_mono_x64.pdb source: Mcafe.exe
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31349B8 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,0_2_00007FF6C31349B8
Source: C:\Users\user\Desktop\Mcafe.exeSection loaded: unityplayer.dllJump to behavior
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31337380_2_00007FF6C3133738
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31385EC0_2_00007FF6C31385EC
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31349B80_2_00007FF6C31349B8
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C313A6080_2_00007FF6C313A608
Source: Mcafe.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Mcafe.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: classification engineClassification label: clean3.winEXE@1/0@0/0
Source: Mcafe.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: Mcafe.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Mcafe.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Mcafe.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Mcafe.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Mcafe.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Mcafe.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Mcafe.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Mcafe.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_VS2019_nondev_m_r\WindowsPlayer_Master_mono_x64.pdb source: Mcafe.exe
Source: Mcafe.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Mcafe.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Mcafe.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Mcafe.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Mcafe.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: Mcafe.exeStatic PE information: section name: _RDATA
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31349B8 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,0_2_00007FF6C31349B8
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C313444C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6C313444C
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31370F0 GetProcessHeap,0_2_00007FF6C31370F0
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C313444C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6C313444C
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C313ABA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6C313ABA4
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31315EC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6C31315EC
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31317D0 SetUnhandledExceptionFilter,0_2_00007FF6C31317D0
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C313A450 cpuid 0_2_00007FF6C313A450
Source: C:\Users\user\Desktop\Mcafe.exeCode function: 0_2_00007FF6C31314C4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6C31314C4
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation1
DLL Side-Loading
1
DLL Side-Loading
1
DLL Side-Loading
OS Credential Dumping1
System Time Discovery
Remote Services1
Archive Collected Data
Exfiltration Over Other Network Medium1
Encrypted Channel
Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory2
Security Software Discovery
Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
File and Directory Discovery
SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS12
System Information Discovery
Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 877004 Sample: Mcafe.exe Startdate: 28/05/2023 Architecture: WINDOWS Score: 3 4 Mcafe.exe 2->4         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
Mcafe.exe0%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox Version:37.1.0 Beryl
Analysis ID:877004
Start date and time:2023-05-28 11:09:22 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 4m 15s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample file name:Mcafe.exe
Detection:CLEAN
Classification:clean3.winEXE@1/0@0/0
EGA Information:Failed
HDC Information:
  • Successful, ratio: 100% (good quality ratio 88.5%)
  • Quality average: 66.9%
  • Quality standard deviation: 33.5%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 18
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
  • Execution Graph export aborted for target Mcafe.exe, PID 6080 because there are no executed function
  • Not all processes where analyzed, report is missing behavior information
No simulations
No context
No context
No context
No context
No context
No created / dropped files found
File type:PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):2.972849273689623
TrID:
  • Win64 Executable GUI (202006/5) 92.65%
  • Win64 Executable (generic) (12005/4) 5.51%
  • Generic Win/DOS Executable (2004/3) 0.92%
  • DOS Executable Generic (2002/1) 0.92%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:Mcafe.exe
File size:653824
MD5:76166c4ad30e3da0060f41fe59e465f1
SHA1:31d887a689a2a6fab9723589bd02d5c15ec09924
SHA256:908d00c0d3a8fe68b7cb0da154143ac81e357b1ca043ff25ac3581d2186defcb
SHA512:e0ed4e2af54add6d449d9b4ac0ac291ed9195a96d55a44c956fd7d32f7144ef432d9da14a5d6ff00fb3e94e79df8a7278338f3c475936b62a5da3848ab538f47
SSDEEP:3072:FgXpJozm2lkCsuYDbM2ZZQ4MGGfviMQYTQbrEQ:IpC62lkCMcGGHikTk
TLSH:34D4D84DA49010ADE054CA30C4239E6C722EFF617DA4AA1AD86C3F651B721E74BFF536
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.w:cq.icq.icq.i8..hiq.i8..hfq.i8..h.q.i8..haq.ih..hFq.ih..hsq.ih..hkq.i...h`q.icq.i6q.i...haq.i...hbq.i...ibq.i...hbq.iRichcq.
Icon Hash:60714d696171130e
Entrypoint:0x140001260
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x140000000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:0x6045D2FF [Mon Mar 8 07:32:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:0
File Version Major:6
File Version Minor:0
Subsystem Version Major:6
Subsystem Version Minor:0
Import Hash:5f74a5c747508e2822fdb9b687deaf42
Instruction
dec eax
sub esp, 28h
call 00007FA5F89D7E50h
dec eax
add esp, 28h
jmp 00007FA5F89D7A6Fh
int3
int3
dec eax
sub esp, 28h
call 00007FA5F89D83D0h
test eax, eax
je 00007FA5F89D7C13h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FA5F89D7BF7h
dec eax
cmp ecx, eax
je 00007FA5F89D7C06h
xor eax, eax
dec eax
cmpxchg dword ptr [00014780h], ecx
jne 00007FA5F89D7BE0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FA5F89D7BE9h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [0001476Bh]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [0001475Bh], al
call 00007FA5F89D81D7h
call 00007FA5F89D85A2h
test al, al
jne 00007FA5F89D7BF6h
xor al, al
jmp 00007FA5F89D7C06h
call 00007FA5F89DA4F9h
test al, al
jne 00007FA5F89D7BFBh
xor ecx, ecx
call 00007FA5F89D85B2h
jmp 00007FA5F89D7BDCh
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00014720h], 00000000h
mov ebx, ecx
jne 00007FA5F89D7C59h
cmp ecx, 01h
jnbe 00007FA5F89D7C5Ch
call 00007FA5F89D8336h
test eax, eax
je 00007FA5F89D7C1Ah
test ebx, ebx
jne 00007FA5F89D7C16h
dec eax
lea ecx, dword ptr [0001470Ah]
call 00007FA5F89D7C16h
NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x144900x88.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT0x145180x3c.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x190000x8a0d0.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x170000xc48.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0xa40000x634.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x135a00x54.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x136000x130.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0xc0000x220.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000xa1200xa200False0.5997540509259259data6.395766713803173IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0xc0000x8c5e0x8e00False0.420196963028169data4.652196167949441IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x150000x1cd80xc00False0.1220703125data1.6762355778220264IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata0x170000xc480xe00False0.4263392857142857data4.352891457392214IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA0x180000x940x200False0.20703125data1.0851159447005283IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc0x190000x8a0d00x8a200False0.07012690893665158data2.133609499800161IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0xa40000x6340x800False0.46240234375data4.784673546563933IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
NameRVASizeTypeLanguageCountry
RT_ICON0x192b00x42028Device independent bitmap graphic, 256 x 512 x 32, image size 0EnglishUnited States
RT_ICON0x5b2d80x25228Device independent bitmap graphic, 192 x 384 x 32, image size 0EnglishUnited States
RT_ICON0x805000x10828Device independent bitmap graphic, 128 x 256 x 32, image size 0EnglishUnited States
RT_ICON0x90d280x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 0EnglishUnited States
RT_ICON0x9a1d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 0EnglishUnited States
RT_ICON0x9e3f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States
RT_ICON0xa09a00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States
RT_ICON0xa1a480x988Device independent bitmap graphic, 24 x 48 x 32, image size 0EnglishUnited States
RT_ICON0xa23d00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States
RT_GROUP_ICON0xa28380x84dataEnglishUnited States
RT_VERSION0xa2f180x1b4dataEnglishUnited States
RT_MANIFEST0xa28c00x655XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States
DLLImport
UnityPlayer.dllUnityMain
KERNEL32.dllWriteConsoleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, CloseHandle, RtlUnwindEx, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, GetCurrentProcess, ExitProcess, TerminateProcess, GetModuleHandleExW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW
NameOrdinalAddress
AmdPowerXpressRequestHighPerformance10x140015004
NvOptimusEnablement20x140015000
Language of compilation systemCountry where language is spokenMap
EnglishUnited States
No network behavior found

Click to jump to process

Click to jump to process

Target ID:0
Start time:11:10:15
Start date:28/05/2023
Path:C:\Users\user\Desktop\Mcafe.exe
Wow64 process (32bit):false
Commandline:C:\Users\user\Desktop\Mcafe.exe
Imagebase:0x7ff6c3130000
File size:653824 bytes
MD5 hash:76166C4AD30E3DA0060F41FE59E465F1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low

Reset < >
    C-Code - Quality: 83%
    			E00007FF67FF6C31349B8(void* __ecx, long long __rbx, intOrPtr* __rcx, void** __rdx) {
    				void* __rdi;
    				void* __rsi;
    				void* __rbp;
    				void* __r15;
    				signed int _t63;
    				signed int _t73;
    				int _t78;
    				void* _t99;
    				signed long long _t126;
    				signed long long _t127;
    				intOrPtr _t128;
    				signed short* _t129;
    				signed long long _t133;
    				signed long long _t135;
    				signed long long _t145;
    				void* _t150;
    				signed short* _t155;
    				signed short* _t156;
    				signed short* _t157;
    				void* _t170;
    				signed long long _t172;
    				void* _t192;
    				void* _t195;
    				intOrPtr _t197;
    				intOrPtr _t201;
    				void* _t203;
    				void* _t204;
    				void* _t206;
    				signed long long _t207;
    				void* _t209;
    				void* _t224;
    				void* _t233;
    				signed short* _t234;
    				signed long long _t235;
    				union _FINDEX_INFO_LEVELS _t238;
    				intOrPtr* _t242;
    				WCHAR* _t244;
    				signed long long _t249;
    				intOrPtr* _t250;
    
    				 *((long long*)(_t206 + 0x18)) = __rbx;
    				_t204 = _t206 - 0x1c0;
    				_t207 = _t206 - 0x2c0;
    				_t126 =  *0xc3145030; // 0x3d2407701cef
    				_t127 = _t126 ^ _t207;
    				 *(_t204 + 0x1b8) = _t127;
    				 *(_t207 + 0x58) = __rdx;
    				if (__rdx != 0) goto 0xc3134a0d;
    				E00007FF67FF6C31348CC(__rdx, _t127);
    				_t5 = _t192 + 0x16; // 0x16
    				 *_t127 = _t5;
    				E00007FF67FF6C3134660();
    				goto 0xc3134d43;
    				asm("xorps xmm0, xmm0");
    				 *__rdx = _t192;
    				_t128 =  *((intOrPtr*)(__rcx));
    				asm("movdqu [esp+0x30], xmm0");
    				 *(_t207 + 0x40) = _t192;
    				if (_t128 == 0) goto 0xc3134c04;
    				 *(_t204 + 0x1b0) = 0x3f002a;
    				 *((short*)(_t204 + 0x1b4)) = 0;
    				E00007FF67FF6C3136530(_t128, _t204 + 0x1b0);
    				_t234 =  *((intOrPtr*)(__rcx));
    				if (_t128 != 0) goto 0xc3134a90;
    				r8d = 0;
    				_t155 = _t234;
    				_t63 = E00007FF67FF6C3134D84(0x801, _t155, _t204 + 0x1b0,  *((intOrPtr*)(_t207 + 0x38)), _t209, _t207 + 0x30);
    				_t197 =  *((intOrPtr*)(_t207 + 0x38));
    				r15d = _t63;
    				goto 0xc3134bf1;
    				if (_t128 == _t234) goto 0xc3134ab4;
    				_t99 = ( *_t155 & 0x0000ffff) - 0x2f - 0x2d;
    				if (_t99 > 0) goto 0xc3134aab;
    				asm("dec eax");
    				if (_t99 < 0) goto 0xc3134ab4;
    				_t156 = _t155 - 2;
    				if (_t156 != _t234) goto 0xc3134a95;
    				if (( *_t156 & 0x0000ffff) != 0x3a) goto 0xc3134ae0;
    				_t129 =  &(_t234[1]);
    				if (_t156 == _t129) goto 0xc3134ae0;
    				r8d = 0;
    				_t157 = _t234;
    				r15d = E00007FF67FF6C3134D84(0x801, _t157, _t204 + 0x1b0, _t197, _t209, _t207 + 0x30);
    				goto 0xc3134be4;
    				if (0xffffffffffffffd1 - 0x2d > 0) goto 0xc3134af5;
    				asm("dec eax");
    				if (0xffffffffffffffd1 - 0x2d < 0) goto 0xc3134af8;
    				 *((intOrPtr*)(_t207 + 0x28)) = 0;
    				 *(_t207 + 0x20) = _t192;
    				asm("dec ebp");
    				r9d = 0;
    				_t245 = _t244 & (_t157 - _t234 >> 0x00000001) + 0x00000001;
    				 *(_t207 + 0x48) = _t244 & (_t157 - _t234 >> 0x00000001) + 0x00000001;
    				FindFirstFileExW(_t244, _t238, _t233);
    				if (_t129 == 0xffffffff) goto 0xc3134ac6;
    				 *(_t207 + 0x50) = _t197 -  *((intOrPtr*)(_t207 + 0x30)) >> 3;
    				if ( *((short*)(_t204 - 0x74)) != 0x2e) goto 0xc3134b59;
    				if ( *((intOrPtr*)(_t204 - 0x72)) == 0) goto 0xc3134b79;
    				if ( *((short*)(_t204 - 0x72)) != 0x2e) goto 0xc3134b59;
    				if ( *((intOrPtr*)(_t204 - 0x70)) == 0) goto 0xc3134b79;
    				_t73 = E00007FF67FF6C3134D84(_t129, _t204 - 0x74, _t234, _t197 -  *((intOrPtr*)(_t207 + 0x30)) >> 3, _t244 & (_t157 - _t234 >> 0x00000001) + 0x00000001, _t207 + 0x30);
    				r15d = _t73;
    				if (_t73 != 0) goto 0xc3134bdb;
    				if (FindNextFileW(_t224) != 0) goto 0xc3134b3f;
    				if ( *(_t207 + 0x50) !=  *((intOrPtr*)(_t207 + 0x38)) -  *((intOrPtr*)(_t207 + 0x30)) >> 3) goto 0xc3134bb4;
    				FindClose(_t192);
    				goto 0xc3134bf7;
    				r8d = 8;
    				E00007FF67FF6C3137BA0(_t129,  *((intOrPtr*)(_t207 + 0x30)) +  *(_t207 + 0x50) * 8, ( *((intOrPtr*)(_t207 + 0x38)) -  *((intOrPtr*)(_t207 + 0x30)) >> 3) -  *(_t207 + 0x50), _t192,  *((intOrPtr*)(_t207 + 0x38)), _t204, _t245, 0x7ff6c31349a4,  *(_t207 + 0x48));
    				FindClose(_t195);
    				r15d = 0;
    				goto 0xc3134bee;
    				_t78 = FindClose(_t203);
    				_t201 =  *((intOrPtr*)(_t207 + 0x38));
    				_t242 =  *((intOrPtr*)(_t207 + 0x30));
    				if (r15d != 0) goto 0xc3134d05;
    				goto 0xc3134a2b;
    				 *(_t204 + 0x1b0) = _t192;
    				_t133 = _t201 - _t242;
    				_t249 = (_t133 >> 3) + 1;
    				_t170 =  >  ? _t192 : _t133 + 7 >> 3;
    				if (_t170 == 0) goto 0xc3134c62;
    				_t135 = (_t133 | 0xffffffff) + 1;
    				if ( *((intOrPtr*)( *_t242 + _t135 * 2)) != 0) goto 0xc3134c3f;
    				if (_t192 + 1 != _t170) goto 0xc3134c38;
    				 *(_t204 + 0x1b0) = _t192 + 1 + _t135;
    				r8d = 2;
    				E00007FF67FF6C3132D30(_t78, _t249, _t192 + 1 + _t135, _t245);
    				_t145 = _t135;
    				if (_t135 != 0) goto 0xc3134c81;
    				r15d = r15d | 0xffffffff;
    				goto 0xc3134cfe;
    				_t172 = _t135 + _t249 * 8;
    				_t250 = _t242;
    				 *(_t207 + 0x48) = _t172;
    				_t235 = _t172;
    				if (_t242 == _t201) goto 0xc3134cf3;
    				 *(_t207 + 0x50) = _t135 - _t242;
    				if ( *((intOrPtr*)( *_t250 + ((__rcx + 0x00000008 | 0xffffffff) + 1) * 2)) != 0) goto 0xc3134ca4;
    				if (E00007FF67FF6C3134730(_t235 - _t172 >> 1, _t145, _t235,  *(_t204 + 0x1b0) - (_t235 - _t172 >> 1),  *_t250, (__rcx + 0x00000008 | 0xffffffff) + 2) != 0) goto 0xc3134d6d;
    				 *( *(_t207 + 0x50) + _t250) = _t235;
    				if (_t250 + 8 != _t201) goto 0xc3134c9d;
    				r15d = 0;
    				 *( *(_t207 + 0x58)) = _t145;
    				E00007FF67FF6C3134964( *(_t207 + 0x58),  *(_t207 + 0x48));
    				_t150 =  >  ? _t192 : _t201 - _t242 + 7 >> 3;
    				if (_t150 == 0) goto 0xc3134d38;
    				E00007FF67FF6C3134964( *(_t207 + 0x58),  *_t242);
    				if (_t192 + 1 != _t150) goto 0xc3134d22;
    				E00007FF67FF6C3134964( *(_t207 + 0x58), _t242);
    				E00007FF67FF6C313AB80();
    				return r15d;
    			}










































    0x7ff6c31349b8
    0x7ff6c31349c8
    0x7ff6c31349d0
    0x7ff6c31349d7
    0x7ff6c31349de
    0x7ff6c31349e1
    0x7ff6c31349ea
    0x7ff6c31349f5
    0x7ff6c31349f7
    0x7ff6c31349fc
    0x7ff6c31349ff
    0x7ff6c3134a01
    0x7ff6c3134a08
    0x7ff6c3134a0d
    0x7ff6c3134a10
    0x7ff6c3134a13
    0x7ff6c3134a16
    0x7ff6c3134a26
    0x7ff6c3134a2e
    0x7ff6c3134a3b
    0x7ff6c3134a48
    0x7ff6c3134a59
    0x7ff6c3134a5e
    0x7ff6c3134a68
    0x7ff6c3134a6f
    0x7ff6c3134a74
    0x7ff6c3134a77
    0x7ff6c3134a7c
    0x7ff6c3134a81
    0x7ff6c3134a8b
    0x7ff6c3134a93
    0x7ff6c3134a9c
    0x7ff6c3134aa0
    0x7ff6c3134aa5
    0x7ff6c3134aa9
    0x7ff6c3134aab
    0x7ff6c3134ab2
    0x7ff6c3134abb
    0x7ff6c3134abd
    0x7ff6c3134ac4
    0x7ff6c3134acb
    0x7ff6c3134ad0
    0x7ff6c3134ad8
    0x7ff6c3134adb
    0x7ff6c3134ae8
    0x7ff6c3134aed
    0x7ff6c3134af3
    0x7ff6c3134afb
    0x7ff6c3134b0a
    0x7ff6c3134b11
    0x7ff6c3134b14
    0x7ff6c3134b17
    0x7ff6c3134b1f
    0x7ff6c3134b24
    0x7ff6c3134b31
    0x7ff6c3134b3a
    0x7ff6c3134b44
    0x7ff6c3134b4a
    0x7ff6c3134b51
    0x7ff6c3134b57
    0x7ff6c3134b68
    0x7ff6c3134b6d
    0x7ff6c3134b72
    0x7ff6c3134b89
    0x7ff6c3134ba7
    0x7ff6c3134bac
    0x7ff6c3134bb2
    0x7ff6c3134bc2
    0x7ff6c3134bc8
    0x7ff6c3134bd0
    0x7ff6c3134bd6
    0x7ff6c3134bd9
    0x7ff6c3134bde
    0x7ff6c3134be4
    0x7ff6c3134be9
    0x7ff6c3134bf1
    0x7ff6c3134bff
    0x7ff6c3134c07
    0x7ff6c3134c0e
    0x7ff6c3134c21
    0x7ff6c3134c2f
    0x7ff6c3134c36
    0x7ff6c3134c3f
    0x7ff6c3134c47
    0x7ff6c3134c59
    0x7ff6c3134c5b
    0x7ff6c3134c62
    0x7ff6c3134c6e
    0x7ff6c3134c73
    0x7ff6c3134c79
    0x7ff6c3134c7b
    0x7ff6c3134c7f
    0x7ff6c3134c81
    0x7ff6c3134c85
    0x7ff6c3134c88
    0x7ff6c3134c8d
    0x7ff6c3134c93
    0x7ff6c3134c98
    0x7ff6c3134cac
    0x7ff6c3134cd1
    0x7ff6c3134ce1
    0x7ff6c3134cf1
    0x7ff6c3134cf8
    0x7ff6c3134cfb
    0x7ff6c3134d00
    0x7ff6c3134d19
    0x7ff6c3134d20
    0x7ff6c3134d26
    0x7ff6c3134d36
    0x7ff6c3134d3b
    0x7ff6c3134d4d
    0x7ff6c3134d6c

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: _invalid_parameter_noinfo
    • String ID:
    • API String ID: 3215553584-0
    • Opcode ID: b2ef7ca6ea11d22de5dd4a6cd341de201298ac10a29360b5a14040c8f72ad16b
    • Instruction ID: 4fa7f6036f4560a0b4e7f631dba0f2783bc5292f7e3175584973ab4170c6cca4
    • Opcode Fuzzy Hash: b2ef7ca6ea11d22de5dd4a6cd341de201298ac10a29360b5a14040c8f72ad16b
    • Instruction Fuzzy Hash: C1A1D662B1869189EAA0DF27A802ABA73A0FB44FD5F445535DE9EA7F84DF3CD4458300
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 65%
    			E00007FF67FF6C313444C(void* __ecx, intOrPtr __edx, long long __rbx, void* __rdx, long long __rsi, void* __r8) {
    				void* _t36;
    				void* _t37;
    				void* _t38;
    				int _t40;
    				void* _t43;
    				signed long long _t61;
    				long long _t64;
    				_Unknown_base(*)()* _t84;
    				void* _t88;
    				void* _t89;
    				void* _t91;
    				signed long long _t92;
    				struct _EXCEPTION_POINTERS* _t98;
    
    				 *((long long*)(_t91 + 0x10)) = __rbx;
    				 *((long long*)(_t91 + 0x18)) = __rsi;
    				_t89 = _t91 - 0x4f0;
    				_t92 = _t91 - 0x5f0;
    				_t61 =  *0xc3145030; // 0x3d2407701cef
    				 *(_t89 + 0x4e0) = _t61 ^ _t92;
    				if (__ecx == 0xffffffff) goto 0xc313448b;
    				_t37 = E00007FF67FF6C31315E4(_t36);
    				r8d = 0x98;
    				_t38 = E00007FF67FF6C3131DA0(_t37, 0, _t92 + 0x70, __rdx, __r8);
    				r8d = 0x4d0;
    				E00007FF67FF6C3131DA0(_t38, 0, _t89 + 0x10, __rdx, __r8);
    				 *((long long*)(_t92 + 0x48)) = _t92 + 0x70;
    				_t64 = _t89 + 0x10;
    				 *((long long*)(_t92 + 0x50)) = _t64;
    				__imp__RtlCaptureContext();
    				r8d = 0;
    				__imp__RtlLookupFunctionEntry();
    				if (_t64 == 0) goto 0xc313451e;
    				 *(_t92 + 0x38) =  *(_t92 + 0x38) & 0x00000000;
    				 *((long long*)(_t92 + 0x30)) = _t92 + 0x58;
    				 *((long long*)(_t92 + 0x28)) = _t92 + 0x60;
    				 *((long long*)(_t92 + 0x20)) = _t89 + 0x10;
    				__imp__RtlVirtualUnwind();
    				 *((long long*)(_t89 + 0x108)) =  *((intOrPtr*)(_t89 + 0x508));
    				 *((intOrPtr*)(_t92 + 0x70)) = __edx;
    				 *((long long*)(_t89 + 0xa8)) = _t89 + 0x510;
    				 *((long long*)(_t89 - 0x80)) =  *((intOrPtr*)(_t89 + 0x508));
    				 *((intOrPtr*)(_t92 + 0x74)) = r8d;
    				_t40 = IsDebuggerPresent();
    				SetUnhandledExceptionFilter(_t84, _t88);
    				if (UnhandledExceptionFilter(_t98) != 0) goto 0xc3134580;
    				if (_t40 != 0) goto 0xc3134580;
    				if (__ecx == 0xffffffff) goto 0xc3134580;
    				_t43 = E00007FF67FF6C31315E4(_t42);
    				E00007FF67FF6C313AB80();
    				return _t43;
    			}
















    0x7ff6c313444c
    0x7ff6c3134451
    0x7ff6c313445a
    0x7ff6c3134462
    0x7ff6c3134469
    0x7ff6c3134473
    0x7ff6c3134484
    0x7ff6c3134486
    0x7ff6c3134492
    0x7ff6c3134498
    0x7ff6c31344a3
    0x7ff6c31344a9
    0x7ff6c31344b3
    0x7ff6c31344bc
    0x7ff6c31344c0
    0x7ff6c31344c5
    0x7ff6c31344da
    0x7ff6c31344dd
    0x7ff6c31344e6
    0x7ff6c31344e8
    0x7ff6c31344fb
    0x7ff6c3134508
    0x7ff6c3134511
    0x7ff6c3134518
    0x7ff6c3134525
    0x7ff6c3134537
    0x7ff6c313453b
    0x7ff6c3134549
    0x7ff6c313454d
    0x7ff6c3134551
    0x7ff6c313455b
    0x7ff6c313456e
    0x7ff6c3134572
    0x7ff6c3134577
    0x7ff6c313457b
    0x7ff6c313458a
    0x7ff6c31345a6

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
    • String ID:
    • API String ID: 1239891234-0
    • Opcode ID: eb957c507e117894eb427fb8234adb66c6bad41522173b941811609e28733431
    • Instruction ID: f839978691185602b58f9942cc70d6ba26762ad7443c33a36aa4b239a4698aab
    • Opcode Fuzzy Hash: eb957c507e117894eb427fb8234adb66c6bad41522173b941811609e28733431
    • Instruction Fuzzy Hash: 83316236A18B818AEBA0DF25E8416EE77A4FB84B95F500136EACD93B54DF3CC145CB40
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 73%
    			E00007FF67FF6C31385EC(void* __eax, signed int __edx, void* __esi, void* __eflags, long long __rbx, long long __rcx, void* __rdx, long long __r8, void* __r10) {
    				void* __rsi;
    				void* __rbp;
    				char _t159;
    				char _t165;
    				char _t170;
    				int _t171;
    				int _t173;
    				char _t174;
    				intOrPtr _t178;
    				void* _t184;
    				signed char _t185;
    				intOrPtr _t193;
    				signed long long _t235;
    				signed long long _t241;
    				long long _t245;
    				void* _t246;
    				intOrPtr _t260;
    				signed long long _t268;
    				long long _t281;
    				intOrPtr _t287;
    				void* _t288;
    				long _t292;
    				void* _t295;
    				char _t298;
    				void* _t300;
    				void* _t301;
    				DWORD* _t304;
    				void* _t306;
    				struct _OVERLAPPED* _t309;
    				void* _t310;
    				void* _t312;
    				signed long long _t313;
    				void* _t321;
    				intOrPtr _t322;
    				long long _t329;
    				void* _t331;
    				signed long long _t333;
    				void* _t335;
    				long long _t336;
    				intOrPtr _t337;
    				void* _t339;
    				signed long long _t340;
    				long long _t342;
    				long long _t344;
    
    				 *((long long*)(_t312 + 8)) = __rbx;
    				_t310 = _t312 - 0x27;
    				_t313 = _t312 - 0x100;
    				_t235 =  *0xc3145030; // 0x3d2407701cef
    				 *(_t310 + 0x1f) = _t235 ^ _t313;
    				 *((long long*)(_t310 - 1)) = __rcx;
    				r13d = r9d;
    				 *((long long*)(_t310 - 0x19)) = __r8;
    				_t336 = _t335 + __r8;
    				 *((long long*)(_t310 - 9)) = __edx;
    				 *((long long*)(_t310 - 0x49)) = _t336;
    				_t340 = __edx + __edx * 8;
    				_t333 = __edx >> 6;
    				 *((long long*)(_t310 - 0x41)) =  *((intOrPtr*)( *((intOrPtr*)(0x7ff6c3130000 + 0x16120 + _t333 * 8)) + 0x28 + _t340 * 8));
    				 *((intOrPtr*)(_t310 - 0x59)) = GetConsoleCP();
    				E00007FF67FF6C3133CC8( *((intOrPtr*)( *((intOrPtr*)(0x7ff6c3130000 + 0x16120 + _t333 * 8)) + 0x28 + _t340 * 8)), __edx, _t313 + 0x50, __rdx, _t304, _t342);
    				_t260 =  *((intOrPtr*)(_t313 + 0x58));
    				r15d = 0;
    				r10d = 0;
    				 *((long long*)(_t310 - 0x51)) = _t342;
    				 *((long long*)(_t310 - 0x69)) = _t342;
    				_t193 =  *((intOrPtr*)(_t260 + 0xc));
    				 *((intOrPtr*)(_t310 - 0x55)) = _t193;
    				if (__r8 - _t336 >= 0) goto 0xc31389ca;
    				_t241 = __edx >> 6;
    				 *(_t310 - 0x11) = _t241;
    				r15d = 1;
    				 *((char*)(_t313 + 0x40)) =  *((intOrPtr*)(__r8));
    				 *(_t313 + 0x44) = r10d;
    				if (_t193 != 0xfde9) goto 0xc313883e;
    				_t322 =  *((intOrPtr*)(0x7ff6c3130000 + 0x16120 + _t241 * 8));
    				if ( *((intOrPtr*)(_t322 + _t340 * 8 + __r10 + 0x3e)) == r10b) goto 0xc31386eb;
    				_t295 = __r10 + 1;
    				if (_t295 - 5 < 0) goto 0xc31386d9;
    				if (_t295 <= 0) goto 0xc31387e1;
    				r15d =  *((char*)(_t260 + 0x7ff6c31458e0));
    				r15d = r15d + 1;
    				r13d = r15d;
    				r13d = r13d - r10d + 1;
    				if (r13d -  *((intOrPtr*)(_t310 - 0x49)) - __r8 > 0) goto 0xc313898f;
    				if (_t295 <= 0) goto 0xc3138753;
    				_t329 = _t322 - _t310 + 7 + _t340 * 8;
    				 *((char*)(_t310 + 7 + __r10)) =  *((intOrPtr*)(_t310 + 7 + __r10 + _t329 + 0x3e));
    				if (__r10 + 1 - _t295 < 0) goto 0xc313873a;
    				r10d = 0;
    				if (r13d <= 0) goto 0xc313876d;
    				E00007FF67FF6C3132490( *((intOrPtr*)(_t310 + 7 + __r10 + _t329 + 0x3e)), _t310 + 7 + _t295, __r8, r13d);
    				r10d = 0;
    				_t281 = _t329;
    				if (_t295 <= 0) goto 0xc3138794;
    				 *((intOrPtr*)( *((intOrPtr*)(0x7ff6c3130000 + 0x16120 + _t333 * 8)) + _t281 + 0x3e + _t340 * 8)) = r10b;
    				if (_t281 + 1 - _t295 < 0) goto 0xc313877c;
    				_t245 = _t310 + 7;
    				 *((long long*)(_t310 - 0x39)) = _t329;
    				 *((long long*)(_t310 - 0x31)) = _t245;
    				_t159 = (r10d & 0xffffff00 | r15d == 0x00000004) + 1;
    				r8d = _t159;
    				r15d = _t159;
    				E00007FF67FF6C31393F0(_t245, __edx, _t313 + 0x44, _t310 - 0x31, 0x7ff6c3130000, _t310 - 0x39);
    				if (_t245 == 0xffffffff) goto 0xc3138aa2;
    				_t337 =  *((intOrPtr*)(_t310 - 0x49));
    				goto 0xc31388b3;
    				_t298 =  *((char*)(_t245 + 0x7ff6c31458e0));
    				_t184 = _t298 + 1;
    				_t246 = _t184;
    				if (_t246 - _t337 - __r8 > 0) goto 0xc3138a17;
    				 *((long long*)(_t310 - 0x29)) = _t329;
    				 *((long long*)(_t310 - 0x21)) = __r8;
    				_t165 = (r10d & 0xffffff00 | _t184 == 0x00000004) + 1;
    				r8d = _t165;
    				_t268 = _t313 + 0x44;
    				E00007FF67FF6C31393F0(_t246, __edx, _t268, _t310 - 0x21, 0x7ff6c3130000, _t310 - 0x29);
    				if (_t246 == 0xffffffff) goto 0xc3138aa2;
    				r15d = _t165;
    				goto 0xc31388b3;
    				_t287 =  *((intOrPtr*)(0x7ff6c3130000 + 0x16120 + _t333 * 8));
    				_t185 =  *(_t287 + 0x3d + _t340 * 8);
    				if ((_t185 & 0x00000004) == 0) goto 0xc3138878;
    				 *((char*)(_t310 + 0xf)) =  *((intOrPtr*)(_t287 + 0x3e + _t340 * 8));
    				r8d = 2;
    				 *(_t287 + 0x3d + _t340 * 8) = _t185 & 0x000000fb;
    				_t288 = _t310 + 0xf;
    				 *((char*)(_t310 + 0x10)) =  *((intOrPtr*)(__r8));
    				goto 0xc31388a0;
    				E00007FF67FF6C31364A0(0x7ff6c3130000, _t268, _t288);
    				if ( *((intOrPtr*)(0x7ff6c3130000 + _t268 * 2)) >= 0) goto 0xc313889a;
    				_t300 = _t298 + __r8 + 1;
    				if (_t300 - _t337 >= 0) goto 0xc3138a68;
    				_t100 = _t288 + 2; // 0x2
    				r8d = _t100;
    				goto 0xc313889d;
    				_t170 = E00007FF67FF6C3137B04(_t313 + 0x44, __r8);
    				if (_t170 == 0xffffffff) goto 0xc3138aa2;
    				_t321 = _t313 + 0x44;
    				 *((long long*)(_t313 + 0x38)) = __edx;
    				_t106 = _t300 + 1; // 0x2
    				_t306 = _t106;
    				 *((long long*)(_t313 + 0x30)) = __edx;
    				r9d = r15d;
    				 *((intOrPtr*)(_t313 + 0x28)) = 5;
    				 *((long long*)(_t313 + 0x20)) = _t310 + 0x17;
    				E00007FF67FF6C3135A00(_t339);
    				if (_t170 == 0) goto 0xc3138ab4;
    				r8d = _t170;
    				 *((long long*)(_t313 + 0x20)) = __edx;
    				_t171 = WriteFile(_t335, _t331, _t292, _t304, _t309);
    				r10d = 0;
    				if (_t171 == 0) goto 0xc3138aab;
    				_t344 =  *((intOrPtr*)(_t310 - 0x51));
    				_t178 =  *((intOrPtr*)(_t310 - 0x41)) + _t344;
    				 *((intOrPtr*)(_t310 - 0x65)) = _t178;
    				if ( *((intOrPtr*)(_t313 + 0x48)) - _t170 < 0) goto 0xc31389ca;
    				if ( *((char*)(_t313 + 0x40)) != 0xa) goto 0xc313897b;
    				_t121 = _t329 + 0xd; // 0xd
    				 *((short*)(_t313 + 0x40)) = _t121;
    				_t124 = _t329 + 1; // 0x1
    				r8d = _t124;
    				 *((long long*)(_t313 + 0x20)) = _t329;
    				_t173 = WriteFile(??, ??, ??, ??, ??);
    				r10d = 0;
    				if (_t173 == 0) goto 0xc3138a99;
    				if ( *((intOrPtr*)(_t313 + 0x48)) - 1 < 0) goto 0xc31389ca;
    				r15d = r15d + 1;
    				 *((long long*)(_t310 - 0x51)) = _t344;
    				 *((intOrPtr*)(_t310 - 0x65)) = _t178 + 1;
    				_t301 = _t306;
    				if (_t306 - _t337 >= 0) goto 0xc31389ca;
    				goto 0xc31386a3;
    				if (_t321 <= 0) goto 0xc31389c4;
    				_t174 =  *((intOrPtr*)(_t306 - _t301 + _t301));
    				 *((char*)( *((intOrPtr*)(0x7ff6c3130000 + 0x16120 + _t333 * 8)) + _t301 + 0x3e + _t340 * 8)) = _t174;
    				if (r10d + 1 - _t321 < 0) goto 0xc31389a1;
    				 *((intOrPtr*)(_t310 - 0x65)) =  *((intOrPtr*)(_t310 - 0x65)) + r8d;
    				if ( *((intOrPtr*)(_t310 - 0x71)) == r10b) goto 0xc31389dc;
    				 *( *((intOrPtr*)(_t313 + 0x50)) + 0x3a8) =  *( *((intOrPtr*)(_t313 + 0x50)) + 0x3a8) & 0xfffffffd;
    				asm("movsd xmm0, [ebp-0x69]");
    				asm("movsd [eax], xmm0");
    				 *((intOrPtr*)( *((intOrPtr*)(_t310 - 1)) + 8)) = __esi -  *((intOrPtr*)(_t310 - 0x19));
    				E00007FF67FF6C313AB80();
    				return _t174;
    			}















































    0x7ff6c31385ec
    0x7ff6c31385fc
    0x7ff6c3138601
    0x7ff6c3138608
    0x7ff6c3138612
    0x7ff6c313861f
    0x7ff6c3138626
    0x7ff6c3138630
    0x7ff6c3138634
    0x7ff6c3138637
    0x7ff6c313863e
    0x7ff6c3138642
    0x7ff6c3138646
    0x7ff6c3138657
    0x7ff6c3138668
    0x7ff6c313866b
    0x7ff6c3138670
    0x7ff6c3138675
    0x7ff6c3138678
    0x7ff6c313867b
    0x7ff6c313867f
    0x7ff6c3138686
    0x7ff6c3138689
    0x7ff6c313868f
    0x7ff6c313869b
    0x7ff6c313869f
    0x7ff6c31386a5
    0x7ff6c31386ab
    0x7ff6c31386af
    0x7ff6c31386ba
    0x7ff6c31386ca
    0x7ff6c31386de
    0x7ff6c31386e2
    0x7ff6c31386e9
    0x7ff6c31386ee
    0x7ff6c3138709
    0x7ff6c3138712
    0x7ff6c3138715
    0x7ff6c3138718
    0x7ff6c3138721
    0x7ff6c313872d
    0x7ff6c3138736
    0x7ff6c3138749
    0x7ff6c313874e
    0x7ff6c3138750
    0x7ff6c3138756
    0x7ff6c3138765
    0x7ff6c313876a
    0x7ff6c313876d
    0x7ff6c3138773
    0x7ff6c313878a
    0x7ff6c3138792
    0x7ff6c3138794
    0x7ff6c3138798
    0x7ff6c313879c
    0x7ff6c31387b7
    0x7ff6c31387b9
    0x7ff6c31387bc
    0x7ff6c31387bf
    0x7ff6c31387c8
    0x7ff6c31387d2
    0x7ff6c31387dc
    0x7ff6c31387ea
    0x7ff6c31387f3
    0x7ff6c31387f6
    0x7ff6c31387fc
    0x7ff6c3138805
    0x7ff6c313880c
    0x7ff6c3138817
    0x7ff6c313881d
    0x7ff6c3138820
    0x7ff6c3138827
    0x7ff6c3138830
    0x7ff6c3138839
    0x7ff6c313883c
    0x7ff6c3138845
    0x7ff6c313884d
    0x7ff6c3138855
    0x7ff6c313885f
    0x7ff6c3138862
    0x7ff6c313886a
    0x7ff6c313886f
    0x7ff6c3138873
    0x7ff6c3138876
    0x7ff6c3138878
    0x7ff6c3138886
    0x7ff6c3138888
    0x7ff6c313888e
    0x7ff6c3138894
    0x7ff6c3138894
    0x7ff6c3138898
    0x7ff6c31388a5
    0x7ff6c31388ad
    0x7ff6c31388bc
    0x7ff6c31388c1
    0x7ff6c31388c6
    0x7ff6c31388c6
    0x7ff6c31388ca
    0x7ff6c31388cf
    0x7ff6c31388d2
    0x7ff6c31388dc
    0x7ff6c31388e1
    0x7ff6c31388ea
    0x7ff6c31388f9
    0x7ff6c31388fc
    0x7ff6c3138905
    0x7ff6c313890b
    0x7ff6c3138910
    0x7ff6c3138916
    0x7ff6c313891f
    0x7ff6c3138923
    0x7ff6c313892a
    0x7ff6c3138935
    0x7ff6c313893b
    0x7ff6c3138944
    0x7ff6c3138949
    0x7ff6c3138949
    0x7ff6c313894d
    0x7ff6c3138957
    0x7ff6c313895d
    0x7ff6c3138962
    0x7ff6c313896d
    0x7ff6c313896f
    0x7ff6c3138974
    0x7ff6c3138978
    0x7ff6c313897b
    0x7ff6c3138981
    0x7ff6c313898a
    0x7ff6c3138995
    0x7ff6c31389a1
    0x7ff6c31389b4
    0x7ff6c31389bf
    0x7ff6c31389c7
    0x7ff6c31389ce
    0x7ff6c31389d5
    0x7ff6c31389e0
    0x7ff6c31389e9
    0x7ff6c31389ed
    0x7ff6c31389f7
    0x7ff6c3138a16

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: ErrorFileLastWrite$Console
    • String ID:
    • API String ID: 786612050-0
    • Opcode ID: 899a49a3c9ae0634d5da2a823c4895262d614a6fb26b3a9278d039cf8840cc98
    • Instruction ID: 837db96c132297bb586dd49783d1a9d810d59cedd8e5e74fe1d043236d66333a
    • Opcode Fuzzy Hash: 899a49a3c9ae0634d5da2a823c4895262d614a6fb26b3a9278d039cf8840cc98
    • Instruction Fuzzy Hash: 3DD1EF62B08A819EE741CF64D5419ED7BB1FB84B99B144136CE8EA7F89DE38D11AC300
    Uniqueness

    Uniqueness Score: -1.00%

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: ExceptionRaise_clrfp
    • String ID:
    • API String ID: 15204871-0
    • Opcode ID: bac9ce5ef53bd9b92fb2b5bb78bbd4f0ecf427e26d187bce87b91b5d4a4a0c31
    • Instruction ID: 2a41003103835afe3fc37599b9a35d75fb5f5b7ed5bb507056832f85f8abf623
    • Opcode Fuzzy Hash: bac9ce5ef53bd9b92fb2b5bb78bbd4f0ecf427e26d187bce87b91b5d4a4a0c31
    • Instruction Fuzzy Hash: E3B13877A00B858FEB59CF29C88666837E0F744F89F158921DA9D97BA4CF39D452C700
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 100%
    			E00007FF67FF6C31370F0(long long __rax) {
    				signed int _t3;
    
    				_t3 = GetProcessHeap();
    				 *0xc31466e8 = __rax;
    				return _t3 & 0xffffff00 | __rax != 0x00000000;
    			}




    0x7ff6c31370f4
    0x7ff6c31370fd
    0x7ff6c313710b

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: HeapProcess
    • String ID:
    • API String ID: 54951025-0
    • Opcode ID: acf8c9999740b56c0bb7fdb78bdf5ec9b1f26a43436377c91c3f6163e3f2acb0
    • Instruction ID: cbdf6f5f7a086a085100dbcf3ee3a50704b39b0626dc94df35abfff8ed1c5db3
    • Opcode Fuzzy Hash: acf8c9999740b56c0bb7fdb78bdf5ec9b1f26a43436377c91c3f6163e3f2acb0
    • Instruction Fuzzy Hash: 1EB09221E07A02CAEB486F11ACC3A1432A46F48B16F984038C08CA1720DE2C20E5A700
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 56%
    			E00007FF67FF6C3133738(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
    				void* _t24;
    				int _t26;
    				signed int _t51;
    				void* _t52;
    				signed long long _t66;
    				signed int* _t73;
    				signed long long _t75;
    				signed long long _t77;
    				signed long long _t78;
    				signed long long _t95;
    				signed long long _t96;
    				signed long long _t98;
    				signed long long _t104;
    				long long _t115;
    				void* _t117;
    				void* _t120;
    				signed long long* _t123;
    				signed long long _t124;
    				signed long long _t126;
    				signed long long _t129;
    				signed long long*** _t132;
    
    				_t52 = __edi;
    				_t51 = __edx;
    				 *((long long*)(_t117 + 0x10)) = __rbx;
    				 *((long long*)(_t117 + 0x18)) = _t115;
    				 *((long long*)(_t117 + 0x20)) = __rsi;
    				_t66 =  *((intOrPtr*)(__rcx));
    				_t132 = __rcx;
    				_t73 =  *_t66;
    				if (_t73 == 0) goto 0xc31338cc;
    				_t124 =  *0xc3145030; // 0x3d2407701cef
    				_t111 = _t124 ^  *_t73;
    				_t75 = _t73[4] ^ _t124;
    				asm("dec eax");
    				asm("dec eax");
    				asm("dec ecx");
    				if ((_t73[2] ^ _t124) != _t75) goto 0xc313383e;
    				_t77 = _t75 - (_t124 ^  *_t73) >> 3;
    				_t101 =  >  ? _t66 : _t77;
    				_t6 = _t115 + 0x20; // 0x20
    				_t102 = ( >  ? _t66 : _t77) + _t77;
    				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77;
    				if (( ==  ? _t66 : ( >  ? _t66 : _t77) + _t77) - _t77 < 0) goto 0xc31337da;
    				_t7 = _t115 + 8; // 0x8
    				r8d = _t7;
    				E00007FF67FF6C3137058(_t6, _t77, _t111,  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77, _t111, _t115, _t120);
    				_t24 = E00007FF67FF6C3134964(_t66, _t111);
    				if (_t66 != 0) goto 0xc3133802;
    				_t104 = _t77 + 4;
    				r8d = 8;
    				E00007FF67FF6C3137058(_t24, _t77, _t111, _t104, _t111, _t115, _t120);
    				_t129 = _t66;
    				_t26 = E00007FF67FF6C3134964(_t66, _t111);
    				if (_t129 == 0) goto 0xc31338cc;
    				_t123 = _t129 + _t77 * 8;
    				_t78 = _t129 + _t104 * 8;
    				_t88 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
    				_t64 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
    				if (( >  ? _t115 : _t78 - _t123 + 7 >> 3) == 0) goto 0xc313383e;
    				memset(_t52, _t26, 0 << 0);
    				_t126 =  *0xc3145030; // 0x3d2407701cef
    				r8d = 0x40;
    				asm("dec eax");
    				 *_t123 =  *(_t132[1]) ^ _t126;
    				_t95 =  *0xc3145030; // 0x3d2407701cef
    				asm("dec eax");
    				 *( *( *_t132)) = _t129 ^ _t95;
    				_t96 =  *0xc3145030; // 0x3d2407701cef
    				asm("dec eax");
    				( *( *_t132))[1] =  &(_t123[1]) ^ _t96;
    				_t98 =  *0xc3145030; // 0x3d2407701cef
    				r8d = r8d - (_t51 & 0x0000003f);
    				asm("dec eax");
    				( *( *_t132))[2] = _t78 ^ _t98;
    				goto 0xc31338cf;
    				return 0xffffffff;
    			}
























    0x7ff6c3133738
    0x7ff6c3133738
    0x7ff6c3133738
    0x7ff6c313373d
    0x7ff6c3133742
    0x7ff6c3133750
    0x7ff6c3133755
    0x7ff6c3133758
    0x7ff6c313375e
    0x7ff6c3133764
    0x7ff6c3133772
    0x7ff6c3133782
    0x7ff6c3133785
    0x7ff6c3133788
    0x7ff6c313378b
    0x7ff6c3133791
    0x7ff6c313379f
    0x7ff6c31337a9
    0x7ff6c31337ad
    0x7ff6c31337b0
    0x7ff6c31337b3
    0x7ff6c31337ba
    0x7ff6c31337bc
    0x7ff6c31337bc
    0x7ff6c31337c6
    0x7ff6c31337d0
    0x7ff6c31337d8
    0x7ff6c31337da
    0x7ff6c31337de
    0x7ff6c31337ea
    0x7ff6c31337f1
    0x7ff6c31337f4
    0x7ff6c31337fc
    0x7ff6c3133809
    0x7ff6c313380d
    0x7ff6c3133825
    0x7ff6c3133829
    0x7ff6c313382c
    0x7ff6c3133834
    0x7ff6c3133837
    0x7ff6c313383e
    0x7ff6c313385d
    0x7ff6c3133863
    0x7ff6c3133866
    0x7ff6c3133879
    0x7ff6c3133882
    0x7ff6c3133888
    0x7ff6c3133899
    0x7ff6c31338a2
    0x7ff6c31338a6
    0x7ff6c31338b2
    0x7ff6c31338bb
    0x7ff6c31338c6
    0x7ff6c31338ca
    0x7ff6c31338e7

    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: ErrorFreeHeapLast
    • String ID:
    • API String ID: 485612231-0
    • Opcode ID: 63058e78e3a9e88324992360006dd7a3e6c3d7dbd1ee20b1cd9b49724ac58cce
    • Instruction ID: f658cd1719288c719689511f76120f0355aac19bdf26bec76312032054bdba34
    • Opcode Fuzzy Hash: 63058e78e3a9e88324992360006dd7a3e6c3d7dbd1ee20b1cd9b49724ac58cce
    • Instruction Fuzzy Hash: E441F622715A9486EF44CF2AD9255A9B3A1FB48FD4B499532DE4DE7F58DF3CD0028304
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 86%
    			E00007FF67FF6C313A450(intOrPtr __ebx, intOrPtr __edx, signed int __rax, signed int __rdx, void* __r8, signed long long _a8) {
    				intOrPtr _v12;
    				intOrPtr _v16;
    				intOrPtr _v20;
    				void* _t25;
    
    				_t25 = __r8;
    				r8d = 0;
    				 *0xc3146748 = r8d;
    				_t1 = _t25 + 1; // 0x1
    				r9d = _t1;
    				asm("cpuid");
    				_v16 = r9d;
    				_v16 = 0;
    				_v20 = __ebx;
    				_v12 = __edx;
    				if (0 != 0x18001000) goto 0xc313a4b1;
    				asm("xgetbv");
    				_a8 = __rdx << 0x00000020 | __rax;
    				r8d =  *0xc3146748;
    				r8d =  ==  ? r9d : r8d;
    				 *0xc3146748 = r8d;
    				 *0xc314674c = r8d;
    				return 0;
    			}







    0x7ff6c313a450
    0x7ff6c313a456
    0x7ff6c313a45b
    0x7ff6c313a462
    0x7ff6c313a462
    0x7ff6c313a469
    0x7ff6c313a46b
    0x7ff6c313a473
    0x7ff6c313a479
    0x7ff6c313a47d
    0x7ff6c313a483
    0x7ff6c313a487
    0x7ff6c313a491
    0x7ff6c313a49b
    0x7ff6c313a4a6
    0x7ff6c313a4aa
    0x7ff6c313a4b1
    0x7ff6c313a4bf

    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: ba32b002c24deaeb3c6ab066b11eb9fa321601a592af0ac6f8a17c55917153c4
    • Instruction ID: 00e75fdf92497cb2456d585a79dea43410fb2ff7ef186b89c5121801ce42349b
    • Opcode Fuzzy Hash: ba32b002c24deaeb3c6ab066b11eb9fa321601a592af0ac6f8a17c55917153c4
    • Instruction Fuzzy Hash: 51F062B1B182958EDBA48F2CA843A2977D0E708789F908039D6CDC3F04DA3CD0608F04
    Uniqueness

    Uniqueness Score: -1.00%

    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 9bcc6fb170f52aee4d0673ee04c563fda407cd4ec69ee8d5d72e3ed79dbbc1da
    • Instruction ID: 438c4f25b6e67c2bd391911aebda23d8f719074356315330abfe4fef11bd2268
    • Opcode Fuzzy Hash: 9bcc6fb170f52aee4d0673ee04c563fda407cd4ec69ee8d5d72e3ed79dbbc1da
    • Instruction Fuzzy Hash: A2A00266A8CC86D9E6C4AF40E8928703370FB60B92F440131D48DE38A49F3CA444C390
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 71%
    			E00007FF67FF6C31310EC(intOrPtr* __rax, long long __rbx, void* __r8, long long _a8) {
    				char _v24;
    				void* _t9;
    				signed short _t20;
    				void* _t21;
    				void* _t25;
    				intOrPtr _t34;
    				intOrPtr* _t53;
    				intOrPtr* _t54;
    				void* _t67;
    				void* _t68;
    
    				_t55 = __rbx;
    				_t53 = __rax;
    				_a8 = __rbx;
    				if (E00007FF67FF6C31312B0(1) == 0) goto 0xc3131238;
    				dil = 0;
    				_v24 = dil;
    				_t9 = E00007FF67FF6C3131274();
    				_t34 =  *0xc3145a18; // 0x0
    				if (_t34 == 1) goto 0xc3131243;
    				if (_t34 != 0) goto 0xc3131174;
    				 *0xc3145a18 = 1;
    				if (E00007FF67FF6C3133204(__rbx, 0xc313c260, 0xc313c290) == 0) goto 0xc3131155;
    				goto 0xc313122d;
    				E00007FF67FF6C31331A0(_t55, 0xc313c248, 0xc313c258, _t67, _t68);
    				 *0xc3145a18 = 2;
    				goto 0xc313117c;
    				dil = 1;
    				_v24 = dil;
    				E00007FF67FF6C31315D4(E00007FF67FF6C3131420(_t9, 0xc313c258));
    				if ( *_t53 == 0) goto 0xc31311af;
    				if (E00007FF67FF6C3131388(_t53, _t53) == 0) goto 0xc31311af;
    				r8d = 0;
    				_t54 =  *_t53;
    				E00007FF67FF6C31315DC( *0xc313c230());
    				if ( *_t54 == 0) goto 0xc31311d1;
    				if (E00007FF67FF6C3131388(_t54, _t54) == 0) goto 0xc31311d1;
    				E00007FF67FF6C31334E4( *_t54);
    				_t20 = E00007FF67FF6C3131738(0xc313c258);
    				_t21 = E00007FF67FF6C313314C();
    				r9d = _t20 & 0x0000ffff;
    				_t73 = _t54;
    				0xc3131000();
    				if (E00007FF67FF6C313177C(_t54) == 0) goto 0xc313124d;
    				if (dil != 0) goto 0xc3131207;
    				E00007FF67FF6C31334C8(0x7ff6c3130000, 0xc313c258, _t54);
    				E00007FF67FF6C3131444(1, 0);
    				_t25 = _t21;
    				if (E00007FF67FF6C313177C(_t54) == 0) goto 0xc3131255;
    				if (_v24 != 0) goto 0xc313122b;
    				E00007FF67FF6C31334B8(0x7ff6c3130000, 0xc313c258, _t73);
    				return _t25;
    			}













    0x7ff6c31310ec
    0x7ff6c31310ec
    0x7ff6c31310ec
    0x7ff6c3131102
    0x7ff6c3131108
    0x7ff6c313110b
    0x7ff6c3131110
    0x7ff6c3131117
    0x7ff6c3131120
    0x7ff6c3131128
    0x7ff6c313112a
    0x7ff6c3131149
    0x7ff6c3131150
    0x7ff6c3131163
    0x7ff6c3131168
    0x7ff6c3131172
    0x7ff6c3131174
    0x7ff6c3131177
    0x7ff6c3131183
    0x7ff6c313118f
    0x7ff6c313119b
    0x7ff6c313119d
    0x7ff6c31311a6
    0x7ff6c31311af
    0x7ff6c31311bb
    0x7ff6c31311c7
    0x7ff6c31311cc
    0x7ff6c31311d1
    0x7ff6c31311d9
    0x7ff6c31311de
    0x7ff6c31311e1
    0x7ff6c31311ed
    0x7ff6c31311fb
    0x7ff6c3131200
    0x7ff6c3131202
    0x7ff6c313120b
    0x7ff6c3131210
    0x7ff6c313121d
    0x7ff6c3131224
    0x7ff6c3131226
    0x7ff6c3131237

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: __scrt_fastfail$MainUnity__scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
    • String ID:
    • API String ID: 3902901072-0
    • Opcode ID: 2db354336f7948c9e0c039416499f788ca8e3c0556fc39a0fe15e29ea9ece645
    • Instruction ID: 8e732729616ef6dfc58e38cf609f8d26680fd18ef37aab2fd7f54a0231f69ce3
    • Opcode Fuzzy Hash: 2db354336f7948c9e0c039416499f788ca8e3c0556fc39a0fe15e29ea9ece645
    • Instruction Fuzzy Hash: 283145A1E0C1434DFAD4BF609853AF932919F45BA6F944434D9CEFBEE3CE2CA5048285
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 50%
    			E00007FF67FF6C3132180(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
    				intOrPtr _t61;
    				intOrPtr _t65;
    				intOrPtr _t67;
    				intOrPtr _t68;
    				struct HINSTANCE__* _t81;
    				long long _t85;
    				void* _t89;
    				struct HINSTANCE__* _t94;
    				long _t97;
    				void* _t100;
    				signed long long _t101;
    				WCHAR* _t104;
    
    				 *((long long*)(_t89 + 8)) = __rbx;
    				 *((long long*)(_t89 + 0x10)) = _t85;
    				 *((long long*)(_t89 + 0x18)) = __rsi;
    				_t61 =  *((intOrPtr*)(0x7ff6c3130000 + 0x15bc0 + _t81 * 8));
    				_t101 = _t100 | 0xffffffff;
    				if (_t61 == _t101) goto 0xc31322ad;
    				if (_t61 != 0) goto 0xc31322af;
    				if (__r8 == __r9) goto 0xc31322a5;
    				_t67 =  *((intOrPtr*)(0x7ff6c3130000 + 0x15ba8 + __rsi * 8));
    				if (_t67 == 0) goto 0xc31321f0;
    				if (_t67 != _t101) goto 0xc3132287;
    				goto 0xc313225b;
    				r8d = 0x800;
    				LoadLibraryExW(_t104, _t100, _t97);
    				_t68 = _t61;
    				if (_t61 != 0) goto 0xc3132267;
    				if (GetLastError() != 0x57) goto 0xc3132249;
    				_t14 = _t68 + 7; // 0x7
    				r8d = _t14;
    				if (E00007FF67FF6C3133E00(__r8) == 0) goto 0xc3132249;
    				r8d = 0;
    				LoadLibraryExW(??, ??, ??);
    				if (_t61 != 0) goto 0xc3132267;
    				 *((intOrPtr*)(0x7ff6c3130000 + 0x15ba8 + __rsi * 8)) = _t101;
    				goto 0xc31321cf;
    				_t21 = 0x7ff6c3130000 + 0x15ba8 + __rsi * 8;
    				_t65 =  *_t21;
    				 *_t21 = _t61;
    				if (_t65 == 0) goto 0xc3132287;
    				FreeLibrary(_t94);
    				GetProcAddress(_t81);
    				if (_t65 == 0) goto 0xc31322a5;
    				 *((intOrPtr*)(0x7ff6c3130000 + 0x15bc0 + _t81 * 8)) = _t65;
    				goto 0xc31322af;
    				 *((intOrPtr*)(0x7ff6c3130000 + 0x15bc0 + _t81 * 8)) = _t101;
    				return 0;
    			}















    0x7ff6c3132180
    0x7ff6c3132185
    0x7ff6c313218a
    0x7ff6c31321ae
    0x7ff6c31321b6
    0x7ff6c31321bd
    0x7ff6c31321c6
    0x7ff6c31321cf
    0x7ff6c31321d8
    0x7ff6c31321e3
    0x7ff6c31321e8
    0x7ff6c31321ee
    0x7ff6c31321fd
    0x7ff6c3132203
    0x7ff6c3132209
    0x7ff6c313220f
    0x7ff6c313221a
    0x7ff6c313221c
    0x7ff6c313221c
    0x7ff6c3132231
    0x7ff6c3132233
    0x7ff6c313223b
    0x7ff6c3132247
    0x7ff6c3132253
    0x7ff6c3132262
    0x7ff6c3132271
    0x7ff6c3132271
    0x7ff6c3132271
    0x7ff6c313227c
    0x7ff6c3132281
    0x7ff6c313228d
    0x7ff6c3132296
    0x7ff6c313229b
    0x7ff6c31322a3
    0x7ff6c31322a5
    0x7ff6c31322cb

    APIs
    • LoadLibraryExW.KERNEL32(?,?,?,00007FF6C313242E,?,?,?,00007FF6C313212C,?,?,?,?,00007FF6C3131C8D), ref: 00007FF6C3132203
    • GetLastError.KERNEL32(?,?,?,00007FF6C313242E,?,?,?,00007FF6C313212C,?,?,?,?,00007FF6C3131C8D), ref: 00007FF6C3132211
    • LoadLibraryExW.KERNEL32(?,?,?,00007FF6C313242E,?,?,?,00007FF6C313212C,?,?,?,?,00007FF6C3131C8D), ref: 00007FF6C313223B
    • FreeLibrary.KERNEL32(?,?,?,00007FF6C313242E,?,?,?,00007FF6C313212C,?,?,?,?,00007FF6C3131C8D), ref: 00007FF6C3132281
    • GetProcAddress.KERNEL32(?,?,?,00007FF6C313242E,?,?,?,00007FF6C313212C,?,?,?,?,00007FF6C3131C8D), ref: 00007FF6C313228D
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: Library$Load$AddressErrorFreeLastProc
    • String ID: api-ms-
    • API String ID: 2559590344-2084034818
    • Opcode ID: 45368810073cf9b16b0d4a895fa082b4dd9bddfe82befc46eb2887b1d89dcae8
    • Instruction ID: 70a43c14c197e4bbd648722ec354f2b334e563800e2a8afe55a1a7407f284544
    • Opcode Fuzzy Hash: 45368810073cf9b16b0d4a895fa082b4dd9bddfe82befc46eb2887b1d89dcae8
    • Instruction Fuzzy Hash: C331F425A0EA469DEE91AF02EC429B53394BF48FA2F094135DD9DABF40DF3CE0468300
    Uniqueness

    Uniqueness Score: -1.00%

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
    • String ID: CONOUT$
    • API String ID: 3230265001-3130406586
    • Opcode ID: e57135731ae6dd63c0be655441e427cfa77131c4b6e64726efef8aa5f7ceb0c6
    • Instruction ID: 8f79679fe2732bc330500abc8e86e8adeaa82a892b432043a519c97ea3e8f930
    • Opcode Fuzzy Hash: e57135731ae6dd63c0be655441e427cfa77131c4b6e64726efef8aa5f7ceb0c6
    • Instruction Fuzzy Hash: C4119321B18A418AE3909F56E846B2976A4FB88FF6F044234EA9DD7F94CF7CD4048740
    Uniqueness

    Uniqueness Score: -1.00%

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: AddressFreeHandleLibraryModuleProc
    • String ID: CorExitProcess$mscoree.dll
    • API String ID: 4061214504-1276376045
    • Opcode ID: b8f0f8b62cd604fbe330a7d83cdbb8bfccc3bf6f38d0ca3fe6ca2aa41b2063c7
    • Instruction ID: 86398a6b1cf0bc07e84fe3b2e6cfea928e2d049f1687d60fb64b6ab12234aacc
    • Opcode Fuzzy Hash: b8f0f8b62cd604fbe330a7d83cdbb8bfccc3bf6f38d0ca3fe6ca2aa41b2063c7
    • Instruction Fuzzy Hash: C1F05E65B29A8289FF859F61E486B783360AF48F92F441835D58FD7960CF2CD488C700
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 48%
    			E00007FF67FF6C3138F38(signed long long __ecx, void* __edi, void* __ebp, signed int* __rax, unsigned int __rbx, signed short* __rdx, void* __r9, void* __r10, long long _a32) {
    				signed short _v72;
    				void* _v84;
    				unsigned int _v88;
    				intOrPtr _v96;
    				intOrPtr _v100;
    				long _v104;
    				signed int _v120;
    				void* __rsi;
    				void* __rbp;
    				void* _t89;
    				long _t98;
    				intOrPtr _t109;
    				signed int _t118;
    				unsigned int _t123;
    				void* _t129;
    				intOrPtr _t151;
    				intOrPtr _t163;
    				unsigned long long _t169;
    				signed int* _t171;
    				unsigned int _t172;
    				signed short* _t185;
    				signed short* _t188;
    				long _t189;
    				void* _t191;
    				signed long long _t201;
    				void* _t202;
    				signed long long _t204;
    				void* _t205;
    				signed short* _t206;
    				signed long long _t208;
    
    				_t185 = __rdx;
    				_t172 = __rbx;
    				_t129 = __edi;
    				_a32 = __rbx;
    				r14d = r8d;
    				_t188 = __rdx;
    				_t201 = __ecx;
    				if (r8d == 0) goto 0xc31391f8;
    				if (__rdx != 0) goto 0xc3138f86;
    				E00007FF67FF6C31348AC(__rdx, __rax);
    				 *__rax =  *__rax & 0x00000000;
    				E00007FF67FF6C31348CC(__rdx, __rax);
    				 *__rax = 0x16;
    				E00007FF67FF6C3134660();
    				goto 0xc31391fa;
    				_t204 = _t201 >> 6;
    				_t208 = _t201 + _t201 * 8;
    				sil =  *((intOrPtr*)(0xc3146120 + 0x39 + _t208 * 8));
    				if (_t189 - 1 - 1 > 0) goto 0xc3138fb7;
    				if (( !r14d & 0x00000001) == 0) goto 0xc3138f66;
    				if (( *( *((intOrPtr*)(0xc3146120 + _t204 * 8)) + 0x38 + _t208 * 8) & 0x00000020) == 0) goto 0xc3138fcd;
    				_t17 = _t185 + 2; // 0x2
    				r8d = _t17;
    				E00007FF67FF6C313961C(r12d);
    				_v88 = __rbx;
    				if (E00007FF67FF6C3139308(r12d, _t201) == 0) goto 0xc31390e6;
    				_t163 =  *((intOrPtr*)(0xc3146120 + _t204 * 8));
    				if ( *(0xc3146120 + 0x38 + _t208 * 8) >= 0) goto 0xc31390e6;
    				E00007FF67FF6C31341A4(_t163, __rbx, _t185, _t189);
    				if ( *((intOrPtr*)( *((intOrPtr*)(_t163 + 0x90)) + 0x138)) != _t172) goto 0xc3139024;
    				if ( *((intOrPtr*)( *((intOrPtr*)(0xc3146120 + _t204 * 8)) + 0x39 + _t208 * 8)) == 0) goto 0xc31390e6;
    				if (GetConsoleMode(??, ??) == 0) goto 0xc31390e6;
    				if (sil == 0) goto 0xc31390c8;
    				sil = sil - 1;
    				if (sil - 1 > 0) goto 0xc3139184;
    				_t202 = _t188 + _t205;
    				_v104 = _t189;
    				_t206 = _t188;
    				if (_t188 - _t202 >= 0) goto 0xc31390c1;
    				_v72 =  *_t206 & 0x0000ffff;
    				_t89 = E00007FF67FF6C3139624( *_t206 & 0xffff);
    				_t118 = _v72 & 0x0000ffff;
    				if (_t89 != _t118) goto 0xc31390b8;
    				_t109 = _v100 + 2;
    				_v100 = _t109;
    				if (_t118 != 0xa) goto 0xc31390ad;
    				if (E00007FF67FF6C3139624(0xd) != 0xd) goto 0xc31390b8;
    				_v100 = _t109 + 1;
    				if ( &(_t206[1]) - _t202 >= 0) goto 0xc31390c1;
    				goto 0xc313906d;
    				_v104 = GetLastError();
    				goto 0xc313917a;
    				r9d = r14d;
    				E00007FF67FF6C31385EC(_t91, r12d, 1,  &(_t206[1]) - _t202, _t172,  &_v104,  &_v72, _t188, __r10);
    				asm("movsd xmm0, [eax]");
    				goto 0xc313917f;
    				if ( *( *((intOrPtr*)(0xc3146120 + _t204 * 8)) + 0x38 + _t208 * 8) -  *0x7FF6C3146128 >= 0) goto 0xc3139147;
    				_t151 = sil;
    				if (_t151 == 0) goto 0xc3139133;
    				if (_t151 == 0) goto 0xc313911f;
    				if (sil - 1 != 1) goto 0xc3139184;
    				r9d = r14d;
    				E00007FF67FF6C3138BC0( *0x7FF6C3146128, r12d, 0xc3146120, _t172,  &_v104, _t191, _t188);
    				goto 0xc31390da;
    				r9d = r14d;
    				E00007FF67FF6C3138CDC(r12d, _t129, 0xc3146120, _t172,  &_v104, _t191, _t188);
    				goto 0xc31390da;
    				r9d = r14d;
    				E00007FF67FF6C3138ABC( *0x7FF6C3146128, r12d, 0xc3146120, _t172,  &_v104, _t191, _t188);
    				goto 0xc31390da;
    				r8d = r14d;
    				_v120 = _v120 & 0xc3146120;
    				_v104 = 0xc3146120;
    				_v96 = 0;
    				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0xc3139177;
    				_t98 = GetLastError();
    				_v104 = _t98;
    				asm("movsd xmm0, [ebp-0x30]");
    				asm("movsd [ebp-0x20], xmm0");
    				_t169 = _v88 >> 0x20;
    				if (_t98 != 0) goto 0xc31391f1;
    				_t123 = _v88;
    				if (_t123 == 0) goto 0xc31391c1;
    				if (_t123 != 5) goto 0xc31391b7;
    				E00007FF67FF6C31348CC(_t123 - 5, _t169);
    				 *_t169 = 9;
    				E00007FF67FF6C31348AC(_t123 - 5, _t169);
    				 *_t169 = 5;
    				goto 0xc3138f7e;
    				E00007FF67FF6C313485C(_t123, r12d, _t123 - 5, _t169, _t172, _t189, _t188);
    				goto 0xc3138f7e;
    				_t171 =  *((intOrPtr*)(0xc3146120 + _t204 * 8));
    				if (( *(0xc3146120 + 0x38 + _t208 * 8) & 0x00000040) == 0) goto 0xc31391d9;
    				if ( *_t188 == 0x1a) goto 0xc31391f8;
    				E00007FF67FF6C31348CC( *_t188 - 0x1a, _t171);
    				 *0xc3146120 = 0x1c;
    				E00007FF67FF6C31348AC( *_t188 - 0x1a, _t171);
    				 *_t171 =  *_t171 & 0x00000000;
    				goto 0xc3138f7e;
    				goto 0xc31391fa;
    				return 0;
    			}

































    0x7ff6c3138f38
    0x7ff6c3138f38
    0x7ff6c3138f38
    0x7ff6c3138f38
    0x7ff6c3138f4f
    0x7ff6c3138f52
    0x7ff6c3138f55
    0x7ff6c3138f5b
    0x7ff6c3138f64
    0x7ff6c3138f66
    0x7ff6c3138f6b
    0x7ff6c3138f6e
    0x7ff6c3138f73
    0x7ff6c3138f79
    0x7ff6c3138f81
    0x7ff6c3138f96
    0x7ff6c3138f9a
    0x7ff6c3138fa2
    0x7ff6c3138fac
    0x7ff6c3138fb5
    0x7ff6c3138fbd
    0x7ff6c3138fc4
    0x7ff6c3138fc4
    0x7ff6c3138fc8
    0x7ff6c3138fd2
    0x7ff6c3138fdd
    0x7ff6c3138fea
    0x7ff6c3138ff3
    0x7ff6c3138ff9
    0x7ff6c313900c
    0x7ff6c313901e
    0x7ff6c3139040
    0x7ff6c3139049
    0x7ff6c313904b
    0x7ff6c3139052
    0x7ff6c313905a
    0x7ff6c313905e
    0x7ff6c3139062
    0x7ff6c3139068
    0x7ff6c3139074
    0x7ff6c3139078
    0x7ff6c313907d
    0x7ff6c3139084
    0x7ff6c3139086
    0x7ff6c3139089
    0x7ff6c3139090
    0x7ff6c31390a4
    0x7ff6c31390a8
    0x7ff6c31390b4
    0x7ff6c31390b6
    0x7ff6c31390be
    0x7ff6c31390c3
    0x7ff6c31390c8
    0x7ff6c31390d5
    0x7ff6c31390da
    0x7ff6c31390e1
    0x7ff6c31390f6
    0x7ff6c31390fc
    0x7ff6c31390ff
    0x7ff6c3139104
    0x7ff6c3139109
    0x7ff6c313910b
    0x7ff6c3139118
    0x7ff6c313911d
    0x7ff6c313911f
    0x7ff6c313912c
    0x7ff6c3139131
    0x7ff6c3139133
    0x7ff6c3139140
    0x7ff6c3139145
    0x7ff6c3139152
    0x7ff6c3139155
    0x7ff6c313915d
    0x7ff6c3139161
    0x7ff6c313916c
    0x7ff6c313916e
    0x7ff6c3139174
    0x7ff6c313917a
    0x7ff6c313917f
    0x7ff6c3139188
    0x7ff6c313918e
    0x7ff6c3139190
    0x7ff6c3139195
    0x7ff6c313919a
    0x7ff6c313919c
    0x7ff6c31391a1
    0x7ff6c31391a7
    0x7ff6c31391ac
    0x7ff6c31391b2
    0x7ff6c31391b7
    0x7ff6c31391bc
    0x7ff6c31391c8
    0x7ff6c31391d2
    0x7ff6c31391d7
    0x7ff6c31391d9
    0x7ff6c31391de
    0x7ff6c31391e4
    0x7ff6c31391e9
    0x7ff6c31391ec
    0x7ff6c31391f6
    0x7ff6c3139211

    APIs
    • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6C3138F79
    • GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00007FF6C3138EF7,00000000,?,?,00007FF6C313776B), ref: 00007FF6C3139038
    • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00007FF6C3138EF7,00000000,?,?,00007FF6C313776B), ref: 00007FF6C31390B8
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
    • String ID:
    • API String ID: 2210144848-0
    • Opcode ID: 456f8ed3b213cc305edbd8eae32fce22d5bff71a1b36d32a0e914a5618de1bf0
    • Instruction ID: 489ddcf95fa3d5704267b42c1f026da152a6e161b7ecffd4cc6a2b1738ff4f8d
    • Opcode Fuzzy Hash: 456f8ed3b213cc305edbd8eae32fce22d5bff71a1b36d32a0e914a5618de1bf0
    • Instruction Fuzzy Hash: 8B81B222E186424DFB909F658442BBD76A4FB44F9AF444235DA8EF3E91DE3CE445CB10
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 85%
    			E00007FF67FF6C313A268(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
    				signed int _t27;
    				signed int _t28;
    				signed int _t29;
    				signed int _t30;
    				signed int _t31;
    				signed int _t42;
    				signed int _t43;
    				signed int _t44;
    				signed int _t46;
    				void* _t51;
    
    				_a8 = __rbx;
    				_a16 = __rsi;
    				_t27 = __ecx & 0x0000001f;
    				if ((__ecx & 0x00000008) == 0) goto 0xc313a29a;
    				if (sil >= 0) goto 0xc313a29a;
    				E00007FF67FF6C313A9E4(_t27, _t51);
    				_t28 = _t27 & 0xfffffff7;
    				goto 0xc313a2f1;
    				_t42 = 0x00000004 & dil;
    				if (_t42 == 0) goto 0xc313a2b5;
    				asm("dec eax");
    				if (_t42 >= 0) goto 0xc313a2b5;
    				E00007FF67FF6C313A9E4(_t28, _t51);
    				_t29 = _t28 & 0xfffffffb;
    				goto 0xc313a2f1;
    				_t43 = dil & 0x00000001;
    				if (_t43 == 0) goto 0xc313a2d1;
    				asm("dec eax");
    				if (_t43 >= 0) goto 0xc313a2d1;
    				E00007FF67FF6C313A9E4(_t29, _t51);
    				_t30 = _t29 & 0xfffffffe;
    				goto 0xc313a2f1;
    				_t44 = dil & 0x00000002;
    				if (_t44 == 0) goto 0xc313a2f1;
    				asm("dec eax");
    				if (_t44 >= 0) goto 0xc313a2f1;
    				if ((dil & 0x00000010) == 0) goto 0xc313a2ee;
    				E00007FF67FF6C313A9E4(_t30, _t51);
    				_t31 = _t30 & 0xfffffffd;
    				_t46 = dil & 0x00000010;
    				if (_t46 == 0) goto 0xc313a30b;
    				asm("dec eax");
    				if (_t46 >= 0) goto 0xc313a30b;
    				E00007FF67FF6C313A9E4(_t31, _t51);
    				return 0 | (_t31 & 0xffffffef) == 0x00000000;
    			}













    0x7ff6c313a268
    0x7ff6c313a26d
    0x7ff6c313a27c
    0x7ff6c313a284
    0x7ff6c313a289
    0x7ff6c313a290
    0x7ff6c313a295
    0x7ff6c313a298
    0x7ff6c313a29f
    0x7ff6c313a2a2
    0x7ff6c313a2a4
    0x7ff6c313a2a9
    0x7ff6c313a2ab
    0x7ff6c313a2b0
    0x7ff6c313a2b3
    0x7ff6c313a2b5
    0x7ff6c313a2b9
    0x7ff6c313a2bb
    0x7ff6c313a2c0
    0x7ff6c313a2c7
    0x7ff6c313a2cc
    0x7ff6c313a2cf
    0x7ff6c313a2d1
    0x7ff6c313a2d5
    0x7ff6c313a2d7
    0x7ff6c313a2dc
    0x7ff6c313a2e2
    0x7ff6c313a2e9
    0x7ff6c313a2ee
    0x7ff6c313a2f1
    0x7ff6c313a2f5
    0x7ff6c313a2f7
    0x7ff6c313a2fc
    0x7ff6c313a303
    0x7ff6c313a321

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: _set_statfp
    • String ID:
    • API String ID: 1156100317-0
    • Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
    • Instruction ID: df0e97504849d496a0650c2dd1f3bb1c652726c0255630c1ef73e10a82a576a7
    • Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
    • Instruction Fuzzy Hash: 1211C422E4CA034DF6D41924D453B7931C06FACB76E450635EBEEB7ED7CE1DA8918200
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 33%
    			E00007FF67FF6C3138CDC(signed int __edx, void* __edi, void* __rax, signed long long __rbx, long* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed long long _a5176, void* _a5192) {
    				intOrPtr _v0;
    				signed long long _v8;
    				long _t39;
    				void* _t40;
    				signed int _t41;
    				signed long long _t62;
    				short* _t67;
    				signed int* _t68;
    				void* _t84;
    				void* _t92;
    				void* _t98;
    				void* _t100;
    				void* _t103;
    				void* _t104;
    
    				_a8 = __rbx;
    				_a24 = __rbp;
    				E00007FF67FF6C313AD30(_t40, __rax, __rcx, _t84, __r8, _t98, _t100);
    				_t62 =  *0xc3145030; // 0x3d2407701cef
    				_a5176 = _t62 ^ _t92 - __rax;
    				r14d = r9d;
    				r10d = r10d & 0x0000003f;
    				_t104 = _t103 + __r8;
    				 *__rcx =  *((intOrPtr*)(0xc3146120 + (__edx >> 6) * 8));
    				__rcx[2] = 0;
    				if (__r8 - _t104 >= 0) goto 0xc3138e1d;
    				_t67 =  &_a40;
    				if (__r8 - _t104 >= 0) goto 0xc3138d86;
    				_t41 =  *__r8 & 0x0000ffff;
    				if (_t41 != 0xa) goto 0xc3138d72;
    				 *_t67 = 0xd;
    				_t68 = _t67 + 2;
    				 *_t68 = _t41;
    				if ( &(_t68[0]) -  &_a1744 < 0) goto 0xc3138d54;
    				_a16 = _a16 & 0x00000000;
    				_a8 = _a8 & 0x00000000;
    				_v0 = 0xd55;
    				_v8 =  &_a1752;
    				r9d = 0;
    				E00007FF67FF6C3135A00();
    				if (0 == 0) goto 0xc3138e15;
    				if (0 == 0) goto 0xc3138e05;
    				_v8 = _v8 & 0x00000000;
    				r8d = 0;
    				r8d = r8d;
    				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xc3138e15;
    				if (0 + _a24 < 0) goto 0xc3138dd2;
    				__rcx[1] = __edi - r15d;
    				goto 0xc3138d49;
    				_t39 = GetLastError();
    				 *__rcx = _t39;
    				E00007FF67FF6C313AB80();
    				return _t39;
    			}

















    0x7ff6c3138cdc
    0x7ff6c3138ce1
    0x7ff6c3138cf3
    0x7ff6c3138cfb
    0x7ff6c3138d05
    0x7ff6c3138d16
    0x7ff6c3138d24
    0x7ff6c3138d28
    0x7ff6c3138d40
    0x7ff6c3138d46
    0x7ff6c3138d49
    0x7ff6c3138d4f
    0x7ff6c3138d57
    0x7ff6c3138d59
    0x7ff6c3138d64
    0x7ff6c3138d6b
    0x7ff6c3138d6e
    0x7ff6c3138d72
    0x7ff6c3138d84
    0x7ff6c3138d86
    0x7ff6c3138d91
    0x7ff6c3138d9f
    0x7ff6c3138db2
    0x7ff6c3138db7
    0x7ff6c3138dc1
    0x7ff6c3138dca
    0x7ff6c3138dd0
    0x7ff6c3138dd2
    0x7ff6c3138de7
    0x7ff6c3138df0
    0x7ff6c3138dfb
    0x7ff6c3138e03
    0x7ff6c3138e0a
    0x7ff6c3138e10
    0x7ff6c3138e15
    0x7ff6c3138e1b
    0x7ff6c3138e2b
    0x7ff6c3138e4b

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: ErrorFileLastWrite
    • String ID: U
    • API String ID: 442123175-4171548499
    • Opcode ID: 046cac1dda343332d8a777e8d129d57e18234e07123fd41dcd56f86ea251afd3
    • Instruction ID: 48e99e88bbf69a4b1bc5b08b05d97ffd518ed15d70cc5334ebf5e83809d294c8
    • Opcode Fuzzy Hash: 046cac1dda343332d8a777e8d129d57e18234e07123fd41dcd56f86ea251afd3
    • Instruction Fuzzy Hash: 2841C362B19A8189DB509F25E8457BA77A0FB98B95F404031EE8DD7B94DF3CD405C740
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 20%
    			E00007FF67FF6C3136EB4(void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r8, long long _a8, long long _a16, long long _a24, long long _a40, intOrPtr _a48, long long _a56, long long _a64, long long _a72) {
    				long long _v24;
    				long long _v32;
    				long long _v40;
    				intOrPtr _v48;
    				long long _v56;
    				void* _t26;
    				void* _t38;
    				void* _t53;
    
    				_t40 = __rbx;
    				_t38 = __rax;
    				_a8 = __rbx;
    				_a16 = __rbp;
    				_a24 = __rsi;
    				_t26 = r9d;
    				_t53 = __rcx;
    				E00007FF67FF6C3136AFC(0x14, __rbx, "LCMapStringEx", __rsi, 0xc313e780, "LCMapStringEx");
    				if (_t38 == 0) goto 0xc3136f49;
    				r9d = _t26;
    				_v24 = _a72;
    				_v32 = _a64;
    				_v40 = _a56;
    				_v48 = _a48;
    				_v56 = _a40;
    				 *0xc313c230();
    				goto 0xc3136f7b;
    				E00007FF67FF6C3136F90(0, 0, _t38, _t40, _t53);
    				r9d = _t26;
    				_v48 = _a48;
    				_v56 = _a40;
    				return LCMapStringW(??, ??, ??, ??, ??, ??);
    			}











    0x7ff6c3136eb4
    0x7ff6c3136eb4
    0x7ff6c3136eb4
    0x7ff6c3136eb9
    0x7ff6c3136ebe
    0x7ff6c3136ec8
    0x7ff6c3136ed7
    0x7ff6c3136eed
    0x7ff6c3136ef5
    0x7ff6c3136eff
    0x7ff6c3136f0c
    0x7ff6c3136f14
    0x7ff6c3136f21
    0x7ff6c3136f2d
    0x7ff6c3136f39
    0x7ff6c3136f41
    0x7ff6c3136f47
    0x7ff6c3136f4e
    0x7ff6c3136f55
    0x7ff6c3136f62
    0x7ff6c3136f70
    0x7ff6c3136f8f

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: Stringtry_get_function
    • String ID: LCMapStringEx
    • API String ID: 2588686239-3893581201
    • Opcode ID: 93d9f743ca1939faac1e1e1f0674deeca4f04e6be3347adec69dbc131fb9dddb
    • Instruction ID: d1cc6e52d9d9304681e3f85c73c90f13f34a277642a2789440ae485614078f24
    • Opcode Fuzzy Hash: 93d9f743ca1939faac1e1e1f0674deeca4f04e6be3347adec69dbc131fb9dddb
    • Instruction Fuzzy Hash: 41110B36608B818AD7A0CF56B4816AAB7A4FB89B90F544136EECD93F59DF3CD4408B40
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 27%
    			E00007FF67FF6C3136E50(void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, long long __rsi, long long _a8, long long _a16) {
    				void* _t15;
    
    				_t15 = __rax;
    				_a8 = __rbx;
    				_a16 = __rsi;
    				E00007FF67FF6C3136AFC(0x12, __rbx, "InitializeCriticalSectionEx", __rsi, 0xc313e778, 0xc313e780);
    				if (_t15 == 0) goto 0xc3136e9b;
    				 *0xc313c230();
    				goto 0xc3136ea1;
    				return InitializeCriticalSectionAndSpinCount(??, ??);
    			}




    0x7ff6c3136e50
    0x7ff6c3136e50
    0x7ff6c3136e55
    0x7ff6c3136e81
    0x7ff6c3136e8e
    0x7ff6c3136e93
    0x7ff6c3136e99
    0x7ff6c3136eb0

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: CountCriticalInitializeSectionSpintry_get_function
    • String ID: InitializeCriticalSectionEx
    • API String ID: 539475747-3084827643
    • Opcode ID: b700cb8a87ced41a669cf07a54b5b02a2dad8f2dcb22668fb52988fea8261fc4
    • Instruction ID: 9e6cd831bef969d8a514f5264aa4649e1372134b046712302bbcc0b25ae63609
    • Opcode Fuzzy Hash: b700cb8a87ced41a669cf07a54b5b02a2dad8f2dcb22668fb52988fea8261fc4
    • Instruction Fuzzy Hash: 2AF0BE26B18B8186FB849F42E4828A93260EF48F91F445031EA8E63F54CF3CE4598340
    Uniqueness

    Uniqueness Score: -1.00%

    C-Code - Quality: 27%
    			E00007FF67FF6C3136DFC(void* __ecx, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long _a8) {
    				void* _t12;
    				void* _t19;
    
    				_t12 = __rax;
    				_a8 = __rbx;
    				E00007FF67FF6C3136AFC(6, __rdx, "FlsSetValue", _t19, 0xc313e770, 0xc313e778);
    				if (_t12 == 0) goto 0xc3136e3c;
    				 *0xc313c230();
    				goto 0xc3136e42;
    				return TlsSetValue(??, ??);
    			}





    0x7ff6c3136dfc
    0x7ff6c3136dfc
    0x7ff6c3136e25
    0x7ff6c3136e32
    0x7ff6c3136e34
    0x7ff6c3136e3a
    0x7ff6c3136e4c

    APIs
    • try_get_function.LIBVCRUNTIME ref: 00007FF6C3136E25
    • TlsSetValue.KERNEL32(?,?,?,00007FF6C313436A,?,?,?,00007FF6C31348D5,?,?,?,?,00007FF6C3133554), ref: 00007FF6C3136E3C
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.625929901.00007FF6C3131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3130000, based on PE: true
    • Associated: 00000000.00000002.625924469.00007FF6C3130000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625941804.00007FF6C313C000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625947526.00007FF6C313D000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625956281.00007FF6C3145000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3147000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C3149000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C314F000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C318E000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31B2000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31C1000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.625961267.00007FF6C31CA000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_7ff6c3130000_Mcafe.jbxd
    Similarity
    • API ID: Valuetry_get_function
    • String ID: FlsSetValue
    • API String ID: 738293619-3750699315
    • Opcode ID: 9980b1b4abbfcf7594fad718044e096b0f67e1c623a15003582e75d2cd31afa0
    • Instruction ID: 5a1439d038809fed67f0f0dc5712aa81a6a304247410907fcf8ffe5d0ad966a5
    • Opcode Fuzzy Hash: 9980b1b4abbfcf7594fad718044e096b0f67e1c623a15003582e75d2cd31afa0
    • Instruction Fuzzy Hash: B9E06566A1C64289FA845F51E8828B53221AF48F92F585036D58DABA94CF3CD4588310
    Uniqueness

    Uniqueness Score: -1.00%